drivers/char/ipmi/ipmi_msghandler.c

   1 /*
   2  * ipmi_msghandler.c
   3  *
   4  * Incoming and outgoing message routing for an IPMI interface.
   5  *
   6  * Author: MontaVista Software, Inc.
   7  *         Corey Minyard <minyard@mvista.com>
   8  *         source@mvista.com
   9  *
  10  * Copyright 2002 MontaVista Software Inc.
  11  *
  12  *  This program is free software; you can redistribute it and/or modify it
  13  *  under the terms of the GNU General Public License as published by the
  14  *  Free Software Foundation; either version 2 of the License, or (at your
  15  *  option) any later version.
  16  *
  17  *
  18  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  19  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  20  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  *  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  23  *  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
  24  *  OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  25  *  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
  26  *  TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  27  *  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  *
  29  *  You should have received a copy of the GNU General Public License along
  30  *  with this program; if not, write to the Free Software Foundation, Inc.,
  31  *  675 Mass Ave, Cambridge, MA 02139, USA.
  32  */
  33
  34 #include <linux/module.h>
  35 #include <linux/errno.h>
  36 #include <linux/poll.h>
  37 #include <linux/sched.h>
  38 #include <linux/seq_file.h>
  39 #include <linux/spinlock.h>
  40 #include <linux/mutex.h>
  41 #include <linux/slab.h>
  42 #include <linux/ipmi.h>
  43 #include <linux/ipmi_smi.h>
  44 #include <linux/notifier.h>
  45 #include <linux/init.h>
  46 #include <linux/proc_fs.h>
  47 #include <linux/rcupdate.h>
  48 #include <linux/interrupt.h>
  49
  50 #define PFX "IPMI message handler: "
  51
  52 #define IPMI_DRIVER_VERSION "39.2"
  53
  54 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);
  55 static int ipmi_init_msghandler(void);
  56 static void smi_recv_tasklet(unsigned long);
  57 static void handle_new_recv_msgs(ipmi_smi_t intf);
  58 static void need_waiter(ipmi_smi_t intf);
  59 static int handle_one_recv_msg(ipmi_smi_t          intf,
  60                                struct ipmi_smi_msg *msg);
  61
  62 static int initialized;
  63
  64 #ifdef CONFIG_PROC_FS
  65 static struct proc_dir_entry *proc_ipmi_root;
  66 #endif /* CONFIG_PROC_FS */
  67
  68 /* Remain in auto-maintenance mode for this amount of time (in ms). */
  69 #define IPMI_MAINTENANCE_MODE_TIMEOUT 30000
  70
  71 #define MAX_EVENTS_IN_QUEUE     25
  72
  73 /*
  74  * Don't let a message sit in a queue forever, always time it with at lest
  75  * the max message timer.  This is in milliseconds.
  76  */
  77 #define MAX_MSG_TIMEOUT         60000
  78
  79 /* Call every ~1000 ms. */
  80 #define IPMI_TIMEOUT_TIME       1000
  81
  82 /* How many jiffies does it take to get to the timeout time. */
  83 #define IPMI_TIMEOUT_JIFFIES    ((IPMI_TIMEOUT_TIME * HZ) / 1000)
  84
  85 /*
  86  * Request events from the queue every second (this is the number of
  87  * IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the
  88  * future, IPMI will add a way to know immediately if an event is in
  89  * the queue and this silliness can go away.
  90  */
  91 #define IPMI_REQUEST_EV_TIME    (1000 / (IPMI_TIMEOUT_TIME))
  92
  93 /*
  94  * The main "user" data structure.
  95  */
  96 struct ipmi_user {
  97         struct list_head link;
  98
  99         /* Set to false when the user is destroyed. */
 100         bool valid;
 101
 102         struct kref refcount;
 103
 104         /* The upper layer that handles receive messages. */
 105         const struct ipmi_user_hndl *handler;
 106         void             *handler_data;
 107
 108         /* The interface this user is bound to. */
 109         ipmi_smi_t intf;
 110
 111         /* Does this interface receive IPMI events? */
 112         bool gets_events;
 113 };
 114
 115 struct cmd_rcvr {
 116         struct list_head link;
 117
 118         ipmi_user_t   user;
 119         unsigned char netfn;
 120         unsigned char cmd;
 121         unsigned int  chans;
 122
 123         /*
 124          * This is used to form a linked lised during mass deletion.
 125          * Since this is in an RCU list, we cannot use the link above
 126          * or change any data until the RCU period completes.  So we
 127          * use this next variable during mass deletion so we can have
 128          * a list and don't have to wait and restart the search on
 129          * every individual deletion of a command.
 130          */
 131         struct cmd_rcvr *next;
 132 };
 133
 134 struct seq_table {
 135         unsigned int         inuse : 1;
 136         unsigned int         broadcast : 1;
 137
 138         unsigned long        timeout;
 139         unsigned long        orig_timeout;
 140         unsigned int         retries_left;
 141
 142         /*
 143          * To verify on an incoming send message response that this is
 144          * the message that the response is for, we keep a sequence id
 145          * and increment it every time we send a message.
 146          */
 147         long                 seqid;
 148
 149         /*
 150          * This is held so we can properly respond to the message on a
 151          * timeout, and it is used to hold the temporary data for
 152          * retransmission, too.
 153          */
 154         struct ipmi_recv_msg *recv_msg;
 155 };
 156
 157 /*
 158  * Store the information in a msgid (long) to allow us to find a
 159  * sequence table entry from the msgid.
 160  */
 161 #define STORE_SEQ_IN_MSGID(seq, seqid) \
 162         ((((seq) & 0x3f) << 26) | ((seqid) & 0x3ffffff))
 163
 164 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \
 165         do {                                                            \
 166                 seq = (((msgid) >> 26) & 0x3f);                         \
 167                 seqid = ((msgid) & 0x3ffffff);                          \
 168         } while (0)
 169
 170 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3ffffff)
 171
 172 struct ipmi_channel {
 173         unsigned char medium;
 174         unsigned char protocol;
 175
 176         /*
 177          * My slave address.  This is initialized to IPMI_BMC_SLAVE_ADDR,
 178          * but may be changed by the user.
 179          */
 180         unsigned char address;
 181
 182         /*
 183          * My LUN.  This should generally stay the SMS LUN, but just in
 184          * case...
 185          */
 186         unsigned char lun;
 187 };
 188
 189 #ifdef CONFIG_PROC_FS
 190 struct ipmi_proc_entry {
 191         char                   *name;
 192         struct ipmi_proc_entry *next;
 193 };
 194 #endif
 195
 196 struct bmc_device {
 197         struct platform_device pdev;
 198         struct ipmi_device_id  id;
 199         unsigned char          guid[16];
 200         int                    guid_set;
 201         char                   name[16];
 202         struct kref            usecount;
 203 };
 204 #define to_bmc_device(x) container_of((x), struct bmc_device, pdev.dev)
 205
 206 /*
 207  * Various statistics for IPMI, these index stats[] in the ipmi_smi
 208  * structure.
 209  */
 210 enum ipmi_stat_indexes {
 211         /* Commands we got from the user that were invalid. */
 212         IPMI_STAT_sent_invalid_commands = 0,
 213
 214         /* Commands we sent to the MC. */
 215         IPMI_STAT_sent_local_commands,
 216
 217         /* Responses from the MC that were delivered to a user. */
 218         IPMI_STAT_handled_local_responses,
 219
 220         /* Responses from the MC that were not delivered to a user. */
 221         IPMI_STAT_unhandled_local_responses,
 222
 223         /* Commands we sent out to the IPMB bus. */
 224         IPMI_STAT_sent_ipmb_commands,
 225
 226         /* Commands sent on the IPMB that had errors on the SEND CMD */
 227         IPMI_STAT_sent_ipmb_command_errs,
 228
 229         /* Each retransmit increments this count. */
 230         IPMI_STAT_retransmitted_ipmb_commands,
 231
 232         /*
 233          * When a message times out (runs out of retransmits) this is
 234          * incremented.
 235          */
 236         IPMI_STAT_timed_out_ipmb_commands,
 237
 238         /*
 239          * This is like above, but for broadcasts.  Broadcasts are
 240          * *not* included in the above count (they are expected to
 241          * time out).
 242          */
 243         IPMI_STAT_timed_out_ipmb_broadcasts,
 244
 245         /* Responses I have sent to the IPMB bus. */
 246         IPMI_STAT_sent_ipmb_responses,
 247
 248         /* The response was delivered to the user. */
 249         IPMI_STAT_handled_ipmb_responses,
 250
 251         /* The response had invalid data in it. */
 252         IPMI_STAT_invalid_ipmb_responses,
 253
 254         /* The response didn't have anyone waiting for it. */
 255         IPMI_STAT_unhandled_ipmb_responses,
 256
 257         /* Commands we sent out to the IPMB bus. */
 258         IPMI_STAT_sent_lan_commands,
 259
 260         /* Commands sent on the IPMB that had errors on the SEND CMD */
 261         IPMI_STAT_sent_lan_command_errs,
 262
 263         /* Each retransmit increments this count. */
 264         IPMI_STAT_retransmitted_lan_commands,
 265
 266         /*
 267          * When a message times out (runs out of retransmits) this is
 268          * incremented.
 269          */
 270         IPMI_STAT_timed_out_lan_commands,
 271
 272         /* Responses I have sent to the IPMB bus. */
 273         IPMI_STAT_sent_lan_responses,
 274
 275         /* The response was delivered to the user. */
 276         IPMI_STAT_handled_lan_responses,
 277
 278         /* The response had invalid data in it. */
 279         IPMI_STAT_invalid_lan_responses,
 280
 281         /* The response didn't have anyone waiting for it. */
 282         IPMI_STAT_unhandled_lan_responses,
 283
 284         /* The command was delivered to the user. */
 285         IPMI_STAT_handled_commands,
 286
 287         /* The command had invalid data in it. */
 288         IPMI_STAT_invalid_commands,
 289
 290         /* The command didn't have anyone waiting for it. */
 291         IPMI_STAT_unhandled_commands,
 292
 293         /* Invalid data in an event. */
 294         IPMI_STAT_invalid_events,
 295
 296         /* Events that were received with the proper format. */
 297         IPMI_STAT_events,
 298
 299         /* Retransmissions on IPMB that failed. */
 300         IPMI_STAT_dropped_rexmit_ipmb_commands,
 301
 302         /* Retransmissions on LAN that failed. */
 303         IPMI_STAT_dropped_rexmit_lan_commands,
 304
 305         /* This *must* remain last, add new values above this. */
 306         IPMI_NUM_STATS
 307 };
 308
 309
 310 #define IPMI_IPMB_NUM_SEQ       64
 311 #define IPMI_MAX_CHANNELS       16
 312 struct ipmi_smi {
 313         /* What interface number are we? */
 314         int intf_num;
 315
 316         struct kref refcount;
 317
 318         /* Set when the interface is being unregistered. */
 319         bool in_shutdown;
 320
 321         /* Used for a list of interfaces. */
 322         struct list_head link;
 323
 324         /*
 325          * The list of upper layers that are using me.  seq_lock
 326          * protects this.
 327          */
 328         struct list_head users;
 329
 330         /* Information to supply to users. */
 331         unsigned char ipmi_version_major;
 332         unsigned char ipmi_version_minor;
 333
 334         /* Used for wake ups at startup. */
 335         wait_queue_head_t waitq;
 336
 337         struct bmc_device *bmc;
 338         char *my_dev_name;
 339
 340         /*
 341          * This is the lower-layer's sender routine.  Note that you
 342          * must either be holding the ipmi_interfaces_mutex or be in
 343          * an umpreemptible region to use this.  You must fetch the
 344          * value into a local variable and make sure it is not NULL.
 345          */
 346         const struct ipmi_smi_handlers *handlers;
 347         void                     *send_info;
 348
 349 #ifdef CONFIG_PROC_FS
 350         /* A list of proc entries for this interface. */
 351         struct mutex           proc_entry_lock;
 352         struct ipmi_proc_entry *proc_entries;
 353 #endif
 354
 355         /* Driver-model device for the system interface. */
 356         struct device          *si_dev;
 357
 358         /*
 359          * A table of sequence numbers for this interface.  We use the
 360          * sequence numbers for IPMB messages that go out of the
 361          * interface to match them up with their responses.  A routine
 362          * is called periodically to time the items in this list.
 363          */
 364         spinlock_t       seq_lock;
 365         struct seq_table seq_table[IPMI_IPMB_NUM_SEQ];
 366         int curr_seq;
 367
 368         /*
 369          * Messages queued for delivery.  If delivery fails (out of memory
 370          * for instance), They will stay in here to be processed later in a
 371          * periodic timer interrupt.  The tasklet is for handling received
 372          * messages directly from the handler.
 373          */
 374         spinlock_t       waiting_rcv_msgs_lock;
 375         struct list_head waiting_rcv_msgs;
 376         atomic_t         watchdog_pretimeouts_to_deliver;
 377         struct tasklet_struct recv_tasklet;
 378
 379         spinlock_t             xmit_msgs_lock;
 380         struct list_head       xmit_msgs;
 381         struct ipmi_smi_msg    *curr_msg;
 382         struct list_head       hp_xmit_msgs;
 383
 384         /*
 385          * The list of command receivers that are registered for commands
 386          * on this interface.
 387          */
 388         struct mutex     cmd_rcvrs_mutex;
 389         struct list_head cmd_rcvrs;
 390
 391         /*
 392          * Events that were queues because no one was there to receive
 393          * them.
 394          */
 395         spinlock_t       events_lock; /* For dealing with event stuff. */
 396         struct list_head waiting_events;
 397         unsigned int     waiting_events_count; /* How many events in queue? */
 398         char             delivering_events;
 399         char             event_msg_printed;
 400         atomic_t         event_waiters;
 401         unsigned int     ticks_to_req_ev;
 402         int              last_needs_timer;
 403
 404         /*
 405          * The event receiver for my BMC, only really used at panic
 406          * shutdown as a place to store this.
 407          */
 408         unsigned char event_receiver;
 409         unsigned char event_receiver_lun;
 410         unsigned char local_sel_device;
 411         unsigned char local_event_generator;
 412
 413         /* For handling of maintenance mode. */
 414         int maintenance_mode;
 415         bool maintenance_mode_enable;
 416         int auto_maintenance_timeout;
 417         spinlock_t maintenance_mode_lock; /* Used in a timer... */
 418
 419         /*
 420          * A cheap hack, if this is non-null and a message to an
 421          * interface comes in with a NULL user, call this routine with
 422          * it.  Note that the message will still be freed by the
 423          * caller.  This only works on the system interface.
 424          */
 425         void (*null_user_handler)(ipmi_smi_t intf, struct ipmi_recv_msg *msg);
 426
 427         /*
 428          * When we are scanning the channels for an SMI, this will
 429          * tell which channel we are scanning.
 430          */
 431         int curr_channel;
 432
 433         /* Channel information */
 434         struct ipmi_channel channels[IPMI_MAX_CHANNELS];
 435
 436         /* Proc FS stuff. */
 437         struct proc_dir_entry *proc_dir;
 438         char                  proc_dir_name[10];
 439
 440         atomic_t stats[IPMI_NUM_STATS];
 441
 442         /*
 443          * run_to_completion duplicate of smb_info, smi_info
 444          * and ipmi_serial_info structures. Used to decrease numbers of
 445          * parameters passed by "low" level IPMI code.
 446          */
 447         int run_to_completion;
 448 };
 449 #define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev)
 450
 451 /**
 452  * The driver model view of the IPMI messaging driver.
 453  */
 454 static struct platform_driver ipmidriver = {
 455         .driver = {
 456                 .name = "ipmi",
 457                 .bus = &platform_bus_type
 458         }
 459 };
 460 static DEFINE_MUTEX(ipmidriver_mutex);
 461
 462 static LIST_HEAD(ipmi_interfaces);
 463 static DEFINE_MUTEX(ipmi_interfaces_mutex);
 464
 465 /*
 466  * List of watchers that want to know when smi's are added and deleted.
 467  */
 468 static LIST_HEAD(smi_watchers);
 469 static DEFINE_MUTEX(smi_watchers_mutex);
 470
 471 #define ipmi_inc_stat(intf, stat) \
 472         atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
 473 #define ipmi_get_stat(intf, stat) \
 474         ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
 475
 476 static const char * const addr_src_to_str[] = {
 477         "invalid", "hotmod", "hardcoded", "SPMI", "ACPI", "SMBIOS", "PCI",
 478         "device-tree"
 479 };
 480
 481 const char *ipmi_addr_src_to_str(enum ipmi_addr_src src)
 482 {
 483         if (src >= SI_LAST)
 484                 src = 0; /* Invalid */
 485         return addr_src_to_str[src];
 486 }
 487 EXPORT_SYMBOL(ipmi_addr_src_to_str);
 488
 489 static int is_lan_addr(struct ipmi_addr *addr)
 490 {
 491         return addr->addr_type == IPMI_LAN_ADDR_TYPE;
 492 }
 493
 494 static int is_ipmb_addr(struct ipmi_addr *addr)
 495 {
 496         return addr->addr_type == IPMI_IPMB_ADDR_TYPE;
 497 }
 498
 499 static int is_ipmb_bcast_addr(struct ipmi_addr *addr)
 500 {
 501         return addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE;
 502 }
 503
 504 static void free_recv_msg_list(struct list_head *q)
 505 {
 506         struct ipmi_recv_msg *msg, *msg2;
 507
 508         list_for_each_entry_safe(msg, msg2, q, link) {
 509                 list_del(&msg->link);
 510                 ipmi_free_recv_msg(msg);
 511         }
 512 }
 513
 514 static void free_smi_msg_list(struct list_head *q)
 515 {
 516         struct ipmi_smi_msg *msg, *msg2;
 517
 518         list_for_each_entry_safe(msg, msg2, q, link) {
 519                 list_del(&msg->link);
 520                 ipmi_free_smi_msg(msg);
 521         }
 522 }
 523
 524 static void clean_up_interface_data(ipmi_smi_t intf)
 525 {
 526         int              i;
 527         struct cmd_rcvr  *rcvr, *rcvr2;
 528         struct list_head list;
 529
 530         tasklet_kill(&intf->recv_tasklet);
 531
 532         free_smi_msg_list(&intf->waiting_rcv_msgs);
 533         free_recv_msg_list(&intf->waiting_events);
 534
 535         /*
 536          * Wholesale remove all the entries from the list in the
 537          * interface and wait for RCU to know that none are in use.
 538          */
 539         mutex_lock(&intf->cmd_rcvrs_mutex);
 540         INIT_LIST_HEAD(&list);
 541         list_splice_init_rcu(&intf->cmd_rcvrs, &list, synchronize_rcu);
 542         mutex_unlock(&intf->cmd_rcvrs_mutex);
 543
 544         list_for_each_entry_safe(rcvr, rcvr2, &list, link)
 545                 kfree(rcvr);
 546
 547         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
 548                 if ((intf->seq_table[i].inuse)
 549                                         && (intf->seq_table[i].recv_msg))
 550                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
 551         }
 552 }
 553
 554 static void intf_free(struct kref *ref)
 555 {
 556         ipmi_smi_t intf = container_of(ref, struct ipmi_smi, refcount);
 557
 558         clean_up_interface_data(intf);
 559         kfree(intf);
 560 }
 561
 562 struct watcher_entry {
 563         int              intf_num;
 564         ipmi_smi_t       intf;
 565         struct list_head link;
 566 };
 567
 568 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 569 {
 570         ipmi_smi_t intf;
 571         LIST_HEAD(to_deliver);
 572         struct watcher_entry *e, *e2;
 573
 574         mutex_lock(&smi_watchers_mutex);
 575
 576         mutex_lock(&ipmi_interfaces_mutex);
 577
 578         /* Build a list of things to deliver. */
 579         list_for_each_entry(intf, &ipmi_interfaces, link) {
 580                 if (intf->intf_num == -1)
 581                         continue;
 582                 e = kmalloc(sizeof(*e), GFP_KERNEL);
 583                 if (!e)
 584                         goto out_err;
 585                 kref_get(&intf->refcount);
 586                 e->intf = intf;
 587                 e->intf_num = intf->intf_num;
 588                 list_add_tail(&e->link, &to_deliver);
 589         }
 590
 591         /* We will succeed, so add it to the list. */
 592         list_add(&watcher->link, &smi_watchers);
 593
 594         mutex_unlock(&ipmi_interfaces_mutex);
 595
 596         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 597                 list_del(&e->link);
 598                 watcher->new_smi(e->intf_num, e->intf->si_dev);
 599                 kref_put(&e->intf->refcount, intf_free);
 600                 kfree(e);
 601         }
 602
 603         mutex_unlock(&smi_watchers_mutex);
 604
 605         return 0;
 606
 607  out_err:
 608         mutex_unlock(&ipmi_interfaces_mutex);
 609         mutex_unlock(&smi_watchers_mutex);
 610         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 611                 list_del(&e->link);
 612                 kref_put(&e->intf->refcount, intf_free);
 613                 kfree(e);
 614         }
 615         return -ENOMEM;
 616 }
 617 EXPORT_SYMBOL(ipmi_smi_watcher_register);
 618
 619 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher)
 620 {
 621         mutex_lock(&smi_watchers_mutex);
 622         list_del(&(watcher->link));
 623         mutex_unlock(&smi_watchers_mutex);
 624         return 0;
 625 }
 626 EXPORT_SYMBOL(ipmi_smi_watcher_unregister);
 627
 628 /*
 629  * Must be called with smi_watchers_mutex held.
 630  */
 631 static void
 632 call_smi_watchers(int i, struct device *dev)
 633 {
 634         struct ipmi_smi_watcher *w;
 635
 636         list_for_each_entry(w, &smi_watchers, link) {
 637                 if (try_module_get(w->owner)) {
 638                         w->new_smi(i, dev);
 639                         module_put(w->owner);
 640                 }
 641         }
 642 }
 643
 644 static int
 645 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)
 646 {
 647         if (addr1->addr_type != addr2->addr_type)
 648                 return 0;
 649
 650         if (addr1->channel != addr2->channel)
 651                 return 0;
 652
 653         if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 654                 struct ipmi_system_interface_addr *smi_addr1
 655                     = (struct ipmi_system_interface_addr *) addr1;
 656                 struct ipmi_system_interface_addr *smi_addr2
 657                     = (struct ipmi_system_interface_addr *) addr2;
 658                 return (smi_addr1->lun == smi_addr2->lun);
 659         }
 660
 661         if (is_ipmb_addr(addr1) || is_ipmb_bcast_addr(addr1)) {
 662                 struct ipmi_ipmb_addr *ipmb_addr1
 663                     = (struct ipmi_ipmb_addr *) addr1;
 664                 struct ipmi_ipmb_addr *ipmb_addr2
 665                     = (struct ipmi_ipmb_addr *) addr2;
 666
 667                 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr)
 668                         && (ipmb_addr1->lun == ipmb_addr2->lun));
 669         }
 670
 671         if (is_lan_addr(addr1)) {
 672                 struct ipmi_lan_addr *lan_addr1
 673                         = (struct ipmi_lan_addr *) addr1;
 674                 struct ipmi_lan_addr *lan_addr2
 675                     = (struct ipmi_lan_addr *) addr2;
 676
 677                 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID)
 678                         && (lan_addr1->local_SWID == lan_addr2->local_SWID)
 679                         && (lan_addr1->session_handle
 680                             == lan_addr2->session_handle)
 681                         && (lan_addr1->lun == lan_addr2->lun));
 682         }
 683
 684         return 1;
 685 }
 686
 687 int ipmi_validate_addr(struct ipmi_addr *addr, int len)
 688 {
 689         if (len < sizeof(struct ipmi_system_interface_addr))
 690                 return -EINVAL;
 691
 692         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 693                 if (addr->channel != IPMI_BMC_CHANNEL)
 694                         return -EINVAL;
 695                 return 0;
 696         }
 697
 698         if ((addr->channel == IPMI_BMC_CHANNEL)
 699             || (addr->channel >= IPMI_MAX_CHANNELS)
 700             || (addr->channel < 0))
 701                 return -EINVAL;
 702
 703         if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
 704                 if (len < sizeof(struct ipmi_ipmb_addr))
 705                         return -EINVAL;
 706                 return 0;
 707         }
 708
 709         if (is_lan_addr(addr)) {
 710                 if (len < sizeof(struct ipmi_lan_addr))
 711                         return -EINVAL;
 712                 return 0;
 713         }
 714
 715         return -EINVAL;
 716 }
 717 EXPORT_SYMBOL(ipmi_validate_addr);
 718
 719 unsigned int ipmi_addr_length(int addr_type)
 720 {
 721         if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
 722                 return sizeof(struct ipmi_system_interface_addr);
 723
 724         if ((addr_type == IPMI_IPMB_ADDR_TYPE)
 725                         || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 726                 return sizeof(struct ipmi_ipmb_addr);
 727
 728         if (addr_type == IPMI_LAN_ADDR_TYPE)
 729                 return sizeof(struct ipmi_lan_addr);
 730
 731         return 0;
 732 }
 733 EXPORT_SYMBOL(ipmi_addr_length);
 734
 735 static void deliver_response(struct ipmi_recv_msg *msg)
 736 {
 737         if (!msg->user) {
 738                 ipmi_smi_t    intf = msg->user_msg_data;
 739
 740                 /* Special handling for NULL users. */
 741                 if (intf->null_user_handler) {
 742                         intf->null_user_handler(intf, msg);
 743                         ipmi_inc_stat(intf, handled_local_responses);
 744                 } else {
 745                         /* No handler, so give up. */
 746                         ipmi_inc_stat(intf, unhandled_local_responses);
 747                 }
 748                 ipmi_free_recv_msg(msg);
 749         } else if (!oops_in_progress) {
 750                 /*
 751                  * If we are running in the panic context, calling the
 752                  * receive handler doesn't much meaning and has a deadlock
 753                  * risk.  At this moment, simply skip it in that case.
 754                  */
 755
 756                 ipmi_user_t user = msg->user;
 757                 user->handler->ipmi_recv_hndl(msg, user->handler_data);
 758         }
 759 }
 760
 761 static void
 762 deliver_err_response(struct ipmi_recv_msg *msg, int err)
 763 {
 764         msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
 765         msg->msg_data[0] = err;
 766         msg->msg.netfn |= 1; /* Convert to a response. */
 767         msg->msg.data_len = 1;
 768         msg->msg.data = msg->msg_data;
 769         deliver_response(msg);
 770 }
 771
 772 /*
 773  * Find the next sequence number not being used and add the given
 774  * message with the given timeout to the sequence table.  This must be
 775  * called with the interface's seq_lock held.
 776  */
 777 static int intf_next_seq(ipmi_smi_t           intf,
 778                          struct ipmi_recv_msg *recv_msg,
 779                          unsigned long        timeout,
 780                          int                  retries,
 781                          int                  broadcast,
 782                          unsigned char        *seq,
 783                          long                 *seqid)
 784 {
 785         int          rv = 0;
 786         unsigned int i;
 787
 788         for (i = intf->curr_seq; (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;
 789                                         i = (i+1)%IPMI_IPMB_NUM_SEQ) {
 790                 if (!intf->seq_table[i].inuse)
 791                         break;
 792         }
 793
 794         if (!intf->seq_table[i].inuse) {
 795                 intf->seq_table[i].recv_msg = recv_msg;
 796
 797                 /*
 798                  * Start with the maximum timeout, when the send response
 799                  * comes in we will start the real timer.
 800                  */
 801                 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT;
 802                 intf->seq_table[i].orig_timeout = timeout;
 803                 intf->seq_table[i].retries_left = retries;
 804                 intf->seq_table[i].broadcast = broadcast;
 805                 intf->seq_table[i].inuse = 1;
 806                 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid);
 807                 *seq = i;
 808                 *seqid = intf->seq_table[i].seqid;
 809                 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
 810                 need_waiter(intf);
 811         } else {
 812                 rv = -EAGAIN;
 813         }
 814
 815         return rv;
 816 }
 817
 818 /*
 819  * Return the receive message for the given sequence number and
 820  * release the sequence number so it can be reused.  Some other data
 821  * is passed in to be sure the message matches up correctly (to help
 822  * guard against message coming in after their timeout and the
 823  * sequence number being reused).
 824  */
 825 static int intf_find_seq(ipmi_smi_t           intf,
 826                          unsigned char        seq,
 827                          short                channel,
 828                          unsigned char        cmd,
 829                          unsigned char        netfn,
 830                          struct ipmi_addr     *addr,
 831                          struct ipmi_recv_msg **recv_msg)
 832 {
 833         int           rv = -ENODEV;
 834         unsigned long flags;
 835
 836         if (seq >= IPMI_IPMB_NUM_SEQ)
 837                 return -EINVAL;
 838
 839         spin_lock_irqsave(&(intf->seq_lock), flags);
 840         if (intf->seq_table[seq].inuse) {
 841                 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg;
 842
 843                 if ((msg->addr.channel == channel) && (msg->msg.cmd == cmd)
 844                                 && (msg->msg.netfn == netfn)
 845                                 && (ipmi_addr_equal(addr, &(msg->addr)))) {
 846                         *recv_msg = msg;
 847                         intf->seq_table[seq].inuse = 0;
 848                         rv = 0;
 849                 }
 850         }
 851         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 852
 853         return rv;
 854 }
 855
 856
 857 /* Start the timer for a specific sequence table entry. */
 858 static int intf_start_seq_timer(ipmi_smi_t intf,
 859                                 long       msgid)
 860 {
 861         int           rv = -ENODEV;
 862         unsigned long flags;
 863         unsigned char seq;
 864         unsigned long seqid;
 865
 866
 867         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 868
 869         spin_lock_irqsave(&(intf->seq_lock), flags);
 870         /*
 871          * We do this verification because the user can be deleted
 872          * while a message is outstanding.
 873          */
 874         if ((intf->seq_table[seq].inuse)
 875                                 && (intf->seq_table[seq].seqid == seqid)) {
 876                 struct seq_table *ent = &(intf->seq_table[seq]);
 877                 ent->timeout = ent->orig_timeout;
 878                 rv = 0;
 879         }
 880         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 881
 882         return rv;
 883 }
 884
 885 /* Got an error for the send message for a specific sequence number. */
 886 static int intf_err_seq(ipmi_smi_t   intf,
 887                         long         msgid,
 888                         unsigned int err)
 889 {
 890         int                  rv = -ENODEV;
 891         unsigned long        flags;
 892         unsigned char        seq;
 893         unsigned long        seqid;
 894         struct ipmi_recv_msg *msg = NULL;
 895
 896
 897         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 898
 899         spin_lock_irqsave(&(intf->seq_lock), flags);
 900         /*
 901          * We do this verification because the user can be deleted
 902          * while a message is outstanding.
 903          */
 904         if ((intf->seq_table[seq].inuse)
 905                                 && (intf->seq_table[seq].seqid == seqid)) {
 906                 struct seq_table *ent = &(intf->seq_table[seq]);
 907
 908                 ent->inuse = 0;
 909                 msg = ent->recv_msg;
 910                 rv = 0;
 911         }
 912         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 913
 914         if (msg)
 915                 deliver_err_response(msg, err);
 916
 917         return rv;
 918 }
 919
 920
 921 int ipmi_create_user(unsigned int          if_num,
 922                      const struct ipmi_user_hndl *handler,
 923                      void                  *handler_data,
 924                      ipmi_user_t           *user)
 925 {
 926         unsigned long flags;
 927         ipmi_user_t   new_user;
 928         int           rv = 0;
 929         ipmi_smi_t    intf;
 930
 931         /*
 932          * There is no module usecount here, because it's not
 933          * required.  Since this can only be used by and called from
 934          * other modules, they will implicitly use this module, and
 935          * thus this can't be removed unless the other modules are
 936          * removed.
 937          */
 938
 939         if (handler == NULL)
 940                 return -EINVAL;
 941
 942         /*
 943          * Make sure the driver is actually initialized, this handles
 944          * problems with initialization order.
 945          */
 946         if (!initialized) {
 947                 rv = ipmi_init_msghandler();
 948                 if (rv)
 949                         return rv;
 950
 951                 /*
 952                  * The init code doesn't return an error if it was turned
 953                  * off, but it won't initialize.  Check that.
 954                  */
 955                 if (!initialized)
 956                         return -ENODEV;
 957         }
 958
 959         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
 960         if (!new_user)
 961                 return -ENOMEM;
 962
 963         mutex_lock(&ipmi_interfaces_mutex);
 964         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
 965                 if (intf->intf_num == if_num)
 966                         goto found;
 967         }
 968         /* Not found, return an error */
 969         rv = -EINVAL;
 970         goto out_kfree;
 971
 972  found:
 973         /* Note that each existing user holds a refcount to the interface. */
 974         kref_get(&intf->refcount);
 975
 976         kref_init(&new_user->refcount);
 977         new_user->handler = handler;
 978         new_user->handler_data = handler_data;
 979         new_user->intf = intf;
 980         new_user->gets_events = false;
 981
 982         if (!try_module_get(intf->handlers->owner)) {
 983                 rv = -ENODEV;
 984                 goto out_kref;
 985         }
 986
 987         if (intf->handlers->inc_usecount) {
 988                 rv = intf->handlers->inc_usecount(intf->send_info);
 989                 if (rv) {
 990                         module_put(intf->handlers->owner);
 991                         goto out_kref;
 992                 }
 993         }
 994
 995         /*
 996          * Hold the lock so intf->handlers is guaranteed to be good
 997          * until now
 998          */
 999         mutex_unlock(&ipmi_interfaces_mutex);
1000
1001         new_user->valid = true;
1002         spin_lock_irqsave(&intf->seq_lock, flags);
1003         list_add_rcu(&new_user->link, &intf->users);
1004         spin_unlock_irqrestore(&intf->seq_lock, flags);
1005         if (handler->ipmi_watchdog_pretimeout) {
1006                 /* User wants pretimeouts, so make sure to watch for them. */
1007                 if (atomic_inc_return(&intf->event_waiters) == 1)
1008                         need_waiter(intf);
1009         }
1010         *user = new_user;
1011         return 0;
1012
1013 out_kref:
1014         kref_put(&intf->refcount, intf_free);
1015 out_kfree:
1016         mutex_unlock(&ipmi_interfaces_mutex);
1017         kfree(new_user);
1018         return rv;
1019 }
1020 EXPORT_SYMBOL(ipmi_create_user);
1021
1022 int ipmi_get_smi_info(int if_num, struct ipmi_smi_info *data)
1023 {
1024         int           rv = 0;
1025         ipmi_smi_t    intf;
1026         const struct ipmi_smi_handlers *handlers;
1027
1028         mutex_lock(&ipmi_interfaces_mutex);
1029         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
1030                 if (intf->intf_num == if_num)
1031                         goto found;
1032         }
1033         /* Not found, return an error */
1034         rv = -EINVAL;
1035         mutex_unlock(&ipmi_interfaces_mutex);
1036         return rv;
1037
1038 found:
1039         handlers = intf->handlers;
1040         rv = -ENOSYS;
1041         if (handlers->get_smi_info)
1042                 rv = handlers->get_smi_info(intf->send_info, data);
1043         mutex_unlock(&ipmi_interfaces_mutex);
1044
1045         return rv;
1046 }
1047 EXPORT_SYMBOL(ipmi_get_smi_info);
1048
1049 static void free_user(struct kref *ref)
1050 {
1051         ipmi_user_t user = container_of(ref, struct ipmi_user, refcount);
1052         kfree(user);
1053 }
1054
1055 int ipmi_destroy_user(ipmi_user_t user)
1056 {
1057         ipmi_smi_t       intf = user->intf;
1058         int              i;
1059         unsigned long    flags;
1060         struct cmd_rcvr  *rcvr;
1061         struct cmd_rcvr  *rcvrs = NULL;
1062
1063         user->valid = false;
1064
1065         if (user->handler->ipmi_watchdog_pretimeout)
1066                 atomic_dec(&intf->event_waiters);
1067
1068         if (user->gets_events)
1069                 atomic_dec(&intf->event_waiters);
1070
1071         /* Remove the user from the interface's sequence table. */
1072         spin_lock_irqsave(&intf->seq_lock, flags);
1073         list_del_rcu(&user->link);
1074
1075         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
1076                 if (intf->seq_table[i].inuse
1077                     && (intf->seq_table[i].recv_msg->user == user)) {
1078                         intf->seq_table[i].inuse = 0;
1079                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
1080                 }
1081         }
1082         spin_unlock_irqrestore(&intf->seq_lock, flags);
1083
1084         /*
1085          * Remove the user from the command receiver's table.  First
1086          * we build a list of everything (not using the standard link,
1087          * since other things may be using it till we do
1088          * synchronize_rcu()) then free everything in that list.
1089          */
1090         mutex_lock(&intf->cmd_rcvrs_mutex);
1091         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1092                 if (rcvr->user == user) {
1093                         list_del_rcu(&rcvr->link);
1094                         rcvr->next = rcvrs;
1095                         rcvrs = rcvr;
1096                 }
1097         }
1098         mutex_unlock(&intf->cmd_rcvrs_mutex);
1099         synchronize_rcu();
1100         while (rcvrs) {
1101                 rcvr = rcvrs;
1102                 rcvrs = rcvr->next;
1103                 kfree(rcvr);
1104         }
1105
1106         mutex_lock(&ipmi_interfaces_mutex);
1107         if (intf->handlers) {
1108                 module_put(intf->handlers->owner);
1109                 if (intf->handlers->dec_usecount)
1110                         intf->handlers->dec_usecount(intf->send_info);
1111         }
1112         mutex_unlock(&ipmi_interfaces_mutex);
1113
1114         kref_put(&intf->refcount, intf_free);
1115
1116         kref_put(&user->refcount, free_user);
1117
1118         return 0;
1119 }
1120 EXPORT_SYMBOL(ipmi_destroy_user);
1121
1122 void ipmi_get_version(ipmi_user_t   user,
1123                       unsigned char *major,
1124                       unsigned char *minor)
1125 {
1126         *major = user->intf->ipmi_version_major;
1127         *minor = user->intf->ipmi_version_minor;
1128 }
1129 EXPORT_SYMBOL(ipmi_get_version);
1130
1131 int ipmi_set_my_address(ipmi_user_t   user,
1132                         unsigned int  channel,
1133                         unsigned char address)
1134 {
1135         if (channel >= IPMI_MAX_CHANNELS)
1136                 return -EINVAL;
1137         user->intf->channels[channel].address = address;
1138         return 0;
1139 }
1140 EXPORT_SYMBOL(ipmi_set_my_address);
1141
1142 int ipmi_get_my_address(ipmi_user_t   user,
1143                         unsigned int  channel,
1144                         unsigned char *address)
1145 {
1146         if (channel >= IPMI_MAX_CHANNELS)
1147                 return -EINVAL;
1148         *address = user->intf->channels[channel].address;
1149         return 0;
1150 }
1151 EXPORT_SYMBOL(ipmi_get_my_address);
1152
1153 int ipmi_set_my_LUN(ipmi_user_t   user,
1154                     unsigned int  channel,
1155                     unsigned char LUN)
1156 {
1157         if (channel >= IPMI_MAX_CHANNELS)
1158                 return -EINVAL;
1159         user->intf->channels[channel].lun = LUN & 0x3;
1160         return 0;
1161 }
1162 EXPORT_SYMBOL(ipmi_set_my_LUN);
1163
1164 int ipmi_get_my_LUN(ipmi_user_t   user,
1165                     unsigned int  channel,
1166                     unsigned char *address)
1167 {
1168         if (channel >= IPMI_MAX_CHANNELS)
1169                 return -EINVAL;
1170         *address = user->intf->channels[channel].lun;
1171         return 0;
1172 }
1173 EXPORT_SYMBOL(ipmi_get_my_LUN);
1174
1175 int ipmi_get_maintenance_mode(ipmi_user_t user)
1176 {
1177         int           mode;
1178         unsigned long flags;
1179
1180         spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags);
1181         mode = user->intf->maintenance_mode;
1182         spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags);
1183
1184         return mode;
1185 }
1186 EXPORT_SYMBOL(ipmi_get_maintenance_mode);
1187
1188 static void maintenance_mode_update(ipmi_smi_t intf)
1189 {
1190         if (intf->handlers->set_maintenance_mode)
1191                 intf->handlers->set_maintenance_mode(
1192                         intf->send_info, intf->maintenance_mode_enable);
1193 }
1194
1195 int ipmi_set_maintenance_mode(ipmi_user_t user, int mode)
1196 {
1197         int           rv = 0;
1198         unsigned long flags;
1199         ipmi_smi_t    intf = user->intf;
1200
1201         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1202         if (intf->maintenance_mode != mode) {
1203                 switch (mode) {
1204                 case IPMI_MAINTENANCE_MODE_AUTO:
1205                         intf->maintenance_mode_enable
1206                                 = (intf->auto_maintenance_timeout > 0);
1207                         break;
1208
1209                 case IPMI_MAINTENANCE_MODE_OFF:
1210                         intf->maintenance_mode_enable = false;
1211                         break;
1212
1213                 case IPMI_MAINTENANCE_MODE_ON:
1214                         intf->maintenance_mode_enable = true;
1215                         break;
1216
1217                 default:
1218                         rv = -EINVAL;
1219                         goto out_unlock;
1220                 }
1221                 intf->maintenance_mode = mode;
1222
1223                 maintenance_mode_update(intf);
1224         }
1225  out_unlock:
1226         spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags);
1227
1228         return rv;
1229 }
1230 EXPORT_SYMBOL(ipmi_set_maintenance_mode);
1231
1232 int ipmi_set_gets_events(ipmi_user_t user, bool val)
1233 {
1234         unsigned long        flags;
1235         ipmi_smi_t           intf = user->intf;
1236         struct ipmi_recv_msg *msg, *msg2;
1237         struct list_head     msgs;
1238
1239         INIT_LIST_HEAD(&msgs);
1240
1241         spin_lock_irqsave(&intf->events_lock, flags);
1242         if (user->gets_events == val)
1243                 goto out;
1244
1245         user->gets_events = val;
1246
1247         if (val) {
1248                 if (atomic_inc_return(&intf->event_waiters) == 1)
1249                         need_waiter(intf);
1250         } else {
1251                 atomic_dec(&intf->event_waiters);
1252         }
1253
1254         if (intf->delivering_events)
1255                 /*
1256                  * Another thread is delivering events for this, so
1257                  * let it handle any new events.
1258                  */
1259                 goto out;
1260
1261         /* Deliver any queued events. */
1262         while (user->gets_events && !list_empty(&intf->waiting_events)) {
1263                 list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link)
1264                         list_move_tail(&msg->link, &msgs);
1265                 intf->waiting_events_count = 0;
1266                 if (intf->event_msg_printed) {
1267                         printk(KERN_WARNING PFX "Event queue no longer"
1268                                " full\n");
1269                         intf->event_msg_printed = 0;
1270                 }
1271
1272                 intf->delivering_events = 1;
1273                 spin_unlock_irqrestore(&intf->events_lock, flags);
1274
1275                 list_for_each_entry_safe(msg, msg2, &msgs, link) {
1276                         msg->user = user;
1277                         kref_get(&user->refcount);
1278                         deliver_response(msg);
1279                 }
1280
1281                 spin_lock_irqsave(&intf->events_lock, flags);
1282                 intf->delivering_events = 0;
1283         }
1284
1285  out:
1286         spin_unlock_irqrestore(&intf->events_lock, flags);
1287
1288         return 0;
1289 }
1290 EXPORT_SYMBOL(ipmi_set_gets_events);
1291
1292 static struct cmd_rcvr *find_cmd_rcvr(ipmi_smi_t    intf,
1293                                       unsigned char netfn,
1294                                       unsigned char cmd,
1295                                       unsigned char chan)
1296 {
1297         struct cmd_rcvr *rcvr;
1298
1299         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1300                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1301                                         && (rcvr->chans & (1 << chan)))
1302                         return rcvr;
1303         }
1304         return NULL;
1305 }
1306
1307 static int is_cmd_rcvr_exclusive(ipmi_smi_t    intf,
1308                                  unsigned char netfn,
1309                                  unsigned char cmd,
1310                                  unsigned int  chans)
1311 {
1312         struct cmd_rcvr *rcvr;
1313
1314         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1315                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1316                                         && (rcvr->chans & chans))
1317                         return 0;
1318         }
1319         return 1;
1320 }
1321
1322 int ipmi_register_for_cmd(ipmi_user_t   user,
1323                           unsigned char netfn,
1324                           unsigned char cmd,
1325                           unsigned int  chans)
1326 {
1327         ipmi_smi_t      intf = user->intf;
1328         struct cmd_rcvr *rcvr;
1329         int             rv = 0;
1330
1331
1332         rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);
1333         if (!rcvr)
1334                 return -ENOMEM;
1335         rcvr->cmd = cmd;
1336         rcvr->netfn = netfn;
1337         rcvr->chans = chans;
1338         rcvr->user = user;
1339
1340         mutex_lock(&intf->cmd_rcvrs_mutex);
1341         /* Make sure the command/netfn is not already registered. */
1342         if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) {
1343                 rv = -EBUSY;
1344                 goto out_unlock;
1345         }
1346
1347         if (atomic_inc_return(&intf->event_waiters) == 1)
1348                 need_waiter(intf);
1349
1350         list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
1351
1352  out_unlock:
1353         mutex_unlock(&intf->cmd_rcvrs_mutex);
1354         if (rv)
1355                 kfree(rcvr);
1356
1357         return rv;
1358 }
1359 EXPORT_SYMBOL(ipmi_register_for_cmd);
1360
1361 int ipmi_unregister_for_cmd(ipmi_user_t   user,
1362                             unsigned char netfn,
1363                             unsigned char cmd,
1364                             unsigned int  chans)
1365 {
1366         ipmi_smi_t      intf = user->intf;
1367         struct cmd_rcvr *rcvr;
1368         struct cmd_rcvr *rcvrs = NULL;
1369         int i, rv = -ENOENT;
1370
1371         mutex_lock(&intf->cmd_rcvrs_mutex);
1372         for (i = 0; i < IPMI_NUM_CHANNELS; i++) {
1373                 if (((1 << i) & chans) == 0)
1374                         continue;
1375                 rcvr = find_cmd_rcvr(intf, netfn, cmd, i);
1376                 if (rcvr == NULL)
1377                         continue;
1378                 if (rcvr->user == user) {
1379                         rv = 0;
1380                         rcvr->chans &= ~chans;
1381                         if (rcvr->chans == 0) {
1382                                 list_del_rcu(&rcvr->link);
1383                                 rcvr->next = rcvrs;
1384                                 rcvrs = rcvr;
1385                         }
1386                 }
1387         }
1388         mutex_unlock(&intf->cmd_rcvrs_mutex);
1389         synchronize_rcu();
1390         while (rcvrs) {
1391                 atomic_dec(&intf->event_waiters);
1392                 rcvr = rcvrs;
1393                 rcvrs = rcvr->next;
1394                 kfree(rcvr);
1395         }
1396         return rv;
1397 }
1398 EXPORT_SYMBOL(ipmi_unregister_for_cmd);
1399
1400 static unsigned char
1401 ipmb_checksum(unsigned char *data, int size)
1402 {
1403         unsigned char csum = 0;
1404
1405         for (; size > 0; size--, data++)
1406                 csum += *data;
1407
1408         return -csum;
1409 }
1410
1411 static inline void format_ipmb_msg(struct ipmi_smi_msg   *smi_msg,
1412                                    struct kernel_ipmi_msg *msg,
1413                                    struct ipmi_ipmb_addr *ipmb_addr,
1414                                    long                  msgid,
1415                                    unsigned char         ipmb_seq,
1416                                    int                   broadcast,
1417                                    unsigned char         source_address,
1418                                    unsigned char         source_lun)
1419 {
1420         int i = broadcast;
1421
1422         /* Format the IPMB header data. */
1423         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1424         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1425         smi_msg->data[2] = ipmb_addr->channel;
1426         if (broadcast)
1427                 smi_msg->data[3] = 0;
1428         smi_msg->data[i+3] = ipmb_addr->slave_addr;
1429         smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3);
1430         smi_msg->data[i+5] = ipmb_checksum(&(smi_msg->data[i+3]), 2);
1431         smi_msg->data[i+6] = source_address;
1432         smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun;
1433         smi_msg->data[i+8] = msg->cmd;
1434
1435         /* Now tack on the data to the message. */
1436         if (msg->data_len > 0)
1437                 memcpy(&(smi_msg->data[i+9]), msg->data,
1438                        msg->data_len);
1439         smi_msg->data_size = msg->data_len + 9;
1440
1441         /* Now calculate the checksum and tack it on. */
1442         smi_msg->data[i+smi_msg->data_size]
1443                 = ipmb_checksum(&(smi_msg->data[i+6]),
1444                                 smi_msg->data_size-6);
1445
1446         /*
1447          * Add on the checksum size and the offset from the
1448          * broadcast.
1449          */
1450         smi_msg->data_size += 1 + i;
1451
1452         smi_msg->msgid = msgid;
1453 }
1454
1455 static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,
1456                                   struct kernel_ipmi_msg *msg,
1457                                   struct ipmi_lan_addr  *lan_addr,
1458                                   long                  msgid,
1459                                   unsigned char         ipmb_seq,
1460                                   unsigned char         source_lun)
1461 {
1462         /* Format the IPMB header data. */
1463         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1464         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1465         smi_msg->data[2] = lan_addr->channel;
1466         smi_msg->data[3] = lan_addr->session_handle;
1467         smi_msg->data[4] = lan_addr->remote_SWID;
1468         smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3);
1469         smi_msg->data[6] = ipmb_checksum(&(smi_msg->data[4]), 2);
1470         smi_msg->data[7] = lan_addr->local_SWID;
1471         smi_msg->data[8] = (ipmb_seq << 2) | source_lun;
1472         smi_msg->data[9] = msg->cmd;
1473
1474         /* Now tack on the data to the message. */
1475         if (msg->data_len > 0)
1476                 memcpy(&(smi_msg->data[10]), msg->data,
1477                        msg->data_len);
1478         smi_msg->data_size = msg->data_len + 10;
1479
1480         /* Now calculate the checksum and tack it on. */
1481         smi_msg->data[smi_msg->data_size]
1482                 = ipmb_checksum(&(smi_msg->data[7]),
1483                                 smi_msg->data_size-7);
1484
1485         /*
1486          * Add on the checksum size and the offset from the
1487          * broadcast.
1488          */
1489         smi_msg->data_size += 1;
1490
1491         smi_msg->msgid = msgid;
1492 }
1493
1494 static struct ipmi_smi_msg *smi_add_send_msg(ipmi_smi_t intf,
1495                                              struct ipmi_smi_msg *smi_msg,
1496                                              int priority)
1497 {
1498         if (intf->curr_msg) {
1499                 if (priority > 0)
1500                         list_add_tail(&smi_msg->link, &intf->hp_xmit_msgs);
1501                 else
1502                         list_add_tail(&smi_msg->link, &intf->xmit_msgs);
1503                 smi_msg = NULL;
1504         } else {
1505                 intf->curr_msg = smi_msg;
1506         }
1507
1508         return smi_msg;
1509 }
1510
1511
1512 static void smi_send(ipmi_smi_t intf, const struct ipmi_smi_handlers *handlers,
1513                      struct ipmi_smi_msg *smi_msg, int priority)
1514 {
1515         int run_to_completion = intf->run_to_completion;
1516
1517         if (run_to_completion) {
1518                 smi_msg = smi_add_send_msg(intf, smi_msg, priority);
1519         } else {
1520                 unsigned long flags;
1521
1522                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
1523                 smi_msg = smi_add_send_msg(intf, smi_msg, priority);
1524                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
1525         }
1526
1527         if (smi_msg)
1528                 handlers->sender(intf->send_info, smi_msg);
1529 }
1530
1531 /*
1532  * Separate from ipmi_request so that the user does not have to be
1533  * supplied in certain circumstances (mainly at panic time).  If
1534  * messages are supplied, they will be freed, even if an error
1535  * occurs.
1536  */
1537 static int i_ipmi_request(ipmi_user_t          user,
1538                           ipmi_smi_t           intf,
1539                           struct ipmi_addr     *addr,
1540                           long                 msgid,
1541                           struct kernel_ipmi_msg *msg,
1542                           void                 *user_msg_data,
1543                           void                 *supplied_smi,
1544                           struct ipmi_recv_msg *supplied_recv,
1545                           int                  priority,
1546                           unsigned char        source_address,
1547                           unsigned char        source_lun,
1548                           int                  retries,
1549                           unsigned int         retry_time_ms)
1550 {
1551         int                      rv = 0;
1552         struct ipmi_smi_msg      *smi_msg;
1553         struct ipmi_recv_msg     *recv_msg;
1554         unsigned long            flags;
1555
1556
1557         if (supplied_recv)
1558                 recv_msg = supplied_recv;
1559         else {
1560                 recv_msg = ipmi_alloc_recv_msg();
1561                 if (recv_msg == NULL)
1562                         return -ENOMEM;
1563         }
1564         recv_msg->user_msg_data = user_msg_data;
1565
1566         if (supplied_smi)
1567                 smi_msg = (struct ipmi_smi_msg *) supplied_smi;
1568         else {
1569                 smi_msg = ipmi_alloc_smi_msg();
1570                 if (smi_msg == NULL) {
1571                         ipmi_free_recv_msg(recv_msg);
1572                         return -ENOMEM;
1573                 }
1574         }
1575
1576         rcu_read_lock();
1577         if (intf->in_shutdown) {
1578                 rv = -ENODEV;
1579                 goto out_err;
1580         }
1581
1582         recv_msg->user = user;
1583         if (user)
1584                 kref_get(&user->refcount);
1585         recv_msg->msgid = msgid;
1586         /*
1587          * Store the message to send in the receive message so timeout
1588          * responses can get the proper response data.
1589          */
1590         recv_msg->msg = *msg;
1591
1592         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
1593                 struct ipmi_system_interface_addr *smi_addr;
1594
1595                 if (msg->netfn & 1) {
1596                         /* Responses are not allowed to the SMI. */
1597                         rv = -EINVAL;
1598                         goto out_err;
1599                 }
1600
1601                 smi_addr = (struct ipmi_system_interface_addr *) addr;
1602                 if (smi_addr->lun > 3) {
1603                         ipmi_inc_stat(intf, sent_invalid_commands);
1604                         rv = -EINVAL;
1605                         goto out_err;
1606                 }
1607
1608                 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr));
1609
1610                 if ((msg->netfn == IPMI_NETFN_APP_REQUEST)
1611                     && ((msg->cmd == IPMI_SEND_MSG_CMD)
1612                         || (msg->cmd == IPMI_GET_MSG_CMD)
1613                         || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD))) {
1614                         /*
1615                          * We don't let the user do these, since we manage
1616                          * the sequence numbers.
1617                          */
1618                         ipmi_inc_stat(intf, sent_invalid_commands);
1619                         rv = -EINVAL;
1620                         goto out_err;
1621                 }
1622
1623                 if (((msg->netfn == IPMI_NETFN_APP_REQUEST)
1624                       && ((msg->cmd == IPMI_COLD_RESET_CMD)
1625                           || (msg->cmd == IPMI_WARM_RESET_CMD)))
1626                      || (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST)) {
1627                         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1628                         intf->auto_maintenance_timeout
1629                                 = IPMI_MAINTENANCE_MODE_TIMEOUT;
1630                         if (!intf->maintenance_mode
1631                             && !intf->maintenance_mode_enable) {
1632                                 intf->maintenance_mode_enable = true;
1633                                 maintenance_mode_update(intf);
1634                         }
1635                         spin_unlock_irqrestore(&intf->maintenance_mode_lock,
1636                                                flags);
1637                 }
1638
1639                 if ((msg->data_len + 2) > IPMI_MAX_MSG_LENGTH) {
1640                         ipmi_inc_stat(intf, sent_invalid_commands);
1641                         rv = -EMSGSIZE;
1642                         goto out_err;
1643                 }
1644
1645                 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3);
1646                 smi_msg->data[1] = msg->cmd;
1647                 smi_msg->msgid = msgid;
1648                 smi_msg->user_data = recv_msg;
1649                 if (msg->data_len > 0)
1650                         memcpy(&(smi_msg->data[2]), msg->data, msg->data_len);
1651                 smi_msg->data_size = msg->data_len + 2;
1652                 ipmi_inc_stat(intf, sent_local_commands);
1653         } else if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
1654                 struct ipmi_ipmb_addr *ipmb_addr;
1655                 unsigned char         ipmb_seq;
1656                 long                  seqid;
1657                 int                   broadcast = 0;
1658
1659                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1660                         ipmi_inc_stat(intf, sent_invalid_commands);
1661                         rv = -EINVAL;
1662                         goto out_err;
1663                 }
1664
1665                 if (intf->channels[addr->channel].medium
1666                                         != IPMI_CHANNEL_MEDIUM_IPMB) {
1667                         ipmi_inc_stat(intf, sent_invalid_commands);
1668                         rv = -EINVAL;
1669                         goto out_err;
1670                 }
1671
1672                 if (retries < 0) {
1673                     if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)
1674                         retries = 0; /* Don't retry broadcasts. */
1675                     else
1676                         retries = 4;
1677                 }
1678                 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) {
1679                     /*
1680                      * Broadcasts add a zero at the beginning of the
1681                      * message, but otherwise is the same as an IPMB
1682                      * address.
1683                      */
1684                     addr->addr_type = IPMI_IPMB_ADDR_TYPE;
1685                     broadcast = 1;
1686                 }
1687
1688
1689                 /* Default to 1 second retries. */
1690                 if (retry_time_ms == 0)
1691                     retry_time_ms = 1000;
1692
1693                 /*
1694                  * 9 for the header and 1 for the checksum, plus
1695                  * possibly one for the broadcast.
1696                  */
1697                 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) {
1698                         ipmi_inc_stat(intf, sent_invalid_commands);
1699                         rv = -EMSGSIZE;
1700                         goto out_err;
1701                 }
1702
1703                 ipmb_addr = (struct ipmi_ipmb_addr *) addr;
1704                 if (ipmb_addr->lun > 3) {
1705                         ipmi_inc_stat(intf, sent_invalid_commands);
1706                         rv = -EINVAL;
1707                         goto out_err;
1708                 }
1709
1710                 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr));
1711
1712                 if (recv_msg->msg.netfn & 0x1) {
1713                         /*
1714                          * It's a response, so use the user's sequence
1715                          * from msgid.
1716                          */
1717                         ipmi_inc_stat(intf, sent_ipmb_responses);
1718                         format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid,
1719                                         msgid, broadcast,
1720                                         source_address, source_lun);
1721
1722                         /*
1723                          * Save the receive message so we can use it
1724                          * to deliver the response.
1725                          */
1726                         smi_msg->user_data = recv_msg;
1727                 } else {
1728                         /* It's a command, so get a sequence for it. */
1729
1730                         spin_lock_irqsave(&(intf->seq_lock), flags);
1731
1732                         /*
1733                          * Create a sequence number with a 1 second
1734                          * timeout and 4 retries.
1735                          */
1736                         rv = intf_next_seq(intf,
1737                                            recv_msg,
1738                                            retry_time_ms,
1739                                            retries,
1740                                            broadcast,
1741                                            &ipmb_seq,
1742                                            &seqid);
1743                         if (rv) {
1744                                 /*
1745                                  * We have used up all the sequence numbers,
1746                                  * probably, so abort.
1747                                  */
1748                                 spin_unlock_irqrestore(&(intf->seq_lock),
1749                                                        flags);
1750                                 goto out_err;
1751                         }
1752
1753                         ipmi_inc_stat(intf, sent_ipmb_commands);
1754
1755                         /*
1756                          * Store the sequence number in the message,
1757                          * so that when the send message response
1758                          * comes back we can start the timer.
1759                          */
1760                         format_ipmb_msg(smi_msg, msg, ipmb_addr,
1761                                         STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1762                                         ipmb_seq, broadcast,
1763                                         source_address, source_lun);
1764
1765                         /*
1766                          * Copy the message into the recv message data, so we
1767                          * can retransmit it later if necessary.
1768                          */
1769                         memcpy(recv_msg->msg_data, smi_msg->data,
1770                                smi_msg->data_size);
1771                         recv_msg->msg.data = recv_msg->msg_data;
1772                         recv_msg->msg.data_len = smi_msg->data_size;
1773
1774                         /*
1775                          * We don't unlock until here, because we need
1776                          * to copy the completed message into the
1777                          * recv_msg before we release the lock.
1778                          * Otherwise, race conditions may bite us.  I
1779                          * know that's pretty paranoid, but I prefer
1780                          * to be correct.
1781                          */
1782                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1783                 }
1784         } else if (is_lan_addr(addr)) {
1785                 struct ipmi_lan_addr  *lan_addr;
1786                 unsigned char         ipmb_seq;
1787                 long                  seqid;
1788
1789                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1790                         ipmi_inc_stat(intf, sent_invalid_commands);
1791                         rv = -EINVAL;
1792                         goto out_err;
1793                 }
1794
1795                 if ((intf->channels[addr->channel].medium
1796                                 != IPMI_CHANNEL_MEDIUM_8023LAN)
1797                     && (intf->channels[addr->channel].medium
1798                                 != IPMI_CHANNEL_MEDIUM_ASYNC)) {
1799                         ipmi_inc_stat(intf, sent_invalid_commands);
1800                         rv = -EINVAL;
1801                         goto out_err;
1802                 }
1803
1804                 retries = 4;
1805
1806                 /* Default to 1 second retries. */
1807                 if (retry_time_ms == 0)
1808                     retry_time_ms = 1000;
1809
1810                 /* 11 for the header and 1 for the checksum. */
1811                 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) {
1812                         ipmi_inc_stat(intf, sent_invalid_commands);
1813                         rv = -EMSGSIZE;
1814                         goto out_err;
1815                 }
1816
1817                 lan_addr = (struct ipmi_lan_addr *) addr;
1818                 if (lan_addr->lun > 3) {
1819                         ipmi_inc_stat(intf, sent_invalid_commands);
1820                         rv = -EINVAL;
1821                         goto out_err;
1822                 }
1823
1824                 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr));
1825
1826                 if (recv_msg->msg.netfn & 0x1) {
1827                         /*
1828                          * It's a response, so use the user's sequence
1829                          * from msgid.
1830                          */
1831                         ipmi_inc_stat(intf, sent_lan_responses);
1832                         format_lan_msg(smi_msg, msg, lan_addr, msgid,
1833                                        msgid, source_lun);
1834
1835                         /*
1836                          * Save the receive message so we can use it
1837                          * to deliver the response.
1838                          */
1839                         smi_msg->user_data = recv_msg;
1840                 } else {
1841                         /* It's a command, so get a sequence for it. */
1842
1843                         spin_lock_irqsave(&(intf->seq_lock), flags);
1844
1845                         /*
1846                          * Create a sequence number with a 1 second
1847                          * timeout and 4 retries.
1848                          */
1849                         rv = intf_next_seq(intf,
1850                                            recv_msg,
1851                                            retry_time_ms,
1852                                            retries,
1853                                            0,
1854                                            &ipmb_seq,
1855                                            &seqid);
1856                         if (rv) {
1857                                 /*
1858                                  * We have used up all the sequence numbers,
1859                                  * probably, so abort.
1860                                  */
1861                                 spin_unlock_irqrestore(&(intf->seq_lock),
1862                                                        flags);
1863                                 goto out_err;
1864                         }
1865
1866                         ipmi_inc_stat(intf, sent_lan_commands);
1867
1868                         /*
1869                          * Store the sequence number in the message,
1870                          * so that when the send message response
1871                          * comes back we can start the timer.
1872                          */
1873                         format_lan_msg(smi_msg, msg, lan_addr,
1874                                        STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1875                                        ipmb_seq, source_lun);
1876
1877                         /*
1878                          * Copy the message into the recv message data, so we
1879                          * can retransmit it later if necessary.
1880                          */
1881                         memcpy(recv_msg->msg_data, smi_msg->data,
1882                                smi_msg->data_size);
1883                         recv_msg->msg.data = recv_msg->msg_data;
1884                         recv_msg->msg.data_len = smi_msg->data_size;
1885
1886                         /*
1887                          * We don't unlock until here, because we need
1888                          * to copy the completed message into the
1889                          * recv_msg before we release the lock.
1890                          * Otherwise, race conditions may bite us.  I
1891                          * know that's pretty paranoid, but I prefer
1892                          * to be correct.
1893                          */
1894                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1895                 }
1896         } else {
1897             /* Unknown address type. */
1898                 ipmi_inc_stat(intf, sent_invalid_commands);
1899                 rv = -EINVAL;
1900                 goto out_err;
1901         }
1902
1903 #ifdef DEBUG_MSGING
1904         {
1905                 int m;
1906                 for (m = 0; m < smi_msg->data_size; m++)
1907                         printk(" %2.2x", smi_msg->data[m]);
1908                 printk("\n");
1909         }
1910 #endif
1911
1912         smi_send(intf, intf->handlers, smi_msg, priority);
1913         rcu_read_unlock();
1914
1915         return 0;
1916
1917  out_err:
1918         rcu_read_unlock();
1919         ipmi_free_smi_msg(smi_msg);
1920         ipmi_free_recv_msg(recv_msg);
1921         return rv;
1922 }
1923
1924 static int check_addr(ipmi_smi_t       intf,
1925                       struct ipmi_addr *addr,
1926                       unsigned char    *saddr,
1927                       unsigned char    *lun)
1928 {
1929         if (addr->channel >= IPMI_MAX_CHANNELS)
1930                 return -EINVAL;
1931         *lun = intf->channels[addr->channel].lun;
1932         *saddr = intf->channels[addr->channel].address;
1933         return 0;
1934 }
1935
1936 int ipmi_request_settime(ipmi_user_t      user,
1937                          struct ipmi_addr *addr,
1938                          long             msgid,
1939                          struct kernel_ipmi_msg  *msg,
1940                          void             *user_msg_data,
1941                          int              priority,
1942                          int              retries,
1943                          unsigned int     retry_time_ms)
1944 {
1945         unsigned char saddr = 0, lun = 0;
1946         int           rv;
1947
1948         if (!user)
1949                 return -EINVAL;
1950         rv = check_addr(user->intf, addr, &saddr, &lun);
1951         if (rv)
1952                 return rv;
1953         return i_ipmi_request(user,
1954                               user->intf,
1955                               addr,
1956                               msgid,
1957                               msg,
1958                               user_msg_data,
1959                               NULL, NULL,
1960                               priority,
1961                               saddr,
1962                               lun,
1963                               retries,
1964                               retry_time_ms);
1965 }
1966 EXPORT_SYMBOL(ipmi_request_settime);
1967
1968 int ipmi_request_supply_msgs(ipmi_user_t          user,
1969                              struct ipmi_addr     *addr,
1970                              long                 msgid,
1971                              struct kernel_ipmi_msg *msg,
1972                              void                 *user_msg_data,
1973                              void                 *supplied_smi,
1974                              struct ipmi_recv_msg *supplied_recv,
1975                              int                  priority)
1976 {
1977         unsigned char saddr = 0, lun = 0;
1978         int           rv;
1979
1980         if (!user)
1981                 return -EINVAL;
1982         rv = check_addr(user->intf, addr, &saddr, &lun);
1983         if (rv)
1984                 return rv;
1985         return i_ipmi_request(user,
1986                               user->intf,
1987                               addr,
1988                               msgid,
1989                               msg,
1990                               user_msg_data,
1991                               supplied_smi,
1992                               supplied_recv,
1993                               priority,
1994                               saddr,
1995                               lun,
1996                               -1, 0);
1997 }
1998 EXPORT_SYMBOL(ipmi_request_supply_msgs);
1999
2000 #ifdef CONFIG_PROC_FS
2001 static int smi_ipmb_proc_show(struct seq_file *m, void *v)
2002 {
2003         ipmi_smi_t intf = m->private;
2004         int        i;
2005
2006         seq_printf(m, "%x", intf->channels[0].address);
2007         for (i = 1; i < IPMI_MAX_CHANNELS; i++)
2008                 seq_printf(m, " %x", intf->channels[i].address);
2009         seq_putc(m, '\n');
2010
2011         return 0;
2012 }
2013
2014 static int smi_ipmb_proc_open(struct inode *inode, struct file *file)
2015 {
2016         return single_open(file, smi_ipmb_proc_show, PDE_DATA(inode));
2017 }
2018
2019 static const struct file_operations smi_ipmb_proc_ops = {
2020         .open           = smi_ipmb_proc_open,
2021         .read           = seq_read,
2022         .llseek         = seq_lseek,
2023         .release        = single_release,
2024 };
2025
2026 static int smi_version_proc_show(struct seq_file *m, void *v)
2027 {
2028         ipmi_smi_t intf = m->private;
2029
2030         seq_printf(m, "%u.%u\n",
2031                    ipmi_version_major(&intf->bmc->id),
2032                    ipmi_version_minor(&intf->bmc->id));
2033
2034         return 0;
2035 }
2036
2037 static int smi_version_proc_open(struct inode *inode, struct file *file)
2038 {
2039         return single_open(file, smi_version_proc_show, PDE_DATA(inode));
2040 }
2041
2042 static const struct file_operations smi_version_proc_ops = {
2043         .open           = smi_version_proc_open,
2044         .read           = seq_read,
2045         .llseek         = seq_lseek,
2046         .release        = single_release,
2047 };
2048
2049 static int smi_stats_proc_show(struct seq_file *m, void *v)
2050 {
2051         ipmi_smi_t intf = m->private;
2052
2053         seq_printf(m, "sent_invalid_commands:       %u\n",
2054                        ipmi_get_stat(intf, sent_invalid_commands));
2055         seq_printf(m, "sent_local_commands:         %u\n",
2056                        ipmi_get_stat(intf, sent_local_commands));
2057         seq_printf(m, "handled_local_responses:     %u\n",
2058                        ipmi_get_stat(intf, handled_local_responses));
2059         seq_printf(m, "unhandled_local_responses:   %u\n",
2060                        ipmi_get_stat(intf, unhandled_local_responses));
2061         seq_printf(m, "sent_ipmb_commands:          %u\n",
2062                        ipmi_get_stat(intf, sent_ipmb_commands));
2063         seq_printf(m, "sent_ipmb_command_errs:      %u\n",
2064                        ipmi_get_stat(intf, sent_ipmb_command_errs));
2065         seq_printf(m, "retransmitted_ipmb_commands: %u\n",
2066                        ipmi_get_stat(intf, retransmitted_ipmb_commands));
2067         seq_printf(m, "timed_out_ipmb_commands:     %u\n",
2068                        ipmi_get_stat(intf, timed_out_ipmb_commands));
2069         seq_printf(m, "timed_out_ipmb_broadcasts:   %u\n",
2070                        ipmi_get_stat(intf, timed_out_ipmb_broadcasts));
2071         seq_printf(m, "sent_ipmb_responses:         %u\n",
2072                        ipmi_get_stat(intf, sent_ipmb_responses));
2073         seq_printf(m, "handled_ipmb_responses:      %u\n",
2074                        ipmi_get_stat(intf, handled_ipmb_responses));
2075         seq_printf(m, "invalid_ipmb_responses:      %u\n",
2076                        ipmi_get_stat(intf, invalid_ipmb_responses));
2077         seq_printf(m, "unhandled_ipmb_responses:    %u\n",
2078                        ipmi_get_stat(intf, unhandled_ipmb_responses));
2079         seq_printf(m, "sent_lan_commands:           %u\n",
2080                        ipmi_get_stat(intf, sent_lan_commands));
2081         seq_printf(m, "sent_lan_command_errs:       %u\n",
2082                        ipmi_get_stat(intf, sent_lan_command_errs));
2083         seq_printf(m, "retransmitted_lan_commands:  %u\n",
2084                        ipmi_get_stat(intf, retransmitted_lan_commands));
2085         seq_printf(m, "timed_out_lan_commands:      %u\n",
2086                        ipmi_get_stat(intf, timed_out_lan_commands));
2087         seq_printf(m, "sent_lan_responses:          %u\n",
2088                        ipmi_get_stat(intf, sent_lan_responses));
2089         seq_printf(m, "handled_lan_responses:       %u\n",
2090                        ipmi_get_stat(intf, handled_lan_responses));
2091         seq_printf(m, "invalid_lan_responses:       %u\n",
2092                        ipmi_get_stat(intf, invalid_lan_responses));
2093         seq_printf(m, "unhandled_lan_responses:     %u\n",
2094                        ipmi_get_stat(intf, unhandled_lan_responses));
2095         seq_printf(m, "handled_commands:            %u\n",
2096                        ipmi_get_stat(intf, handled_commands));
2097         seq_printf(m, "invalid_commands:            %u\n",
2098                        ipmi_get_stat(intf, invalid_commands));
2099         seq_printf(m, "unhandled_commands:          %u\n",
2100                        ipmi_get_stat(intf, unhandled_commands));
2101         seq_printf(m, "invalid_events:              %u\n",
2102                        ipmi_get_stat(intf, invalid_events));
2103         seq_printf(m, "events:                      %u\n",
2104                        ipmi_get_stat(intf, events));
2105         seq_printf(m, "failed rexmit LAN msgs:      %u\n",
2106                        ipmi_get_stat(intf, dropped_rexmit_lan_commands));
2107         seq_printf(m, "failed rexmit IPMB msgs:     %u\n",
2108                        ipmi_get_stat(intf, dropped_rexmit_ipmb_commands));
2109         return 0;
2110 }
2111
2112 static int smi_stats_proc_open(struct inode *inode, struct file *file)
2113 {
2114         return single_open(file, smi_stats_proc_show, PDE_DATA(inode));
2115 }
2116
2117 static const struct file_operations smi_stats_proc_ops = {
2118         .open           = smi_stats_proc_open,
2119         .read           = seq_read,
2120         .llseek         = seq_lseek,
2121         .release        = single_release,
2122 };
2123 #endif /* CONFIG_PROC_FS */
2124
2125 int ipmi_smi_add_proc_entry(ipmi_smi_t smi, char *name,
2126                             const struct file_operations *proc_ops,
2127                             void *data)
2128 {
2129         int                    rv = 0;
2130 #ifdef CONFIG_PROC_FS
2131         struct proc_dir_entry  *file;
2132         struct ipmi_proc_entry *entry;
2133
2134         /* Create a list element. */
2135         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
2136         if (!entry)
2137                 return -ENOMEM;
2138         entry->name = kstrdup(name, GFP_KERNEL);
2139         if (!entry->name) {
2140                 kfree(entry);
2141                 return -ENOMEM;
2142         }
2143
2144         file = proc_create_data(name, 0, smi->proc_dir, proc_ops, data);
2145         if (!file) {
2146                 kfree(entry->name);
2147                 kfree(entry);
2148                 rv = -ENOMEM;
2149         } else {
2150                 mutex_lock(&smi->proc_entry_lock);
2151                 /* Stick it on the list. */
2152                 entry->next = smi->proc_entries;
2153                 smi->proc_entries = entry;
2154                 mutex_unlock(&smi->proc_entry_lock);
2155         }
2156 #endif /* CONFIG_PROC_FS */
2157
2158         return rv;
2159 }
2160 EXPORT_SYMBOL(ipmi_smi_add_proc_entry);
2161
2162 static int add_proc_entries(ipmi_smi_t smi, int num)
2163 {
2164         int rv = 0;
2165
2166 #ifdef CONFIG_PROC_FS
2167         sprintf(smi->proc_dir_name, "%d", num);
2168         smi->proc_dir = proc_mkdir(smi->proc_dir_name, proc_ipmi_root);
2169         if (!smi->proc_dir)
2170                 rv = -ENOMEM;
2171
2172         if (rv == 0)
2173                 rv = ipmi_smi_add_proc_entry(smi, "stats",
2174                                              &smi_stats_proc_ops,
2175                                              smi);
2176
2177         if (rv == 0)
2178                 rv = ipmi_smi_add_proc_entry(smi, "ipmb",
2179                                              &smi_ipmb_proc_ops,
2180                                              smi);
2181
2182         if (rv == 0)
2183                 rv = ipmi_smi_add_proc_entry(smi, "version",
2184                                              &smi_version_proc_ops,
2185                                              smi);
2186 #endif /* CONFIG_PROC_FS */
2187
2188         return rv;
2189 }
2190
2191 static void remove_proc_entries(ipmi_smi_t smi)
2192 {
2193 #ifdef CONFIG_PROC_FS
2194         struct ipmi_proc_entry *entry;
2195
2196         mutex_lock(&smi->proc_entry_lock);
2197         while (smi->proc_entries) {
2198                 entry = smi->proc_entries;
2199                 smi->proc_entries = entry->next;
2200
2201                 remove_proc_entry(entry->name, smi->proc_dir);
2202                 kfree(entry->name);
2203                 kfree(entry);
2204         }
2205         mutex_unlock(&smi->proc_entry_lock);
2206         remove_proc_entry(smi->proc_dir_name, proc_ipmi_root);
2207 #endif /* CONFIG_PROC_FS */
2208 }
2209
2210 static int __find_bmc_guid(struct device *dev, void *data)
2211 {
2212         unsigned char *id = data;
2213         struct bmc_device *bmc = to_bmc_device(dev);
2214         return memcmp(bmc->guid, id, 16) == 0;
2215 }
2216
2217 static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv,
2218                                              unsigned char *guid)
2219 {
2220         struct device *dev;
2221
2222         dev = driver_find_device(drv, NULL, guid, __find_bmc_guid);
2223         if (dev)
2224                 return to_bmc_device(dev);
2225         else
2226                 return NULL;
2227 }
2228
2229 struct prod_dev_id {
2230         unsigned int  product_id;
2231         unsigned char device_id;
2232 };
2233
2234 static int __find_bmc_prod_dev_id(struct device *dev, void *data)
2235 {
2236         struct prod_dev_id *id = data;
2237         struct bmc_device *bmc = to_bmc_device(dev);
2238
2239         return (bmc->id.product_id == id->product_id
2240                 && bmc->id.device_id == id->device_id);
2241 }
2242
2243 static struct bmc_device *ipmi_find_bmc_prod_dev_id(
2244         struct device_driver *drv,
2245         unsigned int product_id, unsigned char device_id)
2246 {
2247         struct prod_dev_id id = {
2248                 .product_id = product_id,
2249                 .device_id = device_id,
2250         };
2251         struct device *dev;
2252
2253         dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id);
2254         if (dev)
2255                 return to_bmc_device(dev);
2256         else
2257                 return NULL;
2258 }
2259
2260 static ssize_t device_id_show(struct device *dev,
2261                               struct device_attribute *attr,
2262                               char *buf)
2263 {
2264         struct bmc_device *bmc = to_bmc_device(dev);
2265
2266         return snprintf(buf, 10, "%u\n", bmc->id.device_id);
2267 }
2268 static DEVICE_ATTR(device_id, S_IRUGO, device_id_show, NULL);
2269
2270 static ssize_t provides_device_sdrs_show(struct device *dev,
2271                                          struct device_attribute *attr,
2272                                          char *buf)
2273 {
2274         struct bmc_device *bmc = to_bmc_device(dev);
2275
2276         return snprintf(buf, 10, "%u\n",
2277                         (bmc->id.device_revision & 0x80) >> 7);
2278 }
2279 static DEVICE_ATTR(provides_device_sdrs, S_IRUGO, provides_device_sdrs_show,
2280                    NULL);
2281
2282 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
2283                              char *buf)
2284 {
2285         struct bmc_device *bmc = to_bmc_device(dev);
2286
2287         return snprintf(buf, 20, "%u\n",
2288                         bmc->id.device_revision & 0x0F);
2289 }
2290 static DEVICE_ATTR(revision, S_IRUGO, revision_show, NULL);
2291
2292 static ssize_t firmware_revision_show(struct device *dev,
2293                                       struct device_attribute *attr,
2294                                       char *buf)
2295 {
2296         struct bmc_device *bmc = to_bmc_device(dev);
2297
2298         return snprintf(buf, 20, "%u.%x\n", bmc->id.firmware_revision_1,
2299                         bmc->id.firmware_revision_2);
2300 }
2301 static DEVICE_ATTR(firmware_revision, S_IRUGO, firmware_revision_show, NULL);
2302
2303 static ssize_t ipmi_version_show(struct device *dev,
2304                                  struct device_attribute *attr,
2305                                  char *buf)
2306 {
2307         struct bmc_device *bmc = to_bmc_device(dev);
2308
2309         return snprintf(buf, 20, "%u.%u\n",
2310                         ipmi_version_major(&bmc->id),
2311                         ipmi_version_minor(&bmc->id));
2312 }
2313 static DEVICE_ATTR(ipmi_version, S_IRUGO, ipmi_version_show, NULL);
2314
2315 static ssize_t add_dev_support_show(struct device *dev,
2316                                     struct device_attribute *attr,
2317                                     char *buf)
2318 {
2319         struct bmc_device *bmc = to_bmc_device(dev);
2320
2321         return snprintf(buf, 10, "0x%02x\n",
2322                         bmc->id.additional_device_support);
2323 }
2324 static DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show,
2325                    NULL);
2326
2327 static ssize_t manufacturer_id_show(struct device *dev,
2328                                     struct device_attribute *attr,
2329                                     char *buf)
2330 {
2331         struct bmc_device *bmc = to_bmc_device(dev);
2332
2333         return snprintf(buf, 20, "0x%6.6x\n", bmc->id.manufacturer_id);
2334 }
2335 static DEVICE_ATTR(manufacturer_id, S_IRUGO, manufacturer_id_show, NULL);
2336
2337 static ssize_t product_id_show(struct device *dev,
2338                                struct device_attribute *attr,
2339                                char *buf)
2340 {
2341         struct bmc_device *bmc = to_bmc_device(dev);
2342
2343         return snprintf(buf, 10, "0x%4.4x\n", bmc->id.product_id);
2344 }
2345 static DEVICE_ATTR(product_id, S_IRUGO, product_id_show, NULL);
2346
2347 static ssize_t aux_firmware_rev_show(struct device *dev,
2348                                      struct device_attribute *attr,
2349                                      char *buf)
2350 {
2351         struct bmc_device *bmc = to_bmc_device(dev);
2352
2353         return snprintf(buf, 21, "0x%02x 0x%02x 0x%02x 0x%02x\n",
2354                         bmc->id.aux_firmware_revision[3],
2355                         bmc->id.aux_firmware_revision[2],
2356                         bmc->id.aux_firmware_revision[1],
2357                         bmc->id.aux_firmware_revision[0]);
2358 }
2359 static DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL);
2360
2361 static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
2362                          char *buf)
2363 {
2364         struct bmc_device *bmc = to_bmc_device(dev);
2365
2366         return snprintf(buf, 100, "%Lx%Lx\n",
2367                         (long long) bmc->guid[0],
2368                         (long long) bmc->guid[8]);
2369 }
2370 static DEVICE_ATTR(guid, S_IRUGO, guid_show, NULL);
2371
2372 static struct attribute *bmc_dev_attrs[] = {
2373         &dev_attr_device_id.attr,
2374         &dev_attr_provides_device_sdrs.attr,
2375         &dev_attr_revision.attr,
2376         &dev_attr_firmware_revision.attr,
2377         &dev_attr_ipmi_version.attr,
2378         &dev_attr_additional_device_support.attr,
2379         &dev_attr_manufacturer_id.attr,
2380         &dev_attr_product_id.attr,
2381         &dev_attr_aux_firmware_revision.attr,
2382         &dev_attr_guid.attr,
2383         NULL
2384 };
2385
2386 static umode_t bmc_dev_attr_is_visible(struct kobject *kobj,
2387                                        struct attribute *attr, int idx)
2388 {
2389         struct device *dev = kobj_to_dev(kobj);
2390         struct bmc_device *bmc = to_bmc_device(dev);
2391         umode_t mode = attr->mode;
2392
2393         if (attr == &dev_attr_aux_firmware_revision.attr)
2394                 return bmc->id.aux_firmware_revision_set ? mode : 0;
2395         if (attr == &dev_attr_guid.attr)
2396                 return bmc->guid_set ? mode : 0;
2397         return mode;
2398 }
2399
2400 static const struct attribute_group bmc_dev_attr_group = {
2401         .attrs          = bmc_dev_attrs,
2402         .is_visible     = bmc_dev_attr_is_visible,
2403 };
2404
2405 static const struct attribute_group *bmc_dev_attr_groups[] = {
2406         &bmc_dev_attr_group,
2407         NULL
2408 };
2409
2410 static const struct device_type bmc_device_type = {
2411         .groups         = bmc_dev_attr_groups,
2412 };
2413
2414 static void
2415 release_bmc_device(struct device *dev)
2416 {
2417         kfree(to_bmc_device(dev));
2418 }
2419
2420 static void
2421 cleanup_bmc_device(struct kref *ref)
2422 {
2423         struct bmc_device *bmc = container_of(ref, struct bmc_device, usecount);
2424
2425         platform_device_unregister(&bmc->pdev);
2426 }
2427
2428 static void ipmi_bmc_unregister(ipmi_smi_t intf)
2429 {
2430         struct bmc_device *bmc = intf->bmc;
2431
2432         sysfs_remove_link(&intf->si_dev->kobj, "bmc");
2433         if (intf->my_dev_name) {
2434                 sysfs_remove_link(&bmc->pdev.dev.kobj, intf->my_dev_name);
2435                 kfree(intf->my_dev_name);
2436                 intf->my_dev_name = NULL;
2437         }
2438
2439         mutex_lock(&ipmidriver_mutex);
2440         kref_put(&bmc->usecount, cleanup_bmc_device);
2441         intf->bmc = NULL;
2442         mutex_unlock(&ipmidriver_mutex);
2443 }
2444
2445 static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum)
2446 {
2447         int               rv;
2448         struct bmc_device *bmc = intf->bmc;
2449         struct bmc_device *old_bmc;
2450
2451         mutex_lock(&ipmidriver_mutex);
2452
2453         /*
2454          * Try to find if there is an bmc_device struct
2455          * representing the interfaced BMC already
2456          */
2457         if (bmc->guid_set)
2458                 old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, bmc->guid);
2459         else
2460                 old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2461                                                     bmc->id.product_id,
2462                                                     bmc->id.device_id);
2463
2464         /*
2465          * If there is already an bmc_device, free the new one,
2466          * otherwise register the new BMC device
2467          */
2468         if (old_bmc) {
2469                 kfree(bmc);
2470                 intf->bmc = old_bmc;
2471                 bmc = old_bmc;
2472
2473                 kref_get(&bmc->usecount);
2474                 mutex_unlock(&ipmidriver_mutex);
2475
2476                 printk(KERN_INFO
2477                        "ipmi: interfacing existing BMC (man_id: 0x%6.6x,"
2478                        " prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2479                        bmc->id.manufacturer_id,
2480                        bmc->id.product_id,
2481                        bmc->id.device_id);
2482         } else {
2483                 unsigned char orig_dev_id = bmc->id.device_id;
2484                 int warn_printed = 0;
2485
2486                 snprintf(bmc->name, sizeof(bmc->name),
2487                          "ipmi_bmc.%4.4x", bmc->id.product_id);
2488                 bmc->pdev.name = bmc->name;
2489
2490                 while (ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2491                                                  bmc->id.product_id,
2492                                                  bmc->id.device_id)) {
2493                         if (!warn_printed) {
2494                                 printk(KERN_WARNING PFX
2495                                        "This machine has two different BMCs"
2496                                        " with the same product id and device"
2497                                        " id.  This is an error in the"
2498                                        " firmware, but incrementing the"
2499                                        " device id to work around the problem."
2500                                        " Prod ID = 0x%x, Dev ID = 0x%x\n",
2501                                        bmc->id.product_id, bmc->id.device_id);
2502                                 warn_printed = 1;
2503                         }
2504                         bmc->id.device_id++; /* Wraps at 255 */
2505                         if (bmc->id.device_id == orig_dev_id) {
2506                                 printk(KERN_ERR PFX
2507                                        "Out of device ids!\n");
2508                                 break;
2509                         }
2510                 }
2511
2512                 bmc->pdev.dev.driver = &ipmidriver.driver;
2513                 bmc->pdev.id = bmc->id.device_id;
2514                 bmc->pdev.dev.release = release_bmc_device;
2515                 bmc->pdev.dev.type = &bmc_device_type;
2516                 kref_init(&bmc->usecount);
2517
2518                 rv = platform_device_register(&bmc->pdev);
2519                 mutex_unlock(&ipmidriver_mutex);
2520                 if (rv) {
2521                         put_device(&bmc->pdev.dev);
2522                         printk(KERN_ERR
2523                                "ipmi_msghandler:"
2524                                " Unable to register bmc device: %d\n",
2525                                rv);
2526                         /*
2527                          * Don't go to out_err, you can only do that if
2528                          * the device is registered already.
2529                          */
2530                         return rv;
2531                 }
2532
2533                 dev_info(intf->si_dev, "Found new BMC (man_id: 0x%6.6x, "
2534                          "prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2535                          bmc->id.manufacturer_id,
2536                          bmc->id.product_id,
2537                          bmc->id.device_id);
2538         }
2539
2540         /*
2541          * create symlink from system interface device to bmc device
2542          * and back.
2543          */
2544         rv = sysfs_create_link(&intf->si_dev->kobj, &bmc->pdev.dev.kobj, "bmc");
2545         if (rv) {
2546                 printk(KERN_ERR
2547                        "ipmi_msghandler: Unable to create bmc symlink: %d\n",
2548                        rv);
2549                 goto out_err;
2550         }
2551
2552         intf->my_dev_name = kasprintf(GFP_KERNEL, "ipmi%d", ifnum);
2553         if (!intf->my_dev_name) {
2554                 rv = -ENOMEM;
2555                 printk(KERN_ERR
2556                        "ipmi_msghandler: allocate link from BMC: %d\n",
2557                        rv);
2558                 goto out_err;
2559         }
2560
2561         rv = sysfs_create_link(&bmc->pdev.dev.kobj, &intf->si_dev->kobj,
2562                                intf->my_dev_name);
2563         if (rv) {
2564                 kfree(intf->my_dev_name);
2565                 intf->my_dev_name = NULL;
2566                 printk(KERN_ERR
2567                        "ipmi_msghandler:"
2568                        " Unable to create symlink to bmc: %d\n",
2569                        rv);
2570                 goto out_err;
2571         }
2572
2573         return 0;
2574
2575 out_err:
2576         ipmi_bmc_unregister(intf);
2577         return rv;
2578 }
2579
2580 static int
2581 send_guid_cmd(ipmi_smi_t intf, int chan)
2582 {
2583         struct kernel_ipmi_msg            msg;
2584         struct ipmi_system_interface_addr si;
2585
2586         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2587         si.channel = IPMI_BMC_CHANNEL;
2588         si.lun = 0;
2589
2590         msg.netfn = IPMI_NETFN_APP_REQUEST;
2591         msg.cmd = IPMI_GET_DEVICE_GUID_CMD;
2592         msg.data = NULL;
2593         msg.data_len = 0;
2594         return i_ipmi_request(NULL,
2595                               intf,
2596                               (struct ipmi_addr *) &si,
2597                               0,
2598                               &msg,
2599                               intf,
2600                               NULL,
2601                               NULL,
2602                               0,
2603                               intf->channels[0].address,
2604                               intf->channels[0].lun,
2605                               -1, 0);
2606 }
2607
2608 static void
2609 guid_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2610 {
2611         if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2612             || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)
2613             || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD))
2614                 /* Not for me */
2615                 return;
2616
2617         if (msg->msg.data[0] != 0) {
2618                 /* Error from getting the GUID, the BMC doesn't have one. */
2619                 intf->bmc->guid_set = 0;
2620                 goto out;
2621         }
2622
2623         if (msg->msg.data_len < 17) {
2624                 intf->bmc->guid_set = 0;
2625                 printk(KERN_WARNING PFX
2626                        "guid_handler: The GUID response from the BMC was too"
2627                        " short, it was %d but should have been 17.  Assuming"
2628                        " GUID is not available.\n",
2629                        msg->msg.data_len);
2630                 goto out;
2631         }
2632
2633         memcpy(intf->bmc->guid, msg->msg.data, 16);
2634         intf->bmc->guid_set = 1;
2635  out:
2636         wake_up(&intf->waitq);
2637 }
2638
2639 static void
2640 get_guid(ipmi_smi_t intf)
2641 {
2642         int rv;
2643
2644         intf->bmc->guid_set = 0x2;
2645         intf->null_user_handler = guid_handler;
2646         rv = send_guid_cmd(intf, 0);
2647         if (rv)
2648                 /* Send failed, no GUID available. */
2649                 intf->bmc->guid_set = 0;
2650         else
2651                 wait_event(intf->waitq, intf->bmc->guid_set != 2);
2652
2653         intf->null_user_handler = NULL;
2654 }
2655
2656 static int
2657 send_channel_info_cmd(ipmi_smi_t intf, int chan)
2658 {
2659         struct kernel_ipmi_msg            msg;
2660         unsigned char                     data[1];
2661         struct ipmi_system_interface_addr si;
2662
2663         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2664         si.channel = IPMI_BMC_CHANNEL;
2665         si.lun = 0;
2666
2667         msg.netfn = IPMI_NETFN_APP_REQUEST;
2668         msg.cmd = IPMI_GET_CHANNEL_INFO_CMD;
2669         msg.data = data;
2670         msg.data_len = 1;
2671         data[0] = chan;
2672         return i_ipmi_request(NULL,
2673                               intf,
2674                               (struct ipmi_addr *) &si,
2675                               0,
2676                               &msg,
2677                               intf,
2678                               NULL,
2679                               NULL,
2680                               0,
2681                               intf->channels[0].address,
2682                               intf->channels[0].lun,
2683                               -1, 0);
2684 }
2685
2686 static void
2687 channel_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2688 {
2689         int rv = 0;
2690         int chan;
2691
2692         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2693             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
2694             && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD)) {
2695                 /* It's the one we want */
2696                 if (msg->msg.data[0] != 0) {
2697                         /* Got an error from the channel, just go on. */
2698
2699                         if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) {
2700                                 /*
2701                                  * If the MC does not support this
2702                                  * command, that is legal.  We just
2703                                  * assume it has one IPMB at channel
2704                                  * zero.
2705                                  */
2706                                 intf->channels[0].medium
2707                                         = IPMI_CHANNEL_MEDIUM_IPMB;
2708                                 intf->channels[0].protocol
2709                                         = IPMI_CHANNEL_PROTOCOL_IPMB;
2710
2711                                 intf->curr_channel = IPMI_MAX_CHANNELS;
2712                                 wake_up(&intf->waitq);
2713                                 goto out;
2714                         }
2715                         goto next_channel;
2716                 }
2717                 if (msg->msg.data_len < 4) {
2718                         /* Message not big enough, just go on. */
2719                         goto next_channel;
2720                 }
2721                 chan = intf->curr_channel;
2722                 intf->channels[chan].medium = msg->msg.data[2] & 0x7f;
2723                 intf->channels[chan].protocol = msg->msg.data[3] & 0x1f;
2724
2725  next_channel:
2726                 intf->curr_channel++;
2727                 if (intf->curr_channel >= IPMI_MAX_CHANNELS)
2728                         wake_up(&intf->waitq);
2729                 else
2730                         rv = send_channel_info_cmd(intf, intf->curr_channel);
2731
2732                 if (rv) {
2733                         /* Got an error somehow, just give up. */
2734                         printk(KERN_WARNING PFX
2735                                "Error sending channel information for channel"
2736                                " %d: %d\n", intf->curr_channel, rv);
2737
2738                         intf->curr_channel = IPMI_MAX_CHANNELS;
2739                         wake_up(&intf->waitq);
2740                 }
2741         }
2742  out:
2743         return;
2744 }
2745
2746 static void ipmi_poll(ipmi_smi_t intf)
2747 {
2748         if (intf->handlers->poll)
2749                 intf->handlers->poll(intf->send_info);
2750         /* In case something came in */
2751         handle_new_recv_msgs(intf);
2752 }
2753
2754 void ipmi_poll_interface(ipmi_user_t user)
2755 {
2756         ipmi_poll(user->intf);
2757 }
2758 EXPORT_SYMBOL(ipmi_poll_interface);
2759
2760 int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
2761                       void                     *send_info,
2762                       struct ipmi_device_id    *device_id,
2763                       struct device            *si_dev,
2764                       unsigned char            slave_addr)
2765 {
2766         int              i, j;
2767         int              rv;
2768         ipmi_smi_t       intf;
2769         ipmi_smi_t       tintf;
2770         struct list_head *link;
2771
2772         /*
2773          * Make sure the driver is actually initialized, this handles
2774          * problems with initialization order.
2775          */
2776         if (!initialized) {
2777                 rv = ipmi_init_msghandler();
2778                 if (rv)
2779                         return rv;
2780                 /*
2781                  * The init code doesn't return an error if it was turned
2782                  * off, but it won't initialize.  Check that.
2783                  */
2784                 if (!initialized)
2785                         return -ENODEV;
2786         }
2787
2788         intf = kzalloc(sizeof(*intf), GFP_KERNEL);
2789         if (!intf)
2790                 return -ENOMEM;
2791
2792         intf->ipmi_version_major = ipmi_version_major(device_id);
2793         intf->ipmi_version_minor = ipmi_version_minor(device_id);
2794
2795         intf->bmc = kzalloc(sizeof(*intf->bmc), GFP_KERNEL);
2796         if (!intf->bmc) {
2797                 kfree(intf);
2798                 return -ENOMEM;
2799         }
2800         intf->intf_num = -1; /* Mark it invalid for now. */
2801         kref_init(&intf->refcount);
2802         intf->bmc->id = *device_id;
2803         intf->si_dev = si_dev;
2804         for (j = 0; j < IPMI_MAX_CHANNELS; j++) {
2805                 intf->channels[j].address = IPMI_BMC_SLAVE_ADDR;
2806                 intf->channels[j].lun = 2;
2807         }
2808         if (slave_addr != 0)
2809                 intf->channels[0].address = slave_addr;
2810         INIT_LIST_HEAD(&intf->users);
2811         intf->handlers = handlers;
2812         intf->send_info = send_info;
2813         spin_lock_init(&intf->seq_lock);
2814         for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) {
2815                 intf->seq_table[j].inuse = 0;
2816                 intf->seq_table[j].seqid = 0;
2817         }
2818         intf->curr_seq = 0;
2819 #ifdef CONFIG_PROC_FS
2820         mutex_init(&intf->proc_entry_lock);
2821 #endif
2822         spin_lock_init(&intf->waiting_rcv_msgs_lock);
2823         INIT_LIST_HEAD(&intf->waiting_rcv_msgs);
2824         tasklet_init(&intf->recv_tasklet,
2825                      smi_recv_tasklet,
2826                      (unsigned long) intf);
2827         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 0);
2828         spin_lock_init(&intf->xmit_msgs_lock);
2829         INIT_LIST_HEAD(&intf->xmit_msgs);
2830         INIT_LIST_HEAD(&intf->hp_xmit_msgs);
2831         spin_lock_init(&intf->events_lock);
2832         atomic_set(&intf->event_waiters, 0);
2833         intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
2834         INIT_LIST_HEAD(&intf->waiting_events);
2835         intf->waiting_events_count = 0;
2836         mutex_init(&intf->cmd_rcvrs_mutex);
2837         spin_lock_init(&intf->maintenance_mode_lock);
2838         INIT_LIST_HEAD(&intf->cmd_rcvrs);
2839         init_waitqueue_head(&intf->waitq);
2840         for (i = 0; i < IPMI_NUM_STATS; i++)
2841                 atomic_set(&intf->stats[i], 0);
2842
2843         intf->proc_dir = NULL;
2844
2845         mutex_lock(&smi_watchers_mutex);
2846         mutex_lock(&ipmi_interfaces_mutex);
2847         /* Look for a hole in the numbers. */
2848         i = 0;
2849         link = &ipmi_interfaces;
2850         list_for_each_entry_rcu(tintf, &ipmi_interfaces, link) {
2851                 if (tintf->intf_num != i) {
2852                         link = &tintf->link;
2853                         break;
2854                 }
2855                 i++;
2856         }
2857         /* Add the new interface in numeric order. */
2858         if (i == 0)
2859                 list_add_rcu(&intf->link, &ipmi_interfaces);
2860         else
2861                 list_add_tail_rcu(&intf->link, link);
2862
2863         rv = handlers->start_processing(send_info, intf);
2864         if (rv)
2865                 goto out;
2866
2867         get_guid(intf);
2868
2869         if ((intf->ipmi_version_major > 1)
2870                         || ((intf->ipmi_version_major == 1)
2871                             && (intf->ipmi_version_minor >= 5))) {
2872                 /*
2873                  * Start scanning the channels to see what is
2874                  * available.
2875                  */
2876                 intf->null_user_handler = channel_handler;
2877                 intf->curr_channel = 0;
2878                 rv = send_channel_info_cmd(intf, 0);
2879                 if (rv) {
2880                         printk(KERN_WARNING PFX
2881                                "Error sending channel information for channel"
2882                                " 0, %d\n", rv);
2883                         goto out;
2884                 }
2885
2886                 /* Wait for the channel info to be read. */
2887                 wait_event(intf->waitq,
2888                            intf->curr_channel >= IPMI_MAX_CHANNELS);
2889                 intf->null_user_handler = NULL;
2890         } else {
2891                 /* Assume a single IPMB channel at zero. */
2892                 intf->channels[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;
2893                 intf->channels[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB;
2894                 intf->curr_channel = IPMI_MAX_CHANNELS;
2895         }
2896
2897         rv = ipmi_bmc_register(intf, i);
2898
2899         if (rv == 0)
2900                 rv = add_proc_entries(intf, i);
2901
2902  out:
2903         if (rv) {
2904                 if (intf->proc_dir)
2905                         remove_proc_entries(intf);
2906                 intf->handlers = NULL;
2907                 list_del_rcu(&intf->link);
2908                 mutex_unlock(&ipmi_interfaces_mutex);
2909                 mutex_unlock(&smi_watchers_mutex);
2910                 synchronize_rcu();
2911                 kref_put(&intf->refcount, intf_free);
2912         } else {
2913                 /*
2914                  * Keep memory order straight for RCU readers.  Make
2915                  * sure everything else is committed to memory before
2916                  * setting intf_num to mark the interface valid.
2917                  */
2918                 smp_wmb();
2919                 intf->intf_num = i;
2920                 mutex_unlock(&ipmi_interfaces_mutex);
2921                 /* After this point the interface is legal to use. */
2922                 call_smi_watchers(i, intf->si_dev);
2923                 mutex_unlock(&smi_watchers_mutex);
2924         }
2925
2926         return rv;
2927 }
2928 EXPORT_SYMBOL(ipmi_register_smi);
2929
2930 static void deliver_smi_err_response(ipmi_smi_t intf,
2931                                      struct ipmi_smi_msg *msg,
2932                                      unsigned char err)
2933 {
2934         int rv;
2935         msg->rsp[0] = msg->data[0] | 4;
2936         msg->rsp[1] = msg->data[1];
2937         msg->rsp[2] = err;
2938         msg->rsp_size = 3;
2939
2940         /* This will never requeue, but it may ask us to free the message. */
2941         rv = handle_one_recv_msg(intf, msg);
2942         if (rv == 0)
2943                 ipmi_free_smi_msg(msg);
2944 }
2945
2946 static void cleanup_smi_msgs(ipmi_smi_t intf)
2947 {
2948         int              i;
2949         struct seq_table *ent;
2950         struct ipmi_smi_msg *msg;
2951         struct list_head *entry;
2952         struct list_head tmplist;
2953
2954         /* Clear out our transmit queues and hold the messages. */
2955         INIT_LIST_HEAD(&tmplist);
2956         list_splice_tail(&intf->hp_xmit_msgs, &tmplist);
2957         list_splice_tail(&intf->xmit_msgs, &tmplist);
2958
2959         /* Current message first, to preserve order */
2960         while (intf->curr_msg && !list_empty(&intf->waiting_rcv_msgs)) {
2961                 /* Wait for the message to clear out. */
2962                 schedule_timeout(1);
2963         }
2964
2965         /* No need for locks, the interface is down. */
2966
2967         /*
2968          * Return errors for all pending messages in queue and in the
2969          * tables waiting for remote responses.
2970          */
2971         while (!list_empty(&tmplist)) {
2972                 entry = tmplist.next;
2973                 list_del(entry);
2974                 msg = list_entry(entry, struct ipmi_smi_msg, link);
2975                 deliver_smi_err_response(intf, msg, IPMI_ERR_UNSPECIFIED);
2976         }
2977
2978         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
2979                 ent = &(intf->seq_table[i]);
2980                 if (!ent->inuse)
2981                         continue;
2982                 deliver_err_response(ent->recv_msg, IPMI_ERR_UNSPECIFIED);
2983         }
2984 }
2985
2986 int ipmi_unregister_smi(ipmi_smi_t intf)
2987 {
2988         struct ipmi_smi_watcher *w;
2989         int intf_num = intf->intf_num;
2990         ipmi_user_t user;
2991
2992         mutex_lock(&smi_watchers_mutex);
2993         mutex_lock(&ipmi_interfaces_mutex);
2994         intf->intf_num = -1;
2995         intf->in_shutdown = true;
2996         list_del_rcu(&intf->link);
2997         mutex_unlock(&ipmi_interfaces_mutex);
2998         synchronize_rcu();
2999
3000         cleanup_smi_msgs(intf);
3001
3002         /* Clean up the effects of users on the lower-level software. */
3003         mutex_lock(&ipmi_interfaces_mutex);
3004         rcu_read_lock();
3005         list_for_each_entry_rcu(user, &intf->users, link) {
3006                 module_put(intf->handlers->owner);
3007                 if (intf->handlers->dec_usecount)
3008                         intf->handlers->dec_usecount(intf->send_info);
3009         }
3010         rcu_read_unlock();
3011         intf->handlers = NULL;
3012         mutex_unlock(&ipmi_interfaces_mutex);
3013
3014         remove_proc_entries(intf);
3015         ipmi_bmc_unregister(intf);
3016
3017         /*
3018          * Call all the watcher interfaces to tell them that
3019          * an interface is gone.
3020          */
3021         list_for_each_entry(w, &smi_watchers, link)
3022                 w->smi_gone(intf_num);
3023         mutex_unlock(&smi_watchers_mutex);
3024
3025         kref_put(&intf->refcount, intf_free);
3026         return 0;
3027 }
3028 EXPORT_SYMBOL(ipmi_unregister_smi);
3029
3030 static int handle_ipmb_get_msg_rsp(ipmi_smi_t          intf,
3031                                    struct ipmi_smi_msg *msg)
3032 {
3033         struct ipmi_ipmb_addr ipmb_addr;
3034         struct ipmi_recv_msg  *recv_msg;
3035
3036         /*
3037          * This is 11, not 10, because the response must contain a
3038          * completion code.
3039          */
3040         if (msg->rsp_size < 11) {
3041                 /* Message not big enough, just ignore it. */
3042                 ipmi_inc_stat(intf, invalid_ipmb_responses);
3043                 return 0;
3044         }
3045
3046         if (msg->rsp[2] != 0) {
3047                 /* An error getting the response, just ignore it. */
3048                 return 0;
3049         }
3050
3051         ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE;
3052         ipmb_addr.slave_addr = msg->rsp[6];
3053         ipmb_addr.channel = msg->rsp[3] & 0x0f;
3054         ipmb_addr.lun = msg->rsp[7] & 3;
3055
3056         /*
3057          * It's a response from a remote entity.  Look up the sequence
3058          * number and handle the response.
3059          */
3060         if (intf_find_seq(intf,
3061                           msg->rsp[7] >> 2,
3062                           msg->rsp[3] & 0x0f,
3063                           msg->rsp[8],
3064                           (msg->rsp[4] >> 2) & (~1),
3065                           (struct ipmi_addr *) &(ipmb_addr),
3066                           &recv_msg)) {
3067                 /*
3068                  * We were unable to find the sequence number,
3069                  * so just nuke the message.
3070                  */
3071                 ipmi_inc_stat(intf, unhandled_ipmb_responses);
3072                 return 0;
3073         }
3074
3075         memcpy(recv_msg->msg_data,
3076                &(msg->rsp[9]),
3077                msg->rsp_size - 9);
3078         /*
3079          * The other fields matched, so no need to set them, except
3080          * for netfn, which needs to be the response that was
3081          * returned, not the request value.
3082          */
3083         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3084         recv_msg->msg.data = recv_msg->msg_data;
3085         recv_msg->msg.data_len = msg->rsp_size - 10;
3086         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3087         ipmi_inc_stat(intf, handled_ipmb_responses);
3088         deliver_response(recv_msg);
3089
3090         return 0;
3091 }
3092
3093 static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
3094                                    struct ipmi_smi_msg *msg)
3095 {
3096         struct cmd_rcvr          *rcvr;
3097         int                      rv = 0;
3098         unsigned char            netfn;
3099         unsigned char            cmd;
3100         unsigned char            chan;
3101         ipmi_user_t              user = NULL;
3102         struct ipmi_ipmb_addr    *ipmb_addr;
3103         struct ipmi_recv_msg     *recv_msg;
3104
3105         if (msg->rsp_size < 10) {
3106                 /* Message not big enough, just ignore it. */
3107                 ipmi_inc_stat(intf, invalid_commands);
3108                 return 0;
3109         }
3110
3111         if (msg->rsp[2] != 0) {
3112                 /* An error getting the response, just ignore it. */
3113                 return 0;
3114         }
3115
3116         netfn = msg->rsp[4] >> 2;
3117         cmd = msg->rsp[8];
3118         chan = msg->rsp[3] & 0xf;
3119
3120         rcu_read_lock();
3121         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3122         if (rcvr) {
3123                 user = rcvr->user;
3124                 kref_get(&user->refcount);
3125         } else
3126                 user = NULL;
3127         rcu_read_unlock();
3128
3129         if (user == NULL) {
3130                 /* We didn't find a user, deliver an error response. */
3131                 ipmi_inc_stat(intf, unhandled_commands);
3132
3133                 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
3134                 msg->data[1] = IPMI_SEND_MSG_CMD;
3135                 msg->data[2] = msg->rsp[3];
3136                 msg->data[3] = msg->rsp[6];
3137                 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3);
3138                 msg->data[5] = ipmb_checksum(&(msg->data[3]), 2);
3139                 msg->data[6] = intf->channels[msg->rsp[3] & 0xf].address;
3140                 /* rqseq/lun */
3141                 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3);
3142                 msg->data[8] = msg->rsp[8]; /* cmd */
3143                 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE;
3144                 msg->data[10] = ipmb_checksum(&(msg->data[6]), 4);
3145                 msg->data_size = 11;
3146
3147 #ifdef DEBUG_MSGING
3148         {
3149                 int m;
3150                 printk("Invalid command:");
3151                 for (m = 0; m < msg->data_size; m++)
3152                         printk(" %2.2x", msg->data[m]);
3153                 printk("\n");
3154         }
3155 #endif
3156                 rcu_read_lock();
3157                 if (!intf->in_shutdown) {
3158                         smi_send(intf, intf->handlers, msg, 0);
3159                         /*
3160                          * We used the message, so return the value
3161                          * that causes it to not be freed or
3162                          * queued.
3163                          */
3164                         rv = -1;
3165                 }
3166                 rcu_read_unlock();
3167         } else {
3168                 /* Deliver the message to the user. */
3169                 ipmi_inc_stat(intf, handled_commands);
3170
3171                 recv_msg = ipmi_alloc_recv_msg();
3172                 if (!recv_msg) {
3173                         /*
3174                          * We couldn't allocate memory for the
3175                          * message, so requeue it for handling
3176                          * later.
3177                          */
3178                         rv = 1;
3179                         kref_put(&user->refcount, free_user);
3180                 } else {
3181                         /* Extract the source address from the data. */
3182                         ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
3183                         ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE;
3184                         ipmb_addr->slave_addr = msg->rsp[6];
3185                         ipmb_addr->lun = msg->rsp[7] & 3;
3186                         ipmb_addr->channel = msg->rsp[3] & 0xf;
3187
3188                         /*
3189                          * Extract the rest of the message information
3190                          * from the IPMB header.
3191                          */
3192                         recv_msg->user = user;
3193                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3194                         recv_msg->msgid = msg->rsp[7] >> 2;
3195                         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3196                         recv_msg->msg.cmd = msg->rsp[8];
3197                         recv_msg->msg.data = recv_msg->msg_data;
3198
3199                         /*
3200                          * We chop off 10, not 9 bytes because the checksum
3201                          * at the end also needs to be removed.
3202                          */
3203                         recv_msg->msg.data_len = msg->rsp_size - 10;
3204                         memcpy(recv_msg->msg_data,
3205                                &(msg->rsp[9]),
3206                                msg->rsp_size - 10);
3207                         deliver_response(recv_msg);
3208                 }
3209         }
3210
3211         return rv;
3212 }
3213
3214 static int handle_lan_get_msg_rsp(ipmi_smi_t          intf,
3215                                   struct ipmi_smi_msg *msg)
3216 {
3217         struct ipmi_lan_addr  lan_addr;
3218         struct ipmi_recv_msg  *recv_msg;
3219
3220
3221         /*
3222          * This is 13, not 12, because the response must contain a
3223          * completion code.
3224          */
3225         if (msg->rsp_size < 13) {
3226                 /* Message not big enough, just ignore it. */
3227                 ipmi_inc_stat(intf, invalid_lan_responses);
3228                 return 0;
3229         }
3230
3231         if (msg->rsp[2] != 0) {
3232                 /* An error getting the response, just ignore it. */
3233                 return 0;
3234         }
3235
3236         lan_addr.addr_type = IPMI_LAN_ADDR_TYPE;
3237         lan_addr.session_handle = msg->rsp[4];
3238         lan_addr.remote_SWID = msg->rsp[8];
3239         lan_addr.local_SWID = msg->rsp[5];
3240         lan_addr.channel = msg->rsp[3] & 0x0f;
3241         lan_addr.privilege = msg->rsp[3] >> 4;
3242         lan_addr.lun = msg->rsp[9] & 3;
3243
3244         /*
3245          * It's a response from a remote entity.  Look up the sequence
3246          * number and handle the response.
3247          */
3248         if (intf_find_seq(intf,
3249                           msg->rsp[9] >> 2,
3250                           msg->rsp[3] & 0x0f,
3251                           msg->rsp[10],
3252                           (msg->rsp[6] >> 2) & (~1),
3253                           (struct ipmi_addr *) &(lan_addr),
3254                           &recv_msg)) {
3255                 /*
3256                  * We were unable to find the sequence number,
3257                  * so just nuke the message.
3258                  */
3259                 ipmi_inc_stat(intf, unhandled_lan_responses);
3260                 return 0;
3261         }
3262
3263         memcpy(recv_msg->msg_data,
3264                &(msg->rsp[11]),
3265                msg->rsp_size - 11);
3266         /*
3267          * The other fields matched, so no need to set them, except
3268          * for netfn, which needs to be the response that was
3269          * returned, not the request value.
3270          */
3271         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3272         recv_msg->msg.data = recv_msg->msg_data;
3273         recv_msg->msg.data_len = msg->rsp_size - 12;
3274         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3275         ipmi_inc_stat(intf, handled_lan_responses);
3276         deliver_response(recv_msg);
3277
3278         return 0;
3279 }
3280
3281 static int handle_lan_get_msg_cmd(ipmi_smi_t          intf,
3282                                   struct ipmi_smi_msg *msg)
3283 {
3284         struct cmd_rcvr          *rcvr;
3285         int                      rv = 0;
3286         unsigned char            netfn;
3287         unsigned char            cmd;
3288         unsigned char            chan;
3289         ipmi_user_t              user = NULL;
3290         struct ipmi_lan_addr     *lan_addr;
3291         struct ipmi_recv_msg     *recv_msg;
3292
3293         if (msg->rsp_size < 12) {
3294                 /* Message not big enough, just ignore it. */
3295                 ipmi_inc_stat(intf, invalid_commands);
3296                 return 0;
3297         }
3298
3299         if (msg->rsp[2] != 0) {
3300                 /* An error getting the response, just ignore it. */
3301                 return 0;
3302         }
3303
3304         netfn = msg->rsp[6] >> 2;
3305         cmd = msg->rsp[10];
3306         chan = msg->rsp[3] & 0xf;
3307
3308         rcu_read_lock();
3309         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3310         if (rcvr) {
3311                 user = rcvr->user;
3312                 kref_get(&user->refcount);
3313         } else
3314                 user = NULL;
3315         rcu_read_unlock();
3316
3317         if (user == NULL) {
3318                 /* We didn't find a user, just give up. */
3319                 ipmi_inc_stat(intf, unhandled_commands);
3320
3321                 /*
3322                  * Don't do anything with these messages, just allow
3323                  * them to be freed.
3324                  */
3325                 rv = 0;
3326         } else {
3327                 /* Deliver the message to the user. */
3328                 ipmi_inc_stat(intf, handled_commands);
3329
3330                 recv_msg = ipmi_alloc_recv_msg();
3331                 if (!recv_msg) {
3332                         /*
3333                          * We couldn't allocate memory for the
3334                          * message, so requeue it for handling later.
3335                          */
3336                         rv = 1;
3337                         kref_put(&user->refcount, free_user);
3338                 } else {
3339                         /* Extract the source address from the data. */
3340                         lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
3341                         lan_addr->addr_type = IPMI_LAN_ADDR_TYPE;
3342                         lan_addr->session_handle = msg->rsp[4];
3343                         lan_addr->remote_SWID = msg->rsp[8];
3344                         lan_addr->local_SWID = msg->rsp[5];
3345                         lan_addr->lun = msg->rsp[9] & 3;
3346                         lan_addr->channel = msg->rsp[3] & 0xf;
3347                         lan_addr->privilege = msg->rsp[3] >> 4;
3348
3349                         /*
3350                          * Extract the rest of the message information
3351                          * from the IPMB header.
3352                          */
3353                         recv_msg->user = user;
3354                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3355                         recv_msg->msgid = msg->rsp[9] >> 2;
3356                         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3357                         recv_msg->msg.cmd = msg->rsp[10];
3358                         recv_msg->msg.data = recv_msg->msg_data;
3359
3360                         /*
3361                          * We chop off 12, not 11 bytes because the checksum
3362                          * at the end also needs to be removed.
3363                          */
3364                         recv_msg->msg.data_len = msg->rsp_size - 12;
3365                         memcpy(recv_msg->msg_data,
3366                                &(msg->rsp[11]),
3367                                msg->rsp_size - 12);
3368                         deliver_response(recv_msg);
3369                 }
3370         }
3371
3372         return rv;
3373 }
3374
3375 /*
3376  * This routine will handle "Get Message" command responses with
3377  * channels that use an OEM Medium. The message format belongs to
3378  * the OEM.  See IPMI 2.0 specification, Chapter 6 and
3379  * Chapter 22, sections 22.6 and 22.24 for more details.
3380  */
3381 static int handle_oem_get_msg_cmd(ipmi_smi_t          intf,
3382                                   struct ipmi_smi_msg *msg)
3383 {
3384         struct cmd_rcvr       *rcvr;
3385         int                   rv = 0;
3386         unsigned char         netfn;
3387         unsigned char         cmd;
3388         unsigned char         chan;
3389         ipmi_user_t           user = NULL;
3390         struct ipmi_system_interface_addr *smi_addr;
3391         struct ipmi_recv_msg  *recv_msg;
3392
3393         /*
3394          * We expect the OEM SW to perform error checking
3395          * so we just do some basic sanity checks
3396          */
3397         if (msg->rsp_size < 4) {
3398                 /* Message not big enough, just ignore it. */
3399                 ipmi_inc_stat(intf, invalid_commands);
3400                 return 0;
3401         }
3402
3403         if (msg->rsp[2] != 0) {
3404                 /* An error getting the response, just ignore it. */
3405                 return 0;
3406         }
3407
3408         /*
3409          * This is an OEM Message so the OEM needs to know how
3410          * handle the message. We do no interpretation.
3411          */
3412         netfn = msg->rsp[0] >> 2;
3413         cmd = msg->rsp[1];
3414         chan = msg->rsp[3] & 0xf;
3415
3416         rcu_read_lock();
3417         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3418         if (rcvr) {
3419                 user = rcvr->user;
3420                 kref_get(&user->refcount);
3421         } else
3422                 user = NULL;
3423         rcu_read_unlock();
3424
3425         if (user == NULL) {
3426                 /* We didn't find a user, just give up. */
3427                 ipmi_inc_stat(intf, unhandled_commands);
3428
3429                 /*
3430                  * Don't do anything with these messages, just allow
3431                  * them to be freed.
3432                  */
3433
3434                 rv = 0;
3435         } else {
3436                 /* Deliver the message to the user. */
3437                 ipmi_inc_stat(intf, handled_commands);
3438
3439                 recv_msg = ipmi_alloc_recv_msg();
3440                 if (!recv_msg) {
3441                         /*
3442                          * We couldn't allocate memory for the
3443                          * message, so requeue it for handling
3444                          * later.
3445                          */
3446                         rv = 1;
3447                         kref_put(&user->refcount, free_user);
3448                 } else {
3449                         /*
3450                          * OEM Messages are expected to be delivered via
3451                          * the system interface to SMS software.  We might
3452                          * need to visit this again depending on OEM
3453                          * requirements
3454                          */
3455                         smi_addr = ((struct ipmi_system_interface_addr *)
3456                                     &(recv_msg->addr));
3457                         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3458                         smi_addr->channel = IPMI_BMC_CHANNEL;
3459                         smi_addr->lun = msg->rsp[0] & 3;
3460
3461                         recv_msg->user = user;
3462                         recv_msg->user_msg_data = NULL;
3463                         recv_msg->recv_type = IPMI_OEM_RECV_TYPE;
3464                         recv_msg->msg.netfn = msg->rsp[0] >> 2;
3465                         recv_msg->msg.cmd = msg->rsp[1];
3466                         recv_msg->msg.data = recv_msg->msg_data;
3467
3468                         /*
3469                          * The message starts at byte 4 which follows the
3470                          * the Channel Byte in the "GET MESSAGE" command
3471                          */
3472                         recv_msg->msg.data_len = msg->rsp_size - 4;
3473                         memcpy(recv_msg->msg_data,
3474                                &(msg->rsp[4]),
3475                                msg->rsp_size - 4);
3476                         deliver_response(recv_msg);
3477                 }
3478         }
3479
3480         return rv;
3481 }
3482
3483 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg,
3484                                      struct ipmi_smi_msg  *msg)
3485 {
3486         struct ipmi_system_interface_addr *smi_addr;
3487
3488         recv_msg->msgid = 0;
3489         smi_addr = (struct ipmi_system_interface_addr *) &(recv_msg->addr);
3490         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3491         smi_addr->channel = IPMI_BMC_CHANNEL;
3492         smi_addr->lun = msg->rsp[0] & 3;
3493         recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE;
3494         recv_msg->msg.netfn = msg->rsp[0] >> 2;
3495         recv_msg->msg.cmd = msg->rsp[1];
3496         memcpy(recv_msg->msg_data, &(msg->rsp[3]), msg->rsp_size - 3);
3497         recv_msg->msg.data = recv_msg->msg_data;
3498         recv_msg->msg.data_len = msg->rsp_size - 3;
3499 }
3500
3501 static int handle_read_event_rsp(ipmi_smi_t          intf,
3502                                  struct ipmi_smi_msg *msg)
3503 {
3504         struct ipmi_recv_msg *recv_msg, *recv_msg2;
3505         struct list_head     msgs;
3506         ipmi_user_t          user;
3507         int                  rv = 0;
3508         int                  deliver_count = 0;
3509         unsigned long        flags;
3510
3511         if (msg->rsp_size < 19) {
3512                 /* Message is too small to be an IPMB event. */
3513                 ipmi_inc_stat(intf, invalid_events);
3514                 return 0;
3515         }
3516
3517         if (msg->rsp[2] != 0) {
3518                 /* An error getting the event, just ignore it. */
3519                 return 0;
3520         }
3521
3522         INIT_LIST_HEAD(&msgs);
3523
3524         spin_lock_irqsave(&intf->events_lock, flags);
3525
3526         ipmi_inc_stat(intf, events);
3527
3528         /*
3529          * Allocate and fill in one message for every user that is
3530          * getting events.
3531          */
3532         rcu_read_lock();
3533         list_for_each_entry_rcu(user, &intf->users, link) {
3534                 if (!user->gets_events)
3535                         continue;
3536
3537                 recv_msg = ipmi_alloc_recv_msg();
3538                 if (!recv_msg) {
3539                         rcu_read_unlock();
3540                         list_for_each_entry_safe(recv_msg, recv_msg2, &msgs,
3541                                                  link) {
3542                                 list_del(&recv_msg->link);
3543                                 ipmi_free_recv_msg(recv_msg);
3544                         }
3545                         /*
3546                          * We couldn't allocate memory for the
3547                          * message, so requeue it for handling
3548                          * later.
3549                          */
3550                         rv = 1;
3551                         goto out;
3552                 }
3553
3554                 deliver_count++;
3555
3556                 copy_event_into_recv_msg(recv_msg, msg);
3557                 recv_msg->user = user;
3558                 kref_get(&user->refcount);
3559                 list_add_tail(&(recv_msg->link), &msgs);
3560         }
3561         rcu_read_unlock();
3562
3563         if (deliver_count) {
3564                 /* Now deliver all the messages. */
3565                 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
3566                         list_del(&recv_msg->link);
3567                         deliver_response(recv_msg);
3568                 }
3569         } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) {
3570                 /*
3571                  * No one to receive the message, put it in queue if there's
3572                  * not already too many things in the queue.
3573                  */
3574                 recv_msg = ipmi_alloc_recv_msg();
3575                 if (!recv_msg) {
3576                         /*
3577                          * We couldn't allocate memory for the
3578                          * message, so requeue it for handling
3579                          * later.
3580                          */
3581                         rv = 1;
3582                         goto out;
3583                 }
3584
3585                 copy_event_into_recv_msg(recv_msg, msg);
3586                 list_add_tail(&(recv_msg->link), &(intf->waiting_events));
3587                 intf->waiting_events_count++;
3588         } else if (!intf->event_msg_printed) {
3589                 /*
3590                  * There's too many things in the queue, discard this
3591                  * message.
3592                  */
3593                 printk(KERN_WARNING PFX "Event queue full, discarding"
3594                        " incoming events\n");
3595                 intf->event_msg_printed = 1;
3596         }
3597
3598  out:
3599         spin_unlock_irqrestore(&(intf->events_lock), flags);
3600
3601         return rv;
3602 }
3603
3604 static int handle_bmc_rsp(ipmi_smi_t          intf,
3605                           struct ipmi_smi_msg *msg)
3606 {
3607         struct ipmi_recv_msg *recv_msg;
3608         struct ipmi_user     *user;
3609
3610         recv_msg = (struct ipmi_recv_msg *) msg->user_data;
3611         if (recv_msg == NULL) {
3612                 printk(KERN_WARNING
3613                        "IPMI message received with no owner. This\n"
3614                        "could be because of a malformed message, or\n"
3615                        "because of a hardware error.  Contact your\n"
3616                        "hardware vender for assistance\n");
3617                 return 0;
3618         }
3619
3620         user = recv_msg->user;
3621         /* Make sure the user still exists. */
3622         if (user && !user->valid) {
3623                 /* The user for the message went away, so give up. */
3624                 ipmi_inc_stat(intf, unhandled_local_responses);
3625                 ipmi_free_recv_msg(recv_msg);
3626         } else {
3627                 struct ipmi_system_interface_addr *smi_addr;
3628
3629                 ipmi_inc_stat(intf, handled_local_responses);
3630                 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3631                 recv_msg->msgid = msg->msgid;
3632                 smi_addr = ((struct ipmi_system_interface_addr *)
3633                             &(recv_msg->addr));
3634                 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3635                 smi_addr->channel = IPMI_BMC_CHANNEL;
3636                 smi_addr->lun = msg->rsp[0] & 3;
3637                 recv_msg->msg.netfn = msg->rsp[0] >> 2;
3638                 recv_msg->msg.cmd = msg->rsp[1];
3639                 memcpy(recv_msg->msg_data,
3640                        &(msg->rsp[2]),
3641                        msg->rsp_size - 2);
3642                 recv_msg->msg.data = recv_msg->msg_data;
3643                 recv_msg->msg.data_len = msg->rsp_size - 2;
3644                 deliver_response(recv_msg);
3645         }
3646
3647         return 0;
3648 }
3649
3650 /*
3651  * Handle a received message.  Return 1 if the message should be requeued,
3652  * 0 if the message should be freed, or -1 if the message should not
3653  * be freed or requeued.
3654  */
3655 static int handle_one_recv_msg(ipmi_smi_t          intf,
3656                                struct ipmi_smi_msg *msg)
3657 {
3658         int requeue;
3659         int chan;
3660
3661 #ifdef DEBUG_MSGING
3662         int m;
3663         printk("Recv:");
3664         for (m = 0; m < msg->rsp_size; m++)
3665                 printk(" %2.2x", msg->rsp[m]);
3666         printk("\n");
3667 #endif
3668         if (msg->rsp_size < 2) {
3669                 /* Message is too small to be correct. */
3670                 printk(KERN_WARNING PFX "BMC returned to small a message"
3671                        " for netfn %x cmd %x, got %d bytes\n",
3672                        (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size);
3673
3674                 /* Generate an error response for the message. */
3675                 msg->rsp[0] = msg->data[0] | (1 << 2);
3676                 msg->rsp[1] = msg->data[1];
3677                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3678                 msg->rsp_size = 3;
3679         } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1))
3680                    || (msg->rsp[1] != msg->data[1])) {
3681                 /*
3682                  * The NetFN and Command in the response is not even
3683                  * marginally correct.
3684                  */
3685                 printk(KERN_WARNING PFX "BMC returned incorrect response,"
3686                        " expected netfn %x cmd %x, got netfn %x cmd %x\n",
3687                        (msg->data[0] >> 2) | 1, msg->data[1],
3688                        msg->rsp[0] >> 2, msg->rsp[1]);
3689
3690                 /* Generate an error response for the message. */
3691                 msg->rsp[0] = msg->data[0] | (1 << 2);
3692                 msg->rsp[1] = msg->data[1];
3693                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3694                 msg->rsp_size = 3;
3695         }
3696
3697         if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3698             && (msg->rsp[1] == IPMI_SEND_MSG_CMD)
3699             && (msg->user_data != NULL)) {
3700                 /*
3701                  * It's a response to a response we sent.  For this we
3702                  * deliver a send message response to the user.
3703                  */
3704                 struct ipmi_recv_msg     *recv_msg = msg->user_data;
3705
3706                 requeue = 0;
3707                 if (msg->rsp_size < 2)
3708                         /* Message is too small to be correct. */
3709                         goto out;
3710
3711                 chan = msg->data[2] & 0x0f;
3712                 if (chan >= IPMI_MAX_CHANNELS)
3713                         /* Invalid channel number */
3714                         goto out;
3715
3716                 if (!recv_msg)
3717                         goto out;
3718
3719                 /* Make sure the user still exists. */
3720                 if (!recv_msg->user || !recv_msg->user->valid)
3721                         goto out;
3722
3723                 recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE;
3724                 recv_msg->msg.data = recv_msg->msg_data;
3725                 recv_msg->msg.data_len = 1;
3726                 recv_msg->msg_data[0] = msg->rsp[2];
3727                 deliver_response(recv_msg);
3728         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3729                    && (msg->rsp[1] == IPMI_GET_MSG_CMD)) {
3730                 /* It's from the receive queue. */
3731                 chan = msg->rsp[3] & 0xf;
3732                 if (chan >= IPMI_MAX_CHANNELS) {
3733                         /* Invalid channel number */
3734                         requeue = 0;
3735                         goto out;
3736                 }
3737
3738                 /*
3739                  * We need to make sure the channels have been initialized.
3740                  * The channel_handler routine will set the "curr_channel"
3741                  * equal to or greater than IPMI_MAX_CHANNELS when all the
3742                  * channels for this interface have been initialized.
3743                  */
3744                 if (intf->curr_channel < IPMI_MAX_CHANNELS) {
3745                         requeue = 0; /* Throw the message away */
3746                         goto out;
3747                 }
3748
3749                 switch (intf->channels[chan].medium) {
3750                 case IPMI_CHANNEL_MEDIUM_IPMB:
3751                         if (msg->rsp[4] & 0x04) {
3752                                 /*
3753                                  * It's a response, so find the
3754                                  * requesting message and send it up.
3755                                  */
3756                                 requeue = handle_ipmb_get_msg_rsp(intf, msg);
3757                         } else {
3758                                 /*
3759                                  * It's a command to the SMS from some other
3760                                  * entity.  Handle that.
3761                                  */
3762                                 requeue = handle_ipmb_get_msg_cmd(intf, msg);
3763                         }
3764                         break;
3765
3766                 case IPMI_CHANNEL_MEDIUM_8023LAN:
3767                 case IPMI_CHANNEL_MEDIUM_ASYNC:
3768                         if (msg->rsp[6] & 0x04) {
3769                                 /*
3770                                  * It's a response, so find the
3771                                  * requesting message and send it up.
3772                                  */
3773                                 requeue = handle_lan_get_msg_rsp(intf, msg);
3774                         } else {
3775                                 /*
3776                                  * It's a command to the SMS from some other
3777                                  * entity.  Handle that.
3778                                  */
3779                                 requeue = handle_lan_get_msg_cmd(intf, msg);
3780                         }
3781                         break;
3782
3783                 default:
3784                         /* Check for OEM Channels.  Clients had better
3785                            register for these commands. */
3786                         if ((intf->channels[chan].medium
3787                              >= IPMI_CHANNEL_MEDIUM_OEM_MIN)
3788                             && (intf->channels[chan].medium
3789                                 <= IPMI_CHANNEL_MEDIUM_OEM_MAX)) {
3790                                 requeue = handle_oem_get_msg_cmd(intf, msg);
3791                         } else {
3792                                 /*
3793                                  * We don't handle the channel type, so just
3794                                  * free the message.
3795                                  */
3796                                 requeue = 0;
3797                         }
3798                 }
3799
3800         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3801                    && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD)) {
3802                 /* It's an asynchronous event. */
3803                 requeue = handle_read_event_rsp(intf, msg);
3804         } else {
3805                 /* It's a response from the local BMC. */
3806                 requeue = handle_bmc_rsp(intf, msg);
3807         }
3808
3809  out:
3810         return requeue;
3811 }
3812
3813 /*
3814  * If there are messages in the queue or pretimeouts, handle them.
3815  */
3816 static void handle_new_recv_msgs(ipmi_smi_t intf)
3817 {
3818         struct ipmi_smi_msg  *smi_msg;
3819         unsigned long        flags = 0;
3820         int                  rv;
3821         int                  run_to_completion = intf->run_to_completion;
3822
3823         /* See if any waiting messages need to be processed. */
3824         if (!run_to_completion)
3825                 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
3826         while (!list_empty(&intf->waiting_rcv_msgs)) {
3827                 smi_msg = list_entry(intf->waiting_rcv_msgs.next,
3828                                      struct ipmi_smi_msg, link);
3829                 list_del(&smi_msg->link);
3830                 if (!run_to_completion)
3831                         spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
3832                                                flags);
3833                 rv = handle_one_recv_msg(intf, smi_msg);
3834                 if (!run_to_completion)
3835                         spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
3836                 if (rv > 0) {
3837                         /*
3838                          * To preserve message order, quit if we
3839                          * can't handle a message.  Add the message
3840                          * back at the head, this is safe because this
3841                          * tasklet is the only thing that pulls the
3842                          * messages.
3843                          */
3844                         list_add(&smi_msg->link, &intf->waiting_rcv_msgs);
3845                         break;
3846                 } else {
3847                         if (rv == 0)
3848                                 /* Message handled */
3849                                 ipmi_free_smi_msg(smi_msg);
3850                         /* If rv < 0, fatal error, del but don't free. */
3851                 }
3852         }
3853         if (!run_to_completion)
3854                 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, flags);
3855
3856         /*
3857          * If the pretimout count is non-zero, decrement one from it and
3858          * deliver pretimeouts to all the users.
3859          */
3860         if (atomic_add_unless(&intf->watchdog_pretimeouts_to_deliver, -1, 0)) {
3861                 ipmi_user_t user;
3862
3863                 rcu_read_lock();
3864                 list_for_each_entry_rcu(user, &intf->users, link) {
3865                         if (user->handler->ipmi_watchdog_pretimeout)
3866                                 user->handler->ipmi_watchdog_pretimeout(
3867                                         user->handler_data);
3868                 }
3869                 rcu_read_unlock();
3870         }
3871 }
3872
3873 static void smi_recv_tasklet(unsigned long val)
3874 {
3875         unsigned long flags = 0; /* keep us warning-free. */
3876         ipmi_smi_t intf = (ipmi_smi_t) val;
3877         int run_to_completion = intf->run_to_completion;
3878         struct ipmi_smi_msg *newmsg = NULL;
3879
3880         /*
3881          * Start the next message if available.
3882          *
3883          * Do this here, not in the actual receiver, because we may deadlock
3884          * because the lower layer is allowed to hold locks while calling
3885          * message delivery.
3886          */
3887
3888         rcu_read_lock();
3889
3890         if (!run_to_completion)
3891                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
3892         if (intf->curr_msg == NULL && !intf->in_shutdown) {
3893                 struct list_head *entry = NULL;
3894
3895                 /* Pick the high priority queue first. */
3896                 if (!list_empty(&intf->hp_xmit_msgs))
3897                         entry = intf->hp_xmit_msgs.next;
3898                 else if (!list_empty(&intf->xmit_msgs))
3899                         entry = intf->xmit_msgs.next;
3900
3901                 if (entry) {
3902                         list_del(entry);
3903                         newmsg = list_entry(entry, struct ipmi_smi_msg, link);
3904                         intf->curr_msg = newmsg;
3905                 }
3906         }
3907         if (!run_to_completion)
3908                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
3909         if (newmsg)
3910                 intf->handlers->sender(intf->send_info, newmsg);
3911
3912         rcu_read_unlock();
3913
3914         handle_new_recv_msgs(intf);
3915 }
3916
3917 /* Handle a new message from the lower layer. */
3918 void ipmi_smi_msg_received(ipmi_smi_t          intf,
3919                            struct ipmi_smi_msg *msg)
3920 {
3921         unsigned long flags = 0; /* keep us warning-free. */
3922         int run_to_completion = intf->run_to_completion;
3923
3924         if ((msg->data_size >= 2)
3925             && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
3926             && (msg->data[1] == IPMI_SEND_MSG_CMD)
3927             && (msg->user_data == NULL)) {
3928
3929                 if (intf->in_shutdown)
3930                         goto free_msg;
3931
3932                 /*
3933                  * This is the local response to a command send, start
3934                  * the timer for these.  The user_data will not be
3935                  * NULL if this is a response send, and we will let
3936                  * response sends just go through.
3937                  */
3938
3939                 /*
3940                  * Check for errors, if we get certain errors (ones
3941                  * that mean basically we can try again later), we
3942                  * ignore them and start the timer.  Otherwise we
3943                  * report the error immediately.
3944                  */
3945                 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
3946                     && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
3947                     && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
3948                     && (msg->rsp[2] != IPMI_BUS_ERR)
3949                     && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
3950                         int chan = msg->rsp[3] & 0xf;
3951
3952                         /* Got an error sending the message, handle it. */
3953                         if (chan >= IPMI_MAX_CHANNELS)
3954                                 ; /* This shouldn't happen */
3955                         else if ((intf->channels[chan].medium
3956                                   == IPMI_CHANNEL_MEDIUM_8023LAN)
3957                                  || (intf->channels[chan].medium
3958                                      == IPMI_CHANNEL_MEDIUM_ASYNC))
3959                                 ipmi_inc_stat(intf, sent_lan_command_errs);
3960                         else
3961                                 ipmi_inc_stat(intf, sent_ipmb_command_errs);
3962                         intf_err_seq(intf, msg->msgid, msg->rsp[2]);
3963                 } else
3964                         /* The message was sent, start the timer. */
3965                         intf_start_seq_timer(intf, msg->msgid);
3966
3967 free_msg:
3968                 ipmi_free_smi_msg(msg);
3969         } else {
3970                 /*
3971                  * To preserve message order, we keep a queue and deliver from
3972                  * a tasklet.
3973                  */
3974                 if (!run_to_completion)
3975                         spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
3976                 list_add_tail(&msg->link, &intf->waiting_rcv_msgs);
3977                 if (!run_to_completion)
3978                         spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
3979                                                flags);
3980         }
3981
3982         if (!run_to_completion)
3983                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
3984         /*
3985          * We can get an asynchronous event or receive message in addition
3986          * to commands we send.
3987          */
3988         if (msg == intf->curr_msg)
3989                 intf->curr_msg = NULL;
3990         if (!run_to_completion)
3991                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
3992
3993         if (run_to_completion)
3994                 smi_recv_tasklet((unsigned long) intf);
3995         else
3996                 tasklet_schedule(&intf->recv_tasklet);
3997 }
3998 EXPORT_SYMBOL(ipmi_smi_msg_received);
3999
4000 void ipmi_smi_watchdog_pretimeout(ipmi_smi_t intf)
4001 {
4002         if (intf->in_shutdown)
4003                 return;
4004
4005         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 1);
4006         tasklet_schedule(&intf->recv_tasklet);
4007 }
4008 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout);
4009
4010 static struct ipmi_smi_msg *
4011 smi_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
4012                   unsigned char seq, long seqid)
4013 {
4014         struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg();
4015         if (!smi_msg)
4016                 /*
4017                  * If we can't allocate the message, then just return, we
4018                  * get 4 retries, so this should be ok.
4019                  */
4020                 return NULL;
4021
4022         memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len);
4023         smi_msg->data_size = recv_msg->msg.data_len;
4024         smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);
4025
4026 #ifdef DEBUG_MSGING
4027         {
4028                 int m;
4029                 printk("Resend: ");
4030                 for (m = 0; m < smi_msg->data_size; m++)
4031                         printk(" %2.2x", smi_msg->data[m]);
4032                 printk("\n");
4033         }
4034 #endif
4035         return smi_msg;
4036 }
4037
4038 static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
4039                               struct list_head *timeouts,
4040                               unsigned long timeout_period,
4041                               int slot, unsigned long *flags,
4042                               unsigned int *waiting_msgs)
4043 {
4044         struct ipmi_recv_msg     *msg;
4045         const struct ipmi_smi_handlers *handlers;
4046
4047         if (intf->in_shutdown)
4048                 return;
4049
4050         if (!ent->inuse)
4051                 return;
4052
4053         if (timeout_period < ent->timeout) {
4054                 ent->timeout -= timeout_period;
4055                 (*waiting_msgs)++;
4056                 return;
4057         }
4058
4059         if (ent->retries_left == 0) {
4060                 /* The message has used all its retries. */
4061                 ent->inuse = 0;
4062                 msg = ent->recv_msg;
4063                 list_add_tail(&msg->link, timeouts);
4064                 if (ent->broadcast)
4065                         ipmi_inc_stat(intf, timed_out_ipmb_broadcasts);
4066                 else if (is_lan_addr(&ent->recv_msg->addr))
4067                         ipmi_inc_stat(intf, timed_out_lan_commands);
4068                 else
4069                         ipmi_inc_stat(intf, timed_out_ipmb_commands);
4070         } else {
4071                 struct ipmi_smi_msg *smi_msg;
4072                 /* More retries, send again. */
4073
4074                 (*waiting_msgs)++;
4075
4076                 /*
4077                  * Start with the max timer, set to normal timer after
4078                  * the message is sent.
4079                  */
4080                 ent->timeout = MAX_MSG_TIMEOUT;
4081                 ent->retries_left--;
4082                 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot,
4083                                             ent->seqid);
4084                 if (!smi_msg) {
4085                         if (is_lan_addr(&ent->recv_msg->addr))
4086                                 ipmi_inc_stat(intf,
4087                                               dropped_rexmit_lan_commands);
4088                         else
4089                                 ipmi_inc_stat(intf,
4090                                               dropped_rexmit_ipmb_commands);
4091                         return;
4092                 }
4093
4094                 spin_unlock_irqrestore(&intf->seq_lock, *flags);
4095
4096                 /*
4097                  * Send the new message.  We send with a zero
4098                  * priority.  It timed out, I doubt time is that
4099                  * critical now, and high priority messages are really
4100                  * only for messages to the local MC, which don't get
4101                  * resent.
4102                  */
4103                 handlers = intf->handlers;
4104                 if (handlers) {
4105                         if (is_lan_addr(&ent->recv_msg->addr))
4106                                 ipmi_inc_stat(intf,
4107                                               retransmitted_lan_commands);
4108                         else
4109                                 ipmi_inc_stat(intf,
4110                                               retransmitted_ipmb_commands);
4111
4112                         smi_send(intf, handlers, smi_msg, 0);
4113                 } else
4114                         ipmi_free_smi_msg(smi_msg);
4115
4116                 spin_lock_irqsave(&intf->seq_lock, *flags);
4117         }
4118 }
4119
4120 static unsigned int ipmi_timeout_handler(ipmi_smi_t intf,
4121                                          unsigned long timeout_period)
4122 {
4123         struct list_head     timeouts;
4124         struct ipmi_recv_msg *msg, *msg2;
4125         unsigned long        flags;
4126         int                  i;
4127         unsigned int         waiting_msgs = 0;
4128
4129         /*
4130          * Go through the seq table and find any messages that
4131          * have timed out, putting them in the timeouts
4132          * list.
4133          */
4134         INIT_LIST_HEAD(&timeouts);
4135         spin_lock_irqsave(&intf->seq_lock, flags);
4136         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
4137                 check_msg_timeout(intf, &(intf->seq_table[i]),
4138                                   &timeouts, timeout_period, i,
4139                                   &flags, &waiting_msgs);
4140         spin_unlock_irqrestore(&intf->seq_lock, flags);
4141
4142         list_for_each_entry_safe(msg, msg2, &timeouts, link)
4143                 deliver_err_response(msg, IPMI_TIMEOUT_COMPLETION_CODE);
4144
4145         /*
4146          * Maintenance mode handling.  Check the timeout
4147          * optimistically before we claim the lock.  It may
4148          * mean a timeout gets missed occasionally, but that
4149          * only means the timeout gets extended by one period
4150          * in that case.  No big deal, and it avoids the lock
4151          * most of the time.
4152          */
4153         if (intf->auto_maintenance_timeout > 0) {
4154                 spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
4155                 if (intf->auto_maintenance_timeout > 0) {
4156                         intf->auto_maintenance_timeout
4157                                 -= timeout_period;
4158                         if (!intf->maintenance_mode
4159                             && (intf->auto_maintenance_timeout <= 0)) {
4160                                 intf->maintenance_mode_enable = false;
4161                                 maintenance_mode_update(intf);
4162                         }
4163                 }
4164                 spin_unlock_irqrestore(&intf->maintenance_mode_lock,
4165                                        flags);
4166         }
4167
4168         tasklet_schedule(&intf->recv_tasklet);
4169
4170         return waiting_msgs;
4171 }
4172
4173 static void ipmi_request_event(ipmi_smi_t intf)
4174 {
4175         /* No event requests when in maintenance mode. */
4176         if (intf->maintenance_mode_enable)
4177                 return;
4178
4179         if (!intf->in_shutdown)
4180                 intf->handlers->request_events(intf->send_info);
4181 }
4182
4183 static struct timer_list ipmi_timer;
4184
4185 static atomic_t stop_operation;
4186
4187 static void ipmi_timeout(unsigned long data)
4188 {
4189         ipmi_smi_t intf;
4190         int nt = 0;
4191
4192         if (atomic_read(&stop_operation))
4193                 return;
4194
4195         rcu_read_lock();
4196         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4197                 int lnt = 0;
4198
4199                 if (atomic_read(&intf->event_waiters)) {
4200                         intf->ticks_to_req_ev--;
4201                         if (intf->ticks_to_req_ev == 0) {
4202                                 ipmi_request_event(intf);
4203                                 intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
4204                         }
4205                         lnt++;
4206                 }
4207
4208                 lnt += ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME);
4209
4210                 lnt = !!lnt;
4211                 if (lnt != intf->last_needs_timer &&
4212                                         intf->handlers->set_need_watch)
4213                         intf->handlers->set_need_watch(intf->send_info, lnt);
4214                 intf->last_needs_timer = lnt;
4215
4216                 nt += lnt;
4217         }
4218         rcu_read_unlock();
4219
4220         if (nt)
4221                 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4222 }
4223
4224 static void need_waiter(ipmi_smi_t intf)
4225 {
4226         /* Racy, but worst case we start the timer twice. */
4227         if (!timer_pending(&ipmi_timer))
4228                 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4229 }
4230
4231 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0);
4232 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);
4233
4234 static void free_smi_msg(struct ipmi_smi_msg *msg)
4235 {
4236         atomic_dec(&smi_msg_inuse_count);
4237         kfree(msg);
4238 }
4239
4240 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)
4241 {
4242         struct ipmi_smi_msg *rv;
4243         rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC);
4244         if (rv) {
4245                 rv->done = free_smi_msg;
4246                 rv->user_data = NULL;
4247                 atomic_inc(&smi_msg_inuse_count);
4248         }
4249         return rv;
4250 }
4251 EXPORT_SYMBOL(ipmi_alloc_smi_msg);
4252
4253 static void free_recv_msg(struct ipmi_recv_msg *msg)
4254 {
4255         atomic_dec(&recv_msg_inuse_count);
4256         kfree(msg);
4257 }
4258
4259 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
4260 {
4261         struct ipmi_recv_msg *rv;
4262
4263         rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC);
4264         if (rv) {
4265                 rv->user = NULL;
4266                 rv->done = free_recv_msg;
4267                 atomic_inc(&recv_msg_inuse_count);
4268         }
4269         return rv;
4270 }
4271
4272 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg)
4273 {
4274         if (msg->user)
4275                 kref_put(&msg->user->refcount, free_user);
4276         msg->done(msg);
4277 }
4278 EXPORT_SYMBOL(ipmi_free_recv_msg);
4279
4280 #ifdef CONFIG_IPMI_PANIC_EVENT
4281
4282 static atomic_t panic_done_count = ATOMIC_INIT(0);
4283
4284 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg)
4285 {
4286         atomic_dec(&panic_done_count);
4287 }
4288
4289 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg)
4290 {
4291         atomic_dec(&panic_done_count);
4292 }
4293
4294 /*
4295  * Inside a panic, send a message and wait for a response.
4296  */
4297 static void ipmi_panic_request_and_wait(ipmi_smi_t           intf,
4298                                         struct ipmi_addr     *addr,
4299                                         struct kernel_ipmi_msg *msg)
4300 {
4301         struct ipmi_smi_msg  smi_msg;
4302         struct ipmi_recv_msg recv_msg;
4303         int rv;
4304
4305         smi_msg.done = dummy_smi_done_handler;
4306         recv_msg.done = dummy_recv_done_handler;
4307         atomic_add(2, &panic_done_count);
4308         rv = i_ipmi_request(NULL,
4309                             intf,
4310                             addr,
4311                             0,
4312                             msg,
4313                             intf,
4314                             &smi_msg,
4315                             &recv_msg,
4316                             0,
4317                             intf->channels[0].address,
4318                             intf->channels[0].lun,
4319                             0, 1); /* Don't retry, and don't wait. */
4320         if (rv)
4321                 atomic_sub(2, &panic_done_count);
4322         else if (intf->handlers->flush_messages)
4323                 intf->handlers->flush_messages(intf->send_info);
4324
4325         while (atomic_read(&panic_done_count) != 0)
4326                 ipmi_poll(intf);
4327 }
4328
4329 #ifdef CONFIG_IPMI_PANIC_STRING
4330 static void event_receiver_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
4331 {
4332         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
4333             && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE)
4334             && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD)
4335             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
4336                 /* A get event receiver command, save it. */
4337                 intf->event_receiver = msg->msg.data[1];
4338                 intf->event_receiver_lun = msg->msg.data[2] & 0x3;
4339         }
4340 }
4341
4342 static void device_id_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
4343 {
4344         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
4345             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
4346             && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD)
4347             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
4348                 /*
4349                  * A get device id command, save if we are an event
4350                  * receiver or generator.
4351                  */
4352                 intf->local_sel_device = (msg->msg.data[6] >> 2) & 1;
4353                 intf->local_event_generator = (msg->msg.data[6] >> 5) & 1;
4354         }
4355 }
4356 #endif
4357
4358 static void send_panic_events(char *str)
4359 {
4360         struct kernel_ipmi_msg            msg;
4361         ipmi_smi_t                        intf;
4362         unsigned char                     data[16];
4363         struct ipmi_system_interface_addr *si;
4364         struct ipmi_addr                  addr;
4365
4366         si = (struct ipmi_system_interface_addr *) &addr;
4367         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4368         si->channel = IPMI_BMC_CHANNEL;
4369         si->lun = 0;
4370
4371         /* Fill in an event telling that we have failed. */
4372         msg.netfn = 0x04; /* Sensor or Event. */
4373         msg.cmd = 2; /* Platform event command. */
4374         msg.data = data;
4375         msg.data_len = 8;
4376         data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */
4377         data[1] = 0x03; /* This is for IPMI 1.0. */
4378         data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */
4379         data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */
4380         data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */
4381
4382         /*
4383          * Put a few breadcrumbs in.  Hopefully later we can add more things
4384          * to make the panic events more useful.
4385          */
4386         if (str) {
4387                 data[3] = str[0];
4388                 data[6] = str[1];
4389                 data[7] = str[2];
4390         }
4391
4392         /* For every registered interface, send the event. */
4393         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4394                 if (!intf->handlers)
4395                         /* Interface is not ready. */
4396                         continue;
4397
4398                 /* Send the event announcing the panic. */
4399                 ipmi_panic_request_and_wait(intf, &addr, &msg);
4400         }
4401
4402 #ifdef CONFIG_IPMI_PANIC_STRING
4403         /*
4404          * On every interface, dump a bunch of OEM event holding the
4405          * string.
4406          */
4407         if (!str)
4408                 return;
4409
4410         /* For every registered interface, send the event. */
4411         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4412                 char                  *p = str;
4413                 struct ipmi_ipmb_addr *ipmb;
4414                 int                   j;
4415
4416                 if (intf->intf_num == -1)
4417                         /* Interface was not ready yet. */
4418                         continue;
4419
4420                 /*
4421                  * intf_num is used as an marker to tell if the
4422                  * interface is valid.  Thus we need a read barrier to
4423                  * make sure data fetched before checking intf_num
4424                  * won't be used.
4425                  */
4426                 smp_rmb();
4427
4428                 /*
4429                  * First job here is to figure out where to send the
4430                  * OEM events.  There's no way in IPMI to send OEM
4431                  * events using an event send command, so we have to
4432                  * find the SEL to put them in and stick them in
4433                  * there.
4434                  */
4435
4436                 /* Get capabilities from the get device id. */
4437                 intf->local_sel_device = 0;
4438                 intf->local_event_generator = 0;
4439                 intf->event_receiver = 0;
4440
4441                 /* Request the device info from the local MC. */
4442                 msg.netfn = IPMI_NETFN_APP_REQUEST;
4443                 msg.cmd = IPMI_GET_DEVICE_ID_CMD;
4444                 msg.data = NULL;
4445                 msg.data_len = 0;
4446                 intf->null_user_handler = device_id_fetcher;
4447                 ipmi_panic_request_and_wait(intf, &addr, &msg);
4448
4449                 if (intf->local_event_generator) {
4450                         /* Request the event receiver from the local MC. */
4451                         msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST;
4452                         msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD;
4453                         msg.data = NULL;
4454                         msg.data_len = 0;
4455                         intf->null_user_handler = event_receiver_fetcher;
4456                         ipmi_panic_request_and_wait(intf, &addr, &msg);
4457                 }
4458                 intf->null_user_handler = NULL;
4459
4460                 /*
4461                  * Validate the event receiver.  The low bit must not
4462                  * be 1 (it must be a valid IPMB address), it cannot
4463                  * be zero, and it must not be my address.
4464                  */
4465                 if (((intf->event_receiver & 1) == 0)
4466                     && (intf->event_receiver != 0)
4467                     && (intf->event_receiver != intf->channels[0].address)) {
4468                         /*
4469                          * The event receiver is valid, send an IPMB
4470                          * message.
4471                          */
4472                         ipmb = (struct ipmi_ipmb_addr *) &addr;
4473                         ipmb->addr_type = IPMI_IPMB_ADDR_TYPE;
4474                         ipmb->channel = 0; /* FIXME - is this right? */
4475                         ipmb->lun = intf->event_receiver_lun;
4476                         ipmb->slave_addr = intf->event_receiver;
4477                 } else if (intf->local_sel_device) {
4478                         /*
4479                          * The event receiver was not valid (or was
4480                          * me), but I am an SEL device, just dump it
4481                          * in my SEL.
4482                          */
4483                         si = (struct ipmi_system_interface_addr *) &addr;
4484                         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4485                         si->channel = IPMI_BMC_CHANNEL;
4486                         si->lun = 0;
4487                 } else
4488                         continue; /* No where to send the event. */
4489
4490                 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */
4491                 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD;
4492                 msg.data = data;
4493                 msg.data_len = 16;
4494
4495                 j = 0;
4496                 while (*p) {
4497                         int size = strlen(p);
4498
4499                         if (size > 11)
4500                                 size = 11;
4501                         data[0] = 0;
4502                         data[1] = 0;
4503                         data[2] = 0xf0; /* OEM event without timestamp. */
4504                         data[3] = intf->channels[0].address;
4505                         data[4] = j++; /* sequence # */
4506                         /*
4507                          * Always give 11 bytes, so strncpy will fill
4508                          * it with zeroes for me.
4509                          */
4510                         strncpy(data+5, p, 11);
4511                         p += size;
4512
4513                         ipmi_panic_request_and_wait(intf, &addr, &msg);
4514                 }
4515         }
4516 #endif /* CONFIG_IPMI_PANIC_STRING */
4517 }
4518 #endif /* CONFIG_IPMI_PANIC_EVENT */
4519
4520 static int has_panicked;
4521
4522 static int panic_event(struct notifier_block *this,
4523                        unsigned long         event,
4524                        void                  *ptr)
4525 {
4526         ipmi_smi_t intf;
4527
4528         if (has_panicked)
4529                 return NOTIFY_DONE;
4530         has_panicked = 1;
4531
4532         /* For every registered interface, set it to run to completion. */
4533         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4534                 if (!intf->handlers)
4535                         /* Interface is not ready. */
4536                         continue;
4537
4538                 /*
4539                  * If we were interrupted while locking xmit_msgs_lock or
4540                  * waiting_rcv_msgs_lock, the corresponding list may be
4541                  * corrupted.  In this case, drop items on the list for
4542                  * the safety.
4543                  */
4544                 if (!spin_trylock(&intf->xmit_msgs_lock)) {
4545                         INIT_LIST_HEAD(&intf->xmit_msgs);
4546                         INIT_LIST_HEAD(&intf->hp_xmit_msgs);
4547                 } else
4548                         spin_unlock(&intf->xmit_msgs_lock);
4549
4550                 if (!spin_trylock(&intf->waiting_rcv_msgs_lock))
4551                         INIT_LIST_HEAD(&intf->waiting_rcv_msgs);
4552                 else
4553                         spin_unlock(&intf->waiting_rcv_msgs_lock);
4554
4555                 intf->run_to_completion = 1;
4556                 intf->handlers->set_run_to_completion(intf->send_info, 1);
4557         }
4558
4559 #ifdef CONFIG_IPMI_PANIC_EVENT
4560         send_panic_events(ptr);
4561 #endif
4562
4563         return NOTIFY_DONE;
4564 }
4565
4566 static struct notifier_block panic_block = {
4567         .notifier_call  = panic_event,
4568         .next           = NULL,
4569         .priority       = 200   /* priority: INT_MAX >= x >= 0 */
4570 };
4571
4572 static int ipmi_init_msghandler(void)
4573 {
4574         int rv;
4575
4576         if (initialized)
4577                 return 0;
4578
4579         rv = driver_register(&ipmidriver.driver);
4580         if (rv) {
4581                 printk(KERN_ERR PFX "Could not register IPMI driver\n");
4582                 return rv;
4583         }
4584
4585         printk(KERN_INFO "ipmi message handler version "
4586                IPMI_DRIVER_VERSION "\n");
4587
4588 #ifdef CONFIG_PROC_FS
4589         proc_ipmi_root = proc_mkdir("ipmi", NULL);
4590         if (!proc_ipmi_root) {
4591             printk(KERN_ERR PFX "Unable to create IPMI proc dir");
4592             driver_unregister(&ipmidriver.driver);
4593             return -ENOMEM;
4594         }
4595
4596 #endif /* CONFIG_PROC_FS */
4597
4598         setup_timer(&ipmi_timer, ipmi_timeout, 0);
4599         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4600
4601         atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
4602
4603         initialized = 1;
4604
4605         return 0;
4606 }
4607
4608 static int __init ipmi_init_msghandler_mod(void)
4609 {
4610         ipmi_init_msghandler();
4611         return 0;
4612 }
4613
4614 static void __exit cleanup_ipmi(void)
4615 {
4616         int count;
4617
4618         if (!initialized)
4619                 return;
4620
4621         atomic_notifier_chain_unregister(&panic_notifier_list, &panic_block);
4622
4623         /*
4624          * This can't be called if any interfaces exist, so no worry
4625          * about shutting down the interfaces.
4626          */
4627
4628         /*
4629          * Tell the timer to stop, then wait for it to stop.  This
4630          * avoids problems with race conditions removing the timer
4631          * here.
4632          */
4633         atomic_inc(&stop_operation);
4634         del_timer_sync(&ipmi_timer);
4635
4636 #ifdef CONFIG_PROC_FS
4637         proc_remove(proc_ipmi_root);
4638 #endif /* CONFIG_PROC_FS */
4639
4640         driver_unregister(&ipmidriver.driver);
4641
4642         initialized = 0;
4643
4644         /* Check for buffer leaks. */
4645         count = atomic_read(&smi_msg_inuse_count);
4646         if (count != 0)
4647                 printk(KERN_WARNING PFX "SMI message count %d at exit\n",
4648                        count);
4649         count = atomic_read(&recv_msg_inuse_count);
4650         if (count != 0)
4651                 printk(KERN_WARNING PFX "recv message count %d at exit\n",
4652                        count);
4653 }
4654 module_exit(cleanup_ipmi);
4655
4656 module_init(ipmi_init_msghandler_mod);
4657 MODULE_LICENSE("GPL");
4658 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
4659 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI"
4660                    " interface.");
4661 MODULE_VERSION(IPMI_DRIVER_VERSION);
4662 MODULE_SOFTDEP("post: ipmi_devintf");