Pileus Git - ~andy/linux/blob - drivers/char/ipmi/ipmi_msghandler.c

   1 /*
   2  * ipmi_msghandler.c
   3  *
   4  * Incoming and outgoing message routing for an IPMI interface.
   5  *
   6  * Author: MontaVista Software, Inc.
   7  *         Corey Minyard <minyard@mvista.com>
   8  *         source@mvista.com
   9  *
  10  * Copyright 2002 MontaVista Software Inc.
  11  *
  12  *  This program is free software; you can redistribute it and/or modify it
  13  *  under the terms of the GNU General Public License as published by the
  14  *  Free Software Foundation; either version 2 of the License, or (at your
  15  *  option) any later version.
  16  *
  17  *
  18  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  19  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  20  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  *  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  23  *  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
  24  *  OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  25  *  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
  26  *  TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  27  *  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  *
  29  *  You should have received a copy of the GNU General Public License along
  30  *  with this program; if not, write to the Free Software Foundation, Inc.,
  31  *  675 Mass Ave, Cambridge, MA 02139, USA.
  32  */
  33
  34 #include <linux/module.h>
  35 #include <linux/errno.h>
  36 #include <asm/system.h>
  37 #include <linux/poll.h>
  38 #include <linux/sched.h>
  39 #include <linux/seq_file.h>
  40 #include <linux/spinlock.h>
  41 #include <linux/mutex.h>
  42 #include <linux/slab.h>
  43 #include <linux/ipmi.h>
  44 #include <linux/ipmi_smi.h>
  45 #include <linux/notifier.h>
  46 #include <linux/init.h>
  47 #include <linux/proc_fs.h>
  48 #include <linux/rcupdate.h>
  49 #include <linux/interrupt.h>
  50
  51 #define PFX "IPMI message handler: "
  52
  53 #define IPMI_DRIVER_VERSION "39.2"
  54
  55 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);
  56 static int ipmi_init_msghandler(void);
  57 static void smi_recv_tasklet(unsigned long);
  58 static void handle_new_recv_msgs(ipmi_smi_t intf);
  59
  60 static int initialized;
  61
  62 #ifdef CONFIG_PROC_FS
  63 static struct proc_dir_entry *proc_ipmi_root;
  64 #endif /* CONFIG_PROC_FS */
  65
  66 /* Remain in auto-maintenance mode for this amount of time (in ms). */
  67 #define IPMI_MAINTENANCE_MODE_TIMEOUT 30000
  68
  69 #define MAX_EVENTS_IN_QUEUE     25
  70
  71 /*
  72  * Don't let a message sit in a queue forever, always time it with at lest
  73  * the max message timer.  This is in milliseconds.
  74  */
  75 #define MAX_MSG_TIMEOUT         60000
  76
  77 /*
  78  * The main "user" data structure.
  79  */
  80 struct ipmi_user {
  81         struct list_head link;
  82
  83         /* Set to "0" when the user is destroyed. */
  84         int valid;
  85
  86         struct kref refcount;
  87
  88         /* The upper layer that handles receive messages. */
  89         struct ipmi_user_hndl *handler;
  90         void             *handler_data;
  91
  92         /* The interface this user is bound to. */
  93         ipmi_smi_t intf;
  94
  95         /* Does this interface receive IPMI events? */
  96         int gets_events;
  97 };
  98
  99 struct cmd_rcvr {
 100         struct list_head link;
 101
 102         ipmi_user_t   user;
 103         unsigned char netfn;
 104         unsigned char cmd;
 105         unsigned int  chans;
 106
 107         /*
 108          * This is used to form a linked lised during mass deletion.
 109          * Since this is in an RCU list, we cannot use the link above
 110          * or change any data until the RCU period completes.  So we
 111          * use this next variable during mass deletion so we can have
 112          * a list and don't have to wait and restart the search on
 113          * every individual deletion of a command.
 114          */
 115         struct cmd_rcvr *next;
 116 };
 117
 118 struct seq_table {
 119         unsigned int         inuse : 1;
 120         unsigned int         broadcast : 1;
 121
 122         unsigned long        timeout;
 123         unsigned long        orig_timeout;
 124         unsigned int         retries_left;
 125
 126         /*
 127          * To verify on an incoming send message response that this is
 128          * the message that the response is for, we keep a sequence id
 129          * and increment it every time we send a message.
 130          */
 131         long                 seqid;
 132
 133         /*
 134          * This is held so we can properly respond to the message on a
 135          * timeout, and it is used to hold the temporary data for
 136          * retransmission, too.
 137          */
 138         struct ipmi_recv_msg *recv_msg;
 139 };
 140
 141 /*
 142  * Store the information in a msgid (long) to allow us to find a
 143  * sequence table entry from the msgid.
 144  */
 145 #define STORE_SEQ_IN_MSGID(seq, seqid) (((seq&0xff)<<26) | (seqid&0x3ffffff))
 146
 147 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \
 148         do {                                                            \
 149                 seq = ((msgid >> 26) & 0x3f);                           \
 150                 seqid = (msgid & 0x3fffff);                             \
 151         } while (0)
 152
 153 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3fffff)
 154
 155 struct ipmi_channel {
 156         unsigned char medium;
 157         unsigned char protocol;
 158
 159         /*
 160          * My slave address.  This is initialized to IPMI_BMC_SLAVE_ADDR,
 161          * but may be changed by the user.
 162          */
 163         unsigned char address;
 164
 165         /*
 166          * My LUN.  This should generally stay the SMS LUN, but just in
 167          * case...
 168          */
 169         unsigned char lun;
 170 };
 171
 172 #ifdef CONFIG_PROC_FS
 173 struct ipmi_proc_entry {
 174         char                   *name;
 175         struct ipmi_proc_entry *next;
 176 };
 177 #endif
 178
 179 struct bmc_device {
 180         struct platform_device *dev;
 181         struct ipmi_device_id  id;
 182         unsigned char          guid[16];
 183         int                    guid_set;
 184
 185         struct kref            refcount;
 186
 187         /* bmc device attributes */
 188         struct device_attribute device_id_attr;
 189         struct device_attribute provides_dev_sdrs_attr;
 190         struct device_attribute revision_attr;
 191         struct device_attribute firmware_rev_attr;
 192         struct device_attribute version_attr;
 193         struct device_attribute add_dev_support_attr;
 194         struct device_attribute manufacturer_id_attr;
 195         struct device_attribute product_id_attr;
 196         struct device_attribute guid_attr;
 197         struct device_attribute aux_firmware_rev_attr;
 198 };
 199
 200 /*
 201  * Various statistics for IPMI, these index stats[] in the ipmi_smi
 202  * structure.
 203  */
 204 enum ipmi_stat_indexes {
 205         /* Commands we got from the user that were invalid. */
 206         IPMI_STAT_sent_invalid_commands = 0,
 207
 208         /* Commands we sent to the MC. */
 209         IPMI_STAT_sent_local_commands,
 210
 211         /* Responses from the MC that were delivered to a user. */
 212         IPMI_STAT_handled_local_responses,
 213
 214         /* Responses from the MC that were not delivered to a user. */
 215         IPMI_STAT_unhandled_local_responses,
 216
 217         /* Commands we sent out to the IPMB bus. */
 218         IPMI_STAT_sent_ipmb_commands,
 219
 220         /* Commands sent on the IPMB that had errors on the SEND CMD */
 221         IPMI_STAT_sent_ipmb_command_errs,
 222
 223         /* Each retransmit increments this count. */
 224         IPMI_STAT_retransmitted_ipmb_commands,
 225
 226         /*
 227          * When a message times out (runs out of retransmits) this is
 228          * incremented.
 229          */
 230         IPMI_STAT_timed_out_ipmb_commands,
 231
 232         /*
 233          * This is like above, but for broadcasts.  Broadcasts are
 234          * *not* included in the above count (they are expected to
 235          * time out).
 236          */
 237         IPMI_STAT_timed_out_ipmb_broadcasts,
 238
 239         /* Responses I have sent to the IPMB bus. */
 240         IPMI_STAT_sent_ipmb_responses,
 241
 242         /* The response was delivered to the user. */
 243         IPMI_STAT_handled_ipmb_responses,
 244
 245         /* The response had invalid data in it. */
 246         IPMI_STAT_invalid_ipmb_responses,
 247
 248         /* The response didn't have anyone waiting for it. */
 249         IPMI_STAT_unhandled_ipmb_responses,
 250
 251         /* Commands we sent out to the IPMB bus. */
 252         IPMI_STAT_sent_lan_commands,
 253
 254         /* Commands sent on the IPMB that had errors on the SEND CMD */
 255         IPMI_STAT_sent_lan_command_errs,
 256
 257         /* Each retransmit increments this count. */
 258         IPMI_STAT_retransmitted_lan_commands,
 259
 260         /*
 261          * When a message times out (runs out of retransmits) this is
 262          * incremented.
 263          */
 264         IPMI_STAT_timed_out_lan_commands,
 265
 266         /* Responses I have sent to the IPMB bus. */
 267         IPMI_STAT_sent_lan_responses,
 268
 269         /* The response was delivered to the user. */
 270         IPMI_STAT_handled_lan_responses,
 271
 272         /* The response had invalid data in it. */
 273         IPMI_STAT_invalid_lan_responses,
 274
 275         /* The response didn't have anyone waiting for it. */
 276         IPMI_STAT_unhandled_lan_responses,
 277
 278         /* The command was delivered to the user. */
 279         IPMI_STAT_handled_commands,
 280
 281         /* The command had invalid data in it. */
 282         IPMI_STAT_invalid_commands,
 283
 284         /* The command didn't have anyone waiting for it. */
 285         IPMI_STAT_unhandled_commands,
 286
 287         /* Invalid data in an event. */
 288         IPMI_STAT_invalid_events,
 289
 290         /* Events that were received with the proper format. */
 291         IPMI_STAT_events,
 292
 293         /* Retransmissions on IPMB that failed. */
 294         IPMI_STAT_dropped_rexmit_ipmb_commands,
 295
 296         /* Retransmissions on LAN that failed. */
 297         IPMI_STAT_dropped_rexmit_lan_commands,
 298
 299         /* This *must* remain last, add new values above this. */
 300         IPMI_NUM_STATS
 301 };
 302
 303
 304 #define IPMI_IPMB_NUM_SEQ       64
 305 #define IPMI_MAX_CHANNELS       16
 306 struct ipmi_smi {
 307         /* What interface number are we? */
 308         int intf_num;
 309
 310         struct kref refcount;
 311
 312         /* Used for a list of interfaces. */
 313         struct list_head link;
 314
 315         /*
 316          * The list of upper layers that are using me.  seq_lock
 317          * protects this.
 318          */
 319         struct list_head users;
 320
 321         /* Information to supply to users. */
 322         unsigned char ipmi_version_major;
 323         unsigned char ipmi_version_minor;
 324
 325         /* Used for wake ups at startup. */
 326         wait_queue_head_t waitq;
 327
 328         struct bmc_device *bmc;
 329         char *my_dev_name;
 330         char *sysfs_name;
 331
 332         /*
 333          * This is the lower-layer's sender routine.  Note that you
 334          * must either be holding the ipmi_interfaces_mutex or be in
 335          * an umpreemptible region to use this.  You must fetch the
 336          * value into a local variable and make sure it is not NULL.
 337          */
 338         struct ipmi_smi_handlers *handlers;
 339         void                     *send_info;
 340
 341 #ifdef CONFIG_PROC_FS
 342         /* A list of proc entries for this interface. */
 343         struct mutex           proc_entry_lock;
 344         struct ipmi_proc_entry *proc_entries;
 345 #endif
 346
 347         /* Driver-model device for the system interface. */
 348         struct device          *si_dev;
 349
 350         /*
 351          * A table of sequence numbers for this interface.  We use the
 352          * sequence numbers for IPMB messages that go out of the
 353          * interface to match them up with their responses.  A routine
 354          * is called periodically to time the items in this list.
 355          */
 356         spinlock_t       seq_lock;
 357         struct seq_table seq_table[IPMI_IPMB_NUM_SEQ];
 358         int curr_seq;
 359
 360         /*
 361          * Messages queued for delivery.  If delivery fails (out of memory
 362          * for instance), They will stay in here to be processed later in a
 363          * periodic timer interrupt.  The tasklet is for handling received
 364          * messages directly from the handler.
 365          */
 366         spinlock_t       waiting_msgs_lock;
 367         struct list_head waiting_msgs;
 368         atomic_t         watchdog_pretimeouts_to_deliver;
 369         struct tasklet_struct recv_tasklet;
 370
 371         /*
 372          * The list of command receivers that are registered for commands
 373          * on this interface.
 374          */
 375         struct mutex     cmd_rcvrs_mutex;
 376         struct list_head cmd_rcvrs;
 377
 378         /*
 379          * Events that were queues because no one was there to receive
 380          * them.
 381          */
 382         spinlock_t       events_lock; /* For dealing with event stuff. */
 383         struct list_head waiting_events;
 384         unsigned int     waiting_events_count; /* How many events in queue? */
 385         char             delivering_events;
 386         char             event_msg_printed;
 387
 388         /*
 389          * The event receiver for my BMC, only really used at panic
 390          * shutdown as a place to store this.
 391          */
 392         unsigned char event_receiver;
 393         unsigned char event_receiver_lun;
 394         unsigned char local_sel_device;
 395         unsigned char local_event_generator;
 396
 397         /* For handling of maintenance mode. */
 398         int maintenance_mode;
 399         int maintenance_mode_enable;
 400         int auto_maintenance_timeout;
 401         spinlock_t maintenance_mode_lock; /* Used in a timer... */
 402
 403         /*
 404          * A cheap hack, if this is non-null and a message to an
 405          * interface comes in with a NULL user, call this routine with
 406          * it.  Note that the message will still be freed by the
 407          * caller.  This only works on the system interface.
 408          */
 409         void (*null_user_handler)(ipmi_smi_t intf, struct ipmi_recv_msg *msg);
 410
 411         /*
 412          * When we are scanning the channels for an SMI, this will
 413          * tell which channel we are scanning.
 414          */
 415         int curr_channel;
 416
 417         /* Channel information */
 418         struct ipmi_channel channels[IPMI_MAX_CHANNELS];
 419
 420         /* Proc FS stuff. */
 421         struct proc_dir_entry *proc_dir;
 422         char                  proc_dir_name[10];
 423
 424         atomic_t stats[IPMI_NUM_STATS];
 425
 426         /*
 427          * run_to_completion duplicate of smb_info, smi_info
 428          * and ipmi_serial_info structures. Used to decrease numbers of
 429          * parameters passed by "low" level IPMI code.
 430          */
 431         int run_to_completion;
 432 };
 433 #define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev)
 434
 435 /**
 436  * The driver model view of the IPMI messaging driver.
 437  */
 438 static struct platform_driver ipmidriver = {
 439         .driver = {
 440                 .name = "ipmi",
 441                 .bus = &platform_bus_type
 442         }
 443 };
 444 static DEFINE_MUTEX(ipmidriver_mutex);
 445
 446 static LIST_HEAD(ipmi_interfaces);
 447 static DEFINE_MUTEX(ipmi_interfaces_mutex);
 448
 449 /*
 450  * List of watchers that want to know when smi's are added and deleted.
 451  */
 452 static LIST_HEAD(smi_watchers);
 453 static DEFINE_MUTEX(smi_watchers_mutex);
 454
 455
 456 #define ipmi_inc_stat(intf, stat) \
 457         atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
 458 #define ipmi_get_stat(intf, stat) \
 459         ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
 460
 461 static int is_lan_addr(struct ipmi_addr *addr)
 462 {
 463         return addr->addr_type == IPMI_LAN_ADDR_TYPE;
 464 }
 465
 466 static int is_ipmb_addr(struct ipmi_addr *addr)
 467 {
 468         return addr->addr_type == IPMI_IPMB_ADDR_TYPE;
 469 }
 470
 471 static int is_ipmb_bcast_addr(struct ipmi_addr *addr)
 472 {
 473         return addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE;
 474 }
 475
 476 static void free_recv_msg_list(struct list_head *q)
 477 {
 478         struct ipmi_recv_msg *msg, *msg2;
 479
 480         list_for_each_entry_safe(msg, msg2, q, link) {
 481                 list_del(&msg->link);
 482                 ipmi_free_recv_msg(msg);
 483         }
 484 }
 485
 486 static void free_smi_msg_list(struct list_head *q)
 487 {
 488         struct ipmi_smi_msg *msg, *msg2;
 489
 490         list_for_each_entry_safe(msg, msg2, q, link) {
 491                 list_del(&msg->link);
 492                 ipmi_free_smi_msg(msg);
 493         }
 494 }
 495
 496 static void clean_up_interface_data(ipmi_smi_t intf)
 497 {
 498         int              i;
 499         struct cmd_rcvr  *rcvr, *rcvr2;
 500         struct list_head list;
 501
 502         tasklet_kill(&intf->recv_tasklet);
 503
 504         free_smi_msg_list(&intf->waiting_msgs);
 505         free_recv_msg_list(&intf->waiting_events);
 506
 507         /*
 508          * Wholesale remove all the entries from the list in the
 509          * interface and wait for RCU to know that none are in use.
 510          */
 511         mutex_lock(&intf->cmd_rcvrs_mutex);
 512         INIT_LIST_HEAD(&list);
 513         list_splice_init_rcu(&intf->cmd_rcvrs, &list, synchronize_rcu);
 514         mutex_unlock(&intf->cmd_rcvrs_mutex);
 515
 516         list_for_each_entry_safe(rcvr, rcvr2, &list, link)
 517                 kfree(rcvr);
 518
 519         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
 520                 if ((intf->seq_table[i].inuse)
 521                                         && (intf->seq_table[i].recv_msg))
 522                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
 523         }
 524 }
 525
 526 static void intf_free(struct kref *ref)
 527 {
 528         ipmi_smi_t intf = container_of(ref, struct ipmi_smi, refcount);
 529
 530         clean_up_interface_data(intf);
 531         kfree(intf);
 532 }
 533
 534 struct watcher_entry {
 535         int              intf_num;
 536         ipmi_smi_t       intf;
 537         struct list_head link;
 538 };
 539
 540 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 541 {
 542         ipmi_smi_t intf;
 543         LIST_HEAD(to_deliver);
 544         struct watcher_entry *e, *e2;
 545
 546         mutex_lock(&smi_watchers_mutex);
 547
 548         mutex_lock(&ipmi_interfaces_mutex);
 549
 550         /* Build a list of things to deliver. */
 551         list_for_each_entry(intf, &ipmi_interfaces, link) {
 552                 if (intf->intf_num == -1)
 553                         continue;
 554                 e = kmalloc(sizeof(*e), GFP_KERNEL);
 555                 if (!e)
 556                         goto out_err;
 557                 kref_get(&intf->refcount);
 558                 e->intf = intf;
 559                 e->intf_num = intf->intf_num;
 560                 list_add_tail(&e->link, &to_deliver);
 561         }
 562
 563         /* We will succeed, so add it to the list. */
 564         list_add(&watcher->link, &smi_watchers);
 565
 566         mutex_unlock(&ipmi_interfaces_mutex);
 567
 568         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 569                 list_del(&e->link);
 570                 watcher->new_smi(e->intf_num, e->intf->si_dev);
 571                 kref_put(&e->intf->refcount, intf_free);
 572                 kfree(e);
 573         }
 574
 575         mutex_unlock(&smi_watchers_mutex);
 576
 577         return 0;
 578
 579  out_err:
 580         mutex_unlock(&ipmi_interfaces_mutex);
 581         mutex_unlock(&smi_watchers_mutex);
 582         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 583                 list_del(&e->link);
 584                 kref_put(&e->intf->refcount, intf_free);
 585                 kfree(e);
 586         }
 587         return -ENOMEM;
 588 }
 589 EXPORT_SYMBOL(ipmi_smi_watcher_register);
 590
 591 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher)
 592 {
 593         mutex_lock(&smi_watchers_mutex);
 594         list_del(&(watcher->link));
 595         mutex_unlock(&smi_watchers_mutex);
 596         return 0;
 597 }
 598 EXPORT_SYMBOL(ipmi_smi_watcher_unregister);
 599
 600 /*
 601  * Must be called with smi_watchers_mutex held.
 602  */
 603 static void
 604 call_smi_watchers(int i, struct device *dev)
 605 {
 606         struct ipmi_smi_watcher *w;
 607
 608         list_for_each_entry(w, &smi_watchers, link) {
 609                 if (try_module_get(w->owner)) {
 610                         w->new_smi(i, dev);
 611                         module_put(w->owner);
 612                 }
 613         }
 614 }
 615
 616 static int
 617 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)
 618 {
 619         if (addr1->addr_type != addr2->addr_type)
 620                 return 0;
 621
 622         if (addr1->channel != addr2->channel)
 623                 return 0;
 624
 625         if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 626                 struct ipmi_system_interface_addr *smi_addr1
 627                     = (struct ipmi_system_interface_addr *) addr1;
 628                 struct ipmi_system_interface_addr *smi_addr2
 629                     = (struct ipmi_system_interface_addr *) addr2;
 630                 return (smi_addr1->lun == smi_addr2->lun);
 631         }
 632
 633         if (is_ipmb_addr(addr1) || is_ipmb_bcast_addr(addr1)) {
 634                 struct ipmi_ipmb_addr *ipmb_addr1
 635                     = (struct ipmi_ipmb_addr *) addr1;
 636                 struct ipmi_ipmb_addr *ipmb_addr2
 637                     = (struct ipmi_ipmb_addr *) addr2;
 638
 639                 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr)
 640                         && (ipmb_addr1->lun == ipmb_addr2->lun));
 641         }
 642
 643         if (is_lan_addr(addr1)) {
 644                 struct ipmi_lan_addr *lan_addr1
 645                         = (struct ipmi_lan_addr *) addr1;
 646                 struct ipmi_lan_addr *lan_addr2
 647                     = (struct ipmi_lan_addr *) addr2;
 648
 649                 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID)
 650                         && (lan_addr1->local_SWID == lan_addr2->local_SWID)
 651                         && (lan_addr1->session_handle
 652                             == lan_addr2->session_handle)
 653                         && (lan_addr1->lun == lan_addr2->lun));
 654         }
 655
 656         return 1;
 657 }
 658
 659 int ipmi_validate_addr(struct ipmi_addr *addr, int len)
 660 {
 661         if (len < sizeof(struct ipmi_system_interface_addr))
 662                 return -EINVAL;
 663
 664         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 665                 if (addr->channel != IPMI_BMC_CHANNEL)
 666                         return -EINVAL;
 667                 return 0;
 668         }
 669
 670         if ((addr->channel == IPMI_BMC_CHANNEL)
 671             || (addr->channel >= IPMI_MAX_CHANNELS)
 672             || (addr->channel < 0))
 673                 return -EINVAL;
 674
 675         if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
 676                 if (len < sizeof(struct ipmi_ipmb_addr))
 677                         return -EINVAL;
 678                 return 0;
 679         }
 680
 681         if (is_lan_addr(addr)) {
 682                 if (len < sizeof(struct ipmi_lan_addr))
 683                         return -EINVAL;
 684                 return 0;
 685         }
 686
 687         return -EINVAL;
 688 }
 689 EXPORT_SYMBOL(ipmi_validate_addr);
 690
 691 unsigned int ipmi_addr_length(int addr_type)
 692 {
 693         if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
 694                 return sizeof(struct ipmi_system_interface_addr);
 695
 696         if ((addr_type == IPMI_IPMB_ADDR_TYPE)
 697                         || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 698                 return sizeof(struct ipmi_ipmb_addr);
 699
 700         if (addr_type == IPMI_LAN_ADDR_TYPE)
 701                 return sizeof(struct ipmi_lan_addr);
 702
 703         return 0;
 704 }
 705 EXPORT_SYMBOL(ipmi_addr_length);
 706
 707 static void deliver_response(struct ipmi_recv_msg *msg)
 708 {
 709         if (!msg->user) {
 710                 ipmi_smi_t    intf = msg->user_msg_data;
 711
 712                 /* Special handling for NULL users. */
 713                 if (intf->null_user_handler) {
 714                         intf->null_user_handler(intf, msg);
 715                         ipmi_inc_stat(intf, handled_local_responses);
 716                 } else {
 717                         /* No handler, so give up. */
 718                         ipmi_inc_stat(intf, unhandled_local_responses);
 719                 }
 720                 ipmi_free_recv_msg(msg);
 721         } else {
 722                 ipmi_user_t user = msg->user;
 723                 user->handler->ipmi_recv_hndl(msg, user->handler_data);
 724         }
 725 }
 726
 727 static void
 728 deliver_err_response(struct ipmi_recv_msg *msg, int err)
 729 {
 730         msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
 731         msg->msg_data[0] = err;
 732         msg->msg.netfn |= 1; /* Convert to a response. */
 733         msg->msg.data_len = 1;
 734         msg->msg.data = msg->msg_data;
 735         deliver_response(msg);
 736 }
 737
 738 /*
 739  * Find the next sequence number not being used and add the given
 740  * message with the given timeout to the sequence table.  This must be
 741  * called with the interface's seq_lock held.
 742  */
 743 static int intf_next_seq(ipmi_smi_t           intf,
 744                          struct ipmi_recv_msg *recv_msg,
 745                          unsigned long        timeout,
 746                          int                  retries,
 747                          int                  broadcast,
 748                          unsigned char        *seq,
 749                          long                 *seqid)
 750 {
 751         int          rv = 0;
 752         unsigned int i;
 753
 754         for (i = intf->curr_seq; (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;
 755                                         i = (i+1)%IPMI_IPMB_NUM_SEQ) {
 756                 if (!intf->seq_table[i].inuse)
 757                         break;
 758         }
 759
 760         if (!intf->seq_table[i].inuse) {
 761                 intf->seq_table[i].recv_msg = recv_msg;
 762
 763                 /*
 764                  * Start with the maximum timeout, when the send response
 765                  * comes in we will start the real timer.
 766                  */
 767                 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT;
 768                 intf->seq_table[i].orig_timeout = timeout;
 769                 intf->seq_table[i].retries_left = retries;
 770                 intf->seq_table[i].broadcast = broadcast;
 771                 intf->seq_table[i].inuse = 1;
 772                 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid);
 773                 *seq = i;
 774                 *seqid = intf->seq_table[i].seqid;
 775                 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
 776         } else {
 777                 rv = -EAGAIN;
 778         }
 779
 780         return rv;
 781 }
 782
 783 /*
 784  * Return the receive message for the given sequence number and
 785  * release the sequence number so it can be reused.  Some other data
 786  * is passed in to be sure the message matches up correctly (to help
 787  * guard against message coming in after their timeout and the
 788  * sequence number being reused).
 789  */
 790 static int intf_find_seq(ipmi_smi_t           intf,
 791                          unsigned char        seq,
 792                          short                channel,
 793                          unsigned char        cmd,
 794                          unsigned char        netfn,
 795                          struct ipmi_addr     *addr,
 796                          struct ipmi_recv_msg **recv_msg)
 797 {
 798         int           rv = -ENODEV;
 799         unsigned long flags;
 800
 801         if (seq >= IPMI_IPMB_NUM_SEQ)
 802                 return -EINVAL;
 803
 804         spin_lock_irqsave(&(intf->seq_lock), flags);
 805         if (intf->seq_table[seq].inuse) {
 806                 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg;
 807
 808                 if ((msg->addr.channel == channel) && (msg->msg.cmd == cmd)
 809                                 && (msg->msg.netfn == netfn)
 810                                 && (ipmi_addr_equal(addr, &(msg->addr)))) {
 811                         *recv_msg = msg;
 812                         intf->seq_table[seq].inuse = 0;
 813                         rv = 0;
 814                 }
 815         }
 816         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 817
 818         return rv;
 819 }
 820
 821
 822 /* Start the timer for a specific sequence table entry. */
 823 static int intf_start_seq_timer(ipmi_smi_t intf,
 824                                 long       msgid)
 825 {
 826         int           rv = -ENODEV;
 827         unsigned long flags;
 828         unsigned char seq;
 829         unsigned long seqid;
 830
 831
 832         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 833
 834         spin_lock_irqsave(&(intf->seq_lock), flags);
 835         /*
 836          * We do this verification because the user can be deleted
 837          * while a message is outstanding.
 838          */
 839         if ((intf->seq_table[seq].inuse)
 840                                 && (intf->seq_table[seq].seqid == seqid)) {
 841                 struct seq_table *ent = &(intf->seq_table[seq]);
 842                 ent->timeout = ent->orig_timeout;
 843                 rv = 0;
 844         }
 845         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 846
 847         return rv;
 848 }
 849
 850 /* Got an error for the send message for a specific sequence number. */
 851 static int intf_err_seq(ipmi_smi_t   intf,
 852                         long         msgid,
 853                         unsigned int err)
 854 {
 855         int                  rv = -ENODEV;
 856         unsigned long        flags;
 857         unsigned char        seq;
 858         unsigned long        seqid;
 859         struct ipmi_recv_msg *msg = NULL;
 860
 861
 862         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 863
 864         spin_lock_irqsave(&(intf->seq_lock), flags);
 865         /*
 866          * We do this verification because the user can be deleted
 867          * while a message is outstanding.
 868          */
 869         if ((intf->seq_table[seq].inuse)
 870                                 && (intf->seq_table[seq].seqid == seqid)) {
 871                 struct seq_table *ent = &(intf->seq_table[seq]);
 872
 873                 ent->inuse = 0;
 874                 msg = ent->recv_msg;
 875                 rv = 0;
 876         }
 877         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 878
 879         if (msg)
 880                 deliver_err_response(msg, err);
 881
 882         return rv;
 883 }
 884
 885
 886 int ipmi_create_user(unsigned int          if_num,
 887                      struct ipmi_user_hndl *handler,
 888                      void                  *handler_data,
 889                      ipmi_user_t           *user)
 890 {
 891         unsigned long flags;
 892         ipmi_user_t   new_user;
 893         int           rv = 0;
 894         ipmi_smi_t    intf;
 895
 896         /*
 897          * There is no module usecount here, because it's not
 898          * required.  Since this can only be used by and called from
 899          * other modules, they will implicitly use this module, and
 900          * thus this can't be removed unless the other modules are
 901          * removed.
 902          */
 903
 904         if (handler == NULL)
 905                 return -EINVAL;
 906
 907         /*
 908          * Make sure the driver is actually initialized, this handles
 909          * problems with initialization order.
 910          */
 911         if (!initialized) {
 912                 rv = ipmi_init_msghandler();
 913                 if (rv)
 914                         return rv;
 915
 916                 /*
 917                  * The init code doesn't return an error if it was turned
 918                  * off, but it won't initialize.  Check that.
 919                  */
 920                 if (!initialized)
 921                         return -ENODEV;
 922         }
 923
 924         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
 925         if (!new_user)
 926                 return -ENOMEM;
 927
 928         mutex_lock(&ipmi_interfaces_mutex);
 929         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
 930                 if (intf->intf_num == if_num)
 931                         goto found;
 932         }
 933         /* Not found, return an error */
 934         rv = -EINVAL;
 935         goto out_kfree;
 936
 937  found:
 938         /* Note that each existing user holds a refcount to the interface. */
 939         kref_get(&intf->refcount);
 940
 941         kref_init(&new_user->refcount);
 942         new_user->handler = handler;
 943         new_user->handler_data = handler_data;
 944         new_user->intf = intf;
 945         new_user->gets_events = 0;
 946
 947         if (!try_module_get(intf->handlers->owner)) {
 948                 rv = -ENODEV;
 949                 goto out_kref;
 950         }
 951
 952         if (intf->handlers->inc_usecount) {
 953                 rv = intf->handlers->inc_usecount(intf->send_info);
 954                 if (rv) {
 955                         module_put(intf->handlers->owner);
 956                         goto out_kref;
 957                 }
 958         }
 959
 960         /*
 961          * Hold the lock so intf->handlers is guaranteed to be good
 962          * until now
 963          */
 964         mutex_unlock(&ipmi_interfaces_mutex);
 965
 966         new_user->valid = 1;
 967         spin_lock_irqsave(&intf->seq_lock, flags);
 968         list_add_rcu(&new_user->link, &intf->users);
 969         spin_unlock_irqrestore(&intf->seq_lock, flags);
 970         *user = new_user;
 971         return 0;
 972
 973 out_kref:
 974         kref_put(&intf->refcount, intf_free);
 975 out_kfree:
 976         mutex_unlock(&ipmi_interfaces_mutex);
 977         kfree(new_user);
 978         return rv;
 979 }
 980 EXPORT_SYMBOL(ipmi_create_user);
 981
 982 int ipmi_get_smi_info(int if_num, struct ipmi_smi_info *data)
 983 {
 984         int           rv = 0;
 985         ipmi_smi_t    intf;
 986         struct ipmi_smi_handlers *handlers;
 987
 988         mutex_lock(&ipmi_interfaces_mutex);
 989         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
 990                 if (intf->intf_num == if_num)
 991                         goto found;
 992         }
 993         /* Not found, return an error */
 994         rv = -EINVAL;
 995         mutex_unlock(&ipmi_interfaces_mutex);
 996         return rv;
 997
 998 found:
 999         handlers = intf->handlers;
1000         rv = -ENOSYS;
1001         if (handlers->get_smi_info)
1002                 rv = handlers->get_smi_info(intf->send_info, data);
1003         mutex_unlock(&ipmi_interfaces_mutex);
1004
1005         return rv;
1006 }
1007 EXPORT_SYMBOL(ipmi_get_smi_info);
1008
1009 static void free_user(struct kref *ref)
1010 {
1011         ipmi_user_t user = container_of(ref, struct ipmi_user, refcount);
1012         kfree(user);
1013 }
1014
1015 int ipmi_destroy_user(ipmi_user_t user)
1016 {
1017         ipmi_smi_t       intf = user->intf;
1018         int              i;
1019         unsigned long    flags;
1020         struct cmd_rcvr  *rcvr;
1021         struct cmd_rcvr  *rcvrs = NULL;
1022
1023         user->valid = 0;
1024
1025         /* Remove the user from the interface's sequence table. */
1026         spin_lock_irqsave(&intf->seq_lock, flags);
1027         list_del_rcu(&user->link);
1028
1029         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
1030                 if (intf->seq_table[i].inuse
1031                     && (intf->seq_table[i].recv_msg->user == user)) {
1032                         intf->seq_table[i].inuse = 0;
1033                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
1034                 }
1035         }
1036         spin_unlock_irqrestore(&intf->seq_lock, flags);
1037
1038         /*
1039          * Remove the user from the command receiver's table.  First
1040          * we build a list of everything (not using the standard link,
1041          * since other things may be using it till we do
1042          * synchronize_rcu()) then free everything in that list.
1043          */
1044         mutex_lock(&intf->cmd_rcvrs_mutex);
1045         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1046                 if (rcvr->user == user) {
1047                         list_del_rcu(&rcvr->link);
1048                         rcvr->next = rcvrs;
1049                         rcvrs = rcvr;
1050                 }
1051         }
1052         mutex_unlock(&intf->cmd_rcvrs_mutex);
1053         synchronize_rcu();
1054         while (rcvrs) {
1055                 rcvr = rcvrs;
1056                 rcvrs = rcvr->next;
1057                 kfree(rcvr);
1058         }
1059
1060         mutex_lock(&ipmi_interfaces_mutex);
1061         if (intf->handlers) {
1062                 module_put(intf->handlers->owner);
1063                 if (intf->handlers->dec_usecount)
1064                         intf->handlers->dec_usecount(intf->send_info);
1065         }
1066         mutex_unlock(&ipmi_interfaces_mutex);
1067
1068         kref_put(&intf->refcount, intf_free);
1069
1070         kref_put(&user->refcount, free_user);
1071
1072         return 0;
1073 }
1074 EXPORT_SYMBOL(ipmi_destroy_user);
1075
1076 void ipmi_get_version(ipmi_user_t   user,
1077                       unsigned char *major,
1078                       unsigned char *minor)
1079 {
1080         *major = user->intf->ipmi_version_major;
1081         *minor = user->intf->ipmi_version_minor;
1082 }
1083 EXPORT_SYMBOL(ipmi_get_version);
1084
1085 int ipmi_set_my_address(ipmi_user_t   user,
1086                         unsigned int  channel,
1087                         unsigned char address)
1088 {
1089         if (channel >= IPMI_MAX_CHANNELS)
1090                 return -EINVAL;
1091         user->intf->channels[channel].address = address;
1092         return 0;
1093 }
1094 EXPORT_SYMBOL(ipmi_set_my_address);
1095
1096 int ipmi_get_my_address(ipmi_user_t   user,
1097                         unsigned int  channel,
1098                         unsigned char *address)
1099 {
1100         if (channel >= IPMI_MAX_CHANNELS)
1101                 return -EINVAL;
1102         *address = user->intf->channels[channel].address;
1103         return 0;
1104 }
1105 EXPORT_SYMBOL(ipmi_get_my_address);
1106
1107 int ipmi_set_my_LUN(ipmi_user_t   user,
1108                     unsigned int  channel,
1109                     unsigned char LUN)
1110 {
1111         if (channel >= IPMI_MAX_CHANNELS)
1112                 return -EINVAL;
1113         user->intf->channels[channel].lun = LUN & 0x3;
1114         return 0;
1115 }
1116 EXPORT_SYMBOL(ipmi_set_my_LUN);
1117
1118 int ipmi_get_my_LUN(ipmi_user_t   user,
1119                     unsigned int  channel,
1120                     unsigned char *address)
1121 {
1122         if (channel >= IPMI_MAX_CHANNELS)
1123                 return -EINVAL;
1124         *address = user->intf->channels[channel].lun;
1125         return 0;
1126 }
1127 EXPORT_SYMBOL(ipmi_get_my_LUN);
1128
1129 int ipmi_get_maintenance_mode(ipmi_user_t user)
1130 {
1131         int           mode;
1132         unsigned long flags;
1133
1134         spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags);
1135         mode = user->intf->maintenance_mode;
1136         spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags);
1137
1138         return mode;
1139 }
1140 EXPORT_SYMBOL(ipmi_get_maintenance_mode);
1141
1142 static void maintenance_mode_update(ipmi_smi_t intf)
1143 {
1144         if (intf->handlers->set_maintenance_mode)
1145                 intf->handlers->set_maintenance_mode(
1146                         intf->send_info, intf->maintenance_mode_enable);
1147 }
1148
1149 int ipmi_set_maintenance_mode(ipmi_user_t user, int mode)
1150 {
1151         int           rv = 0;
1152         unsigned long flags;
1153         ipmi_smi_t    intf = user->intf;
1154
1155         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1156         if (intf->maintenance_mode != mode) {
1157                 switch (mode) {
1158                 case IPMI_MAINTENANCE_MODE_AUTO:
1159                         intf->maintenance_mode = mode;
1160                         intf->maintenance_mode_enable
1161                                 = (intf->auto_maintenance_timeout > 0);
1162                         break;
1163
1164                 case IPMI_MAINTENANCE_MODE_OFF:
1165                         intf->maintenance_mode = mode;
1166                         intf->maintenance_mode_enable = 0;
1167                         break;
1168
1169                 case IPMI_MAINTENANCE_MODE_ON:
1170                         intf->maintenance_mode = mode;
1171                         intf->maintenance_mode_enable = 1;
1172                         break;
1173
1174                 default:
1175                         rv = -EINVAL;
1176                         goto out_unlock;
1177                 }
1178
1179                 maintenance_mode_update(intf);
1180         }
1181  out_unlock:
1182         spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags);
1183
1184         return rv;
1185 }
1186 EXPORT_SYMBOL(ipmi_set_maintenance_mode);
1187
1188 int ipmi_set_gets_events(ipmi_user_t user, int val)
1189 {
1190         unsigned long        flags;
1191         ipmi_smi_t           intf = user->intf;
1192         struct ipmi_recv_msg *msg, *msg2;
1193         struct list_head     msgs;
1194
1195         INIT_LIST_HEAD(&msgs);
1196
1197         spin_lock_irqsave(&intf->events_lock, flags);
1198         user->gets_events = val;
1199
1200         if (intf->delivering_events)
1201                 /*
1202                  * Another thread is delivering events for this, so
1203                  * let it handle any new events.
1204                  */
1205                 goto out;
1206
1207         /* Deliver any queued events. */
1208         while (user->gets_events && !list_empty(&intf->waiting_events)) {
1209                 list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link)
1210                         list_move_tail(&msg->link, &msgs);
1211                 intf->waiting_events_count = 0;
1212                 if (intf->event_msg_printed) {
1213                         printk(KERN_WARNING PFX "Event queue no longer"
1214                                " full\n");
1215                         intf->event_msg_printed = 0;
1216                 }
1217
1218                 intf->delivering_events = 1;
1219                 spin_unlock_irqrestore(&intf->events_lock, flags);
1220
1221                 list_for_each_entry_safe(msg, msg2, &msgs, link) {
1222                         msg->user = user;
1223                         kref_get(&user->refcount);
1224                         deliver_response(msg);
1225                 }
1226
1227                 spin_lock_irqsave(&intf->events_lock, flags);
1228                 intf->delivering_events = 0;
1229         }
1230
1231  out:
1232         spin_unlock_irqrestore(&intf->events_lock, flags);
1233
1234         return 0;
1235 }
1236 EXPORT_SYMBOL(ipmi_set_gets_events);
1237
1238 static struct cmd_rcvr *find_cmd_rcvr(ipmi_smi_t    intf,
1239                                       unsigned char netfn,
1240                                       unsigned char cmd,
1241                                       unsigned char chan)
1242 {
1243         struct cmd_rcvr *rcvr;
1244
1245         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1246                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1247                                         && (rcvr->chans & (1 << chan)))
1248                         return rcvr;
1249         }
1250         return NULL;
1251 }
1252
1253 static int is_cmd_rcvr_exclusive(ipmi_smi_t    intf,
1254                                  unsigned char netfn,
1255                                  unsigned char cmd,
1256                                  unsigned int  chans)
1257 {
1258         struct cmd_rcvr *rcvr;
1259
1260         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1261                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1262                                         && (rcvr->chans & chans))
1263                         return 0;
1264         }
1265         return 1;
1266 }
1267
1268 int ipmi_register_for_cmd(ipmi_user_t   user,
1269                           unsigned char netfn,
1270                           unsigned char cmd,
1271                           unsigned int  chans)
1272 {
1273         ipmi_smi_t      intf = user->intf;
1274         struct cmd_rcvr *rcvr;
1275         int             rv = 0;
1276
1277
1278         rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);
1279         if (!rcvr)
1280                 return -ENOMEM;
1281         rcvr->cmd = cmd;
1282         rcvr->netfn = netfn;
1283         rcvr->chans = chans;
1284         rcvr->user = user;
1285
1286         mutex_lock(&intf->cmd_rcvrs_mutex);
1287         /* Make sure the command/netfn is not already registered. */
1288         if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) {
1289                 rv = -EBUSY;
1290                 goto out_unlock;
1291         }
1292
1293         list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
1294
1295  out_unlock:
1296         mutex_unlock(&intf->cmd_rcvrs_mutex);
1297         if (rv)
1298                 kfree(rcvr);
1299
1300         return rv;
1301 }
1302 EXPORT_SYMBOL(ipmi_register_for_cmd);
1303
1304 int ipmi_unregister_for_cmd(ipmi_user_t   user,
1305                             unsigned char netfn,
1306                             unsigned char cmd,
1307                             unsigned int  chans)
1308 {
1309         ipmi_smi_t      intf = user->intf;
1310         struct cmd_rcvr *rcvr;
1311         struct cmd_rcvr *rcvrs = NULL;
1312         int i, rv = -ENOENT;
1313
1314         mutex_lock(&intf->cmd_rcvrs_mutex);
1315         for (i = 0; i < IPMI_NUM_CHANNELS; i++) {
1316                 if (((1 << i) & chans) == 0)
1317                         continue;
1318                 rcvr = find_cmd_rcvr(intf, netfn, cmd, i);
1319                 if (rcvr == NULL)
1320                         continue;
1321                 if (rcvr->user == user) {
1322                         rv = 0;
1323                         rcvr->chans &= ~chans;
1324                         if (rcvr->chans == 0) {
1325                                 list_del_rcu(&rcvr->link);
1326                                 rcvr->next = rcvrs;
1327                                 rcvrs = rcvr;
1328                         }
1329                 }
1330         }
1331         mutex_unlock(&intf->cmd_rcvrs_mutex);
1332         synchronize_rcu();
1333         while (rcvrs) {
1334                 rcvr = rcvrs;
1335                 rcvrs = rcvr->next;
1336                 kfree(rcvr);
1337         }
1338         return rv;
1339 }
1340 EXPORT_SYMBOL(ipmi_unregister_for_cmd);
1341
1342 static unsigned char
1343 ipmb_checksum(unsigned char *data, int size)
1344 {
1345         unsigned char csum = 0;
1346
1347         for (; size > 0; size--, data++)
1348                 csum += *data;
1349
1350         return -csum;
1351 }
1352
1353 static inline void format_ipmb_msg(struct ipmi_smi_msg   *smi_msg,
1354                                    struct kernel_ipmi_msg *msg,
1355                                    struct ipmi_ipmb_addr *ipmb_addr,
1356                                    long                  msgid,
1357                                    unsigned char         ipmb_seq,
1358                                    int                   broadcast,
1359                                    unsigned char         source_address,
1360                                    unsigned char         source_lun)
1361 {
1362         int i = broadcast;
1363
1364         /* Format the IPMB header data. */
1365         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1366         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1367         smi_msg->data[2] = ipmb_addr->channel;
1368         if (broadcast)
1369                 smi_msg->data[3] = 0;
1370         smi_msg->data[i+3] = ipmb_addr->slave_addr;
1371         smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3);
1372         smi_msg->data[i+5] = ipmb_checksum(&(smi_msg->data[i+3]), 2);
1373         smi_msg->data[i+6] = source_address;
1374         smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun;
1375         smi_msg->data[i+8] = msg->cmd;
1376
1377         /* Now tack on the data to the message. */
1378         if (msg->data_len > 0)
1379                 memcpy(&(smi_msg->data[i+9]), msg->data,
1380                        msg->data_len);
1381         smi_msg->data_size = msg->data_len + 9;
1382
1383         /* Now calculate the checksum and tack it on. */
1384         smi_msg->data[i+smi_msg->data_size]
1385                 = ipmb_checksum(&(smi_msg->data[i+6]),
1386                                 smi_msg->data_size-6);
1387
1388         /*
1389          * Add on the checksum size and the offset from the
1390          * broadcast.
1391          */
1392         smi_msg->data_size += 1 + i;
1393
1394         smi_msg->msgid = msgid;
1395 }
1396
1397 static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,
1398                                   struct kernel_ipmi_msg *msg,
1399                                   struct ipmi_lan_addr  *lan_addr,
1400                                   long                  msgid,
1401                                   unsigned char         ipmb_seq,
1402                                   unsigned char         source_lun)
1403 {
1404         /* Format the IPMB header data. */
1405         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1406         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1407         smi_msg->data[2] = lan_addr->channel;
1408         smi_msg->data[3] = lan_addr->session_handle;
1409         smi_msg->data[4] = lan_addr->remote_SWID;
1410         smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3);
1411         smi_msg->data[6] = ipmb_checksum(&(smi_msg->data[4]), 2);
1412         smi_msg->data[7] = lan_addr->local_SWID;
1413         smi_msg->data[8] = (ipmb_seq << 2) | source_lun;
1414         smi_msg->data[9] = msg->cmd;
1415
1416         /* Now tack on the data to the message. */
1417         if (msg->data_len > 0)
1418                 memcpy(&(smi_msg->data[10]), msg->data,
1419                        msg->data_len);
1420         smi_msg->data_size = msg->data_len + 10;
1421
1422         /* Now calculate the checksum and tack it on. */
1423         smi_msg->data[smi_msg->data_size]
1424                 = ipmb_checksum(&(smi_msg->data[7]),
1425                                 smi_msg->data_size-7);
1426
1427         /*
1428          * Add on the checksum size and the offset from the
1429          * broadcast.
1430          */
1431         smi_msg->data_size += 1;
1432
1433         smi_msg->msgid = msgid;
1434 }
1435
1436 /*
1437  * Separate from ipmi_request so that the user does not have to be
1438  * supplied in certain circumstances (mainly at panic time).  If
1439  * messages are supplied, they will be freed, even if an error
1440  * occurs.
1441  */
1442 static int i_ipmi_request(ipmi_user_t          user,
1443                           ipmi_smi_t           intf,
1444                           struct ipmi_addr     *addr,
1445                           long                 msgid,
1446                           struct kernel_ipmi_msg *msg,
1447                           void                 *user_msg_data,
1448                           void                 *supplied_smi,
1449                           struct ipmi_recv_msg *supplied_recv,
1450                           int                  priority,
1451                           unsigned char        source_address,
1452                           unsigned char        source_lun,
1453                           int                  retries,
1454                           unsigned int         retry_time_ms)
1455 {
1456         int                      rv = 0;
1457         struct ipmi_smi_msg      *smi_msg;
1458         struct ipmi_recv_msg     *recv_msg;
1459         unsigned long            flags;
1460         struct ipmi_smi_handlers *handlers;
1461
1462
1463         if (supplied_recv)
1464                 recv_msg = supplied_recv;
1465         else {
1466                 recv_msg = ipmi_alloc_recv_msg();
1467                 if (recv_msg == NULL)
1468                         return -ENOMEM;
1469         }
1470         recv_msg->user_msg_data = user_msg_data;
1471
1472         if (supplied_smi)
1473                 smi_msg = (struct ipmi_smi_msg *) supplied_smi;
1474         else {
1475                 smi_msg = ipmi_alloc_smi_msg();
1476                 if (smi_msg == NULL) {
1477                         ipmi_free_recv_msg(recv_msg);
1478                         return -ENOMEM;
1479                 }
1480         }
1481
1482         rcu_read_lock();
1483         handlers = intf->handlers;
1484         if (!handlers) {
1485                 rv = -ENODEV;
1486                 goto out_err;
1487         }
1488
1489         recv_msg->user = user;
1490         if (user)
1491                 kref_get(&user->refcount);
1492         recv_msg->msgid = msgid;
1493         /*
1494          * Store the message to send in the receive message so timeout
1495          * responses can get the proper response data.
1496          */
1497         recv_msg->msg = *msg;
1498
1499         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
1500                 struct ipmi_system_interface_addr *smi_addr;
1501
1502                 if (msg->netfn & 1) {
1503                         /* Responses are not allowed to the SMI. */
1504                         rv = -EINVAL;
1505                         goto out_err;
1506                 }
1507
1508                 smi_addr = (struct ipmi_system_interface_addr *) addr;
1509                 if (smi_addr->lun > 3) {
1510                         ipmi_inc_stat(intf, sent_invalid_commands);
1511                         rv = -EINVAL;
1512                         goto out_err;
1513                 }
1514
1515                 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr));
1516
1517                 if ((msg->netfn == IPMI_NETFN_APP_REQUEST)
1518                     && ((msg->cmd == IPMI_SEND_MSG_CMD)
1519                         || (msg->cmd == IPMI_GET_MSG_CMD)
1520                         || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD))) {
1521                         /*
1522                          * We don't let the user do these, since we manage
1523                          * the sequence numbers.
1524                          */
1525                         ipmi_inc_stat(intf, sent_invalid_commands);
1526                         rv = -EINVAL;
1527                         goto out_err;
1528                 }
1529
1530                 if (((msg->netfn == IPMI_NETFN_APP_REQUEST)
1531                       && ((msg->cmd == IPMI_COLD_RESET_CMD)
1532                           || (msg->cmd == IPMI_WARM_RESET_CMD)))
1533                      || (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST)) {
1534                         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1535                         intf->auto_maintenance_timeout
1536                                 = IPMI_MAINTENANCE_MODE_TIMEOUT;
1537                         if (!intf->maintenance_mode
1538                             && !intf->maintenance_mode_enable) {
1539                                 intf->maintenance_mode_enable = 1;
1540                                 maintenance_mode_update(intf);
1541                         }
1542                         spin_unlock_irqrestore(&intf->maintenance_mode_lock,
1543                                                flags);
1544                 }
1545
1546                 if ((msg->data_len + 2) > IPMI_MAX_MSG_LENGTH) {
1547                         ipmi_inc_stat(intf, sent_invalid_commands);
1548                         rv = -EMSGSIZE;
1549                         goto out_err;
1550                 }
1551
1552                 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3);
1553                 smi_msg->data[1] = msg->cmd;
1554                 smi_msg->msgid = msgid;
1555                 smi_msg->user_data = recv_msg;
1556                 if (msg->data_len > 0)
1557                         memcpy(&(smi_msg->data[2]), msg->data, msg->data_len);
1558                 smi_msg->data_size = msg->data_len + 2;
1559                 ipmi_inc_stat(intf, sent_local_commands);
1560         } else if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
1561                 struct ipmi_ipmb_addr *ipmb_addr;
1562                 unsigned char         ipmb_seq;
1563                 long                  seqid;
1564                 int                   broadcast = 0;
1565
1566                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1567                         ipmi_inc_stat(intf, sent_invalid_commands);
1568                         rv = -EINVAL;
1569                         goto out_err;
1570                 }
1571
1572                 if (intf->channels[addr->channel].medium
1573                                         != IPMI_CHANNEL_MEDIUM_IPMB) {
1574                         ipmi_inc_stat(intf, sent_invalid_commands);
1575                         rv = -EINVAL;
1576                         goto out_err;
1577                 }
1578
1579                 if (retries < 0) {
1580                     if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)
1581                         retries = 0; /* Don't retry broadcasts. */
1582                     else
1583                         retries = 4;
1584                 }
1585                 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) {
1586                     /*
1587                      * Broadcasts add a zero at the beginning of the
1588                      * message, but otherwise is the same as an IPMB
1589                      * address.
1590                      */
1591                     addr->addr_type = IPMI_IPMB_ADDR_TYPE;
1592                     broadcast = 1;
1593                 }
1594
1595
1596                 /* Default to 1 second retries. */
1597                 if (retry_time_ms == 0)
1598                     retry_time_ms = 1000;
1599
1600                 /*
1601                  * 9 for the header and 1 for the checksum, plus
1602                  * possibly one for the broadcast.
1603                  */
1604                 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) {
1605                         ipmi_inc_stat(intf, sent_invalid_commands);
1606                         rv = -EMSGSIZE;
1607                         goto out_err;
1608                 }
1609
1610                 ipmb_addr = (struct ipmi_ipmb_addr *) addr;
1611                 if (ipmb_addr->lun > 3) {
1612                         ipmi_inc_stat(intf, sent_invalid_commands);
1613                         rv = -EINVAL;
1614                         goto out_err;
1615                 }
1616
1617                 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr));
1618
1619                 if (recv_msg->msg.netfn & 0x1) {
1620                         /*
1621                          * It's a response, so use the user's sequence
1622                          * from msgid.
1623                          */
1624                         ipmi_inc_stat(intf, sent_ipmb_responses);
1625                         format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid,
1626                                         msgid, broadcast,
1627                                         source_address, source_lun);
1628
1629                         /*
1630                          * Save the receive message so we can use it
1631                          * to deliver the response.
1632                          */
1633                         smi_msg->user_data = recv_msg;
1634                 } else {
1635                         /* It's a command, so get a sequence for it. */
1636
1637                         spin_lock_irqsave(&(intf->seq_lock), flags);
1638
1639                         /*
1640                          * Create a sequence number with a 1 second
1641                          * timeout and 4 retries.
1642                          */
1643                         rv = intf_next_seq(intf,
1644                                            recv_msg,
1645                                            retry_time_ms,
1646                                            retries,
1647                                            broadcast,
1648                                            &ipmb_seq,
1649                                            &seqid);
1650                         if (rv) {
1651                                 /*
1652                                  * We have used up all the sequence numbers,
1653                                  * probably, so abort.
1654                                  */
1655                                 spin_unlock_irqrestore(&(intf->seq_lock),
1656                                                        flags);
1657                                 goto out_err;
1658                         }
1659
1660                         ipmi_inc_stat(intf, sent_ipmb_commands);
1661
1662                         /*
1663                          * Store the sequence number in the message,
1664                          * so that when the send message response
1665                          * comes back we can start the timer.
1666                          */
1667                         format_ipmb_msg(smi_msg, msg, ipmb_addr,
1668                                         STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1669                                         ipmb_seq, broadcast,
1670                                         source_address, source_lun);
1671
1672                         /*
1673                          * Copy the message into the recv message data, so we
1674                          * can retransmit it later if necessary.
1675                          */
1676                         memcpy(recv_msg->msg_data, smi_msg->data,
1677                                smi_msg->data_size);
1678                         recv_msg->msg.data = recv_msg->msg_data;
1679                         recv_msg->msg.data_len = smi_msg->data_size;
1680
1681                         /*
1682                          * We don't unlock until here, because we need
1683                          * to copy the completed message into the
1684                          * recv_msg before we release the lock.
1685                          * Otherwise, race conditions may bite us.  I
1686                          * know that's pretty paranoid, but I prefer
1687                          * to be correct.
1688                          */
1689                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1690                 }
1691         } else if (is_lan_addr(addr)) {
1692                 struct ipmi_lan_addr  *lan_addr;
1693                 unsigned char         ipmb_seq;
1694                 long                  seqid;
1695
1696                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1697                         ipmi_inc_stat(intf, sent_invalid_commands);
1698                         rv = -EINVAL;
1699                         goto out_err;
1700                 }
1701
1702                 if ((intf->channels[addr->channel].medium
1703                                 != IPMI_CHANNEL_MEDIUM_8023LAN)
1704                     && (intf->channels[addr->channel].medium
1705                                 != IPMI_CHANNEL_MEDIUM_ASYNC)) {
1706                         ipmi_inc_stat(intf, sent_invalid_commands);
1707                         rv = -EINVAL;
1708                         goto out_err;
1709                 }
1710
1711                 retries = 4;
1712
1713                 /* Default to 1 second retries. */
1714                 if (retry_time_ms == 0)
1715                     retry_time_ms = 1000;
1716
1717                 /* 11 for the header and 1 for the checksum. */
1718                 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) {
1719                         ipmi_inc_stat(intf, sent_invalid_commands);
1720                         rv = -EMSGSIZE;
1721                         goto out_err;
1722                 }
1723
1724                 lan_addr = (struct ipmi_lan_addr *) addr;
1725                 if (lan_addr->lun > 3) {
1726                         ipmi_inc_stat(intf, sent_invalid_commands);
1727                         rv = -EINVAL;
1728                         goto out_err;
1729                 }
1730
1731                 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr));
1732
1733                 if (recv_msg->msg.netfn & 0x1) {
1734                         /*
1735                          * It's a response, so use the user's sequence
1736                          * from msgid.
1737                          */
1738                         ipmi_inc_stat(intf, sent_lan_responses);
1739                         format_lan_msg(smi_msg, msg, lan_addr, msgid,
1740                                        msgid, source_lun);
1741
1742                         /*
1743                          * Save the receive message so we can use it
1744                          * to deliver the response.
1745                          */
1746                         smi_msg->user_data = recv_msg;
1747                 } else {
1748                         /* It's a command, so get a sequence for it. */
1749
1750                         spin_lock_irqsave(&(intf->seq_lock), flags);
1751
1752                         /*
1753                          * Create a sequence number with a 1 second
1754                          * timeout and 4 retries.
1755                          */
1756                         rv = intf_next_seq(intf,
1757                                            recv_msg,
1758                                            retry_time_ms,
1759                                            retries,
1760                                            0,
1761                                            &ipmb_seq,
1762                                            &seqid);
1763                         if (rv) {
1764                                 /*
1765                                  * We have used up all the sequence numbers,
1766                                  * probably, so abort.
1767                                  */
1768                                 spin_unlock_irqrestore(&(intf->seq_lock),
1769                                                        flags);
1770                                 goto out_err;
1771                         }
1772
1773                         ipmi_inc_stat(intf, sent_lan_commands);
1774
1775                         /*
1776                          * Store the sequence number in the message,
1777                          * so that when the send message response
1778                          * comes back we can start the timer.
1779                          */
1780                         format_lan_msg(smi_msg, msg, lan_addr,
1781                                        STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1782                                        ipmb_seq, source_lun);
1783
1784                         /*
1785                          * Copy the message into the recv message data, so we
1786                          * can retransmit it later if necessary.
1787                          */
1788                         memcpy(recv_msg->msg_data, smi_msg->data,
1789                                smi_msg->data_size);
1790                         recv_msg->msg.data = recv_msg->msg_data;
1791                         recv_msg->msg.data_len = smi_msg->data_size;
1792
1793                         /*
1794                          * We don't unlock until here, because we need
1795                          * to copy the completed message into the
1796                          * recv_msg before we release the lock.
1797                          * Otherwise, race conditions may bite us.  I
1798                          * know that's pretty paranoid, but I prefer
1799                          * to be correct.
1800                          */
1801                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1802                 }
1803         } else {
1804             /* Unknown address type. */
1805                 ipmi_inc_stat(intf, sent_invalid_commands);
1806                 rv = -EINVAL;
1807                 goto out_err;
1808         }
1809
1810 #ifdef DEBUG_MSGING
1811         {
1812                 int m;
1813                 for (m = 0; m < smi_msg->data_size; m++)
1814                         printk(" %2.2x", smi_msg->data[m]);
1815                 printk("\n");
1816         }
1817 #endif
1818
1819         handlers->sender(intf->send_info, smi_msg, priority);
1820         rcu_read_unlock();
1821
1822         return 0;
1823
1824  out_err:
1825         rcu_read_unlock();
1826         ipmi_free_smi_msg(smi_msg);
1827         ipmi_free_recv_msg(recv_msg);
1828         return rv;
1829 }
1830
1831 static int check_addr(ipmi_smi_t       intf,
1832                       struct ipmi_addr *addr,
1833                       unsigned char    *saddr,
1834                       unsigned char    *lun)
1835 {
1836         if (addr->channel >= IPMI_MAX_CHANNELS)
1837                 return -EINVAL;
1838         *lun = intf->channels[addr->channel].lun;
1839         *saddr = intf->channels[addr->channel].address;
1840         return 0;
1841 }
1842
1843 int ipmi_request_settime(ipmi_user_t      user,
1844                          struct ipmi_addr *addr,
1845                          long             msgid,
1846                          struct kernel_ipmi_msg  *msg,
1847                          void             *user_msg_data,
1848                          int              priority,
1849                          int              retries,
1850                          unsigned int     retry_time_ms)
1851 {
1852         unsigned char saddr, lun;
1853         int           rv;
1854
1855         if (!user)
1856                 return -EINVAL;
1857         rv = check_addr(user->intf, addr, &saddr, &lun);
1858         if (rv)
1859                 return rv;
1860         return i_ipmi_request(user,
1861                               user->intf,
1862                               addr,
1863                               msgid,
1864                               msg,
1865                               user_msg_data,
1866                               NULL, NULL,
1867                               priority,
1868                               saddr,
1869                               lun,
1870                               retries,
1871                               retry_time_ms);
1872 }
1873 EXPORT_SYMBOL(ipmi_request_settime);
1874
1875 int ipmi_request_supply_msgs(ipmi_user_t          user,
1876                              struct ipmi_addr     *addr,
1877                              long                 msgid,
1878                              struct kernel_ipmi_msg *msg,
1879                              void                 *user_msg_data,
1880                              void                 *supplied_smi,
1881                              struct ipmi_recv_msg *supplied_recv,
1882                              int                  priority)
1883 {
1884         unsigned char saddr, lun;
1885         int           rv;
1886
1887         if (!user)
1888                 return -EINVAL;
1889         rv = check_addr(user->intf, addr, &saddr, &lun);
1890         if (rv)
1891                 return rv;
1892         return i_ipmi_request(user,
1893                               user->intf,
1894                               addr,
1895                               msgid,
1896                               msg,
1897                               user_msg_data,
1898                               supplied_smi,
1899                               supplied_recv,
1900                               priority,
1901                               saddr,
1902                               lun,
1903                               -1, 0);
1904 }
1905 EXPORT_SYMBOL(ipmi_request_supply_msgs);
1906
1907 #ifdef CONFIG_PROC_FS
1908 static int smi_ipmb_proc_show(struct seq_file *m, void *v)
1909 {
1910         ipmi_smi_t intf = m->private;
1911         int        i;
1912
1913         seq_printf(m, "%x", intf->channels[0].address);
1914         for (i = 1; i < IPMI_MAX_CHANNELS; i++)
1915                 seq_printf(m, " %x", intf->channels[i].address);
1916         return seq_putc(m, '\n');
1917 }
1918
1919 static int smi_ipmb_proc_open(struct inode *inode, struct file *file)
1920 {
1921         return single_open(file, smi_ipmb_proc_show, PDE(inode)->data);
1922 }
1923
1924 static const struct file_operations smi_ipmb_proc_ops = {
1925         .open           = smi_ipmb_proc_open,
1926         .read           = seq_read,
1927         .llseek         = seq_lseek,
1928         .release        = single_release,
1929 };
1930
1931 static int smi_version_proc_show(struct seq_file *m, void *v)
1932 {
1933         ipmi_smi_t intf = m->private;
1934
1935         return seq_printf(m, "%u.%u\n",
1936                        ipmi_version_major(&intf->bmc->id),
1937                        ipmi_version_minor(&intf->bmc->id));
1938 }
1939
1940 static int smi_version_proc_open(struct inode *inode, struct file *file)
1941 {
1942         return single_open(file, smi_version_proc_show, PDE(inode)->data);
1943 }
1944
1945 static const struct file_operations smi_version_proc_ops = {
1946         .open           = smi_version_proc_open,
1947         .read           = seq_read,
1948         .llseek         = seq_lseek,
1949         .release        = single_release,
1950 };
1951
1952 static int smi_stats_proc_show(struct seq_file *m, void *v)
1953 {
1954         ipmi_smi_t intf = m->private;
1955
1956         seq_printf(m, "sent_invalid_commands:       %u\n",
1957                        ipmi_get_stat(intf, sent_invalid_commands));
1958         seq_printf(m, "sent_local_commands:         %u\n",
1959                        ipmi_get_stat(intf, sent_local_commands));
1960         seq_printf(m, "handled_local_responses:     %u\n",
1961                        ipmi_get_stat(intf, handled_local_responses));
1962         seq_printf(m, "unhandled_local_responses:   %u\n",
1963                        ipmi_get_stat(intf, unhandled_local_responses));
1964         seq_printf(m, "sent_ipmb_commands:          %u\n",
1965                        ipmi_get_stat(intf, sent_ipmb_commands));
1966         seq_printf(m, "sent_ipmb_command_errs:      %u\n",
1967                        ipmi_get_stat(intf, sent_ipmb_command_errs));
1968         seq_printf(m, "retransmitted_ipmb_commands: %u\n",
1969                        ipmi_get_stat(intf, retransmitted_ipmb_commands));
1970         seq_printf(m, "timed_out_ipmb_commands:     %u\n",
1971                        ipmi_get_stat(intf, timed_out_ipmb_commands));
1972         seq_printf(m, "timed_out_ipmb_broadcasts:   %u\n",
1973                        ipmi_get_stat(intf, timed_out_ipmb_broadcasts));
1974         seq_printf(m, "sent_ipmb_responses:         %u\n",
1975                        ipmi_get_stat(intf, sent_ipmb_responses));
1976         seq_printf(m, "handled_ipmb_responses:      %u\n",
1977                        ipmi_get_stat(intf, handled_ipmb_responses));
1978         seq_printf(m, "invalid_ipmb_responses:      %u\n",
1979                        ipmi_get_stat(intf, invalid_ipmb_responses));
1980         seq_printf(m, "unhandled_ipmb_responses:    %u\n",
1981                        ipmi_get_stat(intf, unhandled_ipmb_responses));
1982         seq_printf(m, "sent_lan_commands:           %u\n",
1983                        ipmi_get_stat(intf, sent_lan_commands));
1984         seq_printf(m, "sent_lan_command_errs:       %u\n",
1985                        ipmi_get_stat(intf, sent_lan_command_errs));
1986         seq_printf(m, "retransmitted_lan_commands:  %u\n",
1987                        ipmi_get_stat(intf, retransmitted_lan_commands));
1988         seq_printf(m, "timed_out_lan_commands:      %u\n",
1989                        ipmi_get_stat(intf, timed_out_lan_commands));
1990         seq_printf(m, "sent_lan_responses:          %u\n",
1991                        ipmi_get_stat(intf, sent_lan_responses));
1992         seq_printf(m, "handled_lan_responses:       %u\n",
1993                        ipmi_get_stat(intf, handled_lan_responses));
1994         seq_printf(m, "invalid_lan_responses:       %u\n",
1995                        ipmi_get_stat(intf, invalid_lan_responses));
1996         seq_printf(m, "unhandled_lan_responses:     %u\n",
1997                        ipmi_get_stat(intf, unhandled_lan_responses));
1998         seq_printf(m, "handled_commands:            %u\n",
1999                        ipmi_get_stat(intf, handled_commands));
2000         seq_printf(m, "invalid_commands:            %u\n",
2001                        ipmi_get_stat(intf, invalid_commands));
2002         seq_printf(m, "unhandled_commands:          %u\n",
2003                        ipmi_get_stat(intf, unhandled_commands));
2004         seq_printf(m, "invalid_events:              %u\n",
2005                        ipmi_get_stat(intf, invalid_events));
2006         seq_printf(m, "events:                      %u\n",
2007                        ipmi_get_stat(intf, events));
2008         seq_printf(m, "failed rexmit LAN msgs:      %u\n",
2009                        ipmi_get_stat(intf, dropped_rexmit_lan_commands));
2010         seq_printf(m, "failed rexmit IPMB msgs:     %u\n",
2011                        ipmi_get_stat(intf, dropped_rexmit_ipmb_commands));
2012         return 0;
2013 }
2014
2015 static int smi_stats_proc_open(struct inode *inode, struct file *file)
2016 {
2017         return single_open(file, smi_stats_proc_show, PDE(inode)->data);
2018 }
2019
2020 static const struct file_operations smi_stats_proc_ops = {
2021         .open           = smi_stats_proc_open,
2022         .read           = seq_read,
2023         .llseek         = seq_lseek,
2024         .release        = single_release,
2025 };
2026 #endif /* CONFIG_PROC_FS */
2027
2028 int ipmi_smi_add_proc_entry(ipmi_smi_t smi, char *name,
2029                             const struct file_operations *proc_ops,
2030                             void *data)
2031 {
2032         int                    rv = 0;
2033 #ifdef CONFIG_PROC_FS
2034         struct proc_dir_entry  *file;
2035         struct ipmi_proc_entry *entry;
2036
2037         /* Create a list element. */
2038         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
2039         if (!entry)
2040                 return -ENOMEM;
2041         entry->name = kmalloc(strlen(name)+1, GFP_KERNEL);
2042         if (!entry->name) {
2043                 kfree(entry);
2044                 return -ENOMEM;
2045         }
2046         strcpy(entry->name, name);
2047
2048         file = proc_create_data(name, 0, smi->proc_dir, proc_ops, data);
2049         if (!file) {
2050                 kfree(entry->name);
2051                 kfree(entry);
2052                 rv = -ENOMEM;
2053         } else {
2054                 mutex_lock(&smi->proc_entry_lock);
2055                 /* Stick it on the list. */
2056                 entry->next = smi->proc_entries;
2057                 smi->proc_entries = entry;
2058                 mutex_unlock(&smi->proc_entry_lock);
2059         }
2060 #endif /* CONFIG_PROC_FS */
2061
2062         return rv;
2063 }
2064 EXPORT_SYMBOL(ipmi_smi_add_proc_entry);
2065
2066 static int add_proc_entries(ipmi_smi_t smi, int num)
2067 {
2068         int rv = 0;
2069
2070 #ifdef CONFIG_PROC_FS
2071         sprintf(smi->proc_dir_name, "%d", num);
2072         smi->proc_dir = proc_mkdir(smi->proc_dir_name, proc_ipmi_root);
2073         if (!smi->proc_dir)
2074                 rv = -ENOMEM;
2075
2076         if (rv == 0)
2077                 rv = ipmi_smi_add_proc_entry(smi, "stats",
2078                                              &smi_stats_proc_ops,
2079                                              smi);
2080
2081         if (rv == 0)
2082                 rv = ipmi_smi_add_proc_entry(smi, "ipmb",
2083                                              &smi_ipmb_proc_ops,
2084                                              smi);
2085
2086         if (rv == 0)
2087                 rv = ipmi_smi_add_proc_entry(smi, "version",
2088                                              &smi_version_proc_ops,
2089                                              smi);
2090 #endif /* CONFIG_PROC_FS */
2091
2092         return rv;
2093 }
2094
2095 static void remove_proc_entries(ipmi_smi_t smi)
2096 {
2097 #ifdef CONFIG_PROC_FS
2098         struct ipmi_proc_entry *entry;
2099
2100         mutex_lock(&smi->proc_entry_lock);
2101         while (smi->proc_entries) {
2102                 entry = smi->proc_entries;
2103                 smi->proc_entries = entry->next;
2104
2105                 remove_proc_entry(entry->name, smi->proc_dir);
2106                 kfree(entry->name);
2107                 kfree(entry);
2108         }
2109         mutex_unlock(&smi->proc_entry_lock);
2110         remove_proc_entry(smi->proc_dir_name, proc_ipmi_root);
2111 #endif /* CONFIG_PROC_FS */
2112 }
2113
2114 static int __find_bmc_guid(struct device *dev, void *data)
2115 {
2116         unsigned char *id = data;
2117         struct bmc_device *bmc = dev_get_drvdata(dev);
2118         return memcmp(bmc->guid, id, 16) == 0;
2119 }
2120
2121 static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv,
2122                                              unsigned char *guid)
2123 {
2124         struct device *dev;
2125
2126         dev = driver_find_device(drv, NULL, guid, __find_bmc_guid);
2127         if (dev)
2128                 return dev_get_drvdata(dev);
2129         else
2130                 return NULL;
2131 }
2132
2133 struct prod_dev_id {
2134         unsigned int  product_id;
2135         unsigned char device_id;
2136 };
2137
2138 static int __find_bmc_prod_dev_id(struct device *dev, void *data)
2139 {
2140         struct prod_dev_id *id = data;
2141         struct bmc_device *bmc = dev_get_drvdata(dev);
2142
2143         return (bmc->id.product_id == id->product_id
2144                 && bmc->id.device_id == id->device_id);
2145 }
2146
2147 static struct bmc_device *ipmi_find_bmc_prod_dev_id(
2148         struct device_driver *drv,
2149         unsigned int product_id, unsigned char device_id)
2150 {
2151         struct prod_dev_id id = {
2152                 .product_id = product_id,
2153                 .device_id = device_id,
2154         };
2155         struct device *dev;
2156
2157         dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id);
2158         if (dev)
2159                 return dev_get_drvdata(dev);
2160         else
2161                 return NULL;
2162 }
2163
2164 static ssize_t device_id_show(struct device *dev,
2165                               struct device_attribute *attr,
2166                               char *buf)
2167 {
2168         struct bmc_device *bmc = dev_get_drvdata(dev);
2169
2170         return snprintf(buf, 10, "%u\n", bmc->id.device_id);
2171 }
2172
2173 static ssize_t provides_dev_sdrs_show(struct device *dev,
2174                                       struct device_attribute *attr,
2175                                       char *buf)
2176 {
2177         struct bmc_device *bmc = dev_get_drvdata(dev);
2178
2179         return snprintf(buf, 10, "%u\n",
2180                         (bmc->id.device_revision & 0x80) >> 7);
2181 }
2182
2183 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
2184                              char *buf)
2185 {
2186         struct bmc_device *bmc = dev_get_drvdata(dev);
2187
2188         return snprintf(buf, 20, "%u\n",
2189                         bmc->id.device_revision & 0x0F);
2190 }
2191
2192 static ssize_t firmware_rev_show(struct device *dev,
2193                                  struct device_attribute *attr,
2194                                  char *buf)
2195 {
2196         struct bmc_device *bmc = dev_get_drvdata(dev);
2197
2198         return snprintf(buf, 20, "%u.%x\n", bmc->id.firmware_revision_1,
2199                         bmc->id.firmware_revision_2);
2200 }
2201
2202 static ssize_t ipmi_version_show(struct device *dev,
2203                                  struct device_attribute *attr,
2204                                  char *buf)
2205 {
2206         struct bmc_device *bmc = dev_get_drvdata(dev);
2207
2208         return snprintf(buf, 20, "%u.%u\n",
2209                         ipmi_version_major(&bmc->id),
2210                         ipmi_version_minor(&bmc->id));
2211 }
2212
2213 static ssize_t add_dev_support_show(struct device *dev,
2214                                     struct device_attribute *attr,
2215                                     char *buf)
2216 {
2217         struct bmc_device *bmc = dev_get_drvdata(dev);
2218
2219         return snprintf(buf, 10, "0x%02x\n",
2220                         bmc->id.additional_device_support);
2221 }
2222
2223 static ssize_t manufacturer_id_show(struct device *dev,
2224                                     struct device_attribute *attr,
2225                                     char *buf)
2226 {
2227         struct bmc_device *bmc = dev_get_drvdata(dev);
2228
2229         return snprintf(buf, 20, "0x%6.6x\n", bmc->id.manufacturer_id);
2230 }
2231
2232 static ssize_t product_id_show(struct device *dev,
2233                                struct device_attribute *attr,
2234                                char *buf)
2235 {
2236         struct bmc_device *bmc = dev_get_drvdata(dev);
2237
2238         return snprintf(buf, 10, "0x%4.4x\n", bmc->id.product_id);
2239 }
2240
2241 static ssize_t aux_firmware_rev_show(struct device *dev,
2242                                      struct device_attribute *attr,
2243                                      char *buf)
2244 {
2245         struct bmc_device *bmc = dev_get_drvdata(dev);
2246
2247         return snprintf(buf, 21, "0x%02x 0x%02x 0x%02x 0x%02x\n",
2248                         bmc->id.aux_firmware_revision[3],
2249                         bmc->id.aux_firmware_revision[2],
2250                         bmc->id.aux_firmware_revision[1],
2251                         bmc->id.aux_firmware_revision[0]);
2252 }
2253
2254 static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
2255                          char *buf)
2256 {
2257         struct bmc_device *bmc = dev_get_drvdata(dev);
2258
2259         return snprintf(buf, 100, "%Lx%Lx\n",
2260                         (long long) bmc->guid[0],
2261                         (long long) bmc->guid[8]);
2262 }
2263
2264 static void remove_files(struct bmc_device *bmc)
2265 {
2266         if (!bmc->dev)
2267                 return;
2268
2269         device_remove_file(&bmc->dev->dev,
2270                            &bmc->device_id_attr);
2271         device_remove_file(&bmc->dev->dev,
2272                            &bmc->provides_dev_sdrs_attr);
2273         device_remove_file(&bmc->dev->dev,
2274                            &bmc->revision_attr);
2275         device_remove_file(&bmc->dev->dev,
2276                            &bmc->firmware_rev_attr);
2277         device_remove_file(&bmc->dev->dev,
2278                            &bmc->version_attr);
2279         device_remove_file(&bmc->dev->dev,
2280                            &bmc->add_dev_support_attr);
2281         device_remove_file(&bmc->dev->dev,
2282                            &bmc->manufacturer_id_attr);
2283         device_remove_file(&bmc->dev->dev,
2284                            &bmc->product_id_attr);
2285
2286         if (bmc->id.aux_firmware_revision_set)
2287                 device_remove_file(&bmc->dev->dev,
2288                                    &bmc->aux_firmware_rev_attr);
2289         if (bmc->guid_set)
2290                 device_remove_file(&bmc->dev->dev,
2291                                    &bmc->guid_attr);
2292 }
2293
2294 static void
2295 cleanup_bmc_device(struct kref *ref)
2296 {
2297         struct bmc_device *bmc;
2298
2299         bmc = container_of(ref, struct bmc_device, refcount);
2300
2301         remove_files(bmc);
2302         platform_device_unregister(bmc->dev);
2303         kfree(bmc);
2304 }
2305
2306 static void ipmi_bmc_unregister(ipmi_smi_t intf)
2307 {
2308         struct bmc_device *bmc = intf->bmc;
2309
2310         if (intf->sysfs_name) {
2311                 sysfs_remove_link(&intf->si_dev->kobj, intf->sysfs_name);
2312                 kfree(intf->sysfs_name);
2313                 intf->sysfs_name = NULL;
2314         }
2315         if (intf->my_dev_name) {
2316                 sysfs_remove_link(&bmc->dev->dev.kobj, intf->my_dev_name);
2317                 kfree(intf->my_dev_name);
2318                 intf->my_dev_name = NULL;
2319         }
2320
2321         mutex_lock(&ipmidriver_mutex);
2322         kref_put(&bmc->refcount, cleanup_bmc_device);
2323         intf->bmc = NULL;
2324         mutex_unlock(&ipmidriver_mutex);
2325 }
2326
2327 static int create_files(struct bmc_device *bmc)
2328 {
2329         int err;
2330
2331         bmc->device_id_attr.attr.name = "device_id";
2332         bmc->device_id_attr.attr.mode = S_IRUGO;
2333         bmc->device_id_attr.show = device_id_show;
2334         sysfs_attr_init(&bmc->device_id_attr.attr);
2335
2336         bmc->provides_dev_sdrs_attr.attr.name = "provides_device_sdrs";
2337         bmc->provides_dev_sdrs_attr.attr.mode = S_IRUGO;
2338         bmc->provides_dev_sdrs_attr.show = provides_dev_sdrs_show;
2339         sysfs_attr_init(&bmc->provides_dev_sdrs_attr.attr);
2340
2341         bmc->revision_attr.attr.name = "revision";
2342         bmc->revision_attr.attr.mode = S_IRUGO;
2343         bmc->revision_attr.show = revision_show;
2344         sysfs_attr_init(&bmc->revision_attr.attr);
2345
2346         bmc->firmware_rev_attr.attr.name = "firmware_revision";
2347         bmc->firmware_rev_attr.attr.mode = S_IRUGO;
2348         bmc->firmware_rev_attr.show = firmware_rev_show;
2349         sysfs_attr_init(&bmc->firmware_rev_attr.attr);
2350
2351         bmc->version_attr.attr.name = "ipmi_version";
2352         bmc->version_attr.attr.mode = S_IRUGO;
2353         bmc->version_attr.show = ipmi_version_show;
2354         sysfs_attr_init(&bmc->version_attr.attr);
2355
2356         bmc->add_dev_support_attr.attr.name = "additional_device_support";
2357         bmc->add_dev_support_attr.attr.mode = S_IRUGO;
2358         bmc->add_dev_support_attr.show = add_dev_support_show;
2359         sysfs_attr_init(&bmc->add_dev_support_attr.attr);
2360
2361         bmc->manufacturer_id_attr.attr.name = "manufacturer_id";
2362         bmc->manufacturer_id_attr.attr.mode = S_IRUGO;
2363         bmc->manufacturer_id_attr.show = manufacturer_id_show;
2364         sysfs_attr_init(&bmc->manufacturer_id_attr.attr);
2365
2366         bmc->product_id_attr.attr.name = "product_id";
2367         bmc->product_id_attr.attr.mode = S_IRUGO;
2368         bmc->product_id_attr.show = product_id_show;
2369         sysfs_attr_init(&bmc->product_id_attr.attr);
2370
2371         bmc->guid_attr.attr.name = "guid";
2372         bmc->guid_attr.attr.mode = S_IRUGO;
2373         bmc->guid_attr.show = guid_show;
2374         sysfs_attr_init(&bmc->guid_attr.attr);
2375
2376         bmc->aux_firmware_rev_attr.attr.name = "aux_firmware_revision";
2377         bmc->aux_firmware_rev_attr.attr.mode = S_IRUGO;
2378         bmc->aux_firmware_rev_attr.show = aux_firmware_rev_show;
2379         sysfs_attr_init(&bmc->aux_firmware_rev_attr.attr);
2380
2381         err = device_create_file(&bmc->dev->dev,
2382                            &bmc->device_id_attr);
2383         if (err)
2384                 goto out;
2385         err = device_create_file(&bmc->dev->dev,
2386                            &bmc->provides_dev_sdrs_attr);
2387         if (err)
2388                 goto out_devid;
2389         err = device_create_file(&bmc->dev->dev,
2390                            &bmc->revision_attr);
2391         if (err)
2392                 goto out_sdrs;
2393         err = device_create_file(&bmc->dev->dev,
2394                            &bmc->firmware_rev_attr);
2395         if (err)
2396                 goto out_rev;
2397         err = device_create_file(&bmc->dev->dev,
2398                            &bmc->version_attr);
2399         if (err)
2400                 goto out_firm;
2401         err = device_create_file(&bmc->dev->dev,
2402                            &bmc->add_dev_support_attr);
2403         if (err)
2404                 goto out_version;
2405         err = device_create_file(&bmc->dev->dev,
2406                            &bmc->manufacturer_id_attr);
2407         if (err)
2408                 goto out_add_dev;
2409         err = device_create_file(&bmc->dev->dev,
2410                            &bmc->product_id_attr);
2411         if (err)
2412                 goto out_manu;
2413         if (bmc->id.aux_firmware_revision_set) {
2414                 err = device_create_file(&bmc->dev->dev,
2415                                    &bmc->aux_firmware_rev_attr);
2416                 if (err)
2417                         goto out_prod_id;
2418         }
2419         if (bmc->guid_set) {
2420                 err = device_create_file(&bmc->dev->dev,
2421                                    &bmc->guid_attr);
2422                 if (err)
2423                         goto out_aux_firm;
2424         }
2425
2426         return 0;
2427
2428 out_aux_firm:
2429         if (bmc->id.aux_firmware_revision_set)
2430                 device_remove_file(&bmc->dev->dev,
2431                                    &bmc->aux_firmware_rev_attr);
2432 out_prod_id:
2433         device_remove_file(&bmc->dev->dev,
2434                            &bmc->product_id_attr);
2435 out_manu:
2436         device_remove_file(&bmc->dev->dev,
2437                            &bmc->manufacturer_id_attr);
2438 out_add_dev:
2439         device_remove_file(&bmc->dev->dev,
2440                            &bmc->add_dev_support_attr);
2441 out_version:
2442         device_remove_file(&bmc->dev->dev,
2443                            &bmc->version_attr);
2444 out_firm:
2445         device_remove_file(&bmc->dev->dev,
2446                            &bmc->firmware_rev_attr);
2447 out_rev:
2448         device_remove_file(&bmc->dev->dev,
2449                            &bmc->revision_attr);
2450 out_sdrs:
2451         device_remove_file(&bmc->dev->dev,
2452                            &bmc->provides_dev_sdrs_attr);
2453 out_devid:
2454         device_remove_file(&bmc->dev->dev,
2455                            &bmc->device_id_attr);
2456 out:
2457         return err;
2458 }
2459
2460 static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum,
2461                              const char *sysfs_name)
2462 {
2463         int               rv;
2464         struct bmc_device *bmc = intf->bmc;
2465         struct bmc_device *old_bmc;
2466         int               size;
2467         char              dummy[1];
2468
2469         mutex_lock(&ipmidriver_mutex);
2470
2471         /*
2472          * Try to find if there is an bmc_device struct
2473          * representing the interfaced BMC already
2474          */
2475         if (bmc->guid_set)
2476                 old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, bmc->guid);
2477         else
2478                 old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2479                                                     bmc->id.product_id,
2480                                                     bmc->id.device_id);
2481
2482         /*
2483          * If there is already an bmc_device, free the new one,
2484          * otherwise register the new BMC device
2485          */
2486         if (old_bmc) {
2487                 kfree(bmc);
2488                 intf->bmc = old_bmc;
2489                 bmc = old_bmc;
2490
2491                 kref_get(&bmc->refcount);
2492                 mutex_unlock(&ipmidriver_mutex);
2493
2494                 printk(KERN_INFO
2495                        "ipmi: interfacing existing BMC (man_id: 0x%6.6x,"
2496                        " prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2497                        bmc->id.manufacturer_id,
2498                        bmc->id.product_id,
2499                        bmc->id.device_id);
2500         } else {
2501                 char name[14];
2502                 unsigned char orig_dev_id = bmc->id.device_id;
2503                 int warn_printed = 0;
2504
2505                 snprintf(name, sizeof(name),
2506                          "ipmi_bmc.%4.4x", bmc->id.product_id);
2507
2508                 while (ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2509                                                  bmc->id.product_id,
2510                                                  bmc->id.device_id)) {
2511                         if (!warn_printed) {
2512                                 printk(KERN_WARNING PFX
2513                                        "This machine has two different BMCs"
2514                                        " with the same product id and device"
2515                                        " id.  This is an error in the"
2516                                        " firmware, but incrementing the"
2517                                        " device id to work around the problem."
2518                                        " Prod ID = 0x%x, Dev ID = 0x%x\n",
2519                                        bmc->id.product_id, bmc->id.device_id);
2520                                 warn_printed = 1;
2521                         }
2522                         bmc->id.device_id++; /* Wraps at 255 */
2523                         if (bmc->id.device_id == orig_dev_id) {
2524                                 printk(KERN_ERR PFX
2525                                        "Out of device ids!\n");
2526                                 break;
2527                         }
2528                 }
2529
2530                 bmc->dev = platform_device_alloc(name, bmc->id.device_id);
2531                 if (!bmc->dev) {
2532                         mutex_unlock(&ipmidriver_mutex);
2533                         printk(KERN_ERR
2534                                "ipmi_msghandler:"
2535                                " Unable to allocate platform device\n");
2536                         return -ENOMEM;
2537                 }
2538                 bmc->dev->dev.driver = &ipmidriver.driver;
2539                 dev_set_drvdata(&bmc->dev->dev, bmc);
2540                 kref_init(&bmc->refcount);
2541
2542                 rv = platform_device_add(bmc->dev);
2543                 mutex_unlock(&ipmidriver_mutex);
2544                 if (rv) {
2545                         platform_device_put(bmc->dev);
2546                         bmc->dev = NULL;
2547                         printk(KERN_ERR
2548                                "ipmi_msghandler:"
2549                                " Unable to register bmc device: %d\n",
2550                                rv);
2551                         /*
2552                          * Don't go to out_err, you can only do that if
2553                          * the device is registered already.
2554                          */
2555                         return rv;
2556                 }
2557
2558                 rv = create_files(bmc);
2559                 if (rv) {
2560                         mutex_lock(&ipmidriver_mutex);
2561                         platform_device_unregister(bmc->dev);
2562                         mutex_unlock(&ipmidriver_mutex);
2563
2564                         return rv;
2565                 }
2566
2567                 dev_info(intf->si_dev, "Found new BMC (man_id: 0x%6.6x, "
2568                          "prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2569                          bmc->id.manufacturer_id,
2570                          bmc->id.product_id,
2571                          bmc->id.device_id);
2572         }
2573
2574         /*
2575          * create symlink from system interface device to bmc device
2576          * and back.
2577          */
2578         intf->sysfs_name = kstrdup(sysfs_name, GFP_KERNEL);
2579         if (!intf->sysfs_name) {
2580                 rv = -ENOMEM;
2581                 printk(KERN_ERR
2582                        "ipmi_msghandler: allocate link to BMC: %d\n",
2583                        rv);
2584                 goto out_err;
2585         }
2586
2587         rv = sysfs_create_link(&intf->si_dev->kobj,
2588                                &bmc->dev->dev.kobj, intf->sysfs_name);
2589         if (rv) {
2590                 kfree(intf->sysfs_name);
2591                 intf->sysfs_name = NULL;
2592                 printk(KERN_ERR
2593                        "ipmi_msghandler: Unable to create bmc symlink: %d\n",
2594                        rv);
2595                 goto out_err;
2596         }
2597
2598         size = snprintf(dummy, 0, "ipmi%d", ifnum);
2599         intf->my_dev_name = kmalloc(size+1, GFP_KERNEL);
2600         if (!intf->my_dev_name) {
2601                 kfree(intf->sysfs_name);
2602                 intf->sysfs_name = NULL;
2603                 rv = -ENOMEM;
2604                 printk(KERN_ERR
2605                        "ipmi_msghandler: allocate link from BMC: %d\n",
2606                        rv);
2607                 goto out_err;
2608         }
2609         snprintf(intf->my_dev_name, size+1, "ipmi%d", ifnum);
2610
2611         rv = sysfs_create_link(&bmc->dev->dev.kobj, &intf->si_dev->kobj,
2612                                intf->my_dev_name);
2613         if (rv) {
2614                 kfree(intf->sysfs_name);
2615                 intf->sysfs_name = NULL;
2616                 kfree(intf->my_dev_name);
2617                 intf->my_dev_name = NULL;
2618                 printk(KERN_ERR
2619                        "ipmi_msghandler:"
2620                        " Unable to create symlink to bmc: %d\n",
2621                        rv);
2622                 goto out_err;
2623         }
2624
2625         return 0;
2626
2627 out_err:
2628         ipmi_bmc_unregister(intf);
2629         return rv;
2630 }
2631
2632 static int
2633 send_guid_cmd(ipmi_smi_t intf, int chan)
2634 {
2635         struct kernel_ipmi_msg            msg;
2636         struct ipmi_system_interface_addr si;
2637
2638         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2639         si.channel = IPMI_BMC_CHANNEL;
2640         si.lun = 0;
2641
2642         msg.netfn = IPMI_NETFN_APP_REQUEST;
2643         msg.cmd = IPMI_GET_DEVICE_GUID_CMD;
2644         msg.data = NULL;
2645         msg.data_len = 0;
2646         return i_ipmi_request(NULL,
2647                               intf,
2648                               (struct ipmi_addr *) &si,
2649                               0,
2650                               &msg,
2651                               intf,
2652                               NULL,
2653                               NULL,
2654                               0,
2655                               intf->channels[0].address,
2656                               intf->channels[0].lun,
2657                               -1, 0);
2658 }
2659
2660 static void
2661 guid_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2662 {
2663         if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2664             || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)
2665             || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD))
2666                 /* Not for me */
2667                 return;
2668
2669         if (msg->msg.data[0] != 0) {
2670                 /* Error from getting the GUID, the BMC doesn't have one. */
2671                 intf->bmc->guid_set = 0;
2672                 goto out;
2673         }
2674
2675         if (msg->msg.data_len < 17) {
2676                 intf->bmc->guid_set = 0;
2677                 printk(KERN_WARNING PFX
2678                        "guid_handler: The GUID response from the BMC was too"
2679                        " short, it was %d but should have been 17.  Assuming"
2680                        " GUID is not available.\n",
2681                        msg->msg.data_len);
2682                 goto out;
2683         }
2684
2685         memcpy(intf->bmc->guid, msg->msg.data, 16);
2686         intf->bmc->guid_set = 1;
2687  out:
2688         wake_up(&intf->waitq);
2689 }
2690
2691 static void
2692 get_guid(ipmi_smi_t intf)
2693 {
2694         int rv;
2695
2696         intf->bmc->guid_set = 0x2;
2697         intf->null_user_handler = guid_handler;
2698         rv = send_guid_cmd(intf, 0);
2699         if (rv)
2700                 /* Send failed, no GUID available. */
2701                 intf->bmc->guid_set = 0;
2702         wait_event(intf->waitq, intf->bmc->guid_set != 2);
2703         intf->null_user_handler = NULL;
2704 }
2705
2706 static int
2707 send_channel_info_cmd(ipmi_smi_t intf, int chan)
2708 {
2709         struct kernel_ipmi_msg            msg;
2710         unsigned char                     data[1];
2711         struct ipmi_system_interface_addr si;
2712
2713         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2714         si.channel = IPMI_BMC_CHANNEL;
2715         si.lun = 0;
2716
2717         msg.netfn = IPMI_NETFN_APP_REQUEST;
2718         msg.cmd = IPMI_GET_CHANNEL_INFO_CMD;
2719         msg.data = data;
2720         msg.data_len = 1;
2721         data[0] = chan;
2722         return i_ipmi_request(NULL,
2723                               intf,
2724                               (struct ipmi_addr *) &si,
2725                               0,
2726                               &msg,
2727                               intf,
2728                               NULL,
2729                               NULL,
2730                               0,
2731                               intf->channels[0].address,
2732                               intf->channels[0].lun,
2733                               -1, 0);
2734 }
2735
2736 static void
2737 channel_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2738 {
2739         int rv = 0;
2740         int chan;
2741
2742         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2743             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
2744             && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD)) {
2745                 /* It's the one we want */
2746                 if (msg->msg.data[0] != 0) {
2747                         /* Got an error from the channel, just go on. */
2748
2749                         if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) {
2750                                 /*
2751                                  * If the MC does not support this
2752                                  * command, that is legal.  We just
2753                                  * assume it has one IPMB at channel
2754                                  * zero.
2755                                  */
2756                                 intf->channels[0].medium
2757                                         = IPMI_CHANNEL_MEDIUM_IPMB;
2758                                 intf->channels[0].protocol
2759                                         = IPMI_CHANNEL_PROTOCOL_IPMB;
2760                                 rv = -ENOSYS;
2761
2762                                 intf->curr_channel = IPMI_MAX_CHANNELS;
2763                                 wake_up(&intf->waitq);
2764                                 goto out;
2765                         }
2766                         goto next_channel;
2767                 }
2768                 if (msg->msg.data_len < 4) {
2769                         /* Message not big enough, just go on. */
2770                         goto next_channel;
2771                 }
2772                 chan = intf->curr_channel;
2773                 intf->channels[chan].medium = msg->msg.data[2] & 0x7f;
2774                 intf->channels[chan].protocol = msg->msg.data[3] & 0x1f;
2775
2776  next_channel:
2777                 intf->curr_channel++;
2778                 if (intf->curr_channel >= IPMI_MAX_CHANNELS)
2779                         wake_up(&intf->waitq);
2780                 else
2781                         rv = send_channel_info_cmd(intf, intf->curr_channel);
2782
2783                 if (rv) {
2784                         /* Got an error somehow, just give up. */
2785                         intf->curr_channel = IPMI_MAX_CHANNELS;
2786                         wake_up(&intf->waitq);
2787
2788                         printk(KERN_WARNING PFX
2789                                "Error sending channel information: %d\n",
2790                                rv);
2791                 }
2792         }
2793  out:
2794         return;
2795 }
2796
2797 static void ipmi_poll(ipmi_smi_t intf)
2798 {
2799         if (intf->handlers->poll)
2800                 intf->handlers->poll(intf->send_info);
2801         /* In case something came in */
2802         handle_new_recv_msgs(intf);
2803 }
2804
2805 void ipmi_poll_interface(ipmi_user_t user)
2806 {
2807         ipmi_poll(user->intf);
2808 }
2809 EXPORT_SYMBOL(ipmi_poll_interface);
2810
2811 int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
2812                       void                     *send_info,
2813                       struct ipmi_device_id    *device_id,
2814                       struct device            *si_dev,
2815                       const char               *sysfs_name,
2816                       unsigned char            slave_addr)
2817 {
2818         int              i, j;
2819         int              rv;
2820         ipmi_smi_t       intf;
2821         ipmi_smi_t       tintf;
2822         struct list_head *link;
2823
2824         /*
2825          * Make sure the driver is actually initialized, this handles
2826          * problems with initialization order.
2827          */
2828         if (!initialized) {
2829                 rv = ipmi_init_msghandler();
2830                 if (rv)
2831                         return rv;
2832                 /*
2833                  * The init code doesn't return an error if it was turned
2834                  * off, but it won't initialize.  Check that.
2835                  */
2836                 if (!initialized)
2837                         return -ENODEV;
2838         }
2839
2840         intf = kzalloc(sizeof(*intf), GFP_KERNEL);
2841         if (!intf)
2842                 return -ENOMEM;
2843
2844         intf->ipmi_version_major = ipmi_version_major(device_id);
2845         intf->ipmi_version_minor = ipmi_version_minor(device_id);
2846
2847         intf->bmc = kzalloc(sizeof(*intf->bmc), GFP_KERNEL);
2848         if (!intf->bmc) {
2849                 kfree(intf);
2850                 return -ENOMEM;
2851         }
2852         intf->intf_num = -1; /* Mark it invalid for now. */
2853         kref_init(&intf->refcount);
2854         intf->bmc->id = *device_id;
2855         intf->si_dev = si_dev;
2856         for (j = 0; j < IPMI_MAX_CHANNELS; j++) {
2857                 intf->channels[j].address = IPMI_BMC_SLAVE_ADDR;
2858                 intf->channels[j].lun = 2;
2859         }
2860         if (slave_addr != 0)
2861                 intf->channels[0].address = slave_addr;
2862         INIT_LIST_HEAD(&intf->users);
2863         intf->handlers = handlers;
2864         intf->send_info = send_info;
2865         spin_lock_init(&intf->seq_lock);
2866         for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) {
2867                 intf->seq_table[j].inuse = 0;
2868                 intf->seq_table[j].seqid = 0;
2869         }
2870         intf->curr_seq = 0;
2871 #ifdef CONFIG_PROC_FS
2872         mutex_init(&intf->proc_entry_lock);
2873 #endif
2874         spin_lock_init(&intf->waiting_msgs_lock);
2875         INIT_LIST_HEAD(&intf->waiting_msgs);
2876         tasklet_init(&intf->recv_tasklet,
2877                      smi_recv_tasklet,
2878                      (unsigned long) intf);
2879         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 0);
2880         spin_lock_init(&intf->events_lock);
2881         INIT_LIST_HEAD(&intf->waiting_events);
2882         intf->waiting_events_count = 0;
2883         mutex_init(&intf->cmd_rcvrs_mutex);
2884         spin_lock_init(&intf->maintenance_mode_lock);
2885         INIT_LIST_HEAD(&intf->cmd_rcvrs);
2886         init_waitqueue_head(&intf->waitq);
2887         for (i = 0; i < IPMI_NUM_STATS; i++)
2888                 atomic_set(&intf->stats[i], 0);
2889
2890         intf->proc_dir = NULL;
2891
2892         mutex_lock(&smi_watchers_mutex);
2893         mutex_lock(&ipmi_interfaces_mutex);
2894         /* Look for a hole in the numbers. */
2895         i = 0;
2896         link = &ipmi_interfaces;
2897         list_for_each_entry_rcu(tintf, &ipmi_interfaces, link) {
2898                 if (tintf->intf_num != i) {
2899                         link = &tintf->link;
2900                         break;
2901                 }
2902                 i++;
2903         }
2904         /* Add the new interface in numeric order. */
2905         if (i == 0)
2906                 list_add_rcu(&intf->link, &ipmi_interfaces);
2907         else
2908                 list_add_tail_rcu(&intf->link, link);
2909
2910         rv = handlers->start_processing(send_info, intf);
2911         if (rv)
2912                 goto out;
2913
2914         get_guid(intf);
2915
2916         if ((intf->ipmi_version_major > 1)
2917                         || ((intf->ipmi_version_major == 1)
2918                             && (intf->ipmi_version_minor >= 5))) {
2919                 /*
2920                  * Start scanning the channels to see what is
2921                  * available.
2922                  */
2923                 intf->null_user_handler = channel_handler;
2924                 intf->curr_channel = 0;
2925                 rv = send_channel_info_cmd(intf, 0);
2926                 if (rv)
2927                         goto out;
2928
2929                 /* Wait for the channel info to be read. */
2930                 wait_event(intf->waitq,
2931                            intf->curr_channel >= IPMI_MAX_CHANNELS);
2932                 intf->null_user_handler = NULL;
2933         } else {
2934                 /* Assume a single IPMB channel at zero. */
2935                 intf->channels[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;
2936                 intf->channels[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB;
2937                 intf->curr_channel = IPMI_MAX_CHANNELS;
2938         }
2939
2940         if (rv == 0)
2941                 rv = add_proc_entries(intf, i);
2942
2943         rv = ipmi_bmc_register(intf, i, sysfs_name);
2944
2945  out:
2946         if (rv) {
2947                 if (intf->proc_dir)
2948                         remove_proc_entries(intf);
2949                 intf->handlers = NULL;
2950                 list_del_rcu(&intf->link);
2951                 mutex_unlock(&ipmi_interfaces_mutex);
2952                 mutex_unlock(&smi_watchers_mutex);
2953                 synchronize_rcu();
2954                 kref_put(&intf->refcount, intf_free);
2955         } else {
2956                 /*
2957                  * Keep memory order straight for RCU readers.  Make
2958                  * sure everything else is committed to memory before
2959                  * setting intf_num to mark the interface valid.
2960                  */
2961                 smp_wmb();
2962                 intf->intf_num = i;
2963                 mutex_unlock(&ipmi_interfaces_mutex);
2964                 /* After this point the interface is legal to use. */
2965                 call_smi_watchers(i, intf->si_dev);
2966                 mutex_unlock(&smi_watchers_mutex);
2967         }
2968
2969         return rv;
2970 }
2971 EXPORT_SYMBOL(ipmi_register_smi);
2972
2973 static void cleanup_smi_msgs(ipmi_smi_t intf)
2974 {
2975         int              i;
2976         struct seq_table *ent;
2977
2978         /* No need for locks, the interface is down. */
2979         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
2980                 ent = &(intf->seq_table[i]);
2981                 if (!ent->inuse)
2982                         continue;
2983                 deliver_err_response(ent->recv_msg, IPMI_ERR_UNSPECIFIED);
2984         }
2985 }
2986
2987 int ipmi_unregister_smi(ipmi_smi_t intf)
2988 {
2989         struct ipmi_smi_watcher *w;
2990         int    intf_num = intf->intf_num;
2991
2992         ipmi_bmc_unregister(intf);
2993
2994         mutex_lock(&smi_watchers_mutex);
2995         mutex_lock(&ipmi_interfaces_mutex);
2996         intf->intf_num = -1;
2997         intf->handlers = NULL;
2998         list_del_rcu(&intf->link);
2999         mutex_unlock(&ipmi_interfaces_mutex);
3000         synchronize_rcu();
3001
3002         cleanup_smi_msgs(intf);
3003
3004         remove_proc_entries(intf);
3005
3006         /*
3007          * Call all the watcher interfaces to tell them that
3008          * an interface is gone.
3009          */
3010         list_for_each_entry(w, &smi_watchers, link)
3011                 w->smi_gone(intf_num);
3012         mutex_unlock(&smi_watchers_mutex);
3013
3014         kref_put(&intf->refcount, intf_free);
3015         return 0;
3016 }
3017 EXPORT_SYMBOL(ipmi_unregister_smi);
3018
3019 static int handle_ipmb_get_msg_rsp(ipmi_smi_t          intf,
3020                                    struct ipmi_smi_msg *msg)
3021 {
3022         struct ipmi_ipmb_addr ipmb_addr;
3023         struct ipmi_recv_msg  *recv_msg;
3024
3025         /*
3026          * This is 11, not 10, because the response must contain a
3027          * completion code.
3028          */
3029         if (msg->rsp_size < 11) {
3030                 /* Message not big enough, just ignore it. */
3031                 ipmi_inc_stat(intf, invalid_ipmb_responses);
3032                 return 0;
3033         }
3034
3035         if (msg->rsp[2] != 0) {
3036                 /* An error getting the response, just ignore it. */
3037                 return 0;
3038         }
3039
3040         ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE;
3041         ipmb_addr.slave_addr = msg->rsp[6];
3042         ipmb_addr.channel = msg->rsp[3] & 0x0f;
3043         ipmb_addr.lun = msg->rsp[7] & 3;
3044
3045         /*
3046          * It's a response from a remote entity.  Look up the sequence
3047          * number and handle the response.
3048          */
3049         if (intf_find_seq(intf,
3050                           msg->rsp[7] >> 2,
3051                           msg->rsp[3] & 0x0f,
3052                           msg->rsp[8],
3053                           (msg->rsp[4] >> 2) & (~1),
3054                           (struct ipmi_addr *) &(ipmb_addr),
3055                           &recv_msg)) {
3056                 /*
3057                  * We were unable to find the sequence number,
3058                  * so just nuke the message.
3059                  */
3060                 ipmi_inc_stat(intf, unhandled_ipmb_responses);
3061                 return 0;
3062         }
3063
3064         memcpy(recv_msg->msg_data,
3065                &(msg->rsp[9]),
3066                msg->rsp_size - 9);
3067         /*
3068          * The other fields matched, so no need to set them, except
3069          * for netfn, which needs to be the response that was
3070          * returned, not the request value.
3071          */
3072         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3073         recv_msg->msg.data = recv_msg->msg_data;
3074         recv_msg->msg.data_len = msg->rsp_size - 10;
3075         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3076         ipmi_inc_stat(intf, handled_ipmb_responses);
3077         deliver_response(recv_msg);
3078
3079         return 0;
3080 }
3081
3082 static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
3083                                    struct ipmi_smi_msg *msg)
3084 {
3085         struct cmd_rcvr          *rcvr;
3086         int                      rv = 0;
3087         unsigned char            netfn;
3088         unsigned char            cmd;
3089         unsigned char            chan;
3090         ipmi_user_t              user = NULL;
3091         struct ipmi_ipmb_addr    *ipmb_addr;
3092         struct ipmi_recv_msg     *recv_msg;
3093         struct ipmi_smi_handlers *handlers;
3094
3095         if (msg->rsp_size < 10) {
3096                 /* Message not big enough, just ignore it. */
3097                 ipmi_inc_stat(intf, invalid_commands);
3098                 return 0;
3099         }
3100
3101         if (msg->rsp[2] != 0) {
3102                 /* An error getting the response, just ignore it. */
3103                 return 0;
3104         }
3105
3106         netfn = msg->rsp[4] >> 2;
3107         cmd = msg->rsp[8];
3108         chan = msg->rsp[3] & 0xf;
3109
3110         rcu_read_lock();
3111         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3112         if (rcvr) {
3113                 user = rcvr->user;
3114                 kref_get(&user->refcount);
3115         } else
3116                 user = NULL;
3117         rcu_read_unlock();
3118
3119         if (user == NULL) {
3120                 /* We didn't find a user, deliver an error response. */
3121                 ipmi_inc_stat(intf, unhandled_commands);
3122
3123                 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
3124                 msg->data[1] = IPMI_SEND_MSG_CMD;
3125                 msg->data[2] = msg->rsp[3];
3126                 msg->data[3] = msg->rsp[6];
3127                 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3);
3128                 msg->data[5] = ipmb_checksum(&(msg->data[3]), 2);
3129                 msg->data[6] = intf->channels[msg->rsp[3] & 0xf].address;
3130                 /* rqseq/lun */
3131                 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3);
3132                 msg->data[8] = msg->rsp[8]; /* cmd */
3133                 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE;
3134                 msg->data[10] = ipmb_checksum(&(msg->data[6]), 4);
3135                 msg->data_size = 11;
3136
3137 #ifdef DEBUG_MSGING
3138         {
3139                 int m;
3140                 printk("Invalid command:");
3141                 for (m = 0; m < msg->data_size; m++)
3142                         printk(" %2.2x", msg->data[m]);
3143                 printk("\n");
3144         }
3145 #endif
3146                 rcu_read_lock();
3147                 handlers = intf->handlers;
3148                 if (handlers) {
3149                         handlers->sender(intf->send_info, msg, 0);
3150                         /*
3151                          * We used the message, so return the value
3152                          * that causes it to not be freed or
3153                          * queued.
3154                          */
3155                         rv = -1;
3156                 }
3157                 rcu_read_unlock();
3158         } else {
3159                 /* Deliver the message to the user. */
3160                 ipmi_inc_stat(intf, handled_commands);
3161
3162                 recv_msg = ipmi_alloc_recv_msg();
3163                 if (!recv_msg) {
3164                         /*
3165                          * We couldn't allocate memory for the
3166                          * message, so requeue it for handling
3167                          * later.
3168                          */
3169                         rv = 1;
3170                         kref_put(&user->refcount, free_user);
3171                 } else {
3172                         /* Extract the source address from the data. */
3173                         ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
3174                         ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE;
3175                         ipmb_addr->slave_addr = msg->rsp[6];
3176                         ipmb_addr->lun = msg->rsp[7] & 3;
3177                         ipmb_addr->channel = msg->rsp[3] & 0xf;
3178
3179                         /*
3180                          * Extract the rest of the message information
3181                          * from the IPMB header.
3182                          */
3183                         recv_msg->user = user;
3184                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3185                         recv_msg->msgid = msg->rsp[7] >> 2;
3186                         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3187                         recv_msg->msg.cmd = msg->rsp[8];
3188                         recv_msg->msg.data = recv_msg->msg_data;
3189
3190                         /*
3191                          * We chop off 10, not 9 bytes because the checksum
3192                          * at the end also needs to be removed.
3193                          */
3194                         recv_msg->msg.data_len = msg->rsp_size - 10;
3195                         memcpy(recv_msg->msg_data,
3196                                &(msg->rsp[9]),
3197                                msg->rsp_size - 10);
3198                         deliver_response(recv_msg);
3199                 }
3200         }
3201
3202         return rv;
3203 }
3204
3205 static int handle_lan_get_msg_rsp(ipmi_smi_t          intf,
3206                                   struct ipmi_smi_msg *msg)
3207 {
3208         struct ipmi_lan_addr  lan_addr;
3209         struct ipmi_recv_msg  *recv_msg;
3210
3211
3212         /*
3213          * This is 13, not 12, because the response must contain a
3214          * completion code.
3215          */
3216         if (msg->rsp_size < 13) {
3217                 /* Message not big enough, just ignore it. */
3218                 ipmi_inc_stat(intf, invalid_lan_responses);
3219                 return 0;
3220         }
3221
3222         if (msg->rsp[2] != 0) {
3223                 /* An error getting the response, just ignore it. */
3224                 return 0;
3225         }
3226
3227         lan_addr.addr_type = IPMI_LAN_ADDR_TYPE;
3228         lan_addr.session_handle = msg->rsp[4];
3229         lan_addr.remote_SWID = msg->rsp[8];
3230         lan_addr.local_SWID = msg->rsp[5];
3231         lan_addr.channel = msg->rsp[3] & 0x0f;
3232         lan_addr.privilege = msg->rsp[3] >> 4;
3233         lan_addr.lun = msg->rsp[9] & 3;
3234
3235         /*
3236          * It's a response from a remote entity.  Look up the sequence
3237          * number and handle the response.
3238          */
3239         if (intf_find_seq(intf,
3240                           msg->rsp[9] >> 2,
3241                           msg->rsp[3] & 0x0f,
3242                           msg->rsp[10],
3243                           (msg->rsp[6] >> 2) & (~1),
3244                           (struct ipmi_addr *) &(lan_addr),
3245                           &recv_msg)) {
3246                 /*
3247                  * We were unable to find the sequence number,
3248                  * so just nuke the message.
3249                  */
3250                 ipmi_inc_stat(intf, unhandled_lan_responses);
3251                 return 0;
3252         }
3253
3254         memcpy(recv_msg->msg_data,
3255                &(msg->rsp[11]),
3256                msg->rsp_size - 11);
3257         /*
3258          * The other fields matched, so no need to set them, except
3259          * for netfn, which needs to be the response that was
3260          * returned, not the request value.
3261          */
3262         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3263         recv_msg->msg.data = recv_msg->msg_data;
3264         recv_msg->msg.data_len = msg->rsp_size - 12;
3265         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3266         ipmi_inc_stat(intf, handled_lan_responses);
3267         deliver_response(recv_msg);
3268
3269         return 0;
3270 }
3271
3272 static int handle_lan_get_msg_cmd(ipmi_smi_t          intf,
3273                                   struct ipmi_smi_msg *msg)
3274 {
3275         struct cmd_rcvr          *rcvr;
3276         int                      rv = 0;
3277         unsigned char            netfn;
3278         unsigned char            cmd;
3279         unsigned char            chan;
3280         ipmi_user_t              user = NULL;
3281         struct ipmi_lan_addr     *lan_addr;
3282         struct ipmi_recv_msg     *recv_msg;
3283
3284         if (msg->rsp_size < 12) {
3285                 /* Message not big enough, just ignore it. */
3286                 ipmi_inc_stat(intf, invalid_commands);
3287                 return 0;
3288         }
3289
3290         if (msg->rsp[2] != 0) {
3291                 /* An error getting the response, just ignore it. */
3292                 return 0;
3293         }
3294
3295         netfn = msg->rsp[6] >> 2;
3296         cmd = msg->rsp[10];
3297         chan = msg->rsp[3] & 0xf;
3298
3299         rcu_read_lock();
3300         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3301         if (rcvr) {
3302                 user = rcvr->user;
3303                 kref_get(&user->refcount);
3304         } else
3305                 user = NULL;
3306         rcu_read_unlock();
3307
3308         if (user == NULL) {
3309                 /* We didn't find a user, just give up. */
3310                 ipmi_inc_stat(intf, unhandled_commands);
3311
3312                 /*
3313                  * Don't do anything with these messages, just allow
3314                  * them to be freed.
3315                  */
3316                 rv = 0;
3317         } else {
3318                 /* Deliver the message to the user. */
3319                 ipmi_inc_stat(intf, handled_commands);
3320
3321                 recv_msg = ipmi_alloc_recv_msg();
3322                 if (!recv_msg) {
3323                         /*
3324                          * We couldn't allocate memory for the
3325                          * message, so requeue it for handling later.
3326                          */
3327                         rv = 1;
3328                         kref_put(&user->refcount, free_user);
3329                 } else {
3330                         /* Extract the source address from the data. */
3331                         lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
3332                         lan_addr->addr_type = IPMI_LAN_ADDR_TYPE;
3333                         lan_addr->session_handle = msg->rsp[4];
3334                         lan_addr->remote_SWID = msg->rsp[8];
3335                         lan_addr->local_SWID = msg->rsp[5];
3336                         lan_addr->lun = msg->rsp[9] & 3;
3337                         lan_addr->channel = msg->rsp[3] & 0xf;
3338                         lan_addr->privilege = msg->rsp[3] >> 4;
3339
3340                         /*
3341                          * Extract the rest of the message information
3342                          * from the IPMB header.
3343                          */
3344                         recv_msg->user = user;
3345                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3346                         recv_msg->msgid = msg->rsp[9] >> 2;
3347                         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3348                         recv_msg->msg.cmd = msg->rsp[10];
3349                         recv_msg->msg.data = recv_msg->msg_data;
3350
3351                         /*
3352                          * We chop off 12, not 11 bytes because the checksum
3353                          * at the end also needs to be removed.
3354                          */
3355                         recv_msg->msg.data_len = msg->rsp_size - 12;
3356                         memcpy(recv_msg->msg_data,
3357                                &(msg->rsp[11]),
3358                                msg->rsp_size - 12);
3359                         deliver_response(recv_msg);
3360                 }
3361         }
3362
3363         return rv;
3364 }
3365
3366 /*
3367  * This routine will handle "Get Message" command responses with
3368  * channels that use an OEM Medium. The message format belongs to
3369  * the OEM.  See IPMI 2.0 specification, Chapter 6 and
3370  * Chapter 22, sections 22.6 and 22.24 for more details.
3371  */
3372 static int handle_oem_get_msg_cmd(ipmi_smi_t          intf,
3373                                   struct ipmi_smi_msg *msg)
3374 {
3375         struct cmd_rcvr       *rcvr;
3376         int                   rv = 0;
3377         unsigned char         netfn;
3378         unsigned char         cmd;
3379         unsigned char         chan;
3380         ipmi_user_t           user = NULL;
3381         struct ipmi_system_interface_addr *smi_addr;
3382         struct ipmi_recv_msg  *recv_msg;
3383
3384         /*
3385          * We expect the OEM SW to perform error checking
3386          * so we just do some basic sanity checks
3387          */
3388         if (msg->rsp_size < 4) {
3389                 /* Message not big enough, just ignore it. */
3390                 ipmi_inc_stat(intf, invalid_commands);
3391                 return 0;
3392         }
3393
3394         if (msg->rsp[2] != 0) {
3395                 /* An error getting the response, just ignore it. */
3396                 return 0;
3397         }
3398
3399         /*
3400          * This is an OEM Message so the OEM needs to know how
3401          * handle the message. We do no interpretation.
3402          */
3403         netfn = msg->rsp[0] >> 2;
3404         cmd = msg->rsp[1];
3405         chan = msg->rsp[3] & 0xf;
3406
3407         rcu_read_lock();
3408         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3409         if (rcvr) {
3410                 user = rcvr->user;
3411                 kref_get(&user->refcount);
3412         } else
3413                 user = NULL;
3414         rcu_read_unlock();
3415
3416         if (user == NULL) {
3417                 /* We didn't find a user, just give up. */
3418                 ipmi_inc_stat(intf, unhandled_commands);
3419
3420                 /*
3421                  * Don't do anything with these messages, just allow
3422                  * them to be freed.
3423                  */
3424
3425                 rv = 0;
3426         } else {
3427                 /* Deliver the message to the user. */
3428                 ipmi_inc_stat(intf, handled_commands);
3429
3430                 recv_msg = ipmi_alloc_recv_msg();
3431                 if (!recv_msg) {
3432                         /*
3433                          * We couldn't allocate memory for the
3434                          * message, so requeue it for handling
3435                          * later.
3436                          */
3437                         rv = 1;
3438                         kref_put(&user->refcount, free_user);
3439                 } else {
3440                         /*
3441                          * OEM Messages are expected to be delivered via
3442                          * the system interface to SMS software.  We might
3443                          * need to visit this again depending on OEM
3444                          * requirements
3445                          */
3446                         smi_addr = ((struct ipmi_system_interface_addr *)
3447                                     &(recv_msg->addr));
3448                         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3449                         smi_addr->channel = IPMI_BMC_CHANNEL;
3450                         smi_addr->lun = msg->rsp[0] & 3;
3451
3452                         recv_msg->user = user;
3453                         recv_msg->user_msg_data = NULL;
3454                         recv_msg->recv_type = IPMI_OEM_RECV_TYPE;
3455                         recv_msg->msg.netfn = msg->rsp[0] >> 2;
3456                         recv_msg->msg.cmd = msg->rsp[1];
3457                         recv_msg->msg.data = recv_msg->msg_data;
3458
3459                         /*
3460                          * The message starts at byte 4 which follows the
3461                          * the Channel Byte in the "GET MESSAGE" command
3462                          */
3463                         recv_msg->msg.data_len = msg->rsp_size - 4;
3464                         memcpy(recv_msg->msg_data,
3465                                &(msg->rsp[4]),
3466                                msg->rsp_size - 4);
3467                         deliver_response(recv_msg);
3468                 }
3469         }
3470
3471         return rv;
3472 }
3473
3474 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg,
3475                                      struct ipmi_smi_msg  *msg)
3476 {
3477         struct ipmi_system_interface_addr *smi_addr;
3478
3479         recv_msg->msgid = 0;
3480         smi_addr = (struct ipmi_system_interface_addr *) &(recv_msg->addr);
3481         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3482         smi_addr->channel = IPMI_BMC_CHANNEL;
3483         smi_addr->lun = msg->rsp[0] & 3;
3484         recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE;
3485         recv_msg->msg.netfn = msg->rsp[0] >> 2;
3486         recv_msg->msg.cmd = msg->rsp[1];
3487         memcpy(recv_msg->msg_data, &(msg->rsp[3]), msg->rsp_size - 3);
3488         recv_msg->msg.data = recv_msg->msg_data;
3489         recv_msg->msg.data_len = msg->rsp_size - 3;
3490 }
3491
3492 static int handle_read_event_rsp(ipmi_smi_t          intf,
3493                                  struct ipmi_smi_msg *msg)
3494 {
3495         struct ipmi_recv_msg *recv_msg, *recv_msg2;
3496         struct list_head     msgs;
3497         ipmi_user_t          user;
3498         int                  rv = 0;
3499         int                  deliver_count = 0;
3500         unsigned long        flags;
3501
3502         if (msg->rsp_size < 19) {
3503                 /* Message is too small to be an IPMB event. */
3504                 ipmi_inc_stat(intf, invalid_events);
3505                 return 0;
3506         }
3507
3508         if (msg->rsp[2] != 0) {
3509                 /* An error getting the event, just ignore it. */
3510                 return 0;
3511         }
3512
3513         INIT_LIST_HEAD(&msgs);
3514
3515         spin_lock_irqsave(&intf->events_lock, flags);
3516
3517         ipmi_inc_stat(intf, events);
3518
3519         /*
3520          * Allocate and fill in one message for every user that is
3521          * getting events.
3522          */
3523         rcu_read_lock();
3524         list_for_each_entry_rcu(user, &intf->users, link) {
3525                 if (!user->gets_events)
3526                         continue;
3527
3528                 recv_msg = ipmi_alloc_recv_msg();
3529                 if (!recv_msg) {
3530                         rcu_read_unlock();
3531                         list_for_each_entry_safe(recv_msg, recv_msg2, &msgs,
3532                                                  link) {
3533                                 list_del(&recv_msg->link);
3534                                 ipmi_free_recv_msg(recv_msg);
3535                         }
3536                         /*
3537                          * We couldn't allocate memory for the
3538                          * message, so requeue it for handling
3539                          * later.
3540                          */
3541                         rv = 1;
3542                         goto out;
3543                 }
3544
3545                 deliver_count++;
3546
3547                 copy_event_into_recv_msg(recv_msg, msg);
3548                 recv_msg->user = user;
3549                 kref_get(&user->refcount);
3550                 list_add_tail(&(recv_msg->link), &msgs);
3551         }
3552         rcu_read_unlock();
3553
3554         if (deliver_count) {
3555                 /* Now deliver all the messages. */
3556                 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
3557                         list_del(&recv_msg->link);
3558                         deliver_response(recv_msg);
3559                 }
3560         } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) {
3561                 /*
3562                  * No one to receive the message, put it in queue if there's
3563                  * not already too many things in the queue.
3564                  */
3565                 recv_msg = ipmi_alloc_recv_msg();
3566                 if (!recv_msg) {
3567                         /*
3568                          * We couldn't allocate memory for the
3569                          * message, so requeue it for handling
3570                          * later.
3571                          */
3572                         rv = 1;
3573                         goto out;
3574                 }
3575
3576                 copy_event_into_recv_msg(recv_msg, msg);
3577                 list_add_tail(&(recv_msg->link), &(intf->waiting_events));
3578                 intf->waiting_events_count++;
3579         } else if (!intf->event_msg_printed) {
3580                 /*
3581                  * There's too many things in the queue, discard this
3582                  * message.
3583                  */
3584                 printk(KERN_WARNING PFX "Event queue full, discarding"
3585                        " incoming events\n");
3586                 intf->event_msg_printed = 1;
3587         }
3588
3589  out:
3590         spin_unlock_irqrestore(&(intf->events_lock), flags);
3591
3592         return rv;
3593 }
3594
3595 static int handle_bmc_rsp(ipmi_smi_t          intf,
3596                           struct ipmi_smi_msg *msg)
3597 {
3598         struct ipmi_recv_msg *recv_msg;
3599         struct ipmi_user     *user;
3600
3601         recv_msg = (struct ipmi_recv_msg *) msg->user_data;
3602         if (recv_msg == NULL) {
3603                 printk(KERN_WARNING
3604                        "IPMI message received with no owner. This\n"
3605                        "could be because of a malformed message, or\n"
3606                        "because of a hardware error.  Contact your\n"
3607                        "hardware vender for assistance\n");
3608                 return 0;
3609         }
3610
3611         user = recv_msg->user;
3612         /* Make sure the user still exists. */
3613         if (user && !user->valid) {
3614                 /* The user for the message went away, so give up. */
3615                 ipmi_inc_stat(intf, unhandled_local_responses);
3616                 ipmi_free_recv_msg(recv_msg);
3617         } else {
3618                 struct ipmi_system_interface_addr *smi_addr;
3619
3620                 ipmi_inc_stat(intf, handled_local_responses);
3621                 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3622                 recv_msg->msgid = msg->msgid;
3623                 smi_addr = ((struct ipmi_system_interface_addr *)
3624                             &(recv_msg->addr));
3625                 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3626                 smi_addr->channel = IPMI_BMC_CHANNEL;
3627                 smi_addr->lun = msg->rsp[0] & 3;
3628                 recv_msg->msg.netfn = msg->rsp[0] >> 2;
3629                 recv_msg->msg.cmd = msg->rsp[1];
3630                 memcpy(recv_msg->msg_data,
3631                        &(msg->rsp[2]),
3632                        msg->rsp_size - 2);
3633                 recv_msg->msg.data = recv_msg->msg_data;
3634                 recv_msg->msg.data_len = msg->rsp_size - 2;
3635                 deliver_response(recv_msg);
3636         }
3637
3638         return 0;
3639 }
3640
3641 /*
3642  * Handle a received message.  Return 1 if the message should be requeued,
3643  * 0 if the message should be freed, or -1 if the message should not
3644  * be freed or requeued.
3645  */
3646 static int handle_one_recv_msg(ipmi_smi_t          intf,
3647                                struct ipmi_smi_msg *msg)
3648 {
3649         int requeue;
3650         int chan;
3651
3652 #ifdef DEBUG_MSGING
3653         int m;
3654         printk("Recv:");
3655         for (m = 0; m < msg->rsp_size; m++)
3656                 printk(" %2.2x", msg->rsp[m]);
3657         printk("\n");
3658 #endif
3659         if (msg->rsp_size < 2) {
3660                 /* Message is too small to be correct. */
3661                 printk(KERN_WARNING PFX "BMC returned to small a message"
3662                        " for netfn %x cmd %x, got %d bytes\n",
3663                        (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size);
3664
3665                 /* Generate an error response for the message. */
3666                 msg->rsp[0] = msg->data[0] | (1 << 2);
3667                 msg->rsp[1] = msg->data[1];
3668                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3669                 msg->rsp_size = 3;
3670         } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1))
3671                    || (msg->rsp[1] != msg->data[1])) {
3672                 /*
3673                  * The NetFN and Command in the response is not even
3674                  * marginally correct.
3675                  */
3676                 printk(KERN_WARNING PFX "BMC returned incorrect response,"
3677                        " expected netfn %x cmd %x, got netfn %x cmd %x\n",
3678                        (msg->data[0] >> 2) | 1, msg->data[1],
3679                        msg->rsp[0] >> 2, msg->rsp[1]);
3680
3681                 /* Generate an error response for the message. */
3682                 msg->rsp[0] = msg->data[0] | (1 << 2);
3683                 msg->rsp[1] = msg->data[1];
3684                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3685                 msg->rsp_size = 3;
3686         }
3687
3688         if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3689             && (msg->rsp[1] == IPMI_SEND_MSG_CMD)
3690             && (msg->user_data != NULL)) {
3691                 /*
3692                  * It's a response to a response we sent.  For this we
3693                  * deliver a send message response to the user.
3694                  */
3695                 struct ipmi_recv_msg     *recv_msg = msg->user_data;
3696
3697                 requeue = 0;
3698                 if (msg->rsp_size < 2)
3699                         /* Message is too small to be correct. */
3700                         goto out;
3701
3702                 chan = msg->data[2] & 0x0f;
3703                 if (chan >= IPMI_MAX_CHANNELS)
3704                         /* Invalid channel number */
3705                         goto out;
3706
3707                 if (!recv_msg)
3708                         goto out;
3709
3710                 /* Make sure the user still exists. */
3711                 if (!recv_msg->user || !recv_msg->user->valid)
3712                         goto out;
3713
3714                 recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE;
3715                 recv_msg->msg.data = recv_msg->msg_data;
3716                 recv_msg->msg.data_len = 1;
3717                 recv_msg->msg_data[0] = msg->rsp[2];
3718                 deliver_response(recv_msg);
3719         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3720                    && (msg->rsp[1] == IPMI_GET_MSG_CMD)) {
3721                 /* It's from the receive queue. */
3722                 chan = msg->rsp[3] & 0xf;
3723                 if (chan >= IPMI_MAX_CHANNELS) {
3724                         /* Invalid channel number */
3725                         requeue = 0;
3726                         goto out;
3727                 }
3728
3729                 /*
3730                  * We need to make sure the channels have been initialized.
3731                  * The channel_handler routine will set the "curr_channel"
3732                  * equal to or greater than IPMI_MAX_CHANNELS when all the
3733                  * channels for this interface have been initialized.
3734                  */
3735                 if (intf->curr_channel < IPMI_MAX_CHANNELS) {
3736                         requeue = 0; /* Throw the message away */
3737                         goto out;
3738                 }
3739
3740                 switch (intf->channels[chan].medium) {
3741                 case IPMI_CHANNEL_MEDIUM_IPMB:
3742                         if (msg->rsp[4] & 0x04) {
3743                                 /*
3744                                  * It's a response, so find the
3745                                  * requesting message and send it up.
3746                                  */
3747                                 requeue = handle_ipmb_get_msg_rsp(intf, msg);
3748                         } else {
3749                                 /*
3750                                  * It's a command to the SMS from some other
3751                                  * entity.  Handle that.
3752                                  */
3753                                 requeue = handle_ipmb_get_msg_cmd(intf, msg);
3754                         }
3755                         break;
3756
3757                 case IPMI_CHANNEL_MEDIUM_8023LAN:
3758                 case IPMI_CHANNEL_MEDIUM_ASYNC:
3759                         if (msg->rsp[6] & 0x04) {
3760                                 /*
3761                                  * It's a response, so find the
3762                                  * requesting message and send it up.
3763                                  */
3764                                 requeue = handle_lan_get_msg_rsp(intf, msg);
3765                         } else {
3766                                 /*
3767                                  * It's a command to the SMS from some other
3768                                  * entity.  Handle that.
3769                                  */
3770                                 requeue = handle_lan_get_msg_cmd(intf, msg);
3771                         }
3772                         break;
3773
3774                 default:
3775                         /* Check for OEM Channels.  Clients had better
3776                            register for these commands. */
3777                         if ((intf->channels[chan].medium
3778                              >= IPMI_CHANNEL_MEDIUM_OEM_MIN)
3779                             && (intf->channels[chan].medium
3780                                 <= IPMI_CHANNEL_MEDIUM_OEM_MAX)) {
3781                                 requeue = handle_oem_get_msg_cmd(intf, msg);
3782                         } else {
3783                                 /*
3784                                  * We don't handle the channel type, so just
3785                                  * free the message.
3786                                  */
3787                                 requeue = 0;
3788                         }
3789                 }
3790
3791         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3792                    && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD)) {
3793                 /* It's an asyncronous event. */
3794                 requeue = handle_read_event_rsp(intf, msg);
3795         } else {
3796                 /* It's a response from the local BMC. */
3797                 requeue = handle_bmc_rsp(intf, msg);
3798         }
3799
3800  out:
3801         return requeue;
3802 }
3803
3804 /*
3805  * If there are messages in the queue or pretimeouts, handle them.
3806  */
3807 static void handle_new_recv_msgs(ipmi_smi_t intf)
3808 {
3809         struct ipmi_smi_msg  *smi_msg;
3810         unsigned long        flags = 0;
3811         int                  rv;
3812         int                  run_to_completion = intf->run_to_completion;
3813
3814         /* See if any waiting messages need to be processed. */
3815         if (!run_to_completion)
3816                 spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
3817         while (!list_empty(&intf->waiting_msgs)) {
3818                 smi_msg = list_entry(intf->waiting_msgs.next,
3819                                      struct ipmi_smi_msg, link);
3820                 list_del(&smi_msg->link);
3821                 if (!run_to_completion)
3822                         spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3823                 rv = handle_one_recv_msg(intf, smi_msg);
3824                 if (!run_to_completion)
3825                         spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
3826                 if (rv == 0) {
3827                         /* Message handled */
3828                         ipmi_free_smi_msg(smi_msg);
3829                 } else if (rv < 0) {
3830                         /* Fatal error on the message, del but don't free. */
3831                 } else {
3832                         /*
3833                          * To preserve message order, quit if we
3834                          * can't handle a message.
3835                          */
3836                         list_add(&smi_msg->link, &intf->waiting_msgs);
3837                         break;
3838                 }
3839         }
3840         if (!run_to_completion)
3841                 spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3842
3843         /*
3844          * If the pretimout count is non-zero, decrement one from it and
3845          * deliver pretimeouts to all the users.
3846          */
3847         if (atomic_add_unless(&intf->watchdog_pretimeouts_to_deliver, -1, 0)) {
3848                 ipmi_user_t user;
3849
3850                 rcu_read_lock();
3851                 list_for_each_entry_rcu(user, &intf->users, link) {
3852                         if (user->handler->ipmi_watchdog_pretimeout)
3853                                 user->handler->ipmi_watchdog_pretimeout(
3854                                         user->handler_data);
3855                 }
3856                 rcu_read_unlock();
3857         }
3858 }
3859
3860 static void smi_recv_tasklet(unsigned long val)
3861 {
3862         handle_new_recv_msgs((ipmi_smi_t) val);
3863 }
3864
3865 /* Handle a new message from the lower layer. */
3866 void ipmi_smi_msg_received(ipmi_smi_t          intf,
3867                            struct ipmi_smi_msg *msg)
3868 {
3869         unsigned long flags = 0; /* keep us warning-free. */
3870         int           run_to_completion;
3871
3872
3873         if ((msg->data_size >= 2)
3874             && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
3875             && (msg->data[1] == IPMI_SEND_MSG_CMD)
3876             && (msg->user_data == NULL)) {
3877                 /*
3878                  * This is the local response to a command send, start
3879                  * the timer for these.  The user_data will not be
3880                  * NULL if this is a response send, and we will let
3881                  * response sends just go through.
3882                  */
3883
3884                 /*
3885                  * Check for errors, if we get certain errors (ones
3886                  * that mean basically we can try again later), we
3887                  * ignore them and start the timer.  Otherwise we
3888                  * report the error immediately.
3889                  */
3890                 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
3891                     && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
3892                     && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
3893                     && (msg->rsp[2] != IPMI_BUS_ERR)
3894                     && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
3895                         int chan = msg->rsp[3] & 0xf;
3896
3897                         /* Got an error sending the message, handle it. */
3898                         if (chan >= IPMI_MAX_CHANNELS)
3899                                 ; /* This shouldn't happen */
3900                         else if ((intf->channels[chan].medium
3901                                   == IPMI_CHANNEL_MEDIUM_8023LAN)
3902                                  || (intf->channels[chan].medium
3903                                      == IPMI_CHANNEL_MEDIUM_ASYNC))
3904                                 ipmi_inc_stat(intf, sent_lan_command_errs);
3905                         else
3906                                 ipmi_inc_stat(intf, sent_ipmb_command_errs);
3907                         intf_err_seq(intf, msg->msgid, msg->rsp[2]);
3908                 } else
3909                         /* The message was sent, start the timer. */
3910                         intf_start_seq_timer(intf, msg->msgid);
3911
3912                 ipmi_free_smi_msg(msg);
3913                 goto out;
3914         }
3915
3916         /*
3917          * To preserve message order, if the list is not empty, we
3918          * tack this message onto the end of the list.
3919          */
3920         run_to_completion = intf->run_to_completion;
3921         if (!run_to_completion)
3922                 spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
3923         list_add_tail(&msg->link, &intf->waiting_msgs);
3924         if (!run_to_completion)
3925                 spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3926
3927         tasklet_schedule(&intf->recv_tasklet);
3928  out:
3929         return;
3930 }
3931 EXPORT_SYMBOL(ipmi_smi_msg_received);
3932
3933 void ipmi_smi_watchdog_pretimeout(ipmi_smi_t intf)
3934 {
3935         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 1);
3936         tasklet_schedule(&intf->recv_tasklet);
3937 }
3938 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout);
3939
3940 static struct ipmi_smi_msg *
3941 smi_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
3942                   unsigned char seq, long seqid)
3943 {
3944         struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg();
3945         if (!smi_msg)
3946                 /*
3947                  * If we can't allocate the message, then just return, we
3948                  * get 4 retries, so this should be ok.
3949                  */
3950                 return NULL;
3951
3952         memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len);
3953         smi_msg->data_size = recv_msg->msg.data_len;
3954         smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);
3955
3956 #ifdef DEBUG_MSGING
3957         {
3958                 int m;
3959                 printk("Resend: ");
3960                 for (m = 0; m < smi_msg->data_size; m++)
3961                         printk(" %2.2x", smi_msg->data[m]);
3962                 printk("\n");
3963         }
3964 #endif
3965         return smi_msg;
3966 }
3967
3968 static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
3969                               struct list_head *timeouts, long timeout_period,
3970                               int slot, unsigned long *flags)
3971 {
3972         struct ipmi_recv_msg     *msg;
3973         struct ipmi_smi_handlers *handlers;
3974
3975         if (intf->intf_num == -1)
3976                 return;
3977
3978         if (!ent->inuse)
3979                 return;
3980
3981         ent->timeout -= timeout_period;
3982         if (ent->timeout > 0)
3983                 return;
3984
3985         if (ent->retries_left == 0) {
3986                 /* The message has used all its retries. */
3987                 ent->inuse = 0;
3988                 msg = ent->recv_msg;
3989                 list_add_tail(&msg->link, timeouts);
3990                 if (ent->broadcast)
3991                         ipmi_inc_stat(intf, timed_out_ipmb_broadcasts);
3992                 else if (is_lan_addr(&ent->recv_msg->addr))
3993                         ipmi_inc_stat(intf, timed_out_lan_commands);
3994                 else
3995                         ipmi_inc_stat(intf, timed_out_ipmb_commands);
3996         } else {
3997                 struct ipmi_smi_msg *smi_msg;
3998                 /* More retries, send again. */
3999
4000                 /*
4001                  * Start with the max timer, set to normal timer after
4002                  * the message is sent.
4003                  */
4004                 ent->timeout = MAX_MSG_TIMEOUT;
4005                 ent->retries_left--;
4006                 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot,
4007                                             ent->seqid);
4008                 if (!smi_msg) {
4009                         if (is_lan_addr(&ent->recv_msg->addr))
4010                                 ipmi_inc_stat(intf,
4011                                               dropped_rexmit_lan_commands);
4012                         else
4013                                 ipmi_inc_stat(intf,
4014                                               dropped_rexmit_ipmb_commands);
4015                         return;
4016                 }
4017
4018                 spin_unlock_irqrestore(&intf->seq_lock, *flags);
4019
4020                 /*
4021                  * Send the new message.  We send with a zero
4022                  * priority.  It timed out, I doubt time is that
4023                  * critical now, and high priority messages are really
4024                  * only for messages to the local MC, which don't get
4025                  * resent.
4026                  */
4027                 handlers = intf->handlers;
4028                 if (handlers) {
4029                         if (is_lan_addr(&ent->recv_msg->addr))
4030                                 ipmi_inc_stat(intf,
4031                                               retransmitted_lan_commands);
4032                         else
4033                                 ipmi_inc_stat(intf,
4034                                               retransmitted_ipmb_commands);
4035
4036                         intf->handlers->sender(intf->send_info,
4037                                                smi_msg, 0);
4038                 } else
4039                         ipmi_free_smi_msg(smi_msg);
4040
4041                 spin_lock_irqsave(&intf->seq_lock, *flags);
4042         }
4043 }
4044
4045 static void ipmi_timeout_handler(long timeout_period)
4046 {
4047         ipmi_smi_t           intf;
4048         struct list_head     timeouts;
4049         struct ipmi_recv_msg *msg, *msg2;
4050         unsigned long        flags;
4051         int                  i;
4052
4053         rcu_read_lock();
4054         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4055                 tasklet_schedule(&intf->recv_tasklet);
4056
4057                 /*
4058                  * Go through the seq table and find any messages that
4059                  * have timed out, putting them in the timeouts
4060                  * list.
4061                  */
4062                 INIT_LIST_HEAD(&timeouts);
4063                 spin_lock_irqsave(&intf->seq_lock, flags);
4064                 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
4065                         check_msg_timeout(intf, &(intf->seq_table[i]),
4066                                           &timeouts, timeout_period, i,
4067                                           &flags);
4068                 spin_unlock_irqrestore(&intf->seq_lock, flags);
4069
4070                 list_for_each_entry_safe(msg, msg2, &timeouts, link)
4071                         deliver_err_response(msg, IPMI_TIMEOUT_COMPLETION_CODE);
4072
4073                 /*
4074                  * Maintenance mode handling.  Check the timeout
4075                  * optimistically before we claim the lock.  It may
4076                  * mean a timeout gets missed occasionally, but that
4077                  * only means the timeout gets extended by one period
4078                  * in that case.  No big deal, and it avoids the lock
4079                  * most of the time.
4080                  */
4081                 if (intf->auto_maintenance_timeout > 0) {
4082                         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
4083                         if (intf->auto_maintenance_timeout > 0) {
4084                                 intf->auto_maintenance_timeout
4085                                         -= timeout_period;
4086                                 if (!intf->maintenance_mode
4087                                     && (intf->auto_maintenance_timeout <= 0)) {
4088                                         intf->maintenance_mode_enable = 0;
4089                                         maintenance_mode_update(intf);
4090                                 }
4091                         }
4092                         spin_unlock_irqrestore(&intf->maintenance_mode_lock,
4093                                                flags);
4094                 }
4095         }
4096         rcu_read_unlock();
4097 }
4098
4099 static void ipmi_request_event(void)
4100 {
4101         ipmi_smi_t               intf;
4102         struct ipmi_smi_handlers *handlers;
4103
4104         rcu_read_lock();
4105         /*
4106          * Called from the timer, no need to check if handlers is
4107          * valid.
4108          */
4109         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4110                 /* No event requests when in maintenance mode. */
4111                 if (intf->maintenance_mode_enable)
4112                         continue;
4113
4114                 handlers = intf->handlers;
4115                 if (handlers)
4116                         handlers->request_events(intf->send_info);
4117         }
4118         rcu_read_unlock();
4119 }
4120
4121 static struct timer_list ipmi_timer;
4122
4123 /* Call every ~1000 ms. */
4124 #define IPMI_TIMEOUT_TIME       1000
4125
4126 /* How many jiffies does it take to get to the timeout time. */
4127 #define IPMI_TIMEOUT_JIFFIES    ((IPMI_TIMEOUT_TIME * HZ) / 1000)
4128
4129 /*
4130  * Request events from the queue every second (this is the number of
4131  * IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the
4132  * future, IPMI will add a way to know immediately if an event is in
4133  * the queue and this silliness can go away.
4134  */
4135 #define IPMI_REQUEST_EV_TIME    (1000 / (IPMI_TIMEOUT_TIME))
4136
4137 static atomic_t stop_operation;
4138 static unsigned int ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
4139
4140 static void ipmi_timeout(unsigned long data)
4141 {
4142         if (atomic_read(&stop_operation))
4143                 return;
4144
4145         ticks_to_req_ev--;
4146         if (ticks_to_req_ev == 0) {
4147                 ipmi_request_event();
4148                 ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
4149         }
4150
4151         ipmi_timeout_handler(IPMI_TIMEOUT_TIME);
4152
4153         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4154 }
4155
4156
4157 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0);
4158 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);
4159
4160 /* FIXME - convert these to slabs. */
4161 static void free_smi_msg(struct ipmi_smi_msg *msg)
4162 {
4163         atomic_dec(&smi_msg_inuse_count);
4164         kfree(msg);
4165 }
4166
4167 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)
4168 {
4169         struct ipmi_smi_msg *rv;
4170         rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC);
4171         if (rv) {
4172                 rv->done = free_smi_msg;
4173                 rv->user_data = NULL;
4174                 atomic_inc(&smi_msg_inuse_count);
4175         }
4176         return rv;
4177 }
4178 EXPORT_SYMBOL(ipmi_alloc_smi_msg);
4179
4180 static void free_recv_msg(struct ipmi_recv_msg *msg)
4181 {
4182         atomic_dec(&recv_msg_inuse_count);
4183         kfree(msg);
4184 }
4185
4186 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
4187 {
4188         struct ipmi_recv_msg *rv;
4189
4190         rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC);
4191         if (rv) {
4192                 rv->user = NULL;
4193                 rv->done = free_recv_msg;
4194                 atomic_inc(&recv_msg_inuse_count);
4195         }
4196         return rv;
4197 }
4198
4199 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg)
4200 {
4201         if (msg->user)
4202                 kref_put(&msg->user->refcount, free_user);
4203         msg->done(msg);
4204 }
4205 EXPORT_SYMBOL(ipmi_free_recv_msg);
4206
4207 #ifdef CONFIG_IPMI_PANIC_EVENT
4208
4209 static atomic_t panic_done_count = ATOMIC_INIT(0);
4210
4211 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg)
4212 {
4213         atomic_dec(&panic_done_count);
4214 }
4215
4216 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg)
4217 {
4218         atomic_dec(&panic_done_count);
4219 }
4220
4221 /*
4222  * Inside a panic, send a message and wait for a response.
4223  */
4224 static void ipmi_panic_request_and_wait(ipmi_smi_t           intf,
4225                                         struct ipmi_addr     *addr,
4226                                         struct kernel_ipmi_msg *msg)
4227 {
4228         struct ipmi_smi_msg  smi_msg;
4229         struct ipmi_recv_msg recv_msg;
4230         int rv;
4231
4232         smi_msg.done = dummy_smi_done_handler;
4233         recv_msg.done = dummy_recv_done_handler;
4234         atomic_add(2, &panic_done_count);
4235         rv = i_ipmi_request(NULL,
4236                             intf,
4237                             addr,
4238                             0,
4239                             msg,
4240                             intf,
4241                             &smi_msg,
4242                             &recv_msg,
4243                             0,
4244                             intf->channels[0].address,
4245                             intf->channels[0].lun,
4246                             0, 1); /* Don't retry, and don't wait. */
4247         if (rv)
4248                 atomic_sub(2, &panic_done_count);
4249         while (atomic_read(&panic_done_count) != 0)
4250                 ipmi_poll(intf);
4251 }
4252
4253 #ifdef CONFIG_IPMI_PANIC_STRING
4254 static void event_receiver_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
4255 {
4256         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
4257             && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE)
4258             && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD)
4259             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
4260                 /* A get event receiver command, save it. */
4261                 intf->event_receiver = msg->msg.data[1];
4262                 intf->event_receiver_lun = msg->msg.data[2] & 0x3;
4263         }
4264 }
4265
4266 static void device_id_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
4267 {
4268         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
4269             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
4270             && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD)
4271             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
4272                 /*
4273                  * A get device id command, save if we are an event
4274                  * receiver or generator.
4275                  */
4276                 intf->local_sel_device = (msg->msg.data[6] >> 2) & 1;
4277                 intf->local_event_generator = (msg->msg.data[6] >> 5) & 1;
4278         }
4279 }
4280 #endif
4281
4282 static void send_panic_events(char *str)
4283 {
4284         struct kernel_ipmi_msg            msg;
4285         ipmi_smi_t                        intf;
4286         unsigned char                     data[16];
4287         struct ipmi_system_interface_addr *si;
4288         struct ipmi_addr                  addr;
4289
4290         si = (struct ipmi_system_interface_addr *) &addr;
4291         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4292         si->channel = IPMI_BMC_CHANNEL;
4293         si->lun = 0;
4294
4295         /* Fill in an event telling that we have failed. */
4296         msg.netfn = 0x04; /* Sensor or Event. */
4297         msg.cmd = 2; /* Platform event command. */
4298         msg.data = data;
4299         msg.data_len = 8;
4300         data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */
4301         data[1] = 0x03; /* This is for IPMI 1.0. */
4302         data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */
4303         data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */
4304         data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */
4305
4306         /*
4307          * Put a few breadcrumbs in.  Hopefully later we can add more things
4308          * to make the panic events more useful.
4309          */
4310         if (str) {
4311                 data[3] = str[0];
4312                 data[6] = str[1];
4313                 data[7] = str[2];
4314         }
4315
4316         /* For every registered interface, send the event. */
4317         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4318                 if (!intf->handlers)
4319                         /* Interface is not ready. */
4320                         continue;
4321
4322                 intf->run_to_completion = 1;
4323                 /* Send the event announcing the panic. */
4324                 intf->handlers->set_run_to_completion(intf->send_info, 1);
4325                 ipmi_panic_request_and_wait(intf, &addr, &msg);
4326         }
4327
4328 #ifdef CONFIG_IPMI_PANIC_STRING
4329         /*
4330          * On every interface, dump a bunch of OEM event holding the
4331          * string.
4332          */
4333         if (!str)
4334                 return;
4335
4336         /* For every registered interface, send the event. */
4337         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4338                 char                  *p = str;
4339                 struct ipmi_ipmb_addr *ipmb;
4340                 int                   j;
4341
4342                 if (intf->intf_num == -1)
4343                         /* Interface was not ready yet. */
4344                         continue;
4345
4346                 /*
4347                  * intf_num is used as an marker to tell if the
4348                  * interface is valid.  Thus we need a read barrier to
4349                  * make sure data fetched before checking intf_num
4350                  * won't be used.
4351                  */
4352                 smp_rmb();
4353
4354                 /*
4355                  * First job here is to figure out where to send the
4356                  * OEM events.  There's no way in IPMI to send OEM
4357                  * events using an event send command, so we have to
4358                  * find the SEL to put them in and stick them in
4359                  * there.
4360                  */
4361
4362                 /* Get capabilities from the get device id. */
4363                 intf->local_sel_device = 0;
4364                 intf->local_event_generator = 0;
4365                 intf->event_receiver = 0;
4366
4367                 /* Request the device info from the local MC. */
4368                 msg.netfn = IPMI_NETFN_APP_REQUEST;
4369                 msg.cmd = IPMI_GET_DEVICE_ID_CMD;
4370                 msg.data = NULL;
4371                 msg.data_len = 0;
4372                 intf->null_user_handler = device_id_fetcher;
4373                 ipmi_panic_request_and_wait(intf, &addr, &msg);
4374
4375                 if (intf->local_event_generator) {
4376                         /* Request the event receiver from the local MC. */
4377                         msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST;
4378                         msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD;
4379                         msg.data = NULL;
4380                         msg.data_len = 0;
4381                         intf->null_user_handler = event_receiver_fetcher;
4382                         ipmi_panic_request_and_wait(intf, &addr, &msg);
4383                 }
4384                 intf->null_user_handler = NULL;
4385
4386                 /*
4387                  * Validate the event receiver.  The low bit must not
4388                  * be 1 (it must be a valid IPMB address), it cannot
4389                  * be zero, and it must not be my address.
4390                  */
4391                 if (((intf->event_receiver & 1) == 0)
4392                     && (intf->event_receiver != 0)
4393                     && (intf->event_receiver != intf->channels[0].address)) {
4394                         /*
4395                          * The event receiver is valid, send an IPMB
4396                          * message.
4397                          */
4398                         ipmb = (struct ipmi_ipmb_addr *) &addr;
4399                         ipmb->addr_type = IPMI_IPMB_ADDR_TYPE;
4400                         ipmb->channel = 0; /* FIXME - is this right? */
4401                         ipmb->lun = intf->event_receiver_lun;
4402                         ipmb->slave_addr = intf->event_receiver;
4403                 } else if (intf->local_sel_device) {
4404                         /*
4405                          * The event receiver was not valid (or was
4406                          * me), but I am an SEL device, just dump it
4407                          * in my SEL.
4408                          */
4409                         si = (struct ipmi_system_interface_addr *) &addr;
4410                         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4411                         si->channel = IPMI_BMC_CHANNEL;
4412                         si->lun = 0;
4413                 } else
4414                         continue; /* No where to send the event. */
4415
4416                 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */
4417                 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD;
4418                 msg.data = data;
4419                 msg.data_len = 16;
4420
4421                 j = 0;
4422                 while (*p) {
4423                         int size = strlen(p);
4424
4425                         if (size > 11)
4426                                 size = 11;
4427                         data[0] = 0;
4428                         data[1] = 0;
4429                         data[2] = 0xf0; /* OEM event without timestamp. */
4430                         data[3] = intf->channels[0].address;
4431                         data[4] = j++; /* sequence # */
4432                         /*
4433                          * Always give 11 bytes, so strncpy will fill
4434                          * it with zeroes for me.
4435                          */
4436                         strncpy(data+5, p, 11);
4437                         p += size;
4438
4439                         ipmi_panic_request_and_wait(intf, &addr, &msg);
4440                 }
4441         }
4442 #endif /* CONFIG_IPMI_PANIC_STRING */
4443 }
4444 #endif /* CONFIG_IPMI_PANIC_EVENT */
4445
4446 static int has_panicked;
4447
4448 static int panic_event(struct notifier_block *this,
4449                        unsigned long         event,
4450                        void                  *ptr)
4451 {
4452         ipmi_smi_t intf;
4453
4454         if (has_panicked)
4455                 return NOTIFY_DONE;
4456         has_panicked = 1;
4457
4458         /* For every registered interface, set it to run to completion. */
4459         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4460                 if (!intf->handlers)
4461                         /* Interface is not ready. */
4462                         continue;
4463
4464                 intf->run_to_completion = 1;
4465                 intf->handlers->set_run_to_completion(intf->send_info, 1);
4466         }
4467
4468 #ifdef CONFIG_IPMI_PANIC_EVENT
4469         send_panic_events(ptr);
4470 #endif
4471
4472         return NOTIFY_DONE;
4473 }
4474
4475 static struct notifier_block panic_block = {
4476         .notifier_call  = panic_event,
4477         .next           = NULL,
4478         .priority       = 200   /* priority: INT_MAX >= x >= 0 */
4479 };
4480
4481 static int ipmi_init_msghandler(void)
4482 {
4483         int rv;
4484
4485         if (initialized)
4486                 return 0;
4487
4488         rv = driver_register(&ipmidriver.driver);
4489         if (rv) {
4490                 printk(KERN_ERR PFX "Could not register IPMI driver\n");
4491                 return rv;
4492         }
4493
4494         printk(KERN_INFO "ipmi message handler version "
4495                IPMI_DRIVER_VERSION "\n");
4496
4497 #ifdef CONFIG_PROC_FS
4498         proc_ipmi_root = proc_mkdir("ipmi", NULL);
4499         if (!proc_ipmi_root) {
4500             printk(KERN_ERR PFX "Unable to create IPMI proc dir");
4501             return -ENOMEM;
4502         }
4503
4504 #endif /* CONFIG_PROC_FS */
4505
4506         setup_timer(&ipmi_timer, ipmi_timeout, 0);
4507         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4508
4509         atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
4510
4511         initialized = 1;
4512
4513         return 0;
4514 }
4515
4516 static int __init ipmi_init_msghandler_mod(void)
4517 {
4518         ipmi_init_msghandler();
4519         return 0;
4520 }
4521
4522 static void __exit cleanup_ipmi(void)
4523 {
4524         int count;
4525
4526         if (!initialized)
4527                 return;
4528
4529         atomic_notifier_chain_unregister(&panic_notifier_list, &panic_block);
4530
4531         /*
4532          * This can't be called if any interfaces exist, so no worry
4533          * about shutting down the interfaces.
4534          */
4535
4536         /*
4537          * Tell the timer to stop, then wait for it to stop.  This
4538          * avoids problems with race conditions removing the timer
4539          * here.
4540          */
4541         atomic_inc(&stop_operation);
4542         del_timer_sync(&ipmi_timer);
4543
4544 #ifdef CONFIG_PROC_FS
4545         remove_proc_entry(proc_ipmi_root->name, NULL);
4546 #endif /* CONFIG_PROC_FS */
4547
4548         driver_unregister(&ipmidriver.driver);
4549
4550         initialized = 0;
4551
4552         /* Check for buffer leaks. */
4553         count = atomic_read(&smi_msg_inuse_count);
4554         if (count != 0)
4555                 printk(KERN_WARNING PFX "SMI message count %d at exit\n",
4556                        count);
4557         count = atomic_read(&recv_msg_inuse_count);
4558         if (count != 0)
4559                 printk(KERN_WARNING PFX "recv message count %d at exit\n",
4560                        count);
4561 }
4562 module_exit(cleanup_ipmi);
4563
4564 module_init(ipmi_init_msghandler_mod);
4565 MODULE_LICENSE("GPL");
4566 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
4567 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI"
4568                    " interface.");
4569 MODULE_VERSION(IPMI_DRIVER_VERSION);