drivers/char/ipmi/ipmi

/* [<][>][^][v][top][bottom][index][help] */
This source file includes following definitions.
ipmi_debug_msg
ipmi_debug_msg
panic_op_write_handler
panic_op_read_handler
acquire_ipmi_user
release_ipmi_user
ipmi_addr_src_to_str
is_lan_addr
is_ipmb_addr
is_ipmb_bcast_addr
free_recv_msg_list
free_smi_msg_list
clean_up_interface_data
intf_free
ipmi_smi_watcher_register
ipmi_smi_watcher_unregister
call_smi_watchers
ipmi_addr_equal
ipmi_validate_addr
ipmi_addr_length
deliver_response
deliver_local_response
deliver_err_response
smi_add_watch
smi_remove_watch
intf_next_seq
intf_find_seq
intf_start_seq_timer
intf_err_seq
free_user_work
ipmi_create_user
ipmi_get_smi_info
free_user
_ipmi_destroy_user
ipmi_destroy_user
ipmi_get_version
ipmi_set_my_address
ipmi_get_my_address
ipmi_set_my_LUN
ipmi_get_my_LUN
ipmi_get_maintenance_mode
maintenance_mode_update
ipmi_set_maintenance_mode
ipmi_set_gets_events
find_cmd_rcvr
is_cmd_rcvr_exclusive
ipmi_register_for_cmd
ipmi_unregister_for_cmd
ipmb_checksum
format_ipmb_msg
format_lan_msg
smi_add_send_msg
smi_send
is_maintenance_mode_cmd
i_ipmi_req_sysintf
i_ipmi_req_ipmb
i_ipmi_req_lan
i_ipmi_request
check_addr
ipmi_request_settime
ipmi_request_supply_msgs
bmc_device_id_handler
send_get_device_id_cmd
__get_device_id
__bmc_get_device_id
bmc_get_device_id
device_id_show
provides_device_sdrs_show
revision_show
firmware_revision_show
ipmi_version_show
add_dev_support_show
manufacturer_id_show
product_id_show
aux_firmware_rev_show
guid_show
bmc_dev_attr_is_visible
__find_bmc_guid
ipmi_find_bmc_guid
__find_bmc_prod_dev_id
ipmi_find_bmc_prod_dev_id
release_bmc_device
cleanup_bmc_work
cleanup_bmc_device
__ipmi_bmc_unregister
ipmi_bmc_unregister
__ipmi_bmc_register
send_guid_cmd
guid_handler
__get_guid
send_channel_info_cmd
channel_handler
__scan_channels
ipmi_poll
ipmi_poll_interface
redo_bmc_reg
ipmi_add_smi
deliver_smi_err_response
cleanup_smi_msgs
ipmi_unregister_smi
handle_ipmb_get_msg_rsp
handle_ipmb_get_msg_cmd
handle_lan_get_msg_rsp
handle_lan_get_msg_cmd
handle_oem_get_msg_cmd
copy_event_into_recv_msg
handle_read_event_rsp
handle_bmc_rsp
handle_one_recv_msg
handle_new_recv_msgs
smi_recv_tasklet
ipmi_smi_msg_received
ipmi_smi_watchdog_pretimeout
smi_from_recv_msg
check_msg_timeout
ipmi_timeout_handler
ipmi_request_event
ipmi_timeout
need_waiter
free_smi_msg
ipmi_alloc_smi_msg
free_recv_msg
ipmi_alloc_recv_msg
ipmi_free_recv_msg
dummy_smi_done_handler
dummy_recv_done_handler
ipmi_panic_request_and_wait
event_receiver_fetcher
device_id_fetcher
send_panic_events
panic_event
ipmi_register_driver
ipmi_init_msghandler
ipmi_init_msghandler_mod
cleanup_ipmi
   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  * ipmi_msghandler.c
   4  *
   5  * Incoming and outgoing message routing for an IPMI interface.
   6  *
   7  * Author: MontaVista Software, Inc.
   8  *         Corey Minyard <minyard@mvista.com>
   9  *         source@mvista.com
  10  *
  11  * Copyright 2002 MontaVista Software Inc.
  12  */
  13 
  14 #define pr_fmt(fmt) "%s" fmt, "IPMI message handler: "
  15 #define dev_fmt pr_fmt
  16 
  17 #include <linux/module.h>
  18 #include <linux/errno.h>
  19 #include <linux/poll.h>
  20 #include <linux/sched.h>
  21 #include <linux/seq_file.h>
  22 #include <linux/spinlock.h>
  23 #include <linux/mutex.h>
  24 #include <linux/slab.h>
  25 #include <linux/ipmi.h>
  26 #include <linux/ipmi_smi.h>
  27 #include <linux/notifier.h>
  28 #include <linux/init.h>
  29 #include <linux/proc_fs.h>
  30 #include <linux/rcupdate.h>
  31 #include <linux/interrupt.h>
  32 #include <linux/moduleparam.h>
  33 #include <linux/workqueue.h>
  34 #include <linux/uuid.h>
  35 #include <linux/nospec.h>
  36 
  37 #define IPMI_DRIVER_VERSION "39.2"
  38 
  39 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);
  40 static int ipmi_init_msghandler(void);
  41 static void smi_recv_tasklet(unsigned long);
  42 static void handle_new_recv_msgs(struct ipmi_smi *intf);
  43 static void need_waiter(struct ipmi_smi *intf);
  44 static int handle_one_recv_msg(struct ipmi_smi *intf,
  45                                struct ipmi_smi_msg *msg);
  46 
  47 #ifdef DEBUG
  48 static void ipmi_debug_msg(const char *title, unsigned char *data,
  49                            unsigned int len)
  50 {
  51         int i, pos;
  52         char buf[100];
  53 
  54         pos = snprintf(buf, sizeof(buf), "%s: ", title);
  55         for (i = 0; i < len; i++)
  56                 pos += snprintf(buf + pos, sizeof(buf) - pos,
  57                                 " %2.2x", data[i]);
  58         pr_debug("%s\n", buf);
  59 }
  60 #else
  61 static void ipmi_debug_msg(const char *title, unsigned char *data,
  62                            unsigned int len)
  63 { }
  64 #endif
  65 
  66 static bool initialized;
  67 static bool drvregistered;
  68 
  69 enum ipmi_panic_event_op {
  70         IPMI_SEND_PANIC_EVENT_NONE,
  71         IPMI_SEND_PANIC_EVENT,
  72         IPMI_SEND_PANIC_EVENT_STRING
  73 };
  74 #ifdef CONFIG_IPMI_PANIC_STRING
  75 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT_STRING
  76 #elif defined(CONFIG_IPMI_PANIC_EVENT)
  77 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT
  78 #else
  79 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT_NONE
  80 #endif
  81 static enum ipmi_panic_event_op ipmi_send_panic_event = IPMI_PANIC_DEFAULT;
  82 
  83 static int panic_op_write_handler(const char *val,
  84                                   const struct kernel_param *kp)
  85 {
  86         char valcp[16];
  87         char *s;
  88 
  89         strncpy(valcp, val, 15);
  90         valcp[15] = '\0';
  91 
  92         s = strstrip(valcp);
  93 
  94         if (strcmp(s, "none") == 0)
  95                 ipmi_send_panic_event = IPMI_SEND_PANIC_EVENT_NONE;
  96         else if (strcmp(s, "event") == 0)
  97                 ipmi_send_panic_event = IPMI_SEND_PANIC_EVENT;
  98         else if (strcmp(s, "string") == 0)
  99                 ipmi_send_panic_event = IPMI_SEND_PANIC_EVENT_STRING;
 100         else
 101                 return -EINVAL;
 102 
 103         return 0;
 104 }
 105 
 106 static int panic_op_read_handler(char *buffer, const struct kernel_param *kp)
 107 {
 108         switch (ipmi_send_panic_event) {
 109         case IPMI_SEND_PANIC_EVENT_NONE:
 110                 strcpy(buffer, "none");
 111                 break;
 112 
 113         case IPMI_SEND_PANIC_EVENT:
 114                 strcpy(buffer, "event");
 115                 break;
 116 
 117         case IPMI_SEND_PANIC_EVENT_STRING:
 118                 strcpy(buffer, "string");
 119                 break;
 120 
 121         default:
 122                 strcpy(buffer, "???");
 123                 break;
 124         }
 125 
 126         return strlen(buffer);
 127 }
 128 
 129 static const struct kernel_param_ops panic_op_ops = {
 130         .set = panic_op_write_handler,
 131         .get = panic_op_read_handler
 132 };
 133 module_param_cb(panic_op, &panic_op_ops, NULL, 0600);
 134 MODULE_PARM_DESC(panic_op, "Sets if the IPMI driver will attempt to store panic information in the event log in the event of a panic.  Set to 'none' for no, 'event' for a single event, or 'string' for a generic event and the panic string in IPMI OEM events.");
 135 
 136 
 137 #define MAX_EVENTS_IN_QUEUE     25
 138 
 139 /* Remain in auto-maintenance mode for this amount of time (in ms). */
 140 static unsigned long maintenance_mode_timeout_ms = 30000;
 141 module_param(maintenance_mode_timeout_ms, ulong, 0644);
 142 MODULE_PARM_DESC(maintenance_mode_timeout_ms,
 143                  "The time (milliseconds) after the last maintenance message that the connection stays in maintenance mode.");
 144 
 145 /*
 146  * Don't let a message sit in a queue forever, always time it with at lest
 147  * the max message timer.  This is in milliseconds.
 148  */
 149 #define MAX_MSG_TIMEOUT         60000
 150 
 151 /*
 152  * Timeout times below are in milliseconds, and are done off a 1
 153  * second timer.  So setting the value to 1000 would mean anything
 154  * between 0 and 1000ms.  So really the only reasonable minimum
 155  * setting it 2000ms, which is between 1 and 2 seconds.
 156  */
 157 
 158 /* The default timeout for message retries. */
 159 static unsigned long default_retry_ms = 2000;
 160 module_param(default_retry_ms, ulong, 0644);
 161 MODULE_PARM_DESC(default_retry_ms,
 162                  "The time (milliseconds) between retry sends");
 163 
 164 /* The default timeout for maintenance mode message retries. */
 165 static unsigned long default_maintenance_retry_ms = 3000;
 166 module_param(default_maintenance_retry_ms, ulong, 0644);
 167 MODULE_PARM_DESC(default_maintenance_retry_ms,
 168                  "The time (milliseconds) between retry sends in maintenance mode");
 169 
 170 /* The default maximum number of retries */
 171 static unsigned int default_max_retries = 4;
 172 module_param(default_max_retries, uint, 0644);
 173 MODULE_PARM_DESC(default_max_retries,
 174                  "The time (milliseconds) between retry sends in maintenance mode");
 175 
 176 /* Call every ~1000 ms. */
 177 #define IPMI_TIMEOUT_TIME       1000
 178 
 179 /* How many jiffies does it take to get to the timeout time. */
 180 #define IPMI_TIMEOUT_JIFFIES    ((IPMI_TIMEOUT_TIME * HZ) / 1000)
 181 
 182 /*
 183  * Request events from the queue every second (this is the number of
 184  * IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the
 185  * future, IPMI will add a way to know immediately if an event is in
 186  * the queue and this silliness can go away.
 187  */
 188 #define IPMI_REQUEST_EV_TIME    (1000 / (IPMI_TIMEOUT_TIME))
 189 
 190 /* How long should we cache dynamic device IDs? */
 191 #define IPMI_DYN_DEV_ID_EXPIRY  (10 * HZ)
 192 
 193 /*
 194  * The main "user" data structure.
 195  */
 196 struct ipmi_user {
 197         struct list_head link;
 198 
 199         /*
 200          * Set to NULL when the user is destroyed, a pointer to myself
 201          * so srcu_dereference can be used on it.
 202          */
 203         struct ipmi_user *self;
 204         struct srcu_struct release_barrier;
 205 
 206         struct kref refcount;
 207 
 208         /* The upper layer that handles receive messages. */
 209         const struct ipmi_user_hndl *handler;
 210         void             *handler_data;
 211 
 212         /* The interface this user is bound to. */
 213         struct ipmi_smi *intf;
 214 
 215         /* Does this interface receive IPMI events? */
 216         bool gets_events;
 217 
 218         /* Free must run in process context for RCU cleanup. */
 219         struct work_struct remove_work;
 220 };
 221 
 222 static struct ipmi_user *acquire_ipmi_user(struct ipmi_user *user, int *index)
 223         __acquires(user->release_barrier)
 224 {
 225         struct ipmi_user *ruser;
 226 
 227         *index = srcu_read_lock(&user->release_barrier);
 228         ruser = srcu_dereference(user->self, &user->release_barrier);
 229         if (!ruser)
 230                 srcu_read_unlock(&user->release_barrier, *index);
 231         return ruser;
 232 }
 233 
 234 static void release_ipmi_user(struct ipmi_user *user, int index)
 235 {
 236         srcu_read_unlock(&user->release_barrier, index);
 237 }
 238 
 239 struct cmd_rcvr {
 240         struct list_head link;
 241 
 242         struct ipmi_user *user;
 243         unsigned char netfn;
 244         unsigned char cmd;
 245         unsigned int  chans;
 246 
 247         /*
 248          * This is used to form a linked lised during mass deletion.
 249          * Since this is in an RCU list, we cannot use the link above
 250          * or change any data until the RCU period completes.  So we
 251          * use this next variable during mass deletion so we can have
 252          * a list and don't have to wait and restart the search on
 253          * every individual deletion of a command.
 254          */
 255         struct cmd_rcvr *next;
 256 };
 257 
 258 struct seq_table {
 259         unsigned int         inuse : 1;
 260         unsigned int         broadcast : 1;
 261 
 262         unsigned long        timeout;
 263         unsigned long        orig_timeout;
 264         unsigned int         retries_left;
 265 
 266         /*
 267          * To verify on an incoming send message response that this is
 268          * the message that the response is for, we keep a sequence id
 269          * and increment it every time we send a message.
 270          */
 271         long                 seqid;
 272 
 273         /*
 274          * This is held so we can properly respond to the message on a
 275          * timeout, and it is used to hold the temporary data for
 276          * retransmission, too.
 277          */
 278         struct ipmi_recv_msg *recv_msg;
 279 };
 280 
 281 /*
 282  * Store the information in a msgid (long) to allow us to find a
 283  * sequence table entry from the msgid.
 284  */
 285 #define STORE_SEQ_IN_MSGID(seq, seqid) \
 286         ((((seq) & 0x3f) << 26) | ((seqid) & 0x3ffffff))
 287 
 288 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \
 289         do {                                                            \
 290                 seq = (((msgid) >> 26) & 0x3f);                         \
 291                 seqid = ((msgid) & 0x3ffffff);                          \
 292         } while (0)
 293 
 294 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3ffffff)
 295 
 296 #define IPMI_MAX_CHANNELS       16
 297 struct ipmi_channel {
 298         unsigned char medium;
 299         unsigned char protocol;
 300 };
 301 
 302 struct ipmi_channel_set {
 303         struct ipmi_channel c[IPMI_MAX_CHANNELS];
 304 };
 305 
 306 struct ipmi_my_addrinfo {
 307         /*
 308          * My slave address.  This is initialized to IPMI_BMC_SLAVE_ADDR,
 309          * but may be changed by the user.
 310          */
 311         unsigned char address;
 312 
 313         /*
 314          * My LUN.  This should generally stay the SMS LUN, but just in
 315          * case...
 316          */
 317         unsigned char lun;
 318 };
 319 
 320 /*
 321  * Note that the product id, manufacturer id, guid, and device id are
 322  * immutable in this structure, so dyn_mutex is not required for
 323  * accessing those.  If those change on a BMC, a new BMC is allocated.
 324  */
 325 struct bmc_device {
 326         struct platform_device pdev;
 327         struct list_head       intfs; /* Interfaces on this BMC. */
 328         struct ipmi_device_id  id;
 329         struct ipmi_device_id  fetch_id;
 330         int                    dyn_id_set;
 331         unsigned long          dyn_id_expiry;
 332         struct mutex           dyn_mutex; /* Protects id, intfs, & dyn* */
 333         guid_t                 guid;
 334         guid_t                 fetch_guid;
 335         int                    dyn_guid_set;
 336         struct kref            usecount;
 337         struct work_struct     remove_work;
 338 };
 339 #define to_bmc_device(x) container_of((x), struct bmc_device, pdev.dev)
 340 
 341 static int bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
 342                              struct ipmi_device_id *id,
 343                              bool *guid_set, guid_t *guid);
 344 
 345 /*
 346  * Various statistics for IPMI, these index stats[] in the ipmi_smi
 347  * structure.
 348  */
 349 enum ipmi_stat_indexes {
 350         /* Commands we got from the user that were invalid. */
 351         IPMI_STAT_sent_invalid_commands = 0,
 352 
 353         /* Commands we sent to the MC. */
 354         IPMI_STAT_sent_local_commands,
 355 
 356         /* Responses from the MC that were delivered to a user. */
 357         IPMI_STAT_handled_local_responses,
 358 
 359         /* Responses from the MC that were not delivered to a user. */
 360         IPMI_STAT_unhandled_local_responses,
 361 
 362         /* Commands we sent out to the IPMB bus. */
 363         IPMI_STAT_sent_ipmb_commands,
 364 
 365         /* Commands sent on the IPMB that had errors on the SEND CMD */
 366         IPMI_STAT_sent_ipmb_command_errs,
 367 
 368         /* Each retransmit increments this count. */
 369         IPMI_STAT_retransmitted_ipmb_commands,
 370 
 371         /*
 372          * When a message times out (runs out of retransmits) this is
 373          * incremented.
 374          */
 375         IPMI_STAT_timed_out_ipmb_commands,
 376 
 377         /*
 378          * This is like above, but for broadcasts.  Broadcasts are
 379          * *not* included in the above count (they are expected to
 380          * time out).
 381          */
 382         IPMI_STAT_timed_out_ipmb_broadcasts,
 383 
 384         /* Responses I have sent to the IPMB bus. */
 385         IPMI_STAT_sent_ipmb_responses,
 386 
 387         /* The response was delivered to the user. */
 388         IPMI_STAT_handled_ipmb_responses,
 389 
 390         /* The response had invalid data in it. */
 391         IPMI_STAT_invalid_ipmb_responses,
 392 
 393         /* The response didn't have anyone waiting for it. */
 394         IPMI_STAT_unhandled_ipmb_responses,
 395 
 396         /* Commands we sent out to the IPMB bus. */
 397         IPMI_STAT_sent_lan_commands,
 398 
 399         /* Commands sent on the IPMB that had errors on the SEND CMD */
 400         IPMI_STAT_sent_lan_command_errs,
 401 
 402         /* Each retransmit increments this count. */
 403         IPMI_STAT_retransmitted_lan_commands,
 404 
 405         /*
 406          * When a message times out (runs out of retransmits) this is
 407          * incremented.
 408          */
 409         IPMI_STAT_timed_out_lan_commands,
 410 
 411         /* Responses I have sent to the IPMB bus. */
 412         IPMI_STAT_sent_lan_responses,
 413 
 414         /* The response was delivered to the user. */
 415         IPMI_STAT_handled_lan_responses,
 416 
 417         /* The response had invalid data in it. */
 418         IPMI_STAT_invalid_lan_responses,
 419 
 420         /* The response didn't have anyone waiting for it. */
 421         IPMI_STAT_unhandled_lan_responses,
 422 
 423         /* The command was delivered to the user. */
 424         IPMI_STAT_handled_commands,
 425 
 426         /* The command had invalid data in it. */
 427         IPMI_STAT_invalid_commands,
 428 
 429         /* The command didn't have anyone waiting for it. */
 430         IPMI_STAT_unhandled_commands,
 431 
 432         /* Invalid data in an event. */
 433         IPMI_STAT_invalid_events,
 434 
 435         /* Events that were received with the proper format. */
 436         IPMI_STAT_events,
 437 
 438         /* Retransmissions on IPMB that failed. */
 439         IPMI_STAT_dropped_rexmit_ipmb_commands,
 440 
 441         /* Retransmissions on LAN that failed. */
 442         IPMI_STAT_dropped_rexmit_lan_commands,
 443 
 444         /* This *must* remain last, add new values above this. */
 445         IPMI_NUM_STATS
 446 };
 447 
 448 
 449 #define IPMI_IPMB_NUM_SEQ       64
 450 struct ipmi_smi {
 451         struct module *owner;
 452 
 453         /* What interface number are we? */
 454         int intf_num;
 455 
 456         struct kref refcount;
 457 
 458         /* Set when the interface is being unregistered. */
 459         bool in_shutdown;
 460 
 461         /* Used for a list of interfaces. */
 462         struct list_head link;
 463 
 464         /*
 465          * The list of upper layers that are using me.  seq_lock write
 466          * protects this.  Read protection is with srcu.
 467          */
 468         struct list_head users;
 469         struct srcu_struct users_srcu;
 470 
 471         /* Used for wake ups at startup. */
 472         wait_queue_head_t waitq;
 473 
 474         /*
 475          * Prevents the interface from being unregistered when the
 476          * interface is used by being looked up through the BMC
 477          * structure.
 478          */
 479         struct mutex bmc_reg_mutex;
 480 
 481         struct bmc_device tmp_bmc;
 482         struct bmc_device *bmc;
 483         bool bmc_registered;
 484         struct list_head bmc_link;
 485         char *my_dev_name;
 486         bool in_bmc_register;  /* Handle recursive situations.  Yuck. */
 487         struct work_struct bmc_reg_work;
 488 
 489         const struct ipmi_smi_handlers *handlers;
 490         void                     *send_info;
 491 
 492         /* Driver-model device for the system interface. */
 493         struct device          *si_dev;
 494 
 495         /*
 496          * A table of sequence numbers for this interface.  We use the
 497          * sequence numbers for IPMB messages that go out of the
 498          * interface to match them up with their responses.  A routine
 499          * is called periodically to time the items in this list.
 500          */
 501         spinlock_t       seq_lock;
 502         struct seq_table seq_table[IPMI_IPMB_NUM_SEQ];
 503         int curr_seq;
 504 
 505         /*
 506          * Messages queued for delivery.  If delivery fails (out of memory
 507          * for instance), They will stay in here to be processed later in a
 508          * periodic timer interrupt.  The tasklet is for handling received
 509          * messages directly from the handler.
 510          */
 511         spinlock_t       waiting_rcv_msgs_lock;
 512         struct list_head waiting_rcv_msgs;
 513         atomic_t         watchdog_pretimeouts_to_deliver;
 514         struct tasklet_struct recv_tasklet;
 515 
 516         spinlock_t             xmit_msgs_lock;
 517         struct list_head       xmit_msgs;
 518         struct ipmi_smi_msg    *curr_msg;
 519         struct list_head       hp_xmit_msgs;
 520 
 521         /*
 522          * The list of command receivers that are registered for commands
 523          * on this interface.
 524          */
 525         struct mutex     cmd_rcvrs_mutex;
 526         struct list_head cmd_rcvrs;
 527 
 528         /*
 529          * Events that were queues because no one was there to receive
 530          * them.
 531          */
 532         spinlock_t       events_lock; /* For dealing with event stuff. */
 533         struct list_head waiting_events;
 534         unsigned int     waiting_events_count; /* How many events in queue? */
 535         char             delivering_events;
 536         char             event_msg_printed;
 537 
 538         /* How many users are waiting for events? */
 539         atomic_t         event_waiters;
 540         unsigned int     ticks_to_req_ev;
 541 
 542         spinlock_t       watch_lock; /* For dealing with watch stuff below. */
 543 
 544         /* How many users are waiting for commands? */
 545         unsigned int     command_waiters;
 546 
 547         /* How many users are waiting for watchdogs? */
 548         unsigned int     watchdog_waiters;
 549 
 550         /* How many users are waiting for message responses? */
 551         unsigned int     response_waiters;
 552 
 553         /*
 554          * Tells what the lower layer has last been asked to watch for,
 555          * messages and/or watchdogs.  Protected by watch_lock.
 556          */
 557         unsigned int     last_watch_mask;
 558 
 559         /*
 560          * The event receiver for my BMC, only really used at panic
 561          * shutdown as a place to store this.
 562          */
 563         unsigned char event_receiver;
 564         unsigned char event_receiver_lun;
 565         unsigned char local_sel_device;
 566         unsigned char local_event_generator;
 567 
 568         /* For handling of maintenance mode. */
 569         int maintenance_mode;
 570         bool maintenance_mode_enable;
 571         int auto_maintenance_timeout;
 572         spinlock_t maintenance_mode_lock; /* Used in a timer... */
 573 
 574         /*
 575          * If we are doing maintenance on something on IPMB, extend
 576          * the timeout time to avoid timeouts writing firmware and
 577          * such.
 578          */
 579         int ipmb_maintenance_mode_timeout;
 580 
 581         /*
 582          * A cheap hack, if this is non-null and a message to an
 583          * interface comes in with a NULL user, call this routine with
 584          * it.  Note that the message will still be freed by the
 585          * caller.  This only works on the system interface.
 586          *
 587          * Protected by bmc_reg_mutex.
 588          */
 589         void (*null_user_handler)(struct ipmi_smi *intf,
 590                                   struct ipmi_recv_msg *msg);
 591 
 592         /*
 593          * When we are scanning the channels for an SMI, this will
 594          * tell which channel we are scanning.
 595          */
 596         int curr_channel;
 597 
 598         /* Channel information */
 599         struct ipmi_channel_set *channel_list;
 600         unsigned int curr_working_cset; /* First index into the following. */
 601         struct ipmi_channel_set wchannels[2];
 602         struct ipmi_my_addrinfo addrinfo[IPMI_MAX_CHANNELS];
 603         bool channels_ready;
 604 
 605         atomic_t stats[IPMI_NUM_STATS];
 606 
 607         /*
 608          * run_to_completion duplicate of smb_info, smi_info
 609          * and ipmi_serial_info structures. Used to decrease numbers of
 610          * parameters passed by "low" level IPMI code.
 611          */
 612         int run_to_completion;
 613 };
 614 #define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev)
 615 
 616 static void __get_guid(struct ipmi_smi *intf);
 617 static void __ipmi_bmc_unregister(struct ipmi_smi *intf);
 618 static int __ipmi_bmc_register(struct ipmi_smi *intf,
 619                                struct ipmi_device_id *id,
 620                                bool guid_set, guid_t *guid, int intf_num);
 621 static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id);
 622 
 623 
 624 /**
 625  * The driver model view of the IPMI messaging driver.
 626  */
 627 static struct platform_driver ipmidriver = {
 628         .driver = {
 629                 .name = "ipmi",
 630                 .bus = &platform_bus_type
 631         }
 632 };
 633 /*
 634  * This mutex keeps us from adding the same BMC twice.
 635  */
 636 static DEFINE_MUTEX(ipmidriver_mutex);
 637 
 638 static LIST_HEAD(ipmi_interfaces);
 639 static DEFINE_MUTEX(ipmi_interfaces_mutex);
 640 static struct srcu_struct ipmi_interfaces_srcu;
 641 
 642 /*
 643  * List of watchers that want to know when smi's are added and deleted.
 644  */
 645 static LIST_HEAD(smi_watchers);
 646 static DEFINE_MUTEX(smi_watchers_mutex);
 647 
 648 #define ipmi_inc_stat(intf, stat) \
 649         atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
 650 #define ipmi_get_stat(intf, stat) \
 651         ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
 652 
 653 static const char * const addr_src_to_str[] = {
 654         "invalid", "hotmod", "hardcoded", "SPMI", "ACPI", "SMBIOS", "PCI",
 655         "device-tree", "platform"
 656 };
 657 
 658 const char *ipmi_addr_src_to_str(enum ipmi_addr_src src)
 659 {
 660         if (src >= SI_LAST)
 661                 src = 0; /* Invalid */
 662         return addr_src_to_str[src];
 663 }
 664 EXPORT_SYMBOL(ipmi_addr_src_to_str);
 665 
 666 static int is_lan_addr(struct ipmi_addr *addr)
 667 {
 668         return addr->addr_type == IPMI_LAN_ADDR_TYPE;
 669 }
 670 
 671 static int is_ipmb_addr(struct ipmi_addr *addr)
 672 {
 673         return addr->addr_type == IPMI_IPMB_ADDR_TYPE;
 674 }
 675 
 676 static int is_ipmb_bcast_addr(struct ipmi_addr *addr)
 677 {
 678         return addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE;
 679 }
 680 
 681 static void free_recv_msg_list(struct list_head *q)
 682 {
 683         struct ipmi_recv_msg *msg, *msg2;
 684 
 685         list_for_each_entry_safe(msg, msg2, q, link) {
 686                 list_del(&msg->link);
 687                 ipmi_free_recv_msg(msg);
 688         }
 689 }
 690 
 691 static void free_smi_msg_list(struct list_head *q)
 692 {
 693         struct ipmi_smi_msg *msg, *msg2;
 694 
 695         list_for_each_entry_safe(msg, msg2, q, link) {
 696                 list_del(&msg->link);
 697                 ipmi_free_smi_msg(msg);
 698         }
 699 }
 700 
 701 static void clean_up_interface_data(struct ipmi_smi *intf)
 702 {
 703         int              i;
 704         struct cmd_rcvr  *rcvr, *rcvr2;
 705         struct list_head list;
 706 
 707         tasklet_kill(&intf->recv_tasklet);
 708 
 709         free_smi_msg_list(&intf->waiting_rcv_msgs);
 710         free_recv_msg_list(&intf->waiting_events);
 711 
 712         /*
 713          * Wholesale remove all the entries from the list in the
 714          * interface and wait for RCU to know that none are in use.
 715          */
 716         mutex_lock(&intf->cmd_rcvrs_mutex);
 717         INIT_LIST_HEAD(&list);
 718         list_splice_init_rcu(&intf->cmd_rcvrs, &list, synchronize_rcu);
 719         mutex_unlock(&intf->cmd_rcvrs_mutex);
 720 
 721         list_for_each_entry_safe(rcvr, rcvr2, &list, link)
 722                 kfree(rcvr);
 723 
 724         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
 725                 if ((intf->seq_table[i].inuse)
 726                                         && (intf->seq_table[i].recv_msg))
 727                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
 728         }
 729 }
 730 
 731 static void intf_free(struct kref *ref)
 732 {
 733         struct ipmi_smi *intf = container_of(ref, struct ipmi_smi, refcount);
 734 
 735         clean_up_interface_data(intf);
 736         kfree(intf);
 737 }
 738 
 739 struct watcher_entry {
 740         int              intf_num;
 741         struct ipmi_smi  *intf;
 742         struct list_head link;
 743 };
 744 
 745 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 746 {
 747         struct ipmi_smi *intf;
 748         int index, rv;
 749 
 750         /*
 751          * Make sure the driver is actually initialized, this handles
 752          * problems with initialization order.
 753          */
 754         rv = ipmi_init_msghandler();
 755         if (rv)
 756                 return rv;
 757 
 758         mutex_lock(&smi_watchers_mutex);
 759 
 760         list_add(&watcher->link, &smi_watchers);
 761 
 762         index = srcu_read_lock(&ipmi_interfaces_srcu);
 763         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
 764                 int intf_num = READ_ONCE(intf->intf_num);
 765 
 766                 if (intf_num == -1)
 767                         continue;
 768                 watcher->new_smi(intf_num, intf->si_dev);
 769         }
 770         srcu_read_unlock(&ipmi_interfaces_srcu, index);
 771 
 772         mutex_unlock(&smi_watchers_mutex);
 773 
 774         return 0;
 775 }
 776 EXPORT_SYMBOL(ipmi_smi_watcher_register);
 777 
 778 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher)
 779 {
 780         mutex_lock(&smi_watchers_mutex);
 781         list_del(&watcher->link);
 782         mutex_unlock(&smi_watchers_mutex);
 783         return 0;
 784 }
 785 EXPORT_SYMBOL(ipmi_smi_watcher_unregister);
 786 
 787 /*
 788  * Must be called with smi_watchers_mutex held.
 789  */
 790 static void
 791 call_smi_watchers(int i, struct device *dev)
 792 {
 793         struct ipmi_smi_watcher *w;
 794 
 795         mutex_lock(&smi_watchers_mutex);
 796         list_for_each_entry(w, &smi_watchers, link) {
 797                 if (try_module_get(w->owner)) {
 798                         w->new_smi(i, dev);
 799                         module_put(w->owner);
 800                 }
 801         }
 802         mutex_unlock(&smi_watchers_mutex);
 803 }
 804 
 805 static int
 806 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)
 807 {
 808         if (addr1->addr_type != addr2->addr_type)
 809                 return 0;
 810 
 811         if (addr1->channel != addr2->channel)
 812                 return 0;
 813 
 814         if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 815                 struct ipmi_system_interface_addr *smi_addr1
 816                     = (struct ipmi_system_interface_addr *) addr1;
 817                 struct ipmi_system_interface_addr *smi_addr2
 818                     = (struct ipmi_system_interface_addr *) addr2;
 819                 return (smi_addr1->lun == smi_addr2->lun);
 820         }
 821 
 822         if (is_ipmb_addr(addr1) || is_ipmb_bcast_addr(addr1)) {
 823                 struct ipmi_ipmb_addr *ipmb_addr1
 824                     = (struct ipmi_ipmb_addr *) addr1;
 825                 struct ipmi_ipmb_addr *ipmb_addr2
 826                     = (struct ipmi_ipmb_addr *) addr2;
 827 
 828                 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr)
 829                         && (ipmb_addr1->lun == ipmb_addr2->lun));
 830         }
 831 
 832         if (is_lan_addr(addr1)) {
 833                 struct ipmi_lan_addr *lan_addr1
 834                         = (struct ipmi_lan_addr *) addr1;
 835                 struct ipmi_lan_addr *lan_addr2
 836                     = (struct ipmi_lan_addr *) addr2;
 837 
 838                 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID)
 839                         && (lan_addr1->local_SWID == lan_addr2->local_SWID)
 840                         && (lan_addr1->session_handle
 841                             == lan_addr2->session_handle)
 842                         && (lan_addr1->lun == lan_addr2->lun));
 843         }
 844 
 845         return 1;
 846 }
 847 
 848 int ipmi_validate_addr(struct ipmi_addr *addr, int len)
 849 {
 850         if (len < sizeof(struct ipmi_system_interface_addr))
 851                 return -EINVAL;
 852 
 853         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 854                 if (addr->channel != IPMI_BMC_CHANNEL)
 855                         return -EINVAL;
 856                 return 0;
 857         }
 858 
 859         if ((addr->channel == IPMI_BMC_CHANNEL)
 860             || (addr->channel >= IPMI_MAX_CHANNELS)
 861             || (addr->channel < 0))
 862                 return -EINVAL;
 863 
 864         if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
 865                 if (len < sizeof(struct ipmi_ipmb_addr))
 866                         return -EINVAL;
 867                 return 0;
 868         }
 869 
 870         if (is_lan_addr(addr)) {
 871                 if (len < sizeof(struct ipmi_lan_addr))
 872                         return -EINVAL;
 873                 return 0;
 874         }
 875 
 876         return -EINVAL;
 877 }
 878 EXPORT_SYMBOL(ipmi_validate_addr);
 879 
 880 unsigned int ipmi_addr_length(int addr_type)
 881 {
 882         if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
 883                 return sizeof(struct ipmi_system_interface_addr);
 884 
 885         if ((addr_type == IPMI_IPMB_ADDR_TYPE)
 886                         || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 887                 return sizeof(struct ipmi_ipmb_addr);
 888 
 889         if (addr_type == IPMI_LAN_ADDR_TYPE)
 890                 return sizeof(struct ipmi_lan_addr);
 891 
 892         return 0;
 893 }
 894 EXPORT_SYMBOL(ipmi_addr_length);
 895 
 896 static int deliver_response(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
 897 {
 898         int rv = 0;
 899 
 900         if (!msg->user) {
 901                 /* Special handling for NULL users. */
 902                 if (intf->null_user_handler) {
 903                         intf->null_user_handler(intf, msg);
 904                 } else {
 905                         /* No handler, so give up. */
 906                         rv = -EINVAL;
 907                 }
 908                 ipmi_free_recv_msg(msg);
 909         } else if (oops_in_progress) {
 910                 /*
 911                  * If we are running in the panic context, calling the
 912                  * receive handler doesn't much meaning and has a deadlock
 913                  * risk.  At this moment, simply skip it in that case.
 914                  */
 915                 ipmi_free_recv_msg(msg);
 916         } else {
 917                 int index;
 918                 struct ipmi_user *user = acquire_ipmi_user(msg->user, &index);
 919 
 920                 if (user) {
 921                         user->handler->ipmi_recv_hndl(msg, user->handler_data);
 922                         release_ipmi_user(user, index);
 923                 } else {
 924                         /* User went away, give up. */
 925                         ipmi_free_recv_msg(msg);
 926                         rv = -EINVAL;
 927                 }
 928         }
 929 
 930         return rv;
 931 }
 932 
 933 static void deliver_local_response(struct ipmi_smi *intf,
 934                                    struct ipmi_recv_msg *msg)
 935 {
 936         if (deliver_response(intf, msg))
 937                 ipmi_inc_stat(intf, unhandled_local_responses);
 938         else
 939                 ipmi_inc_stat(intf, handled_local_responses);
 940 }
 941 
 942 static void deliver_err_response(struct ipmi_smi *intf,
 943                                  struct ipmi_recv_msg *msg, int err)
 944 {
 945         msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
 946         msg->msg_data[0] = err;
 947         msg->msg.netfn |= 1; /* Convert to a response. */
 948         msg->msg.data_len = 1;
 949         msg->msg.data = msg->msg_data;
 950         deliver_local_response(intf, msg);
 951 }
 952 
 953 static void smi_add_watch(struct ipmi_smi *intf, unsigned int flags)
 954 {
 955         unsigned long iflags;
 956 
 957         if (!intf->handlers->set_need_watch)
 958                 return;
 959 
 960         spin_lock_irqsave(&intf->watch_lock, iflags);
 961         if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES)
 962                 intf->response_waiters++;
 963 
 964         if (flags & IPMI_WATCH_MASK_CHECK_WATCHDOG)
 965                 intf->watchdog_waiters++;
 966 
 967         if (flags & IPMI_WATCH_MASK_CHECK_COMMANDS)
 968                 intf->command_waiters++;
 969 
 970         if ((intf->last_watch_mask & flags) != flags) {
 971                 intf->last_watch_mask |= flags;
 972                 intf->handlers->set_need_watch(intf->send_info,
 973                                                intf->last_watch_mask);
 974         }
 975         spin_unlock_irqrestore(&intf->watch_lock, iflags);
 976 }
 977 
 978 static void smi_remove_watch(struct ipmi_smi *intf, unsigned int flags)
 979 {
 980         unsigned long iflags;
 981 
 982         if (!intf->handlers->set_need_watch)
 983                 return;
 984 
 985         spin_lock_irqsave(&intf->watch_lock, iflags);
 986         if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES)
 987                 intf->response_waiters--;
 988 
 989         if (flags & IPMI_WATCH_MASK_CHECK_WATCHDOG)
 990                 intf->watchdog_waiters--;
 991 
 992         if (flags & IPMI_WATCH_MASK_CHECK_COMMANDS)
 993                 intf->command_waiters--;
 994 
 995         flags = 0;
 996         if (intf->response_waiters)
 997                 flags |= IPMI_WATCH_MASK_CHECK_MESSAGES;
 998         if (intf->watchdog_waiters)
 999                 flags |= IPMI_WATCH_MASK_CHECK_WATCHDOG;
1000         if (intf->command_waiters)
1001                 flags |= IPMI_WATCH_MASK_CHECK_COMMANDS;
1002 
1003         if (intf->last_watch_mask != flags) {
1004                 intf->last_watch_mask = flags;
1005                 intf->handlers->set_need_watch(intf->send_info,
1006                                                intf->last_watch_mask);
1007         }
1008         spin_unlock_irqrestore(&intf->watch_lock, iflags);
1009 }
1010 
1011 /*
1012  * Find the next sequence number not being used and add the given
1013  * message with the given timeout to the sequence table.  This must be
1014  * called with the interface's seq_lock held.
1015  */
1016 static int intf_next_seq(struct ipmi_smi      *intf,
1017                          struct ipmi_recv_msg *recv_msg,
1018                          unsigned long        timeout,
1019                          int                  retries,
1020                          int                  broadcast,
1021                          unsigned char        *seq,
1022                          long                 *seqid)
1023 {
1024         int          rv = 0;
1025         unsigned int i;
1026 
1027         if (timeout == 0)
1028                 timeout = default_retry_ms;
1029         if (retries < 0)
1030                 retries = default_max_retries;
1031 
1032         for (i = intf->curr_seq; (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;
1033                                         i = (i+1)%IPMI_IPMB_NUM_SEQ) {
1034                 if (!intf->seq_table[i].inuse)
1035                         break;
1036         }
1037 
1038         if (!intf->seq_table[i].inuse) {
1039                 intf->seq_table[i].recv_msg = recv_msg;
1040 
1041                 /*
1042                  * Start with the maximum timeout, when the send response
1043                  * comes in we will start the real timer.
1044                  */
1045                 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT;
1046                 intf->seq_table[i].orig_timeout = timeout;
1047                 intf->seq_table[i].retries_left = retries;
1048                 intf->seq_table[i].broadcast = broadcast;
1049                 intf->seq_table[i].inuse = 1;
1050                 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid);
1051                 *seq = i;
1052                 *seqid = intf->seq_table[i].seqid;
1053                 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
1054                 smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);
1055                 need_waiter(intf);
1056         } else {
1057                 rv = -EAGAIN;
1058         }
1059 
1060         return rv;
1061 }
1062 
1063 /*
1064  * Return the receive message for the given sequence number and
1065  * release the sequence number so it can be reused.  Some other data
1066  * is passed in to be sure the message matches up correctly (to help
1067  * guard against message coming in after their timeout and the
1068  * sequence number being reused).
1069  */
1070 static int intf_find_seq(struct ipmi_smi      *intf,
1071                          unsigned char        seq,
1072                          short                channel,
1073                          unsigned char        cmd,
1074                          unsigned char        netfn,
1075                          struct ipmi_addr     *addr,
1076                          struct ipmi_recv_msg **recv_msg)
1077 {
1078         int           rv = -ENODEV;
1079         unsigned long flags;
1080 
1081         if (seq >= IPMI_IPMB_NUM_SEQ)
1082                 return -EINVAL;
1083 
1084         spin_lock_irqsave(&intf->seq_lock, flags);
1085         if (intf->seq_table[seq].inuse) {
1086                 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg;
1087 
1088                 if ((msg->addr.channel == channel) && (msg->msg.cmd == cmd)
1089                                 && (msg->msg.netfn == netfn)
1090                                 && (ipmi_addr_equal(addr, &msg->addr))) {
1091                         *recv_msg = msg;
1092                         intf->seq_table[seq].inuse = 0;
1093                         smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);
1094                         rv = 0;
1095                 }
1096         }
1097         spin_unlock_irqrestore(&intf->seq_lock, flags);
1098 
1099         return rv;
1100 }
1101 
1102 
1103 /* Start the timer for a specific sequence table entry. */
1104 static int intf_start_seq_timer(struct ipmi_smi *intf,
1105                                 long       msgid)
1106 {
1107         int           rv = -ENODEV;
1108         unsigned long flags;
1109         unsigned char seq;
1110         unsigned long seqid;
1111 
1112 
1113         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
1114 
1115         spin_lock_irqsave(&intf->seq_lock, flags);
1116         /*
1117          * We do this verification because the user can be deleted
1118          * while a message is outstanding.
1119          */
1120         if ((intf->seq_table[seq].inuse)
1121                                 && (intf->seq_table[seq].seqid == seqid)) {
1122                 struct seq_table *ent = &intf->seq_table[seq];
1123                 ent->timeout = ent->orig_timeout;
1124                 rv = 0;
1125         }
1126         spin_unlock_irqrestore(&intf->seq_lock, flags);
1127 
1128         return rv;
1129 }
1130 
1131 /* Got an error for the send message for a specific sequence number. */
1132 static int intf_err_seq(struct ipmi_smi *intf,
1133                         long         msgid,
1134                         unsigned int err)
1135 {
1136         int                  rv = -ENODEV;
1137         unsigned long        flags;
1138         unsigned char        seq;
1139         unsigned long        seqid;
1140         struct ipmi_recv_msg *msg = NULL;
1141 
1142 
1143         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
1144 
1145         spin_lock_irqsave(&intf->seq_lock, flags);
1146         /*
1147          * We do this verification because the user can be deleted
1148          * while a message is outstanding.
1149          */
1150         if ((intf->seq_table[seq].inuse)
1151                                 && (intf->seq_table[seq].seqid == seqid)) {
1152                 struct seq_table *ent = &intf->seq_table[seq];
1153 
1154                 ent->inuse = 0;
1155                 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);
1156                 msg = ent->recv_msg;
1157                 rv = 0;
1158         }
1159         spin_unlock_irqrestore(&intf->seq_lock, flags);
1160 
1161         if (msg)
1162                 deliver_err_response(intf, msg, err);
1163 
1164         return rv;
1165 }
1166 
1167 static void free_user_work(struct work_struct *work)
1168 {
1169         struct ipmi_user *user = container_of(work, struct ipmi_user,
1170                                               remove_work);
1171 
1172         cleanup_srcu_struct(&user->release_barrier);
1173         kfree(user);
1174 }
1175 
1176 int ipmi_create_user(unsigned int          if_num,
1177                      const struct ipmi_user_hndl *handler,
1178                      void                  *handler_data,
1179                      struct ipmi_user      **user)
1180 {
1181         unsigned long flags;
1182         struct ipmi_user *new_user;
1183         int           rv, index;
1184         struct ipmi_smi *intf;
1185 
1186         /*
1187          * There is no module usecount here, because it's not
1188          * required.  Since this can only be used by and called from
1189          * other modules, they will implicitly use this module, and
1190          * thus this can't be removed unless the other modules are
1191          * removed.
1192          */
1193 
1194         if (handler == NULL)
1195                 return -EINVAL;
1196 
1197         /*
1198          * Make sure the driver is actually initialized, this handles
1199          * problems with initialization order.
1200          */
1201         rv = ipmi_init_msghandler();
1202         if (rv)
1203                 return rv;
1204 
1205         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
1206         if (!new_user)
1207                 return -ENOMEM;
1208 
1209         index = srcu_read_lock(&ipmi_interfaces_srcu);
1210         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
1211                 if (intf->intf_num == if_num)
1212                         goto found;
1213         }
1214         /* Not found, return an error */
1215         rv = -EINVAL;
1216         goto out_kfree;
1217 
1218  found:
1219         INIT_WORK(&new_user->remove_work, free_user_work);
1220 
1221         rv = init_srcu_struct(&new_user->release_barrier);
1222         if (rv)
1223                 goto out_kfree;
1224 
1225         if (!try_module_get(intf->owner)) {
1226                 rv = -ENODEV;
1227                 goto out_kfree;
1228         }
1229 
1230         /* Note that each existing user holds a refcount to the interface. */
1231         kref_get(&intf->refcount);
1232 
1233         kref_init(&new_user->refcount);
1234         new_user->handler = handler;
1235         new_user->handler_data = handler_data;
1236         new_user->intf = intf;
1237         new_user->gets_events = false;
1238 
1239         rcu_assign_pointer(new_user->self, new_user);
1240         spin_lock_irqsave(&intf->seq_lock, flags);
1241         list_add_rcu(&new_user->link, &intf->users);
1242         spin_unlock_irqrestore(&intf->seq_lock, flags);
1243         if (handler->ipmi_watchdog_pretimeout)
1244                 /* User wants pretimeouts, so make sure to watch for them. */
1245                 smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG);
1246         srcu_read_unlock(&ipmi_interfaces_srcu, index);
1247         *user = new_user;
1248         return 0;
1249 
1250 out_kfree:
1251         srcu_read_unlock(&ipmi_interfaces_srcu, index);
1252         kfree(new_user);
1253         return rv;
1254 }
1255 EXPORT_SYMBOL(ipmi_create_user);
1256 
1257 int ipmi_get_smi_info(int if_num, struct ipmi_smi_info *data)
1258 {
1259         int rv, index;
1260         struct ipmi_smi *intf;
1261 
1262         index = srcu_read_lock(&ipmi_interfaces_srcu);
1263         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
1264                 if (intf->intf_num == if_num)
1265                         goto found;
1266         }
1267         srcu_read_unlock(&ipmi_interfaces_srcu, index);
1268 
1269         /* Not found, return an error */
1270         return -EINVAL;
1271 
1272 found:
1273         if (!intf->handlers->get_smi_info)
1274                 rv = -ENOTTY;
1275         else
1276                 rv = intf->handlers->get_smi_info(intf->send_info, data);
1277         srcu_read_unlock(&ipmi_interfaces_srcu, index);
1278 
1279         return rv;
1280 }
1281 EXPORT_SYMBOL(ipmi_get_smi_info);
1282 
1283 static void free_user(struct kref *ref)
1284 {
1285         struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount);
1286 
1287         /* SRCU cleanup must happen in task context. */
1288         schedule_work(&user->remove_work);
1289 }
1290 
1291 static void _ipmi_destroy_user(struct ipmi_user *user)
1292 {
1293         struct ipmi_smi  *intf = user->intf;
1294         int              i;
1295         unsigned long    flags;
1296         struct cmd_rcvr  *rcvr;
1297         struct cmd_rcvr  *rcvrs = NULL;
1298 
1299         if (!acquire_ipmi_user(user, &i)) {
1300                 /*
1301                  * The user has already been cleaned up, just make sure
1302                  * nothing is using it and return.
1303                  */
1304                 synchronize_srcu(&user->release_barrier);
1305                 return;
1306         }
1307 
1308         rcu_assign_pointer(user->self, NULL);
1309         release_ipmi_user(user, i);
1310 
1311         synchronize_srcu(&user->release_barrier);
1312 
1313         if (user->handler->shutdown)
1314                 user->handler->shutdown(user->handler_data);
1315 
1316         if (user->handler->ipmi_watchdog_pretimeout)
1317                 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG);
1318 
1319         if (user->gets_events)
1320                 atomic_dec(&intf->event_waiters);
1321 
1322         /* Remove the user from the interface's sequence table. */
1323         spin_lock_irqsave(&intf->seq_lock, flags);
1324         list_del_rcu(&user->link);
1325 
1326         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
1327                 if (intf->seq_table[i].inuse
1328                     && (intf->seq_table[i].recv_msg->user == user)) {
1329                         intf->seq_table[i].inuse = 0;
1330                         smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);
1331                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
1332                 }
1333         }
1334         spin_unlock_irqrestore(&intf->seq_lock, flags);
1335 
1336         /*
1337          * Remove the user from the command receiver's table.  First
1338          * we build a list of everything (not using the standard link,
1339          * since other things may be using it till we do
1340          * synchronize_srcu()) then free everything in that list.
1341          */
1342         mutex_lock(&intf->cmd_rcvrs_mutex);
1343         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1344                 if (rcvr->user == user) {
1345                         list_del_rcu(&rcvr->link);
1346                         rcvr->next = rcvrs;
1347                         rcvrs = rcvr;
1348                 }
1349         }
1350         mutex_unlock(&intf->cmd_rcvrs_mutex);
1351         synchronize_rcu();
1352         while (rcvrs) {
1353                 rcvr = rcvrs;
1354                 rcvrs = rcvr->next;
1355                 kfree(rcvr);
1356         }
1357 
1358         kref_put(&intf->refcount, intf_free);
1359         module_put(intf->owner);
1360 }
1361 
1362 int ipmi_destroy_user(struct ipmi_user *user)
1363 {
1364         _ipmi_destroy_user(user);
1365 
1366         kref_put(&user->refcount, free_user);
1367 
1368         return 0;
1369 }
1370 EXPORT_SYMBOL(ipmi_destroy_user);
1371 
1372 int ipmi_get_version(struct ipmi_user *user,
1373                      unsigned char *major,
1374                      unsigned char *minor)
1375 {
1376         struct ipmi_device_id id;
1377         int rv, index;
1378 
1379         user = acquire_ipmi_user(user, &index);
1380         if (!user)
1381                 return -ENODEV;
1382 
1383         rv = bmc_get_device_id(user->intf, NULL, &id, NULL, NULL);
1384         if (!rv) {
1385                 *major = ipmi_version_major(&id);
1386                 *minor = ipmi_version_minor(&id);
1387         }
1388         release_ipmi_user(user, index);
1389 
1390         return rv;
1391 }
1392 EXPORT_SYMBOL(ipmi_get_version);
1393 
1394 int ipmi_set_my_address(struct ipmi_user *user,
1395                         unsigned int  channel,
1396                         unsigned char address)
1397 {
1398         int index, rv = 0;
1399 
1400         user = acquire_ipmi_user(user, &index);
1401         if (!user)
1402                 return -ENODEV;
1403 
1404         if (channel >= IPMI_MAX_CHANNELS) {
1405                 rv = -EINVAL;
1406         } else {
1407                 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
1408                 user->intf->addrinfo[channel].address = address;
1409         }
1410         release_ipmi_user(user, index);
1411 
1412         return rv;
1413 }
1414 EXPORT_SYMBOL(ipmi_set_my_address);
1415 
1416 int ipmi_get_my_address(struct ipmi_user *user,
1417                         unsigned int  channel,
1418                         unsigned char *address)
1419 {
1420         int index, rv = 0;
1421 
1422         user = acquire_ipmi_user(user, &index);
1423         if (!user)
1424                 return -ENODEV;
1425 
1426         if (channel >= IPMI_MAX_CHANNELS) {
1427                 rv = -EINVAL;
1428         } else {
1429                 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
1430                 *address = user->intf->addrinfo[channel].address;
1431         }
1432         release_ipmi_user(user, index);
1433 
1434         return rv;
1435 }
1436 EXPORT_SYMBOL(ipmi_get_my_address);
1437 
1438 int ipmi_set_my_LUN(struct ipmi_user *user,
1439                     unsigned int  channel,
1440                     unsigned char LUN)
1441 {
1442         int index, rv = 0;
1443 
1444         user = acquire_ipmi_user(user, &index);
1445         if (!user)
1446                 return -ENODEV;
1447 
1448         if (channel >= IPMI_MAX_CHANNELS) {
1449                 rv = -EINVAL;
1450         } else {
1451                 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
1452                 user->intf->addrinfo[channel].lun = LUN & 0x3;
1453         }
1454         release_ipmi_user(user, index);
1455 
1456         return rv;
1457 }
1458 EXPORT_SYMBOL(ipmi_set_my_LUN);
1459 
1460 int ipmi_get_my_LUN(struct ipmi_user *user,
1461                     unsigned int  channel,
1462                     unsigned char *address)
1463 {
1464         int index, rv = 0;
1465 
1466         user = acquire_ipmi_user(user, &index);
1467         if (!user)
1468                 return -ENODEV;
1469 
1470         if (channel >= IPMI_MAX_CHANNELS) {
1471                 rv = -EINVAL;
1472         } else {
1473                 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
1474                 *address = user->intf->addrinfo[channel].lun;
1475         }
1476         release_ipmi_user(user, index);
1477 
1478         return rv;
1479 }
1480 EXPORT_SYMBOL(ipmi_get_my_LUN);
1481 
1482 int ipmi_get_maintenance_mode(struct ipmi_user *user)
1483 {
1484         int mode, index;
1485         unsigned long flags;
1486 
1487         user = acquire_ipmi_user(user, &index);
1488         if (!user)
1489                 return -ENODEV;
1490 
1491         spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags);
1492         mode = user->intf->maintenance_mode;
1493         spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags);
1494         release_ipmi_user(user, index);
1495 
1496         return mode;
1497 }
1498 EXPORT_SYMBOL(ipmi_get_maintenance_mode);
1499 
1500 static void maintenance_mode_update(struct ipmi_smi *intf)
1501 {
1502         if (intf->handlers->set_maintenance_mode)
1503                 intf->handlers->set_maintenance_mode(
1504                         intf->send_info, intf->maintenance_mode_enable);
1505 }
1506 
1507 int ipmi_set_maintenance_mode(struct ipmi_user *user, int mode)
1508 {
1509         int rv = 0, index;
1510         unsigned long flags;
1511         struct ipmi_smi *intf = user->intf;
1512 
1513         user = acquire_ipmi_user(user, &index);
1514         if (!user)
1515                 return -ENODEV;
1516 
1517         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1518         if (intf->maintenance_mode != mode) {
1519                 switch (mode) {
1520                 case IPMI_MAINTENANCE_MODE_AUTO:
1521                         intf->maintenance_mode_enable
1522                                 = (intf->auto_maintenance_timeout > 0);
1523                         break;
1524 
1525                 case IPMI_MAINTENANCE_MODE_OFF:
1526                         intf->maintenance_mode_enable = false;
1527                         break;
1528 
1529                 case IPMI_MAINTENANCE_MODE_ON:
1530                         intf->maintenance_mode_enable = true;
1531                         break;
1532 
1533                 default:
1534                         rv = -EINVAL;
1535                         goto out_unlock;
1536                 }
1537                 intf->maintenance_mode = mode;
1538 
1539                 maintenance_mode_update(intf);
1540         }
1541  out_unlock:
1542         spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags);
1543         release_ipmi_user(user, index);
1544 
1545         return rv;
1546 }
1547 EXPORT_SYMBOL(ipmi_set_maintenance_mode);
1548 
1549 int ipmi_set_gets_events(struct ipmi_user *user, bool val)
1550 {
1551         unsigned long        flags;
1552         struct ipmi_smi      *intf = user->intf;
1553         struct ipmi_recv_msg *msg, *msg2;
1554         struct list_head     msgs;
1555         int index;
1556 
1557         user = acquire_ipmi_user(user, &index);
1558         if (!user)
1559                 return -ENODEV;
1560 
1561         INIT_LIST_HEAD(&msgs);
1562 
1563         spin_lock_irqsave(&intf->events_lock, flags);
1564         if (user->gets_events == val)
1565                 goto out;
1566 
1567         user->gets_events = val;
1568 
1569         if (val) {
1570                 if (atomic_inc_return(&intf->event_waiters) == 1)
1571                         need_waiter(intf);
1572         } else {
1573                 atomic_dec(&intf->event_waiters);
1574         }
1575 
1576         if (intf->delivering_events)
1577                 /*
1578                  * Another thread is delivering events for this, so
1579                  * let it handle any new events.
1580                  */
1581                 goto out;
1582 
1583         /* Deliver any queued events. */
1584         while (user->gets_events && !list_empty(&intf->waiting_events)) {
1585                 list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link)
1586                         list_move_tail(&msg->link, &msgs);
1587                 intf->waiting_events_count = 0;
1588                 if (intf->event_msg_printed) {
1589                         dev_warn(intf->si_dev, "Event queue no longer full\n");
1590                         intf->event_msg_printed = 0;
1591                 }
1592 
1593                 intf->delivering_events = 1;
1594                 spin_unlock_irqrestore(&intf->events_lock, flags);
1595 
1596                 list_for_each_entry_safe(msg, msg2, &msgs, link) {
1597                         msg->user = user;
1598                         kref_get(&user->refcount);
1599                         deliver_local_response(intf, msg);
1600                 }
1601 
1602                 spin_lock_irqsave(&intf->events_lock, flags);
1603                 intf->delivering_events = 0;
1604         }
1605 
1606  out:
1607         spin_unlock_irqrestore(&intf->events_lock, flags);
1608         release_ipmi_user(user, index);
1609 
1610         return 0;
1611 }
1612 EXPORT_SYMBOL(ipmi_set_gets_events);
1613 
1614 static struct cmd_rcvr *find_cmd_rcvr(struct ipmi_smi *intf,
1615                                       unsigned char netfn,
1616                                       unsigned char cmd,
1617                                       unsigned char chan)
1618 {
1619         struct cmd_rcvr *rcvr;
1620 
1621         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1622                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1623                                         && (rcvr->chans & (1 << chan)))
1624                         return rcvr;
1625         }
1626         return NULL;
1627 }
1628 
1629 static int is_cmd_rcvr_exclusive(struct ipmi_smi *intf,
1630                                  unsigned char netfn,
1631                                  unsigned char cmd,
1632                                  unsigned int  chans)
1633 {
1634         struct cmd_rcvr *rcvr;
1635 
1636         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1637                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1638                                         && (rcvr->chans & chans))
1639                         return 0;
1640         }
1641         return 1;
1642 }
1643 
1644 int ipmi_register_for_cmd(struct ipmi_user *user,
1645                           unsigned char netfn,
1646                           unsigned char cmd,
1647                           unsigned int  chans)
1648 {
1649         struct ipmi_smi *intf = user->intf;
1650         struct cmd_rcvr *rcvr;
1651         int rv = 0, index;
1652 
1653         user = acquire_ipmi_user(user, &index);
1654         if (!user)
1655                 return -ENODEV;
1656 
1657         rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);
1658         if (!rcvr) {
1659                 rv = -ENOMEM;
1660                 goto out_release;
1661         }
1662         rcvr->cmd = cmd;
1663         rcvr->netfn = netfn;
1664         rcvr->chans = chans;
1665         rcvr->user = user;
1666 
1667         mutex_lock(&intf->cmd_rcvrs_mutex);
1668         /* Make sure the command/netfn is not already registered. */
1669         if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) {
1670                 rv = -EBUSY;
1671                 goto out_unlock;
1672         }
1673 
1674         smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS);
1675 
1676         list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
1677 
1678 out_unlock:
1679         mutex_unlock(&intf->cmd_rcvrs_mutex);
1680         if (rv)
1681                 kfree(rcvr);
1682 out_release:
1683         release_ipmi_user(user, index);
1684 
1685         return rv;
1686 }
1687 EXPORT_SYMBOL(ipmi_register_for_cmd);
1688 
1689 int ipmi_unregister_for_cmd(struct ipmi_user *user,
1690                             unsigned char netfn,
1691                             unsigned char cmd,
1692                             unsigned int  chans)
1693 {
1694         struct ipmi_smi *intf = user->intf;
1695         struct cmd_rcvr *rcvr;
1696         struct cmd_rcvr *rcvrs = NULL;
1697         int i, rv = -ENOENT, index;
1698 
1699         user = acquire_ipmi_user(user, &index);
1700         if (!user)
1701                 return -ENODEV;
1702 
1703         mutex_lock(&intf->cmd_rcvrs_mutex);
1704         for (i = 0; i < IPMI_NUM_CHANNELS; i++) {
1705                 if (((1 << i) & chans) == 0)
1706                         continue;
1707                 rcvr = find_cmd_rcvr(intf, netfn, cmd, i);
1708                 if (rcvr == NULL)
1709                         continue;
1710                 if (rcvr->user == user) {
1711                         rv = 0;
1712                         rcvr->chans &= ~chans;
1713                         if (rcvr->chans == 0) {
1714                                 list_del_rcu(&rcvr->link);
1715                                 rcvr->next = rcvrs;
1716                                 rcvrs = rcvr;
1717                         }
1718                 }
1719         }
1720         mutex_unlock(&intf->cmd_rcvrs_mutex);
1721         synchronize_rcu();
1722         release_ipmi_user(user, index);
1723         while (rcvrs) {
1724                 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS);
1725                 rcvr = rcvrs;
1726                 rcvrs = rcvr->next;
1727                 kfree(rcvr);
1728         }
1729 
1730         return rv;
1731 }
1732 EXPORT_SYMBOL(ipmi_unregister_for_cmd);
1733 
1734 static unsigned char
1735 ipmb_checksum(unsigned char *data, int size)
1736 {
1737         unsigned char csum = 0;
1738 
1739         for (; size > 0; size--, data++)
1740                 csum += *data;
1741 
1742         return -csum;
1743 }
1744 
1745 static inline void format_ipmb_msg(struct ipmi_smi_msg   *smi_msg,
1746                                    struct kernel_ipmi_msg *msg,
1747                                    struct ipmi_ipmb_addr *ipmb_addr,
1748                                    long                  msgid,
1749                                    unsigned char         ipmb_seq,
1750                                    int                   broadcast,
1751                                    unsigned char         source_address,
1752                                    unsigned char         source_lun)
1753 {
1754         int i = broadcast;
1755 
1756         /* Format the IPMB header data. */
1757         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1758         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1759         smi_msg->data[2] = ipmb_addr->channel;
1760         if (broadcast)
1761                 smi_msg->data[3] = 0;
1762         smi_msg->data[i+3] = ipmb_addr->slave_addr;
1763         smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3);
1764         smi_msg->data[i+5] = ipmb_checksum(&smi_msg->data[i + 3], 2);
1765         smi_msg->data[i+6] = source_address;
1766         smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun;
1767         smi_msg->data[i+8] = msg->cmd;
1768 
1769         /* Now tack on the data to the message. */
1770         if (msg->data_len > 0)
1771                 memcpy(&smi_msg->data[i + 9], msg->data, msg->data_len);
1772         smi_msg->data_size = msg->data_len + 9;
1773 
1774         /* Now calculate the checksum and tack it on. */
1775         smi_msg->data[i+smi_msg->data_size]
1776                 = ipmb_checksum(&smi_msg->data[i + 6], smi_msg->data_size - 6);
1777 
1778         /*
1779          * Add on the checksum size and the offset from the
1780          * broadcast.
1781          */
1782         smi_msg->data_size += 1 + i;
1783 
1784         smi_msg->msgid = msgid;
1785 }
1786 
1787 static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,
1788                                   struct kernel_ipmi_msg *msg,
1789                                   struct ipmi_lan_addr  *lan_addr,
1790                                   long                  msgid,
1791                                   unsigned char         ipmb_seq,
1792                                   unsigned char         source_lun)
1793 {
1794         /* Format the IPMB header data. */
1795         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1796         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1797         smi_msg->data[2] = lan_addr->channel;
1798         smi_msg->data[3] = lan_addr->session_handle;
1799         smi_msg->data[4] = lan_addr->remote_SWID;
1800         smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3);
1801         smi_msg->data[6] = ipmb_checksum(&smi_msg->data[4], 2);
1802         smi_msg->data[7] = lan_addr->local_SWID;
1803         smi_msg->data[8] = (ipmb_seq << 2) | source_lun;
1804         smi_msg->data[9] = msg->cmd;
1805 
1806         /* Now tack on the data to the message. */
1807         if (msg->data_len > 0)
1808                 memcpy(&smi_msg->data[10], msg->data, msg->data_len);
1809         smi_msg->data_size = msg->data_len + 10;
1810 
1811         /* Now calculate the checksum and tack it on. */
1812         smi_msg->data[smi_msg->data_size]
1813                 = ipmb_checksum(&smi_msg->data[7], smi_msg->data_size - 7);
1814 
1815         /*
1816          * Add on the checksum size and the offset from the
1817          * broadcast.
1818          */
1819         smi_msg->data_size += 1;
1820 
1821         smi_msg->msgid = msgid;
1822 }
1823 
1824 static struct ipmi_smi_msg *smi_add_send_msg(struct ipmi_smi *intf,
1825                                              struct ipmi_smi_msg *smi_msg,
1826                                              int priority)
1827 {
1828         if (intf->curr_msg) {
1829                 if (priority > 0)
1830                         list_add_tail(&smi_msg->link, &intf->hp_xmit_msgs);
1831                 else
1832                         list_add_tail(&smi_msg->link, &intf->xmit_msgs);
1833                 smi_msg = NULL;
1834         } else {
1835                 intf->curr_msg = smi_msg;
1836         }
1837 
1838         return smi_msg;
1839 }
1840 
1841 static void smi_send(struct ipmi_smi *intf,
1842                      const struct ipmi_smi_handlers *handlers,
1843                      struct ipmi_smi_msg *smi_msg, int priority)
1844 {
1845         int run_to_completion = intf->run_to_completion;
1846         unsigned long flags = 0;
1847 
1848         if (!run_to_completion)
1849                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
1850         smi_msg = smi_add_send_msg(intf, smi_msg, priority);
1851 
1852         if (!run_to_completion)
1853                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
1854 
1855         if (smi_msg)
1856                 handlers->sender(intf->send_info, smi_msg);
1857 }
1858 
1859 static bool is_maintenance_mode_cmd(struct kernel_ipmi_msg *msg)
1860 {
1861         return (((msg->netfn == IPMI_NETFN_APP_REQUEST)
1862                  && ((msg->cmd == IPMI_COLD_RESET_CMD)
1863                      || (msg->cmd == IPMI_WARM_RESET_CMD)))
1864                 || (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST));
1865 }
1866 
1867 static int i_ipmi_req_sysintf(struct ipmi_smi        *intf,
1868                               struct ipmi_addr       *addr,
1869                               long                   msgid,
1870                               struct kernel_ipmi_msg *msg,
1871                               struct ipmi_smi_msg    *smi_msg,
1872                               struct ipmi_recv_msg   *recv_msg,
1873                               int                    retries,
1874                               unsigned int           retry_time_ms)
1875 {
1876         struct ipmi_system_interface_addr *smi_addr;
1877 
1878         if (msg->netfn & 1)
1879                 /* Responses are not allowed to the SMI. */
1880                 return -EINVAL;
1881 
1882         smi_addr = (struct ipmi_system_interface_addr *) addr;
1883         if (smi_addr->lun > 3) {
1884                 ipmi_inc_stat(intf, sent_invalid_commands);
1885                 return -EINVAL;
1886         }
1887 
1888         memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr));
1889 
1890         if ((msg->netfn == IPMI_NETFN_APP_REQUEST)
1891             && ((msg->cmd == IPMI_SEND_MSG_CMD)
1892                 || (msg->cmd == IPMI_GET_MSG_CMD)
1893                 || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD))) {
1894                 /*
1895                  * We don't let the user do these, since we manage
1896                  * the sequence numbers.
1897                  */
1898                 ipmi_inc_stat(intf, sent_invalid_commands);
1899                 return -EINVAL;
1900         }
1901 
1902         if (is_maintenance_mode_cmd(msg)) {
1903                 unsigned long flags;
1904 
1905                 spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1906                 intf->auto_maintenance_timeout
1907                         = maintenance_mode_timeout_ms;
1908                 if (!intf->maintenance_mode
1909                     && !intf->maintenance_mode_enable) {
1910                         intf->maintenance_mode_enable = true;
1911                         maintenance_mode_update(intf);
1912                 }
1913                 spin_unlock_irqrestore(&intf->maintenance_mode_lock,
1914                                        flags);
1915         }
1916 
1917         if (msg->data_len + 2 > IPMI_MAX_MSG_LENGTH) {
1918                 ipmi_inc_stat(intf, sent_invalid_commands);
1919                 return -EMSGSIZE;
1920         }
1921 
1922         smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3);
1923         smi_msg->data[1] = msg->cmd;
1924         smi_msg->msgid = msgid;
1925         smi_msg->user_data = recv_msg;
1926         if (msg->data_len > 0)
1927                 memcpy(&smi_msg->data[2], msg->data, msg->data_len);
1928         smi_msg->data_size = msg->data_len + 2;
1929         ipmi_inc_stat(intf, sent_local_commands);
1930 
1931         return 0;
1932 }
1933 
1934 static int i_ipmi_req_ipmb(struct ipmi_smi        *intf,
1935                            struct ipmi_addr       *addr,
1936                            long                   msgid,
1937                            struct kernel_ipmi_msg *msg,
1938                            struct ipmi_smi_msg    *smi_msg,
1939                            struct ipmi_recv_msg   *recv_msg,
1940                            unsigned char          source_address,
1941                            unsigned char          source_lun,
1942                            int                    retries,
1943                            unsigned int           retry_time_ms)
1944 {
1945         struct ipmi_ipmb_addr *ipmb_addr;
1946         unsigned char ipmb_seq;
1947         long seqid;
1948         int broadcast = 0;
1949         struct ipmi_channel *chans;
1950         int rv = 0;
1951 
1952         if (addr->channel >= IPMI_MAX_CHANNELS) {
1953                 ipmi_inc_stat(intf, sent_invalid_commands);
1954                 return -EINVAL;
1955         }
1956 
1957         chans = READ_ONCE(intf->channel_list)->c;
1958 
1959         if (chans[addr->channel].medium != IPMI_CHANNEL_MEDIUM_IPMB) {
1960                 ipmi_inc_stat(intf, sent_invalid_commands);
1961                 return -EINVAL;
1962         }
1963 
1964         if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) {
1965                 /*
1966                  * Broadcasts add a zero at the beginning of the
1967                  * message, but otherwise is the same as an IPMB
1968                  * address.
1969                  */
1970                 addr->addr_type = IPMI_IPMB_ADDR_TYPE;
1971                 broadcast = 1;
1972                 retries = 0; /* Don't retry broadcasts. */
1973         }
1974 
1975         /*
1976          * 9 for the header and 1 for the checksum, plus
1977          * possibly one for the broadcast.
1978          */
1979         if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) {
1980                 ipmi_inc_stat(intf, sent_invalid_commands);
1981                 return -EMSGSIZE;
1982         }
1983 
1984         ipmb_addr = (struct ipmi_ipmb_addr *) addr;
1985         if (ipmb_addr->lun > 3) {
1986                 ipmi_inc_stat(intf, sent_invalid_commands);
1987                 return -EINVAL;
1988         }
1989 
1990         memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr));
1991 
1992         if (recv_msg->msg.netfn & 0x1) {
1993                 /*
1994                  * It's a response, so use the user's sequence
1995                  * from msgid.
1996                  */
1997                 ipmi_inc_stat(intf, sent_ipmb_responses);
1998                 format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid,
1999                                 msgid, broadcast,
2000                                 source_address, source_lun);
2001 
2002                 /*
2003                  * Save the receive message so we can use it
2004                  * to deliver the response.
2005                  */
2006                 smi_msg->user_data = recv_msg;
2007         } else {
2008                 /* It's a command, so get a sequence for it. */
2009                 unsigned long flags;
2010 
2011                 spin_lock_irqsave(&intf->seq_lock, flags);
2012 
2013                 if (is_maintenance_mode_cmd(msg))
2014                         intf->ipmb_maintenance_mode_timeout =
2015                                 maintenance_mode_timeout_ms;
2016 
2017                 if (intf->ipmb_maintenance_mode_timeout && retry_time_ms == 0)
2018                         /* Different default in maintenance mode */
2019                         retry_time_ms = default_maintenance_retry_ms;
2020 
2021                 /*
2022                  * Create a sequence number with a 1 second
2023                  * timeout and 4 retries.
2024                  */
2025                 rv = intf_next_seq(intf,
2026                                    recv_msg,
2027                                    retry_time_ms,
2028                                    retries,
2029                                    broadcast,
2030                                    &ipmb_seq,
2031                                    &seqid);
2032                 if (rv)
2033                         /*
2034                          * We have used up all the sequence numbers,
2035                          * probably, so abort.
2036                          */
2037                         goto out_err;
2038 
2039                 ipmi_inc_stat(intf, sent_ipmb_commands);
2040 
2041                 /*
2042                  * Store the sequence number in the message,
2043                  * so that when the send message response
2044                  * comes back we can start the timer.
2045                  */
2046                 format_ipmb_msg(smi_msg, msg, ipmb_addr,
2047                                 STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
2048                                 ipmb_seq, broadcast,
2049                                 source_address, source_lun);
2050 
2051                 /*
2052                  * Copy the message into the recv message data, so we
2053                  * can retransmit it later if necessary.
2054                  */
2055                 memcpy(recv_msg->msg_data, smi_msg->data,
2056                        smi_msg->data_size);
2057                 recv_msg->msg.data = recv_msg->msg_data;
2058                 recv_msg->msg.data_len = smi_msg->data_size;
2059 
2060                 /*
2061                  * We don't unlock until here, because we need
2062                  * to copy the completed message into the
2063                  * recv_msg before we release the lock.
2064                  * Otherwise, race conditions may bite us.  I
2065                  * know that's pretty paranoid, but I prefer
2066                  * to be correct.
2067                  */
2068 out_err:
2069                 spin_unlock_irqrestore(&intf->seq_lock, flags);
2070         }
2071 
2072         return rv;
2073 }
2074 
2075 static int i_ipmi_req_lan(struct ipmi_smi        *intf,
2076                           struct ipmi_addr       *addr,
2077                           long                   msgid,
2078                           struct kernel_ipmi_msg *msg,
2079                           struct ipmi_smi_msg    *smi_msg,
2080                           struct ipmi_recv_msg   *recv_msg,
2081                           unsigned char          source_lun,
2082                           int                    retries,
2083                           unsigned int           retry_time_ms)
2084 {
2085         struct ipmi_lan_addr  *lan_addr;
2086         unsigned char ipmb_seq;
2087         long seqid;
2088         struct ipmi_channel *chans;
2089         int rv = 0;
2090 
2091         if (addr->channel >= IPMI_MAX_CHANNELS) {
2092                 ipmi_inc_stat(intf, sent_invalid_commands);
2093                 return -EINVAL;
2094         }
2095 
2096         chans = READ_ONCE(intf->channel_list)->c;
2097 
2098         if ((chans[addr->channel].medium
2099                                 != IPMI_CHANNEL_MEDIUM_8023LAN)
2100                         && (chans[addr->channel].medium
2101                             != IPMI_CHANNEL_MEDIUM_ASYNC)) {
2102                 ipmi_inc_stat(intf, sent_invalid_commands);
2103                 return -EINVAL;
2104         }
2105 
2106         /* 11 for the header and 1 for the checksum. */
2107         if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) {
2108                 ipmi_inc_stat(intf, sent_invalid_commands);
2109                 return -EMSGSIZE;
2110         }
2111 
2112         lan_addr = (struct ipmi_lan_addr *) addr;
2113         if (lan_addr->lun > 3) {
2114                 ipmi_inc_stat(intf, sent_invalid_commands);
2115                 return -EINVAL;
2116         }
2117 
2118         memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr));
2119 
2120         if (recv_msg->msg.netfn & 0x1) {
2121                 /*
2122                  * It's a response, so use the user's sequence
2123                  * from msgid.
2124                  */
2125                 ipmi_inc_stat(intf, sent_lan_responses);
2126                 format_lan_msg(smi_msg, msg, lan_addr, msgid,
2127                                msgid, source_lun);
2128 
2129                 /*
2130                  * Save the receive message so we can use it
2131                  * to deliver the response.
2132                  */
2133                 smi_msg->user_data = recv_msg;
2134         } else {
2135                 /* It's a command, so get a sequence for it. */
2136                 unsigned long flags;
2137 
2138                 spin_lock_irqsave(&intf->seq_lock, flags);
2139 
2140                 /*
2141                  * Create a sequence number with a 1 second
2142                  * timeout and 4 retries.
2143                  */
2144                 rv = intf_next_seq(intf,
2145                                    recv_msg,
2146                                    retry_time_ms,
2147                                    retries,
2148                                    0,
2149                                    &ipmb_seq,
2150                                    &seqid);
2151                 if (rv)
2152                         /*
2153                          * We have used up all the sequence numbers,
2154                          * probably, so abort.
2155                          */
2156                         goto out_err;
2157 
2158                 ipmi_inc_stat(intf, sent_lan_commands);
2159 
2160                 /*
2161                  * Store the sequence number in the message,
2162                  * so that when the send message response
2163                  * comes back we can start the timer.
2164                  */
2165                 format_lan_msg(smi_msg, msg, lan_addr,
2166                                STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
2167                                ipmb_seq, source_lun);
2168 
2169                 /*
2170                  * Copy the message into the recv message data, so we
2171                  * can retransmit it later if necessary.
2172                  */
2173                 memcpy(recv_msg->msg_data, smi_msg->data,
2174                        smi_msg->data_size);
2175                 recv_msg->msg.data = recv_msg->msg_data;
2176                 recv_msg->msg.data_len = smi_msg->data_size;
2177 
2178                 /*
2179                  * We don't unlock until here, because we need
2180                  * to copy the completed message into the
2181                  * recv_msg before we release the lock.
2182                  * Otherwise, race conditions may bite us.  I
2183                  * know that's pretty paranoid, but I prefer
2184                  * to be correct.
2185                  */
2186 out_err:
2187                 spin_unlock_irqrestore(&intf->seq_lock, flags);
2188         }
2189 
2190         return rv;
2191 }
2192 
2193 /*
2194  * Separate from ipmi_request so that the user does not have to be
2195  * supplied in certain circumstances (mainly at panic time).  If
2196  * messages are supplied, they will be freed, even if an error
2197  * occurs.
2198  */
2199 static int i_ipmi_request(struct ipmi_user     *user,
2200                           struct ipmi_smi      *intf,
2201                           struct ipmi_addr     *addr,
2202                           long                 msgid,
2203                           struct kernel_ipmi_msg *msg,
2204                           void                 *user_msg_data,
2205                           void                 *supplied_smi,
2206                           struct ipmi_recv_msg *supplied_recv,
2207                           int                  priority,
2208                           unsigned char        source_address,
2209                           unsigned char        source_lun,
2210                           int                  retries,
2211                           unsigned int         retry_time_ms)
2212 {
2213         struct ipmi_smi_msg *smi_msg;
2214         struct ipmi_recv_msg *recv_msg;
2215         int rv = 0;
2216 
2217         if (supplied_recv)
2218                 recv_msg = supplied_recv;
2219         else {
2220                 recv_msg = ipmi_alloc_recv_msg();
2221                 if (recv_msg == NULL) {
2222                         rv = -ENOMEM;
2223                         goto out;
2224                 }
2225         }
2226         recv_msg->user_msg_data = user_msg_data;
2227 
2228         if (supplied_smi)
2229                 smi_msg = (struct ipmi_smi_msg *) supplied_smi;
2230         else {
2231                 smi_msg = ipmi_alloc_smi_msg();
2232                 if (smi_msg == NULL) {
2233                         if (!supplied_recv)
2234                                 ipmi_free_recv_msg(recv_msg);
2235                         rv = -ENOMEM;
2236                         goto out;
2237                 }
2238         }
2239 
2240         rcu_read_lock();
2241         if (intf->in_shutdown) {
2242                 rv = -ENODEV;
2243                 goto out_err;
2244         }
2245 
2246         recv_msg->user = user;
2247         if (user)
2248                 /* The put happens when the message is freed. */
2249                 kref_get(&user->refcount);
2250         recv_msg->msgid = msgid;
2251         /*
2252          * Store the message to send in the receive message so timeout
2253          * responses can get the proper response data.
2254          */
2255         recv_msg->msg = *msg;
2256 
2257         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
2258                 rv = i_ipmi_req_sysintf(intf, addr, msgid, msg, smi_msg,
2259                                         recv_msg, retries, retry_time_ms);
2260         } else if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
2261                 rv = i_ipmi_req_ipmb(intf, addr, msgid, msg, smi_msg, recv_msg,
2262                                      source_address, source_lun,
2263                                      retries, retry_time_ms);
2264         } else if (is_lan_addr(addr)) {
2265                 rv = i_ipmi_req_lan(intf, addr, msgid, msg, smi_msg, recv_msg,
2266                                     source_lun, retries, retry_time_ms);
2267         } else {
2268             /* Unknown address type. */
2269                 ipmi_inc_stat(intf, sent_invalid_commands);
2270                 rv = -EINVAL;
2271         }
2272 
2273         if (rv) {
2274 out_err:
2275                 ipmi_free_smi_msg(smi_msg);
2276                 ipmi_free_recv_msg(recv_msg);
2277         } else {
2278                 ipmi_debug_msg("Send", smi_msg->data, smi_msg->data_size);
2279 
2280                 smi_send(intf, intf->handlers, smi_msg, priority);
2281         }
2282         rcu_read_unlock();
2283 
2284 out:
2285         return rv;
2286 }
2287 
2288 static int check_addr(struct ipmi_smi  *intf,
2289                       struct ipmi_addr *addr,
2290                       unsigned char    *saddr,
2291                       unsigned char    *lun)
2292 {
2293         if (addr->channel >= IPMI_MAX_CHANNELS)
2294                 return -EINVAL;
2295         addr->channel = array_index_nospec(addr->channel, IPMI_MAX_CHANNELS);
2296         *lun = intf->addrinfo[addr->channel].lun;
2297         *saddr = intf->addrinfo[addr->channel].address;
2298         return 0;
2299 }
2300 
2301 int ipmi_request_settime(struct ipmi_user *user,
2302                          struct ipmi_addr *addr,
2303                          long             msgid,
2304                          struct kernel_ipmi_msg  *msg,
2305                          void             *user_msg_data,
2306                          int              priority,
2307                          int              retries,
2308                          unsigned int     retry_time_ms)
2309 {
2310         unsigned char saddr = 0, lun = 0;
2311         int rv, index;
2312 
2313         if (!user)
2314                 return -EINVAL;
2315 
2316         user = acquire_ipmi_user(user, &index);
2317         if (!user)
2318                 return -ENODEV;
2319 
2320         rv = check_addr(user->intf, addr, &saddr, &lun);
2321         if (!rv)
2322                 rv = i_ipmi_request(user,
2323                                     user->intf,
2324                                     addr,
2325                                     msgid,
2326                                     msg,
2327                                     user_msg_data,
2328                                     NULL, NULL,
2329                                     priority,
2330                                     saddr,
2331                                     lun,
2332                                     retries,
2333                                     retry_time_ms);
2334 
2335         release_ipmi_user(user, index);
2336         return rv;
2337 }
2338 EXPORT_SYMBOL(ipmi_request_settime);
2339 
2340 int ipmi_request_supply_msgs(struct ipmi_user     *user,
2341                              struct ipmi_addr     *addr,
2342                              long                 msgid,
2343                              struct kernel_ipmi_msg *msg,
2344                              void                 *user_msg_data,
2345                              void                 *supplied_smi,
2346                              struct ipmi_recv_msg *supplied_recv,
2347                              int                  priority)
2348 {
2349         unsigned char saddr = 0, lun = 0;
2350         int rv, index;
2351 
2352         if (!user)
2353                 return -EINVAL;
2354 
2355         user = acquire_ipmi_user(user, &index);
2356         if (!user)
2357                 return -ENODEV;
2358 
2359         rv = check_addr(user->intf, addr, &saddr, &lun);
2360         if (!rv)
2361                 rv = i_ipmi_request(user,
2362                                     user->intf,
2363                                     addr,
2364                                     msgid,
2365                                     msg,
2366                                     user_msg_data,
2367                                     supplied_smi,
2368                                     supplied_recv,
2369                                     priority,
2370                                     saddr,
2371                                     lun,
2372                                     -1, 0);
2373 
2374         release_ipmi_user(user, index);
2375         return rv;
2376 }
2377 EXPORT_SYMBOL(ipmi_request_supply_msgs);
2378 
2379 static void bmc_device_id_handler(struct ipmi_smi *intf,
2380                                   struct ipmi_recv_msg *msg)
2381 {
2382         int rv;
2383 
2384         if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2385                         || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)
2386                         || (msg->msg.cmd != IPMI_GET_DEVICE_ID_CMD)) {
2387                 dev_warn(intf->si_dev,
2388                          "invalid device_id msg: addr_type=%d netfn=%x cmd=%x\n",
2389                          msg->addr.addr_type, msg->msg.netfn, msg->msg.cmd);
2390                 return;
2391         }
2392 
2393         rv = ipmi_demangle_device_id(msg->msg.netfn, msg->msg.cmd,
2394                         msg->msg.data, msg->msg.data_len, &intf->bmc->fetch_id);
2395         if (rv) {
2396                 dev_warn(intf->si_dev, "device id demangle failed: %d\n", rv);
2397                 intf->bmc->dyn_id_set = 0;
2398         } else {
2399                 /*
2400                  * Make sure the id data is available before setting
2401                  * dyn_id_set.
2402                  */
2403                 smp_wmb();
2404                 intf->bmc->dyn_id_set = 1;
2405         }
2406 
2407         wake_up(&intf->waitq);
2408 }
2409 
2410 static int
2411 send_get_device_id_cmd(struct ipmi_smi *intf)
2412 {
2413         struct ipmi_system_interface_addr si;
2414         struct kernel_ipmi_msg msg;
2415 
2416         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2417         si.channel = IPMI_BMC_CHANNEL;
2418         si.lun = 0;
2419 
2420         msg.netfn = IPMI_NETFN_APP_REQUEST;
2421         msg.cmd = IPMI_GET_DEVICE_ID_CMD;
2422         msg.data = NULL;
2423         msg.data_len = 0;
2424 
2425         return i_ipmi_request(NULL,
2426                               intf,
2427                               (struct ipmi_addr *) &si,
2428                               0,
2429                               &msg,
2430                               intf,
2431                               NULL,
2432                               NULL,
2433                               0,
2434                               intf->addrinfo[0].address,
2435                               intf->addrinfo[0].lun,
2436                               -1, 0);
2437 }
2438 
2439 static int __get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc)
2440 {
2441         int rv;
2442 
2443         bmc->dyn_id_set = 2;
2444 
2445         intf->null_user_handler = bmc_device_id_handler;
2446 
2447         rv = send_get_device_id_cmd(intf);
2448         if (rv)
2449                 return rv;
2450 
2451         wait_event(intf->waitq, bmc->dyn_id_set != 2);
2452 
2453         if (!bmc->dyn_id_set)
2454                 rv = -EIO; /* Something went wrong in the fetch. */
2455 
2456         /* dyn_id_set makes the id data available. */
2457         smp_rmb();
2458 
2459         intf->null_user_handler = NULL;
2460 
2461         return rv;
2462 }
2463 
2464 /*
2465  * Fetch the device id for the bmc/interface.  You must pass in either
2466  * bmc or intf, this code will get the other one.  If the data has
2467  * been recently fetched, this will just use the cached data.  Otherwise
2468  * it will run a new fetch.
2469  *
2470  * Except for the first time this is called (in ipmi_add_smi()),
2471  * this will always return good data;
2472  */
2473 static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
2474                                struct ipmi_device_id *id,
2475                                bool *guid_set, guid_t *guid, int intf_num)
2476 {
2477         int rv = 0;
2478         int prev_dyn_id_set, prev_guid_set;
2479         bool intf_set = intf != NULL;
2480 
2481         if (!intf) {
2482                 mutex_lock(&bmc->dyn_mutex);
2483 retry_bmc_lock:
2484                 if (list_empty(&bmc->intfs)) {
2485                         mutex_unlock(&bmc->dyn_mutex);
2486                         return -ENOENT;
2487                 }
2488                 intf = list_first_entry(&bmc->intfs, struct ipmi_smi,
2489                                         bmc_link);
2490                 kref_get(&intf->refcount);
2491                 mutex_unlock(&bmc->dyn_mutex);
2492                 mutex_lock(&intf->bmc_reg_mutex);
2493                 mutex_lock(&bmc->dyn_mutex);
2494                 if (intf != list_first_entry(&bmc->intfs, struct ipmi_smi,
2495                                              bmc_link)) {
2496                         mutex_unlock(&intf->bmc_reg_mutex);
2497                         kref_put(&intf->refcount, intf_free);
2498                         goto retry_bmc_lock;
2499                 }
2500         } else {
2501                 mutex_lock(&intf->bmc_reg_mutex);
2502                 bmc = intf->bmc;
2503                 mutex_lock(&bmc->dyn_mutex);
2504                 kref_get(&intf->refcount);
2505         }
2506 
2507         /* If we have a valid and current ID, just return that. */
2508         if (intf->in_bmc_register ||
2509             (bmc->dyn_id_set && time_is_after_jiffies(bmc->dyn_id_expiry)))
2510                 goto out_noprocessing;
2511 
2512         prev_guid_set = bmc->dyn_guid_set;
2513         __get_guid(intf);
2514 
2515         prev_dyn_id_set = bmc->dyn_id_set;
2516         rv = __get_device_id(intf, bmc);
2517         if (rv)
2518                 goto out;
2519 
2520         /*
2521          * The guid, device id, manufacturer id, and product id should
2522          * not change on a BMC.  If it does we have to do some dancing.
2523          */
2524         if (!intf->bmc_registered
2525             || (!prev_guid_set && bmc->dyn_guid_set)
2526             || (!prev_dyn_id_set && bmc->dyn_id_set)
2527             || (prev_guid_set && bmc->dyn_guid_set
2528                 && !guid_equal(&bmc->guid, &bmc->fetch_guid))
2529             || bmc->id.device_id != bmc->fetch_id.device_id
2530             || bmc->id.manufacturer_id != bmc->fetch_id.manufacturer_id
2531             || bmc->id.product_id != bmc->fetch_id.product_id) {
2532                 struct ipmi_device_id id = bmc->fetch_id;
2533                 int guid_set = bmc->dyn_guid_set;
2534                 guid_t guid;
2535 
2536                 guid = bmc->fetch_guid;
2537                 mutex_unlock(&bmc->dyn_mutex);
2538 
2539                 __ipmi_bmc_unregister(intf);
2540                 /* Fill in the temporary BMC for good measure. */
2541                 intf->bmc->id = id;
2542                 intf->bmc->dyn_guid_set = guid_set;
2543                 intf->bmc->guid = guid;
2544                 if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num))
2545                         need_waiter(intf); /* Retry later on an error. */
2546                 else
2547                         __scan_channels(intf, &id);
2548 
2549 
2550                 if (!intf_set) {
2551                         /*
2552                          * We weren't given the interface on the
2553                          * command line, so restart the operation on
2554                          * the next interface for the BMC.
2555                          */
2556                         mutex_unlock(&intf->bmc_reg_mutex);
2557                         mutex_lock(&bmc->dyn_mutex);
2558                         goto retry_bmc_lock;
2559                 }
2560 
2561                 /* We have a new BMC, set it up. */
2562                 bmc = intf->bmc;
2563                 mutex_lock(&bmc->dyn_mutex);
2564                 goto out_noprocessing;
2565         } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id)))
2566                 /* Version info changes, scan the channels again. */
2567                 __scan_channels(intf, &bmc->fetch_id);
2568 
2569         bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY;
2570 
2571 out:
2572         if (rv && prev_dyn_id_set) {
2573                 rv = 0; /* Ignore failures if we have previous data. */
2574                 bmc->dyn_id_set = prev_dyn_id_set;
2575         }
2576         if (!rv) {
2577                 bmc->id = bmc->fetch_id;
2578                 if (bmc->dyn_guid_set)
2579                         bmc->guid = bmc->fetch_guid;
2580                 else if (prev_guid_set)
2581                         /*
2582                          * The guid used to be valid and it failed to fetch,
2583                          * just use the cached value.
2584                          */
2585                         bmc->dyn_guid_set = prev_guid_set;
2586         }
2587 out_noprocessing:
2588         if (!rv) {
2589                 if (id)
2590                         *id = bmc->id;
2591 
2592                 if (guid_set)
2593                         *guid_set = bmc->dyn_guid_set;
2594 
2595                 if (guid && bmc->dyn_guid_set)
2596                         *guid =  bmc->guid;
2597         }
2598 
2599         mutex_unlock(&bmc->dyn_mutex);
2600         mutex_unlock(&intf->bmc_reg_mutex);
2601 
2602         kref_put(&intf->refcount, intf_free);
2603         return rv;
2604 }
2605 
2606 static int bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
2607                              struct ipmi_device_id *id,
2608                              bool *guid_set, guid_t *guid)
2609 {
2610         return __bmc_get_device_id(intf, bmc, id, guid_set, guid, -1);
2611 }
2612 
2613 static ssize_t device_id_show(struct device *dev,
2614                               struct device_attribute *attr,
2615                               char *buf)
2616 {
2617         struct bmc_device *bmc = to_bmc_device(dev);
2618         struct ipmi_device_id id;
2619         int rv;
2620 
2621         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2622         if (rv)
2623                 return rv;
2624 
2625         return snprintf(buf, 10, "%u\n", id.device_id);
2626 }
2627 static DEVICE_ATTR_RO(device_id);
2628 
2629 static ssize_t provides_device_sdrs_show(struct device *dev,
2630                                          struct device_attribute *attr,
2631                                          char *buf)
2632 {
2633         struct bmc_device *bmc = to_bmc_device(dev);
2634         struct ipmi_device_id id;
2635         int rv;
2636 
2637         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2638         if (rv)
2639                 return rv;
2640 
2641         return snprintf(buf, 10, "%u\n", (id.device_revision & 0x80) >> 7);
2642 }
2643 static DEVICE_ATTR_RO(provides_device_sdrs);
2644 
2645 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
2646                              char *buf)
2647 {
2648         struct bmc_device *bmc = to_bmc_device(dev);
2649         struct ipmi_device_id id;
2650         int rv;
2651 
2652         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2653         if (rv)
2654                 return rv;
2655 
2656         return snprintf(buf, 20, "%u\n", id.device_revision & 0x0F);
2657 }
2658 static DEVICE_ATTR_RO(revision);
2659 
2660 static ssize_t firmware_revision_show(struct device *dev,
2661                                       struct device_attribute *attr,
2662                                       char *buf)
2663 {
2664         struct bmc_device *bmc = to_bmc_device(dev);
2665         struct ipmi_device_id id;
2666         int rv;
2667 
2668         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2669         if (rv)
2670                 return rv;
2671 
2672         return snprintf(buf, 20, "%u.%x\n", id.firmware_revision_1,
2673                         id.firmware_revision_2);
2674 }
2675 static DEVICE_ATTR_RO(firmware_revision);
2676 
2677 static ssize_t ipmi_version_show(struct device *dev,
2678                                  struct device_attribute *attr,
2679                                  char *buf)
2680 {
2681         struct bmc_device *bmc = to_bmc_device(dev);
2682         struct ipmi_device_id id;
2683         int rv;
2684 
2685         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2686         if (rv)
2687                 return rv;
2688 
2689         return snprintf(buf, 20, "%u.%u\n",
2690                         ipmi_version_major(&id),
2691                         ipmi_version_minor(&id));
2692 }
2693 static DEVICE_ATTR_RO(ipmi_version);
2694 
2695 static ssize_t add_dev_support_show(struct device *dev,
2696                                     struct device_attribute *attr,
2697                                     char *buf)
2698 {
2699         struct bmc_device *bmc = to_bmc_device(dev);
2700         struct ipmi_device_id id;
2701         int rv;
2702 
2703         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2704         if (rv)
2705                 return rv;
2706 
2707         return snprintf(buf, 10, "0x%02x\n", id.additional_device_support);
2708 }
2709 static DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show,
2710                    NULL);
2711 
2712 static ssize_t manufacturer_id_show(struct device *dev,
2713                                     struct device_attribute *attr,
2714                                     char *buf)
2715 {
2716         struct bmc_device *bmc = to_bmc_device(dev);
2717         struct ipmi_device_id id;
2718         int rv;
2719 
2720         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2721         if (rv)
2722                 return rv;
2723 
2724         return snprintf(buf, 20, "0x%6.6x\n", id.manufacturer_id);
2725 }
2726 static DEVICE_ATTR_RO(manufacturer_id);
2727 
2728 static ssize_t product_id_show(struct device *dev,
2729                                struct device_attribute *attr,
2730                                char *buf)
2731 {
2732         struct bmc_device *bmc = to_bmc_device(dev);
2733         struct ipmi_device_id id;
2734         int rv;
2735 
2736         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2737         if (rv)
2738                 return rv;
2739 
2740         return snprintf(buf, 10, "0x%4.4x\n", id.product_id);
2741 }
2742 static DEVICE_ATTR_RO(product_id);
2743 
2744 static ssize_t aux_firmware_rev_show(struct device *dev,
2745                                      struct device_attribute *attr,
2746                                      char *buf)
2747 {
2748         struct bmc_device *bmc = to_bmc_device(dev);
2749         struct ipmi_device_id id;
2750         int rv;
2751 
2752         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2753         if (rv)
2754                 return rv;
2755 
2756         return snprintf(buf, 21, "0x%02x 0x%02x 0x%02x 0x%02x\n",
2757                         id.aux_firmware_revision[3],
2758                         id.aux_firmware_revision[2],
2759                         id.aux_firmware_revision[1],
2760                         id.aux_firmware_revision[0]);
2761 }
2762 static DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL);
2763 
2764 static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
2765                          char *buf)
2766 {
2767         struct bmc_device *bmc = to_bmc_device(dev);
2768         bool guid_set;
2769         guid_t guid;
2770         int rv;
2771 
2772         rv = bmc_get_device_id(NULL, bmc, NULL, &guid_set, &guid);
2773         if (rv)
2774                 return rv;
2775         if (!guid_set)
2776                 return -ENOENT;
2777 
2778         return snprintf(buf, UUID_STRING_LEN + 1 + 1, "%pUl\n", &guid);
2779 }
2780 static DEVICE_ATTR_RO(guid);
2781 
2782 static struct attribute *bmc_dev_attrs[] = {
2783         &dev_attr_device_id.attr,
2784         &dev_attr_provides_device_sdrs.attr,
2785         &dev_attr_revision.attr,
2786         &dev_attr_firmware_revision.attr,
2787         &dev_attr_ipmi_version.attr,
2788         &dev_attr_additional_device_support.attr,
2789         &dev_attr_manufacturer_id.attr,
2790         &dev_attr_product_id.attr,
2791         &dev_attr_aux_firmware_revision.attr,
2792         &dev_attr_guid.attr,
2793         NULL
2794 };
2795 
2796 static umode_t bmc_dev_attr_is_visible(struct kobject *kobj,
2797                                        struct attribute *attr, int idx)
2798 {
2799         struct device *dev = kobj_to_dev(kobj);
2800         struct bmc_device *bmc = to_bmc_device(dev);
2801         umode_t mode = attr->mode;
2802         int rv;
2803 
2804         if (attr == &dev_attr_aux_firmware_revision.attr) {
2805                 struct ipmi_device_id id;
2806 
2807                 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2808                 return (!rv && id.aux_firmware_revision_set) ? mode : 0;
2809         }
2810         if (attr == &dev_attr_guid.attr) {
2811                 bool guid_set;
2812 
2813                 rv = bmc_get_device_id(NULL, bmc, NULL, &guid_set, NULL);
2814                 return (!rv && guid_set) ? mode : 0;
2815         }
2816         return mode;
2817 }
2818 
2819 static const struct attribute_group bmc_dev_attr_group = {
2820         .attrs          = bmc_dev_attrs,
2821         .is_visible     = bmc_dev_attr_is_visible,
2822 };
2823 
2824 static const struct attribute_group *bmc_dev_attr_groups[] = {
2825         &bmc_dev_attr_group,
2826         NULL
2827 };
2828 
2829 static const struct device_type bmc_device_type = {
2830         .groups         = bmc_dev_attr_groups,
2831 };
2832 
2833 static int __find_bmc_guid(struct device *dev, const void *data)
2834 {
2835         const guid_t *guid = data;
2836         struct bmc_device *bmc;
2837         int rv;
2838 
2839         if (dev->type != &bmc_device_type)
2840                 return 0;
2841 
2842         bmc = to_bmc_device(dev);
2843         rv = bmc->dyn_guid_set && guid_equal(&bmc->guid, guid);
2844         if (rv)
2845                 rv = kref_get_unless_zero(&bmc->usecount);
2846         return rv;
2847 }
2848 
2849 /*
2850  * Returns with the bmc's usecount incremented, if it is non-NULL.
2851  */
2852 static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv,
2853                                              guid_t *guid)
2854 {
2855         struct device *dev;
2856         struct bmc_device *bmc = NULL;
2857 
2858         dev = driver_find_device(drv, NULL, guid, __find_bmc_guid);
2859         if (dev) {
2860                 bmc = to_bmc_device(dev);
2861                 put_device(dev);
2862         }
2863         return bmc;
2864 }
2865 
2866 struct prod_dev_id {
2867         unsigned int  product_id;
2868         unsigned char device_id;
2869 };
2870 
2871 static int __find_bmc_prod_dev_id(struct device *dev, const void *data)
2872 {
2873         const struct prod_dev_id *cid = data;
2874         struct bmc_device *bmc;
2875         int rv;
2876 
2877         if (dev->type != &bmc_device_type)
2878                 return 0;
2879 
2880         bmc = to_bmc_device(dev);
2881         rv = (bmc->id.product_id == cid->product_id
2882               && bmc->id.device_id == cid->device_id);
2883         if (rv)
2884                 rv = kref_get_unless_zero(&bmc->usecount);
2885         return rv;
2886 }
2887 
2888 /*
2889  * Returns with the bmc's usecount incremented, if it is non-NULL.
2890  */
2891 static struct bmc_device *ipmi_find_bmc_prod_dev_id(
2892         struct device_driver *drv,
2893         unsigned int product_id, unsigned char device_id)
2894 {
2895         struct prod_dev_id id = {
2896                 .product_id = product_id,
2897                 .device_id = device_id,
2898         };
2899         struct device *dev;
2900         struct bmc_device *bmc = NULL;
2901 
2902         dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id);
2903         if (dev) {
2904                 bmc = to_bmc_device(dev);
2905                 put_device(dev);
2906         }
2907         return bmc;
2908 }
2909 
2910 static DEFINE_IDA(ipmi_bmc_ida);
2911 
2912 static void
2913 release_bmc_device(struct device *dev)
2914 {
2915         kfree(to_bmc_device(dev));
2916 }
2917 
2918 static void cleanup_bmc_work(struct work_struct *work)
2919 {
2920         struct bmc_device *bmc = container_of(work, struct bmc_device,
2921                                               remove_work);
2922         int id = bmc->pdev.id; /* Unregister overwrites id */
2923 
2924         platform_device_unregister(&bmc->pdev);
2925         ida_simple_remove(&ipmi_bmc_ida, id);
2926 }
2927 
2928 static void
2929 cleanup_bmc_device(struct kref *ref)
2930 {
2931         struct bmc_device *bmc = container_of(ref, struct bmc_device, usecount);
2932 
2933         /*
2934          * Remove the platform device in a work queue to avoid issues
2935          * with removing the device attributes while reading a device
2936          * attribute.
2937          */
2938         schedule_work(&bmc->remove_work);
2939 }
2940 
2941 /*
2942  * Must be called with intf->bmc_reg_mutex held.
2943  */
2944 static void __ipmi_bmc_unregister(struct ipmi_smi *intf)
2945 {
2946         struct bmc_device *bmc = intf->bmc;
2947 
2948         if (!intf->bmc_registered)
2949                 return;
2950 
2951         sysfs_remove_link(&intf->si_dev->kobj, "bmc");
2952         sysfs_remove_link(&bmc->pdev.dev.kobj, intf->my_dev_name);
2953         kfree(intf->my_dev_name);
2954         intf->my_dev_name = NULL;
2955 
2956         mutex_lock(&bmc->dyn_mutex);
2957         list_del(&intf->bmc_link);
2958         mutex_unlock(&bmc->dyn_mutex);
2959         intf->bmc = &intf->tmp_bmc;
2960         kref_put(&bmc->usecount, cleanup_bmc_device);
2961         intf->bmc_registered = false;
2962 }
2963 
2964 static void ipmi_bmc_unregister(struct ipmi_smi *intf)
2965 {
2966         mutex_lock(&intf->bmc_reg_mutex);
2967         __ipmi_bmc_unregister(intf);
2968         mutex_unlock(&intf->bmc_reg_mutex);
2969 }
2970 
2971 /*
2972  * Must be called with intf->bmc_reg_mutex held.
2973  */
2974 static int __ipmi_bmc_register(struct ipmi_smi *intf,
2975                                struct ipmi_device_id *id,
2976                                bool guid_set, guid_t *guid, int intf_num)
2977 {
2978         int               rv;
2979         struct bmc_device *bmc;
2980         struct bmc_device *old_bmc;
2981 
2982         /*
2983          * platform_device_register() can cause bmc_reg_mutex to
2984          * be claimed because of the is_visible functions of
2985          * the attributes.  Eliminate possible recursion and
2986          * release the lock.
2987          */
2988         intf->in_bmc_register = true;
2989         mutex_unlock(&intf->bmc_reg_mutex);
2990 
2991         /*
2992          * Try to find if there is an bmc_device struct
2993          * representing the interfaced BMC already
2994          */
2995         mutex_lock(&ipmidriver_mutex);
2996         if (guid_set)
2997                 old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, guid);
2998         else
2999                 old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
3000                                                     id->product_id,
3001                                                     id->device_id);
3002 
3003         /*
3004          * If there is already an bmc_device, free the new one,
3005          * otherwise register the new BMC device
3006          */
3007         if (old_bmc) {
3008                 bmc = old_bmc;
3009                 /*
3010                  * Note: old_bmc already has usecount incremented by
3011                  * the BMC find functions.
3012                  */
3013                 intf->bmc = old_bmc;
3014                 mutex_lock(&bmc->dyn_mutex);
3015                 list_add_tail(&intf->bmc_link, &bmc->intfs);
3016                 mutex_unlock(&bmc->dyn_mutex);
3017 
3018                 dev_info(intf->si_dev,
3019                          "interfacing existing BMC (man_id: 0x%6.6x, prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
3020                          bmc->id.manufacturer_id,
3021                          bmc->id.product_id,
3022                          bmc->id.device_id);
3023         } else {
3024                 bmc = kzalloc(sizeof(*bmc), GFP_KERNEL);
3025                 if (!bmc) {
3026                         rv = -ENOMEM;
3027                         goto out;
3028                 }
3029                 INIT_LIST_HEAD(&bmc->intfs);
3030                 mutex_init(&bmc->dyn_mutex);
3031                 INIT_WORK(&bmc->remove_work, cleanup_bmc_work);
3032 
3033                 bmc->id = *id;
3034                 bmc->dyn_id_set = 1;
3035                 bmc->dyn_guid_set = guid_set;
3036                 bmc->guid = *guid;
3037                 bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY;
3038 
3039                 bmc->pdev.name = "ipmi_bmc";
3040 
3041                 rv = ida_simple_get(&ipmi_bmc_ida, 0, 0, GFP_KERNEL);
3042                 if (rv < 0) {
3043                         kfree(bmc);
3044                         goto out;
3045                 }
3046 
3047                 bmc->pdev.dev.driver = &ipmidriver.driver;
3048                 bmc->pdev.id = rv;
3049                 bmc->pdev.dev.release = release_bmc_device;
3050                 bmc->pdev.dev.type = &bmc_device_type;
3051                 kref_init(&bmc->usecount);
3052 
3053                 intf->bmc = bmc;
3054                 mutex_lock(&bmc->dyn_mutex);
3055                 list_add_tail(&intf->bmc_link, &bmc->intfs);
3056                 mutex_unlock(&bmc->dyn_mutex);
3057 
3058                 rv = platform_device_register(&bmc->pdev);
3059                 if (rv) {
3060                         dev_err(intf->si_dev,
3061                                 "Unable to register bmc device: %d\n",
3062                                 rv);
3063                         goto out_list_del;
3064                 }
3065 
3066                 dev_info(intf->si_dev,
3067                          "Found new BMC (man_id: 0x%6.6x, prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
3068                          bmc->id.manufacturer_id,
3069                          bmc->id.product_id,
3070                          bmc->id.device_id);
3071         }
3072 
3073         /*
3074          * create symlink from system interface device to bmc device
3075          * and back.
3076          */
3077         rv = sysfs_create_link(&intf->si_dev->kobj, &bmc->pdev.dev.kobj, "bmc");
3078         if (rv) {
3079                 dev_err(intf->si_dev, "Unable to create bmc symlink: %d\n", rv);
3080                 goto out_put_bmc;
3081         }
3082 
3083         if (intf_num == -1)
3084                 intf_num = intf->intf_num;
3085         intf->my_dev_name = kasprintf(GFP_KERNEL, "ipmi%d", intf_num);
3086         if (!intf->my_dev_name) {
3087                 rv = -ENOMEM;
3088                 dev_err(intf->si_dev, "Unable to allocate link from BMC: %d\n",
3089                         rv);
3090                 goto out_unlink1;
3091         }
3092 
3093         rv = sysfs_create_link(&bmc->pdev.dev.kobj, &intf->si_dev->kobj,
3094                                intf->my_dev_name);
3095         if (rv) {
3096                 kfree(intf->my_dev_name);
3097                 intf->my_dev_name = NULL;
3098                 dev_err(intf->si_dev, "Unable to create symlink to bmc: %d\n",
3099                         rv);
3100                 goto out_free_my_dev_name;
3101         }
3102 
3103         intf->bmc_registered = true;
3104 
3105 out:
3106         mutex_unlock(&ipmidriver_mutex);
3107         mutex_lock(&intf->bmc_reg_mutex);
3108         intf->in_bmc_register = false;
3109         return rv;
3110 
3111 
3112 out_free_my_dev_name:
3113         kfree(intf->my_dev_name);
3114         intf->my_dev_name = NULL;
3115 
3116 out_unlink1:
3117         sysfs_remove_link(&intf->si_dev->kobj, "bmc");
3118 
3119 out_put_bmc:
3120         mutex_lock(&bmc->dyn_mutex);
3121         list_del(&intf->bmc_link);
3122         mutex_unlock(&bmc->dyn_mutex);
3123         intf->bmc = &intf->tmp_bmc;
3124         kref_put(&bmc->usecount, cleanup_bmc_device);
3125         goto out;
3126 
3127 out_list_del:
3128         mutex_lock(&bmc->dyn_mutex);
3129         list_del(&intf->bmc_link);
3130         mutex_unlock(&bmc->dyn_mutex);
3131         intf->bmc = &intf->tmp_bmc;
3132         put_device(&bmc->pdev.dev);
3133         goto out;
3134 }
3135 
3136 static int
3137 send_guid_cmd(struct ipmi_smi *intf, int chan)
3138 {
3139         struct kernel_ipmi_msg            msg;
3140         struct ipmi_system_interface_addr si;
3141 
3142         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3143         si.channel = IPMI_BMC_CHANNEL;
3144         si.lun = 0;
3145 
3146         msg.netfn = IPMI_NETFN_APP_REQUEST;
3147         msg.cmd = IPMI_GET_DEVICE_GUID_CMD;
3148         msg.data = NULL;
3149         msg.data_len = 0;
3150         return i_ipmi_request(NULL,
3151                               intf,
3152                               (struct ipmi_addr *) &si,
3153                               0,
3154                               &msg,
3155                               intf,
3156                               NULL,
3157                               NULL,
3158                               0,
3159                               intf->addrinfo[0].address,
3160                               intf->addrinfo[0].lun,
3161                               -1, 0);
3162 }
3163 
3164 static void guid_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
3165 {
3166         struct bmc_device *bmc = intf->bmc;
3167 
3168         if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
3169             || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)
3170             || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD))
3171                 /* Not for me */
3172                 return;
3173 
3174         if (msg->msg.data[0] != 0) {
3175                 /* Error from getting the GUID, the BMC doesn't have one. */
3176                 bmc->dyn_guid_set = 0;
3177                 goto out;
3178         }
3179 
3180         if (msg->msg.data_len < UUID_SIZE + 1) {
3181                 bmc->dyn_guid_set = 0;
3182                 dev_warn(intf->si_dev,
3183                          "The GUID response from the BMC was too short, it was %d but should have been %d.  Assuming GUID is not available.\n",
3184                          msg->msg.data_len, UUID_SIZE + 1);
3185                 goto out;
3186         }
3187 
3188         guid_copy(&bmc->fetch_guid, (guid_t *)(msg->msg.data + 1));
3189         /*
3190          * Make sure the guid data is available before setting
3191          * dyn_guid_set.
3192          */
3193         smp_wmb();
3194         bmc->dyn_guid_set = 1;
3195  out:
3196         wake_up(&intf->waitq);
3197 }
3198 
3199 static void __get_guid(struct ipmi_smi *intf)
3200 {
3201         int rv;
3202         struct bmc_device *bmc = intf->bmc;
3203 
3204         bmc->dyn_guid_set = 2;
3205         intf->null_user_handler = guid_handler;
3206         rv = send_guid_cmd(intf, 0);
3207         if (rv)
3208                 /* Send failed, no GUID available. */
3209                 bmc->dyn_guid_set = 0;
3210         else
3211                 wait_event(intf->waitq, bmc->dyn_guid_set != 2);
3212 
3213         /* dyn_guid_set makes the guid data available. */
3214         smp_rmb();
3215 
3216         intf->null_user_handler = NULL;
3217 }
3218 
3219 static int
3220 send_channel_info_cmd(struct ipmi_smi *intf, int chan)
3221 {
3222         struct kernel_ipmi_msg            msg;
3223         unsigned char                     data[1];
3224         struct ipmi_system_interface_addr si;
3225 
3226         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3227         si.channel = IPMI_BMC_CHANNEL;
3228         si.lun = 0;
3229 
3230         msg.netfn = IPMI_NETFN_APP_REQUEST;
3231         msg.cmd = IPMI_GET_CHANNEL_INFO_CMD;
3232         msg.data = data;
3233         msg.data_len = 1;
3234         data[0] = chan;
3235         return i_ipmi_request(NULL,
3236                               intf,
3237                               (struct ipmi_addr *) &si,
3238                               0,
3239                               &msg,
3240                               intf,
3241                               NULL,
3242                               NULL,
3243                               0,
3244                               intf->addrinfo[0].address,
3245                               intf->addrinfo[0].lun,
3246                               -1, 0);
3247 }
3248 
3249 static void
3250 channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
3251 {
3252         int rv = 0;
3253         int ch;
3254         unsigned int set = intf->curr_working_cset;
3255         struct ipmi_channel *chans;
3256 
3257         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
3258             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
3259             && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD)) {
3260                 /* It's the one we want */
3261                 if (msg->msg.data[0] != 0) {
3262                         /* Got an error from the channel, just go on. */
3263 
3264                         if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) {
3265                                 /*
3266                                  * If the MC does not support this
3267                                  * command, that is legal.  We just
3268                                  * assume it has one IPMB at channel
3269                                  * zero.
3270                                  */
3271                                 intf->wchannels[set].c[0].medium
3272                                         = IPMI_CHANNEL_MEDIUM_IPMB;
3273                                 intf->wchannels[set].c[0].protocol
3274                                         = IPMI_CHANNEL_PROTOCOL_IPMB;
3275 
3276                                 intf->channel_list = intf->wchannels + set;
3277                                 intf->channels_ready = true;
3278                                 wake_up(&intf->waitq);
3279                                 goto out;
3280                         }
3281                         goto next_channel;
3282                 }
3283                 if (msg->msg.data_len < 4) {
3284                         /* Message not big enough, just go on. */
3285                         goto next_channel;
3286                 }
3287                 ch = intf->curr_channel;
3288                 chans = intf->wchannels[set].c;
3289                 chans[ch].medium = msg->msg.data[2] & 0x7f;
3290                 chans[ch].protocol = msg->msg.data[3] & 0x1f;
3291 
3292  next_channel:
3293                 intf->curr_channel++;
3294                 if (intf->curr_channel >= IPMI_MAX_CHANNELS) {
3295                         intf->channel_list = intf->wchannels + set;
3296                         intf->channels_ready = true;
3297                         wake_up(&intf->waitq);
3298                 } else {
3299                         intf->channel_list = intf->wchannels + set;
3300                         intf->channels_ready = true;
3301                         rv = send_channel_info_cmd(intf, intf->curr_channel);
3302                 }
3303 
3304                 if (rv) {
3305                         /* Got an error somehow, just give up. */
3306                         dev_warn(intf->si_dev,
3307                                  "Error sending channel information for channel %d: %d\n",
3308                                  intf->curr_channel, rv);
3309 
3310                         intf->channel_list = intf->wchannels + set;
3311                         intf->channels_ready = true;
3312                         wake_up(&intf->waitq);
3313                 }
3314         }
3315  out:
3316         return;
3317 }
3318 
3319 /*
3320  * Must be holding intf->bmc_reg_mutex to call this.
3321  */
3322 static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id)
3323 {
3324         int rv;
3325 
3326         if (ipmi_version_major(id) > 1
3327                         || (ipmi_version_major(id) == 1
3328                             && ipmi_version_minor(id) >= 5)) {
3329                 unsigned int set;
3330 
3331                 /*
3332                  * Start scanning the channels to see what is
3333                  * available.
3334                  */
3335                 set = !intf->curr_working_cset;
3336                 intf->curr_working_cset = set;
3337                 memset(&intf->wchannels[set], 0,
3338                        sizeof(struct ipmi_channel_set));
3339 
3340                 intf->null_user_handler = channel_handler;
3341                 intf->curr_channel = 0;
3342                 rv = send_channel_info_cmd(intf, 0);
3343                 if (rv) {
3344                         dev_warn(intf->si_dev,
3345                                  "Error sending channel information for channel 0, %d\n",
3346                                  rv);
3347                         return -EIO;
3348                 }
3349 
3350                 /* Wait for the channel info to be read. */
3351                 wait_event(intf->waitq, intf->channels_ready);
3352                 intf->null_user_handler = NULL;
3353         } else {
3354                 unsigned int set = intf->curr_working_cset;
3355 
3356                 /* Assume a single IPMB channel at zero. */
3357                 intf->wchannels[set].c[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;
3358                 intf->wchannels[set].c[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB;
3359                 intf->channel_list = intf->wchannels + set;
3360                 intf->channels_ready = true;
3361         }
3362 
3363         return 0;
3364 }
3365 
3366 static void ipmi_poll(struct ipmi_smi *intf)
3367 {
3368         if (intf->handlers->poll)
3369                 intf->handlers->poll(intf->send_info);
3370         /* In case something came in */
3371         handle_new_recv_msgs(intf);
3372 }
3373 
3374 void ipmi_poll_interface(struct ipmi_user *user)
3375 {
3376         ipmi_poll(user->intf);
3377 }
3378 EXPORT_SYMBOL(ipmi_poll_interface);
3379 
3380 static void redo_bmc_reg(struct work_struct *work)
3381 {
3382         struct ipmi_smi *intf = container_of(work, struct ipmi_smi,
3383                                              bmc_reg_work);
3384 
3385         if (!intf->in_shutdown)
3386                 bmc_get_device_id(intf, NULL, NULL, NULL, NULL);
3387 
3388         kref_put(&intf->refcount, intf_free);
3389 }
3390 
3391 int ipmi_add_smi(struct module         *owner,
3392                  const struct ipmi_smi_handlers *handlers,
3393                  void                  *send_info,
3394                  struct device         *si_dev,
3395                  unsigned char         slave_addr)
3396 {
3397         int              i, j;
3398         int              rv;
3399         struct ipmi_smi *intf, *tintf;
3400         struct list_head *link;
3401         struct ipmi_device_id id;
3402 
3403         /*
3404          * Make sure the driver is actually initialized, this handles
3405          * problems with initialization order.
3406          */
3407         rv = ipmi_init_msghandler();
3408         if (rv)
3409                 return rv;
3410 
3411         intf = kzalloc(sizeof(*intf), GFP_KERNEL);
3412         if (!intf)
3413                 return -ENOMEM;
3414 
3415         rv = init_srcu_struct(&intf->users_srcu);
3416         if (rv) {
3417                 kfree(intf);
3418                 return rv;
3419         }
3420 
3421         intf->owner = owner;
3422         intf->bmc = &intf->tmp_bmc;
3423         INIT_LIST_HEAD(&intf->bmc->intfs);
3424         mutex_init(&intf->bmc->dyn_mutex);
3425         INIT_LIST_HEAD(&intf->bmc_link);
3426         mutex_init(&intf->bmc_reg_mutex);
3427         intf->intf_num = -1; /* Mark it invalid for now. */
3428         kref_init(&intf->refcount);
3429         INIT_WORK(&intf->bmc_reg_work, redo_bmc_reg);
3430         intf->si_dev = si_dev;
3431         for (j = 0; j < IPMI_MAX_CHANNELS; j++) {
3432                 intf->addrinfo[j].address = IPMI_BMC_SLAVE_ADDR;
3433                 intf->addrinfo[j].lun = 2;
3434         }
3435         if (slave_addr != 0)
3436                 intf->addrinfo[0].address = slave_addr;
3437         INIT_LIST_HEAD(&intf->users);
3438         intf->handlers = handlers;
3439         intf->send_info = send_info;
3440         spin_lock_init(&intf->seq_lock);
3441         for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) {
3442                 intf->seq_table[j].inuse = 0;
3443                 intf->seq_table[j].seqid = 0;
3444         }
3445         intf->curr_seq = 0;
3446         spin_lock_init(&intf->waiting_rcv_msgs_lock);
3447         INIT_LIST_HEAD(&intf->waiting_rcv_msgs);
3448         tasklet_init(&intf->recv_tasklet,
3449                      smi_recv_tasklet,
3450                      (unsigned long) intf);
3451         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 0);
3452         spin_lock_init(&intf->xmit_msgs_lock);
3453         INIT_LIST_HEAD(&intf->xmit_msgs);
3454         INIT_LIST_HEAD(&intf->hp_xmit_msgs);
3455         spin_lock_init(&intf->events_lock);
3456         spin_lock_init(&intf->watch_lock);
3457         atomic_set(&intf->event_waiters, 0);
3458         intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
3459         INIT_LIST_HEAD(&intf->waiting_events);
3460         intf->waiting_events_count = 0;
3461         mutex_init(&intf->cmd_rcvrs_mutex);
3462         spin_lock_init(&intf->maintenance_mode_lock);
3463         INIT_LIST_HEAD(&intf->cmd_rcvrs);
3464         init_waitqueue_head(&intf->waitq);
3465         for (i = 0; i < IPMI_NUM_STATS; i++)
3466                 atomic_set(&intf->stats[i], 0);
3467 
3468         mutex_lock(&ipmi_interfaces_mutex);
3469         /* Look for a hole in the numbers. */
3470         i = 0;
3471         link = &ipmi_interfaces;
3472         list_for_each_entry_rcu(tintf, &ipmi_interfaces, link) {
3473                 if (tintf->intf_num != i) {
3474                         link = &tintf->link;
3475                         break;
3476                 }
3477                 i++;
3478         }
3479         /* Add the new interface in numeric order. */
3480         if (i == 0)
3481                 list_add_rcu(&intf->link, &ipmi_interfaces);
3482         else
3483                 list_add_tail_rcu(&intf->link, link);
3484 
3485         rv = handlers->start_processing(send_info, intf);
3486         if (rv)
3487                 goto out_err;
3488 
3489         rv = __bmc_get_device_id(intf, NULL, &id, NULL, NULL, i);
3490         if (rv) {
3491                 dev_err(si_dev, "Unable to get the device id: %d\n", rv);
3492                 goto out_err_started;
3493         }
3494 
3495         mutex_lock(&intf->bmc_reg_mutex);
3496         rv = __scan_channels(intf, &id);
3497         mutex_unlock(&intf->bmc_reg_mutex);
3498         if (rv)
3499                 goto out_err_bmc_reg;
3500 
3501         /*
3502          * Keep memory order straight for RCU readers.  Make
3503          * sure everything else is committed to memory before
3504          * setting intf_num to mark the interface valid.
3505          */
3506         smp_wmb();
3507         intf->intf_num = i;
3508         mutex_unlock(&ipmi_interfaces_mutex);
3509 
3510         /* After this point the interface is legal to use. */
3511         call_smi_watchers(i, intf->si_dev);
3512 
3513         return 0;
3514 
3515  out_err_bmc_reg:
3516         ipmi_bmc_unregister(intf);
3517  out_err_started:
3518         if (intf->handlers->shutdown)
3519                 intf->handlers->shutdown(intf->send_info);
3520  out_err:
3521         list_del_rcu(&intf->link);
3522         mutex_unlock(&ipmi_interfaces_mutex);
3523         synchronize_srcu(&ipmi_interfaces_srcu);
3524         cleanup_srcu_struct(&intf->users_srcu);
3525         kref_put(&intf->refcount, intf_free);
3526 
3527         return rv;
3528 }
3529 EXPORT_SYMBOL(ipmi_add_smi);
3530 
3531 static void deliver_smi_err_response(struct ipmi_smi *intf,
3532                                      struct ipmi_smi_msg *msg,
3533                                      unsigned char err)
3534 {
3535         msg->rsp[0] = msg->data[0] | 4;
3536         msg->rsp[1] = msg->data[1];
3537         msg->rsp[2] = err;
3538         msg->rsp_size = 3;
3539         /* It's an error, so it will never requeue, no need to check return. */
3540         handle_one_recv_msg(intf, msg);
3541 }
3542 
3543 static void cleanup_smi_msgs(struct ipmi_smi *intf)
3544 {
3545         int              i;
3546         struct seq_table *ent;
3547         struct ipmi_smi_msg *msg;
3548         struct list_head *entry;
3549         struct list_head tmplist;
3550 
3551         /* Clear out our transmit queues and hold the messages. */
3552         INIT_LIST_HEAD(&tmplist);
3553         list_splice_tail(&intf->hp_xmit_msgs, &tmplist);
3554         list_splice_tail(&intf->xmit_msgs, &tmplist);
3555 
3556         /* Current message first, to preserve order */
3557         while (intf->curr_msg && !list_empty(&intf->waiting_rcv_msgs)) {
3558                 /* Wait for the message to clear out. */
3559                 schedule_timeout(1);
3560         }
3561 
3562         /* No need for locks, the interface is down. */
3563 
3564         /*
3565          * Return errors for all pending messages in queue and in the
3566          * tables waiting for remote responses.
3567          */
3568         while (!list_empty(&tmplist)) {
3569                 entry = tmplist.next;
3570                 list_del(entry);
3571                 msg = list_entry(entry, struct ipmi_smi_msg, link);
3572                 deliver_smi_err_response(intf, msg, IPMI_ERR_UNSPECIFIED);
3573         }
3574 
3575         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
3576                 ent = &intf->seq_table[i];
3577                 if (!ent->inuse)
3578                         continue;
3579                 deliver_err_response(intf, ent->recv_msg, IPMI_ERR_UNSPECIFIED);
3580         }
3581 }
3582 
3583 void ipmi_unregister_smi(struct ipmi_smi *intf)
3584 {
3585         struct ipmi_smi_watcher *w;
3586         int intf_num = intf->intf_num, index;
3587 
3588         mutex_lock(&ipmi_interfaces_mutex);
3589         intf->intf_num = -1;
3590         intf->in_shutdown = true;
3591         list_del_rcu(&intf->link);
3592         mutex_unlock(&ipmi_interfaces_mutex);
3593         synchronize_srcu(&ipmi_interfaces_srcu);
3594 
3595         /* At this point no users can be added to the interface. */
3596 
3597         /*
3598          * Call all the watcher interfaces to tell them that
3599          * an interface is going away.
3600          */
3601         mutex_lock(&smi_watchers_mutex);
3602         list_for_each_entry(w, &smi_watchers, link)
3603                 w->smi_gone(intf_num);
3604         mutex_unlock(&smi_watchers_mutex);
3605 
3606         index = srcu_read_lock(&intf->users_srcu);
3607         while (!list_empty(&intf->users)) {
3608                 struct ipmi_user *user =
3609                         container_of(list_next_rcu(&intf->users),
3610                                      struct ipmi_user, link);
3611 
3612                 _ipmi_destroy_user(user);
3613         }
3614         srcu_read_unlock(&intf->users_srcu, index);
3615 
3616         if (intf->handlers->shutdown)
3617                 intf->handlers->shutdown(intf->send_info);
3618 
3619         cleanup_smi_msgs(intf);
3620 
3621         ipmi_bmc_unregister(intf);
3622 
3623         cleanup_srcu_struct(&intf->users_srcu);
3624         kref_put(&intf->refcount, intf_free);
3625 }
3626 EXPORT_SYMBOL(ipmi_unregister_smi);
3627 
3628 static int handle_ipmb_get_msg_rsp(struct ipmi_smi *intf,
3629                                    struct ipmi_smi_msg *msg)
3630 {
3631         struct ipmi_ipmb_addr ipmb_addr;
3632         struct ipmi_recv_msg  *recv_msg;
3633 
3634         /*
3635          * This is 11, not 10, because the response must contain a
3636          * completion code.
3637          */
3638         if (msg->rsp_size < 11) {
3639                 /* Message not big enough, just ignore it. */
3640                 ipmi_inc_stat(intf, invalid_ipmb_responses);
3641                 return 0;
3642         }
3643 
3644         if (msg->rsp[2] != 0) {
3645                 /* An error getting the response, just ignore it. */
3646                 return 0;
3647         }
3648 
3649         ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE;
3650         ipmb_addr.slave_addr = msg->rsp[6];
3651         ipmb_addr.channel = msg->rsp[3] & 0x0f;
3652         ipmb_addr.lun = msg->rsp[7] & 3;
3653 
3654         /*
3655          * It's a response from a remote entity.  Look up the sequence
3656          * number and handle the response.
3657          */
3658         if (intf_find_seq(intf,
3659                           msg->rsp[7] >> 2,
3660                           msg->rsp[3] & 0x0f,
3661                           msg->rsp[8],
3662                           (msg->rsp[4] >> 2) & (~1),
3663                           (struct ipmi_addr *) &ipmb_addr,
3664                           &recv_msg)) {
3665                 /*
3666                  * We were unable to find the sequence number,
3667                  * so just nuke the message.
3668                  */
3669                 ipmi_inc_stat(intf, unhandled_ipmb_responses);
3670                 return 0;
3671         }
3672 
3673         memcpy(recv_msg->msg_data, &msg->rsp[9], msg->rsp_size - 9);
3674         /*
3675          * The other fields matched, so no need to set them, except
3676          * for netfn, which needs to be the response that was
3677          * returned, not the request value.
3678          */
3679         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3680         recv_msg->msg.data = recv_msg->msg_data;
3681         recv_msg->msg.data_len = msg->rsp_size - 10;
3682         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3683         if (deliver_response(intf, recv_msg))
3684                 ipmi_inc_stat(intf, unhandled_ipmb_responses);
3685         else
3686                 ipmi_inc_stat(intf, handled_ipmb_responses);
3687 
3688         return 0;
3689 }
3690 
3691 static int handle_ipmb_get_msg_cmd(struct ipmi_smi *intf,
3692                                    struct ipmi_smi_msg *msg)
3693 {
3694         struct cmd_rcvr          *rcvr;
3695         int                      rv = 0;
3696         unsigned char            netfn;
3697         unsigned char            cmd;
3698         unsigned char            chan;
3699         struct ipmi_user         *user = NULL;
3700         struct ipmi_ipmb_addr    *ipmb_addr;
3701         struct ipmi_recv_msg     *recv_msg;
3702 
3703         if (msg->rsp_size < 10) {
3704                 /* Message not big enough, just ignore it. */
3705                 ipmi_inc_stat(intf, invalid_commands);
3706                 return 0;
3707         }
3708 
3709         if (msg->rsp[2] != 0) {
3710                 /* An error getting the response, just ignore it. */
3711                 return 0;
3712         }
3713 
3714         netfn = msg->rsp[4] >> 2;
3715         cmd = msg->rsp[8];
3716         chan = msg->rsp[3] & 0xf;
3717 
3718         rcu_read_lock();
3719         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3720         if (rcvr) {
3721                 user = rcvr->user;
3722                 kref_get(&user->refcount);
3723         } else
3724                 user = NULL;
3725         rcu_read_unlock();
3726 
3727         if (user == NULL) {
3728                 /* We didn't find a user, deliver an error response. */
3729                 ipmi_inc_stat(intf, unhandled_commands);
3730 
3731                 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
3732                 msg->data[1] = IPMI_SEND_MSG_CMD;
3733                 msg->data[2] = msg->rsp[3];
3734                 msg->data[3] = msg->rsp[6];
3735                 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3);
3736                 msg->data[5] = ipmb_checksum(&msg->data[3], 2);
3737                 msg->data[6] = intf->addrinfo[msg->rsp[3] & 0xf].address;
3738                 /* rqseq/lun */
3739                 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3);
3740                 msg->data[8] = msg->rsp[8]; /* cmd */
3741                 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE;
3742                 msg->data[10] = ipmb_checksum(&msg->data[6], 4);
3743                 msg->data_size = 11;
3744 
3745                 ipmi_debug_msg("Invalid command:", msg->data, msg->data_size);
3746 
3747                 rcu_read_lock();
3748                 if (!intf->in_shutdown) {
3749                         smi_send(intf, intf->handlers, msg, 0);
3750                         /*
3751                          * We used the message, so return the value
3752                          * that causes it to not be freed or
3753                          * queued.
3754                          */
3755                         rv = -1;
3756                 }
3757                 rcu_read_unlock();
3758         } else {
3759                 recv_msg = ipmi_alloc_recv_msg();
3760                 if (!recv_msg) {
3761                         /*
3762                          * We couldn't allocate memory for the
3763                          * message, so requeue it for handling
3764                          * later.
3765                          */
3766                         rv = 1;
3767                         kref_put(&user->refcount, free_user);
3768                 } else {
3769                         /* Extract the source address from the data. */
3770                         ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
3771                         ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE;
3772                         ipmb_addr->slave_addr = msg->rsp[6];
3773                         ipmb_addr->lun = msg->rsp[7] & 3;
3774                         ipmb_addr->channel = msg->rsp[3] & 0xf;
3775 
3776                         /*
3777                          * Extract the rest of the message information
3778                          * from the IPMB header.
3779                          */
3780                         recv_msg->user = user;
3781                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3782                         recv_msg->msgid = msg->rsp[7] >> 2;
3783                         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3784                         recv_msg->msg.cmd = msg->rsp[8];
3785                         recv_msg->msg.data = recv_msg->msg_data;
3786 
3787                         /*
3788                          * We chop off 10, not 9 bytes because the checksum
3789                          * at the end also needs to be removed.
3790                          */
3791                         recv_msg->msg.data_len = msg->rsp_size - 10;
3792                         memcpy(recv_msg->msg_data, &msg->rsp[9],
3793                                msg->rsp_size - 10);
3794                         if (deliver_response(intf, recv_msg))
3795                                 ipmi_inc_stat(intf, unhandled_commands);
3796                         else
3797                                 ipmi_inc_stat(intf, handled_commands);
3798                 }
3799         }
3800 
3801         return rv;
3802 }
3803 
3804 static int handle_lan_get_msg_rsp(struct ipmi_smi *intf,
3805                                   struct ipmi_smi_msg *msg)
3806 {
3807         struct ipmi_lan_addr  lan_addr;
3808         struct ipmi_recv_msg  *recv_msg;
3809 
3810 
3811         /*
3812          * This is 13, not 12, because the response must contain a
3813          * completion code.
3814          */
3815         if (msg->rsp_size < 13) {
3816                 /* Message not big enough, just ignore it. */
3817                 ipmi_inc_stat(intf, invalid_lan_responses);
3818                 return 0;
3819         }
3820 
3821         if (msg->rsp[2] != 0) {
3822                 /* An error getting the response, just ignore it. */
3823                 return 0;
3824         }
3825 
3826         lan_addr.addr_type = IPMI_LAN_ADDR_TYPE;
3827         lan_addr.session_handle = msg->rsp[4];
3828         lan_addr.remote_SWID = msg->rsp[8];
3829         lan_addr.local_SWID = msg->rsp[5];
3830         lan_addr.channel = msg->rsp[3] & 0x0f;
3831         lan_addr.privilege = msg->rsp[3] >> 4;
3832         lan_addr.lun = msg->rsp[9] & 3;
3833 
3834         /*
3835          * It's a response from a remote entity.  Look up the sequence
3836          * number and handle the response.
3837          */
3838         if (intf_find_seq(intf,
3839                           msg->rsp[9] >> 2,
3840                           msg->rsp[3] & 0x0f,
3841                           msg->rsp[10],
3842                           (msg->rsp[6] >> 2) & (~1),
3843                           (struct ipmi_addr *) &lan_addr,
3844                           &recv_msg)) {
3845                 /*
3846                  * We were unable to find the sequence number,
3847                  * so just nuke the message.
3848                  */
3849                 ipmi_inc_stat(intf, unhandled_lan_responses);
3850                 return 0;
3851         }
3852 
3853         memcpy(recv_msg->msg_data, &msg->rsp[11], msg->rsp_size - 11);
3854         /*
3855          * The other fields matched, so no need to set them, except
3856          * for netfn, which needs to be the response that was
3857          * returned, not the request value.
3858          */
3859         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3860         recv_msg->msg.data = recv_msg->msg_data;
3861         recv_msg->msg.data_len = msg->rsp_size - 12;
3862         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3863         if (deliver_response(intf, recv_msg))
3864                 ipmi_inc_stat(intf, unhandled_lan_responses);
3865         else
3866                 ipmi_inc_stat(intf, handled_lan_responses);
3867 
3868         return 0;
3869 }
3870 
3871 static int handle_lan_get_msg_cmd(struct ipmi_smi *intf,
3872                                   struct ipmi_smi_msg *msg)
3873 {
3874         struct cmd_rcvr          *rcvr;
3875         int                      rv = 0;
3876         unsigned char            netfn;
3877         unsigned char            cmd;
3878         unsigned char            chan;
3879         struct ipmi_user         *user = NULL;
3880         struct ipmi_lan_addr     *lan_addr;
3881         struct ipmi_recv_msg     *recv_msg;
3882 
3883         if (msg->rsp_size < 12) {
3884                 /* Message not big enough, just ignore it. */
3885                 ipmi_inc_stat(intf, invalid_commands);
3886                 return 0;
3887         }
3888 
3889         if (msg->rsp[2] != 0) {
3890                 /* An error getting the response, just ignore it. */
3891                 return 0;
3892         }
3893 
3894         netfn = msg->rsp[6] >> 2;
3895         cmd = msg->rsp[10];
3896         chan = msg->rsp[3] & 0xf;
3897 
3898         rcu_read_lock();
3899         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3900         if (rcvr) {
3901                 user = rcvr->user;
3902                 kref_get(&user->refcount);
3903         } else
3904                 user = NULL;
3905         rcu_read_unlock();
3906 
3907         if (user == NULL) {
3908                 /* We didn't find a user, just give up. */
3909                 ipmi_inc_stat(intf, unhandled_commands);
3910 
3911                 /*
3912                  * Don't do anything with these messages, just allow
3913                  * them to be freed.
3914                  */
3915                 rv = 0;
3916         } else {
3917                 recv_msg = ipmi_alloc_recv_msg();
3918                 if (!recv_msg) {
3919                         /*
3920                          * We couldn't allocate memory for the
3921                          * message, so requeue it for handling later.
3922                          */
3923                         rv = 1;
3924                         kref_put(&user->refcount, free_user);
3925                 } else {
3926                         /* Extract the source address from the data. */
3927                         lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
3928                         lan_addr->addr_type = IPMI_LAN_ADDR_TYPE;
3929                         lan_addr->session_handle = msg->rsp[4];
3930                         lan_addr->remote_SWID = msg->rsp[8];
3931                         lan_addr->local_SWID = msg->rsp[5];
3932                         lan_addr->lun = msg->rsp[9] & 3;
3933                         lan_addr->channel = msg->rsp[3] & 0xf;
3934                         lan_addr->privilege = msg->rsp[3] >> 4;
3935 
3936                         /*
3937                          * Extract the rest of the message information
3938                          * from the IPMB header.
3939                          */
3940                         recv_msg->user = user;
3941                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3942                         recv_msg->msgid = msg->rsp[9] >> 2;
3943                         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3944                         recv_msg->msg.cmd = msg->rsp[10];
3945                         recv_msg->msg.data = recv_msg->msg_data;
3946 
3947                         /*
3948                          * We chop off 12, not 11 bytes because the checksum
3949                          * at the end also needs to be removed.
3950                          */
3951                         recv_msg->msg.data_len = msg->rsp_size - 12;
3952                         memcpy(recv_msg->msg_data, &msg->rsp[11],
3953                                msg->rsp_size - 12);
3954                         if (deliver_response(intf, recv_msg))
3955                                 ipmi_inc_stat(intf, unhandled_commands);
3956                         else
3957                                 ipmi_inc_stat(intf, handled_commands);
3958                 }
3959         }
3960 
3961         return rv;
3962 }
3963 
3964 /*
3965  * This routine will handle "Get Message" command responses with
3966  * channels that use an OEM Medium. The message format belongs to
3967  * the OEM.  See IPMI 2.0 specification, Chapter 6 and
3968  * Chapter 22, sections 22.6 and 22.24 for more details.
3969  */
3970 static int handle_oem_get_msg_cmd(struct ipmi_smi *intf,
3971                                   struct ipmi_smi_msg *msg)
3972 {
3973         struct cmd_rcvr       *rcvr;
3974         int                   rv = 0;
3975         unsigned char         netfn;
3976         unsigned char         cmd;
3977         unsigned char         chan;
3978         struct ipmi_user *user = NULL;
3979         struct ipmi_system_interface_addr *smi_addr;
3980         struct ipmi_recv_msg  *recv_msg;
3981 
3982         /*
3983          * We expect the OEM SW to perform error checking
3984          * so we just do some basic sanity checks
3985          */
3986         if (msg->rsp_size < 4) {
3987                 /* Message not big enough, just ignore it. */
3988                 ipmi_inc_stat(intf, invalid_commands);
3989                 return 0;
3990         }
3991 
3992         if (msg->rsp[2] != 0) {
3993                 /* An error getting the response, just ignore it. */
3994                 return 0;
3995         }
3996 
3997         /*
3998          * This is an OEM Message so the OEM needs to know how
3999          * handle the message. We do no interpretation.
4000          */
4001         netfn = msg->rsp[0] >> 2;
4002         cmd = msg->rsp[1];
4003         chan = msg->rsp[3] & 0xf;
4004 
4005         rcu_read_lock();
4006         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
4007         if (rcvr) {
4008                 user = rcvr->user;
4009                 kref_get(&user->refcount);
4010         } else
4011                 user = NULL;
4012         rcu_read_unlock();
4013 
4014         if (user == NULL) {
4015                 /* We didn't find a user, just give up. */
4016                 ipmi_inc_stat(intf, unhandled_commands);
4017 
4018                 /*
4019                  * Don't do anything with these messages, just allow
4020                  * them to be freed.
4021                  */
4022 
4023                 rv = 0;
4024         } else {
4025                 recv_msg = ipmi_alloc_recv_msg();
4026                 if (!recv_msg) {
4027                         /*
4028                          * We couldn't allocate memory for the
4029                          * message, so requeue it for handling
4030                          * later.
4031                          */
4032                         rv = 1;
4033                         kref_put(&user->refcount, free_user);
4034                 } else {
4035                         /*
4036                          * OEM Messages are expected to be delivered via
4037                          * the system interface to SMS software.  We might
4038                          * need to visit this again depending on OEM
4039                          * requirements
4040                          */
4041                         smi_addr = ((struct ipmi_system_interface_addr *)
4042                                     &recv_msg->addr);
4043                         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4044                         smi_addr->channel = IPMI_BMC_CHANNEL;
4045                         smi_addr->lun = msg->rsp[0] & 3;
4046 
4047                         recv_msg->user = user;
4048                         recv_msg->user_msg_data = NULL;
4049                         recv_msg->recv_type = IPMI_OEM_RECV_TYPE;
4050                         recv_msg->msg.netfn = msg->rsp[0] >> 2;
4051                         recv_msg->msg.cmd = msg->rsp[1];
4052                         recv_msg->msg.data = recv_msg->msg_data;
4053 
4054                         /*
4055                          * The message starts at byte 4 which follows the
4056                          * the Channel Byte in the "GET MESSAGE" command
4057                          */
4058                         recv_msg->msg.data_len = msg->rsp_size - 4;
4059                         memcpy(recv_msg->msg_data, &msg->rsp[4],
4060                                msg->rsp_size - 4);
4061                         if (deliver_response(intf, recv_msg))
4062                                 ipmi_inc_stat(intf, unhandled_commands);
4063                         else
4064                                 ipmi_inc_stat(intf, handled_commands);
4065                 }
4066         }
4067 
4068         return rv;
4069 }
4070 
4071 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg,
4072                                      struct ipmi_smi_msg  *msg)
4073 {
4074         struct ipmi_system_interface_addr *smi_addr;
4075 
4076         recv_msg->msgid = 0;
4077         smi_addr = (struct ipmi_system_interface_addr *) &recv_msg->addr;
4078         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4079         smi_addr->channel = IPMI_BMC_CHANNEL;
4080         smi_addr->lun = msg->rsp[0] & 3;
4081         recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE;
4082         recv_msg->msg.netfn = msg->rsp[0] >> 2;
4083         recv_msg->msg.cmd = msg->rsp[1];
4084         memcpy(recv_msg->msg_data, &msg->rsp[3], msg->rsp_size - 3);
4085         recv_msg->msg.data = recv_msg->msg_data;
4086         recv_msg->msg.data_len = msg->rsp_size - 3;
4087 }
4088 
4089 static int handle_read_event_rsp(struct ipmi_smi *intf,
4090                                  struct ipmi_smi_msg *msg)
4091 {
4092         struct ipmi_recv_msg *recv_msg, *recv_msg2;
4093         struct list_head     msgs;
4094         struct ipmi_user     *user;
4095         int rv = 0, deliver_count = 0, index;
4096         unsigned long        flags;
4097 
4098         if (msg->rsp_size < 19) {
4099                 /* Message is too small to be an IPMB event. */
4100                 ipmi_inc_stat(intf, invalid_events);
4101                 return 0;
4102         }
4103 
4104         if (msg->rsp[2] != 0) {
4105                 /* An error getting the event, just ignore it. */
4106                 return 0;
4107         }
4108 
4109         INIT_LIST_HEAD(&msgs);
4110 
4111         spin_lock_irqsave(&intf->events_lock, flags);
4112 
4113         ipmi_inc_stat(intf, events);
4114 
4115         /*
4116          * Allocate and fill in one message for every user that is
4117          * getting events.
4118          */
4119         index = srcu_read_lock(&intf->users_srcu);
4120         list_for_each_entry_rcu(user, &intf->users, link) {
4121                 if (!user->gets_events)
4122                         continue;
4123 
4124                 recv_msg = ipmi_alloc_recv_msg();
4125                 if (!recv_msg) {
4126                         rcu_read_unlock();
4127                         list_for_each_entry_safe(recv_msg, recv_msg2, &msgs,
4128                                                  link) {
4129                                 list_del(&recv_msg->link);
4130                                 ipmi_free_recv_msg(recv_msg);
4131                         }
4132                         /*
4133                          * We couldn't allocate memory for the
4134                          * message, so requeue it for handling
4135                          * later.
4136                          */
4137                         rv = 1;
4138                         goto out;
4139                 }
4140 
4141                 deliver_count++;
4142 
4143                 copy_event_into_recv_msg(recv_msg, msg);
4144                 recv_msg->user = user;
4145                 kref_get(&user->refcount);
4146                 list_add_tail(&recv_msg->link, &msgs);
4147         }
4148         srcu_read_unlock(&intf->users_srcu, index);
4149 
4150         if (deliver_count) {
4151                 /* Now deliver all the messages. */
4152                 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
4153                         list_del(&recv_msg->link);
4154                         deliver_local_response(intf, recv_msg);
4155                 }
4156         } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) {
4157                 /*
4158                  * No one to receive the message, put it in queue if there's
4159                  * not already too many things in the queue.
4160                  */
4161                 recv_msg = ipmi_alloc_recv_msg();
4162                 if (!recv_msg) {
4163                         /*
4164                          * We couldn't allocate memory for the
4165                          * message, so requeue it for handling
4166                          * later.
4167                          */
4168                         rv = 1;
4169                         goto out;
4170                 }
4171 
4172                 copy_event_into_recv_msg(recv_msg, msg);
4173                 list_add_tail(&recv_msg->link, &intf->waiting_events);
4174                 intf->waiting_events_count++;
4175         } else if (!intf->event_msg_printed) {
4176                 /*
4177                  * There's too many things in the queue, discard this
4178                  * message.
4179                  */
4180                 dev_warn(intf->si_dev,
4181                          "Event queue full, discarding incoming events\n");
4182                 intf->event_msg_printed = 1;
4183         }
4184 
4185  out:
4186         spin_unlock_irqrestore(&intf->events_lock, flags);
4187 
4188         return rv;
4189 }
4190 
4191 static int handle_bmc_rsp(struct ipmi_smi *intf,
4192                           struct ipmi_smi_msg *msg)
4193 {
4194         struct ipmi_recv_msg *recv_msg;
4195         struct ipmi_system_interface_addr *smi_addr;
4196 
4197         recv_msg = (struct ipmi_recv_msg *) msg->user_data;
4198         if (recv_msg == NULL) {
4199                 dev_warn(intf->si_dev,
4200                          "IPMI message received with no owner. This could be because of a malformed message, or because of a hardware error.  Contact your hardware vendor for assistance.\n");
4201                 return 0;
4202         }
4203 
4204         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
4205         recv_msg->msgid = msg->msgid;
4206         smi_addr = ((struct ipmi_system_interface_addr *)
4207                     &recv_msg->addr);
4208         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4209         smi_addr->channel = IPMI_BMC_CHANNEL;
4210         smi_addr->lun = msg->rsp[0] & 3;
4211         recv_msg->msg.netfn = msg->rsp[0] >> 2;
4212         recv_msg->msg.cmd = msg->rsp[1];
4213         memcpy(recv_msg->msg_data, &msg->rsp[2], msg->rsp_size - 2);
4214         recv_msg->msg.data = recv_msg->msg_data;
4215         recv_msg->msg.data_len = msg->rsp_size - 2;
4216         deliver_local_response(intf, recv_msg);
4217 
4218         return 0;
4219 }
4220 
4221 /*
4222  * Handle a received message.  Return 1 if the message should be requeued,
4223  * 0 if the message should be freed, or -1 if the message should not
4224  * be freed or requeued.
4225  */
4226 static int handle_one_recv_msg(struct ipmi_smi *intf,
4227                                struct ipmi_smi_msg *msg)
4228 {
4229         int requeue;
4230         int chan;
4231 
4232         ipmi_debug_msg("Recv:", msg->rsp, msg->rsp_size);
4233 
4234         if ((msg->data_size >= 2)
4235             && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
4236             && (msg->data[1] == IPMI_SEND_MSG_CMD)
4237             && (msg->user_data == NULL)) {
4238 
4239                 if (intf->in_shutdown)
4240                         goto free_msg;
4241 
4242                 /*
4243                  * This is the local response to a command send, start
4244                  * the timer for these.  The user_data will not be
4245                  * NULL if this is a response send, and we will let
4246                  * response sends just go through.
4247                  */
4248 
4249                 /*
4250                  * Check for errors, if we get certain errors (ones
4251                  * that mean basically we can try again later), we
4252                  * ignore them and start the timer.  Otherwise we
4253                  * report the error immediately.
4254                  */
4255                 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
4256                     && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
4257                     && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
4258                     && (msg->rsp[2] != IPMI_BUS_ERR)
4259                     && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
4260                         int ch = msg->rsp[3] & 0xf;
4261                         struct ipmi_channel *chans;
4262 
4263                         /* Got an error sending the message, handle it. */
4264 
4265                         chans = READ_ONCE(intf->channel_list)->c;
4266                         if ((chans[ch].medium == IPMI_CHANNEL_MEDIUM_8023LAN)
4267                             || (chans[ch].medium == IPMI_CHANNEL_MEDIUM_ASYNC))
4268                                 ipmi_inc_stat(intf, sent_lan_command_errs);
4269                         else
4270                                 ipmi_inc_stat(intf, sent_ipmb_command_errs);
4271                         intf_err_seq(intf, msg->msgid, msg->rsp[2]);
4272                 } else
4273                         /* The message was sent, start the timer. */
4274                         intf_start_seq_timer(intf, msg->msgid);
4275 free_msg:
4276                 requeue = 0;
4277                 goto out;
4278 
4279         } else if (msg->rsp_size < 2) {
4280                 /* Message is too small to be correct. */
4281                 dev_warn(intf->si_dev,
4282                          "BMC returned too small a message for netfn %x cmd %x, got %d bytes\n",
4283                          (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size);
4284 
4285                 /* Generate an error response for the message. */
4286                 msg->rsp[0] = msg->data[0] | (1 << 2);
4287                 msg->rsp[1] = msg->data[1];
4288                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
4289                 msg->rsp_size = 3;
4290         } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1))
4291                    || (msg->rsp[1] != msg->data[1])) {
4292                 /*
4293                  * The NetFN and Command in the response is not even
4294                  * marginally correct.
4295                  */
4296                 dev_warn(intf->si_dev,
4297                          "BMC returned incorrect response, expected netfn %x cmd %x, got netfn %x cmd %x\n",
4298                          (msg->data[0] >> 2) | 1, msg->data[1],
4299                          msg->rsp[0] >> 2, msg->rsp[1]);
4300 
4301                 /* Generate an error response for the message. */
4302                 msg->rsp[0] = msg->data[0] | (1 << 2);
4303                 msg->rsp[1] = msg->data[1];
4304                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
4305                 msg->rsp_size = 3;
4306         }
4307 
4308         if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
4309             && (msg->rsp[1] == IPMI_SEND_MSG_CMD)
4310             && (msg->user_data != NULL)) {
4311                 /*
4312                  * It's a response to a response we sent.  For this we
4313                  * deliver a send message response to the user.
4314                  */
4315                 struct ipmi_recv_msg *recv_msg = msg->user_data;
4316 
4317                 requeue = 0;
4318                 if (msg->rsp_size < 2)
4319                         /* Message is too small to be correct. */
4320                         goto out;
4321 
4322                 chan = msg->data[2] & 0x0f;
4323                 if (chan >= IPMI_MAX_CHANNELS)
4324                         /* Invalid channel number */
4325                         goto out;
4326 
4327                 if (!recv_msg)
4328                         goto out;
4329 
4330                 recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE;
4331                 recv_msg->msg.data = recv_msg->msg_data;
4332                 recv_msg->msg.data_len = 1;
4333                 recv_msg->msg_data[0] = msg->rsp[2];
4334                 deliver_local_response(intf, recv_msg);
4335         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
4336                    && (msg->rsp[1] == IPMI_GET_MSG_CMD)) {
4337                 struct ipmi_channel   *chans;
4338 
4339                 /* It's from the receive queue. */
4340                 chan = msg->rsp[3] & 0xf;
4341                 if (chan >= IPMI_MAX_CHANNELS) {
4342                         /* Invalid channel number */
4343                         requeue = 0;
4344                         goto out;
4345                 }
4346 
4347                 /*
4348                  * We need to make sure the channels have been initialized.
4349                  * The channel_handler routine will set the "curr_channel"
4350                  * equal to or greater than IPMI_MAX_CHANNELS when all the
4351                  * channels for this interface have been initialized.
4352                  */
4353                 if (!intf->channels_ready) {
4354                         requeue = 0; /* Throw the message away */
4355                         goto out;
4356                 }
4357 
4358                 chans = READ_ONCE(intf->channel_list)->c;
4359 
4360                 switch (chans[chan].medium) {
4361                 case IPMI_CHANNEL_MEDIUM_IPMB:
4362                         if (msg->rsp[4] & 0x04) {
4363                                 /*
4364                                  * It's a response, so find the
4365                                  * requesting message and send it up.
4366                                  */
4367                                 requeue = handle_ipmb_get_msg_rsp(intf, msg);
4368                         } else {
4369                                 /*
4370                                  * It's a command to the SMS from some other
4371                                  * entity.  Handle that.
4372                                  */
4373                                 requeue = handle_ipmb_get_msg_cmd(intf, msg);
4374                         }
4375                         break;
4376 
4377                 case IPMI_CHANNEL_MEDIUM_8023LAN:
4378                 case IPMI_CHANNEL_MEDIUM_ASYNC:
4379                         if (msg->rsp[6] & 0x04) {
4380                                 /*
4381                                  * It's a response, so find the
4382                                  * requesting message and send it up.
4383                                  */
4384                                 requeue = handle_lan_get_msg_rsp(intf, msg);
4385                         } else {
4386                                 /*
4387                                  * It's a command to the SMS from some other
4388                                  * entity.  Handle that.
4389                                  */
4390                                 requeue = handle_lan_get_msg_cmd(intf, msg);
4391                         }
4392                         break;
4393 
4394                 default:
4395                         /* Check for OEM Channels.  Clients had better
4396                            register for these commands. */
4397                         if ((chans[chan].medium >= IPMI_CHANNEL_MEDIUM_OEM_MIN)
4398                             && (chans[chan].medium
4399                                 <= IPMI_CHANNEL_MEDIUM_OEM_MAX)) {
4400                                 requeue = handle_oem_get_msg_cmd(intf, msg);
4401                         } else {
4402                                 /*
4403                                  * We don't handle the channel type, so just
4404                                  * free the message.
4405                                  */
4406                                 requeue = 0;
4407                         }
4408                 }
4409 
4410         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
4411                    && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD)) {
4412                 /* It's an asynchronous event. */
4413                 requeue = handle_read_event_rsp(intf, msg);
4414         } else {
4415                 /* It's a response from the local BMC. */
4416                 requeue = handle_bmc_rsp(intf, msg);
4417         }
4418 
4419  out:
4420         return requeue;
4421 }
4422 
4423 /*
4424  * If there are messages in the queue or pretimeouts, handle them.
4425  */
4426 static void handle_new_recv_msgs(struct ipmi_smi *intf)
4427 {
4428         struct ipmi_smi_msg  *smi_msg;
4429         unsigned long        flags = 0;
4430         int                  rv;
4431         int                  run_to_completion = intf->run_to_completion;
4432 
4433         /* See if any waiting messages need to be processed. */
4434         if (!run_to_completion)
4435                 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
4436         while (!list_empty(&intf->waiting_rcv_msgs)) {
4437                 smi_msg = list_entry(intf->waiting_rcv_msgs.next,
4438                                      struct ipmi_smi_msg, link);
4439                 list_del(&smi_msg->link);
4440                 if (!run_to_completion)
4441                         spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
4442                                                flags);
4443                 rv = handle_one_recv_msg(intf, smi_msg);
4444                 if (!run_to_completion)
4445                         spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
4446                 if (rv > 0) {
4447                         /*
4448                          * To preserve message order, quit if we
4449                          * can't handle a message.  Add the message
4450                          * back at the head, this is safe because this
4451                          * tasklet is the only thing that pulls the
4452                          * messages.
4453                          */
4454                         list_add(&smi_msg->link, &intf->waiting_rcv_msgs);
4455                         break;
4456                 } else {
4457                         if (rv == 0)
4458                                 /* Message handled */
4459                                 ipmi_free_smi_msg(smi_msg);
4460                         /* If rv < 0, fatal error, del but don't free. */
4461                 }
4462         }
4463         if (!run_to_completion)
4464                 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, flags);
4465 
4466         /*
4467          * If the pretimout count is non-zero, decrement one from it and
4468          * deliver pretimeouts to all the users.
4469          */
4470         if (atomic_add_unless(&intf->watchdog_pretimeouts_to_deliver, -1, 0)) {
4471                 struct ipmi_user *user;
4472                 int index;
4473 
4474                 index = srcu_read_lock(&intf->users_srcu);
4475                 list_for_each_entry_rcu(user, &intf->users, link) {
4476                         if (user->handler->ipmi_watchdog_pretimeout)
4477                                 user->handler->ipmi_watchdog_pretimeout(
4478                                         user->handler_data);
4479                 }
4480                 srcu_read_unlock(&intf->users_srcu, index);
4481         }
4482 }
4483 
4484 static void smi_recv_tasklet(unsigned long val)
4485 {
4486         unsigned long flags = 0; /* keep us warning-free. */
4487         struct ipmi_smi *intf = (struct ipmi_smi *) val;
4488         int run_to_completion = intf->run_to_completion;
4489         struct ipmi_smi_msg *newmsg = NULL;
4490 
4491         /*
4492          * Start the next message if available.
4493          *
4494          * Do this here, not in the actual receiver, because we may deadlock
4495          * because the lower layer is allowed to hold locks while calling
4496          * message delivery.
4497          */
4498 
4499         rcu_read_lock();
4500 
4501         if (!run_to_completion)
4502                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
4503         if (intf->curr_msg == NULL && !intf->in_shutdown) {
4504                 struct list_head *entry = NULL;
4505 
4506                 /* Pick the high priority queue first. */
4507                 if (!list_empty(&intf->hp_xmit_msgs))
4508                         entry = intf->hp_xmit_msgs.next;
4509                 else if (!list_empty(&intf->xmit_msgs))
4510                         entry = intf->xmit_msgs.next;
4511 
4512                 if (entry) {
4513                         list_del(entry);
4514                         newmsg = list_entry(entry, struct ipmi_smi_msg, link);
4515                         intf->curr_msg = newmsg;
4516                 }
4517         }
4518 
4519         if (!run_to_completion)
4520                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
4521         if (newmsg)
4522                 intf->handlers->sender(intf->send_info, newmsg);
4523 
4524         rcu_read_unlock();
4525 
4526         handle_new_recv_msgs(intf);
4527 }
4528 
4529 /* Handle a new message from the lower layer. */
4530 void ipmi_smi_msg_received(struct ipmi_smi *intf,
4531                            struct ipmi_smi_msg *msg)
4532 {
4533         unsigned long flags = 0; /* keep us warning-free. */
4534         int run_to_completion = intf->run_to_completion;
4535 
4536         /*
4537          * To preserve message order, we keep a queue and deliver from
4538          * a tasklet.
4539          */
4540         if (!run_to_completion)
4541                 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
4542         list_add_tail(&msg->link, &intf->waiting_rcv_msgs);
4543         if (!run_to_completion)
4544                 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
4545                                        flags);
4546 
4547         if (!run_to_completion)
4548                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
4549         /*
4550          * We can get an asynchronous event or receive message in addition
4551          * to commands we send.
4552          */
4553         if (msg == intf->curr_msg)
4554                 intf->curr_msg = NULL;
4555         if (!run_to_completion)
4556                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
4557 
4558         if (run_to_completion)
4559                 smi_recv_tasklet((unsigned long) intf);
4560         else
4561                 tasklet_schedule(&intf->recv_tasklet);
4562 }
4563 EXPORT_SYMBOL(ipmi_smi_msg_received);
4564 
4565 void ipmi_smi_watchdog_pretimeout(struct ipmi_smi *intf)
4566 {
4567         if (intf->in_shutdown)
4568                 return;
4569 
4570         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 1);
4571         tasklet_schedule(&intf->recv_tasklet);
4572 }
4573 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout);
4574 
4575 static struct ipmi_smi_msg *
4576 smi_from_recv_msg(struct ipmi_smi *intf, struct ipmi_recv_msg *recv_msg,
4577                   unsigned char seq, long seqid)
4578 {
4579         struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg();
4580         if (!smi_msg)
4581                 /*
4582                  * If we can't allocate the message, then just return, we
4583                  * get 4 retries, so this should be ok.
4584                  */
4585                 return NULL;
4586 
4587         memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len);
4588         smi_msg->data_size = recv_msg->msg.data_len;
4589         smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);
4590 
4591         ipmi_debug_msg("Resend: ", smi_msg->data, smi_msg->data_size);
4592 
4593         return smi_msg;
4594 }
4595 
4596 static void check_msg_timeout(struct ipmi_smi *intf, struct seq_table *ent,
4597                               struct list_head *timeouts,
4598                               unsigned long timeout_period,
4599                               int slot, unsigned long *flags,
4600                               bool *need_timer)
4601 {
4602         struct ipmi_recv_msg *msg;
4603 
4604         if (intf->in_shutdown)
4605                 return;
4606 
4607         if (!ent->inuse)
4608                 return;
4609 
4610         if (timeout_period < ent->timeout) {
4611                 ent->timeout -= timeout_period;
4612                 *need_timer = true;
4613                 return;
4614         }
4615 
4616         if (ent->retries_left == 0) {
4617                 /* The message has used all its retries. */
4618                 ent->inuse = 0;
4619                 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);
4620                 msg = ent->recv_msg;
4621                 list_add_tail(&msg->link, timeouts);
4622                 if (ent->broadcast)
4623                         ipmi_inc_stat(intf, timed_out_ipmb_broadcasts);
4624                 else if (is_lan_addr(&ent->recv_msg->addr))
4625                         ipmi_inc_stat(intf, timed_out_lan_commands);
4626                 else
4627                         ipmi_inc_stat(intf, timed_out_ipmb_commands);
4628         } else {
4629                 struct ipmi_smi_msg *smi_msg;
4630                 /* More retries, send again. */
4631 
4632                 *need_timer = true;
4633 
4634                 /*
4635                  * Start with the max timer, set to normal timer after
4636                  * the message is sent.
4637                  */
4638                 ent->timeout = MAX_MSG_TIMEOUT;
4639                 ent->retries_left--;
4640                 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot,
4641                                             ent->seqid);
4642                 if (!smi_msg) {
4643                         if (is_lan_addr(&ent->recv_msg->addr))
4644                                 ipmi_inc_stat(intf,
4645                                               dropped_rexmit_lan_commands);
4646                         else
4647                                 ipmi_inc_stat(intf,
4648                                               dropped_rexmit_ipmb_commands);
4649                         return;
4650                 }
4651 
4652                 spin_unlock_irqrestore(&intf->seq_lock, *flags);
4653 
4654                 /*
4655                  * Send the new message.  We send with a zero
4656                  * priority.  It timed out, I doubt time is that
4657                  * critical now, and high priority messages are really
4658                  * only for messages to the local MC, which don't get
4659                  * resent.
4660                  */
4661                 if (intf->handlers) {
4662                         if (is_lan_addr(&ent->recv_msg->addr))
4663                                 ipmi_inc_stat(intf,
4664                                               retransmitted_lan_commands);
4665                         else
4666                                 ipmi_inc_stat(intf,
4667                                               retransmitted_ipmb_commands);
4668 
4669                         smi_send(intf, intf->handlers, smi_msg, 0);
4670                 } else
4671                         ipmi_free_smi_msg(smi_msg);
4672 
4673                 spin_lock_irqsave(&intf->seq_lock, *flags);
4674         }
4675 }
4676 
4677 static bool ipmi_timeout_handler(struct ipmi_smi *intf,
4678                                  unsigned long timeout_period)
4679 {
4680         struct list_head     timeouts;
4681         struct ipmi_recv_msg *msg, *msg2;
4682         unsigned long        flags;
4683         int                  i;
4684         bool                 need_timer = false;
4685 
4686         if (!intf->bmc_registered) {
4687                 kref_get(&intf->refcount);
4688                 if (!schedule_work(&intf->bmc_reg_work)) {
4689                         kref_put(&intf->refcount, intf_free);
4690                         need_timer = true;
4691                 }
4692         }
4693 
4694         /*
4695          * Go through the seq table and find any messages that
4696          * have timed out, putting them in the timeouts
4697          * list.
4698          */
4699         INIT_LIST_HEAD(&timeouts);
4700         spin_lock_irqsave(&intf->seq_lock, flags);
4701         if (intf->ipmb_maintenance_mode_timeout) {
4702                 if (intf->ipmb_maintenance_mode_timeout <= timeout_period)
4703                         intf->ipmb_maintenance_mode_timeout = 0;
4704                 else
4705                         intf->ipmb_maintenance_mode_timeout -= timeout_period;
4706         }
4707         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
4708                 check_msg_timeout(intf, &intf->seq_table[i],
4709                                   &timeouts, timeout_period, i,
4710                                   &flags, &need_timer);
4711         spin_unlock_irqrestore(&intf->seq_lock, flags);
4712 
4713         list_for_each_entry_safe(msg, msg2, &timeouts, link)
4714                 deliver_err_response(intf, msg, IPMI_TIMEOUT_COMPLETION_CODE);
4715 
4716         /*
4717          * Maintenance mode handling.  Check the timeout
4718          * optimistically before we claim the lock.  It may
4719          * mean a timeout gets missed occasionally, but that
4720          * only means the timeout gets extended by one period
4721          * in that case.  No big deal, and it avoids the lock
4722          * most of the time.
4723          */
4724         if (intf->auto_maintenance_timeout > 0) {
4725                 spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
4726                 if (intf->auto_maintenance_timeout > 0) {
4727                         intf->auto_maintenance_timeout
4728                                 -= timeout_period;
4729                         if (!intf->maintenance_mode
4730                             && (intf->auto_maintenance_timeout <= 0)) {
4731                                 intf->maintenance_mode_enable = false;
4732                                 maintenance_mode_update(intf);
4733                         }
4734                 }
4735                 spin_unlock_irqrestore(&intf->maintenance_mode_lock,
4736                                        flags);
4737         }
4738 
4739         tasklet_schedule(&intf->recv_tasklet);
4740 
4741         return need_timer;
4742 }
4743 
4744 static void ipmi_request_event(struct ipmi_smi *intf)
4745 {
4746         /* No event requests when in maintenance mode. */
4747         if (intf->maintenance_mode_enable)
4748                 return;
4749 
4750         if (!intf->in_shutdown)
4751                 intf->handlers->request_events(intf->send_info);
4752 }
4753 
4754 static struct timer_list ipmi_timer;
4755 
4756 static atomic_t stop_operation;
4757 
4758 static void ipmi_timeout(struct timer_list *unused)
4759 {
4760         struct ipmi_smi *intf;
4761         bool need_timer = false;
4762         int index;
4763 
4764         if (atomic_read(&stop_operation))
4765                 return;
4766 
4767         index = srcu_read_lock(&ipmi_interfaces_srcu);
4768         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4769                 if (atomic_read(&intf->event_waiters)) {
4770                         intf->ticks_to_req_ev--;
4771                         if (intf->ticks_to_req_ev == 0) {
4772                                 ipmi_request_event(intf);
4773                                 intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
4774                         }
4775                         need_timer = true;
4776                 }
4777 
4778                 need_timer |= ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME);
4779         }
4780         srcu_read_unlock(&ipmi_interfaces_srcu, index);
4781 
4782         if (need_timer)
4783                 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4784 }
4785 
4786 static void need_waiter(struct ipmi_smi *intf)
4787 {
4788         /* Racy, but worst case we start the timer twice. */
4789         if (!timer_pending(&ipmi_timer))
4790                 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4791 }
4792 
4793 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0);
4794 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);
4795 
4796 static void free_smi_msg(struct ipmi_smi_msg *msg)
4797 {
4798         atomic_dec(&smi_msg_inuse_count);
4799         kfree(msg);
4800 }
4801 
4802 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)
4803 {
4804         struct ipmi_smi_msg *rv;
4805         rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC);
4806         if (rv) {
4807                 rv->done = free_smi_msg;
4808                 rv->user_data = NULL;
4809                 atomic_inc(&smi_msg_inuse_count);
4810         }
4811         return rv;
4812 }
4813 EXPORT_SYMBOL(ipmi_alloc_smi_msg);
4814 
4815 static void free_recv_msg(struct ipmi_recv_msg *msg)
4816 {
4817         atomic_dec(&recv_msg_inuse_count);
4818         kfree(msg);
4819 }
4820 
4821 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
4822 {
4823         struct ipmi_recv_msg *rv;
4824 
4825         rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC);
4826         if (rv) {
4827                 rv->user = NULL;
4828                 rv->done = free_recv_msg;
4829                 atomic_inc(&recv_msg_inuse_count);
4830         }
4831         return rv;
4832 }
4833 
4834 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg)
4835 {
4836         if (msg->user)
4837                 kref_put(&msg->user->refcount, free_user);
4838         msg->done(msg);
4839 }
4840 EXPORT_SYMBOL(ipmi_free_recv_msg);
4841 
4842 static atomic_t panic_done_count = ATOMIC_INIT(0);
4843 
4844 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg)
4845 {
4846         atomic_dec(&panic_done_count);
4847 }
4848 
4849 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg)
4850 {
4851         atomic_dec(&panic_done_count);
4852 }
4853 
4854 /*
4855  * Inside a panic, send a message and wait for a response.
4856  */
4857 static void ipmi_panic_request_and_wait(struct ipmi_smi *intf,
4858                                         struct ipmi_addr *addr,
4859                                         struct kernel_ipmi_msg *msg)
4860 {
4861         struct ipmi_smi_msg  smi_msg;
4862         struct ipmi_recv_msg recv_msg;
4863         int rv;
4864 
4865         smi_msg.done = dummy_smi_done_handler;
4866         recv_msg.done = dummy_recv_done_handler;
4867         atomic_add(2, &panic_done_count);
4868         rv = i_ipmi_request(NULL,
4869                             intf,
4870                             addr,
4871                             0,
4872                             msg,
4873                             intf,
4874                             &smi_msg,
4875                             &recv_msg,
4876                             0,
4877                             intf->addrinfo[0].address,
4878                             intf->addrinfo[0].lun,
4879                             0, 1); /* Don't retry, and don't wait. */
4880         if (rv)
4881                 atomic_sub(2, &panic_done_count);
4882         else if (intf->handlers->flush_messages)
4883                 intf->handlers->flush_messages(intf->send_info);
4884 
4885         while (atomic_read(&panic_done_count) != 0)
4886                 ipmi_poll(intf);
4887 }
4888 
4889 static void event_receiver_fetcher(struct ipmi_smi *intf,
4890                                    struct ipmi_recv_msg *msg)
4891 {
4892         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
4893             && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE)
4894             && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD)
4895             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
4896                 /* A get event receiver command, save it. */
4897                 intf->event_receiver = msg->msg.data[1];
4898                 intf->event_receiver_lun = msg->msg.data[2] & 0x3;
4899         }
4900 }
4901 
4902 static void device_id_fetcher(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
4903 {
4904         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
4905             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
4906             && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD)
4907             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
4908                 /*
4909                  * A get device id command, save if we are an event
4910                  * receiver or generator.
4911                  */
4912                 intf->local_sel_device = (msg->msg.data[6] >> 2) & 1;
4913                 intf->local_event_generator = (msg->msg.data[6] >> 5) & 1;
4914         }
4915 }
4916 
4917 static void send_panic_events(struct ipmi_smi *intf, char *str)
4918 {
4919         struct kernel_ipmi_msg msg;
4920         unsigned char data[16];
4921         struct ipmi_system_interface_addr *si;
4922         struct ipmi_addr addr;
4923         char *p = str;
4924         struct ipmi_ipmb_addr *ipmb;
4925         int j;
4926 
4927         if (ipmi_send_panic_event == IPMI_SEND_PANIC_EVENT_NONE)
4928                 return;
4929 
4930         si = (struct ipmi_system_interface_addr *) &addr;
4931         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4932         si->channel = IPMI_BMC_CHANNEL;
4933         si->lun = 0;
4934 
4935         /* Fill in an event telling that we have failed. */
4936         msg.netfn = 0x04; /* Sensor or Event. */
4937         msg.cmd = 2; /* Platform event command. */
4938         msg.data = data;
4939         msg.data_len = 8;
4940         data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */
4941         data[1] = 0x03; /* This is for IPMI 1.0. */
4942         data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */
4943         data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */
4944         data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */
4945 
4946         /*
4947          * Put a few breadcrumbs in.  Hopefully later we can add more things
4948          * to make the panic events more useful.
4949          */
4950         if (str) {
4951                 data[3] = str[0];
4952                 data[6] = str[1];
4953                 data[7] = str[2];
4954         }
4955 
4956         /* Send the event announcing the panic. */
4957         ipmi_panic_request_and_wait(intf, &addr, &msg);
4958 
4959         /*
4960          * On every interface, dump a bunch of OEM event holding the
4961          * string.
4962          */
4963         if (ipmi_send_panic_event != IPMI_SEND_PANIC_EVENT_STRING || !str)
4964                 return;
4965 
4966         /*
4967          * intf_num is used as an marker to tell if the
4968          * interface is valid.  Thus we need a read barrier to
4969          * make sure data fetched before checking intf_num
4970          * won't be used.
4971          */
4972         smp_rmb();
4973 
4974         /*
4975          * First job here is to figure out where to send the
4976          * OEM events.  There's no way in IPMI to send OEM
4977          * events using an event send command, so we have to
4978          * find the SEL to put them in and stick them in
4979          * there.
4980          */
4981 
4982         /* Get capabilities from the get device id. */
4983         intf->local_sel_device = 0;
4984         intf->local_event_generator = 0;
4985         intf->event_receiver = 0;
4986 
4987         /* Request the device info from the local MC. */
4988         msg.netfn = IPMI_NETFN_APP_REQUEST;
4989         msg.cmd = IPMI_GET_DEVICE_ID_CMD;
4990         msg.data = NULL;
4991         msg.data_len = 0;
4992         intf->null_user_handler = device_id_fetcher;
4993         ipmi_panic_request_and_wait(intf, &addr, &msg);
4994 
4995         if (intf->local_event_generator) {
4996                 /* Request the event receiver from the local MC. */
4997                 msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST;
4998                 msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD;
4999                 msg.data = NULL;
5000                 msg.data_len = 0;
5001                 intf->null_user_handler = event_receiver_fetcher;
5002                 ipmi_panic_request_and_wait(intf, &addr, &msg);
5003         }
5004         intf->null_user_handler = NULL;
5005 
5006         /*
5007          * Validate the event receiver.  The low bit must not
5008          * be 1 (it must be a valid IPMB address), it cannot
5009          * be zero, and it must not be my address.
5010          */
5011         if (((intf->event_receiver & 1) == 0)
5012             && (intf->event_receiver != 0)
5013             && (intf->event_receiver != intf->addrinfo[0].address)) {
5014                 /*
5015                  * The event receiver is valid, send an IPMB
5016                  * message.
5017                  */
5018                 ipmb = (struct ipmi_ipmb_addr *) &addr;
5019                 ipmb->addr_type = IPMI_IPMB_ADDR_TYPE;
5020                 ipmb->channel = 0; /* FIXME - is this right? */
5021                 ipmb->lun = intf->event_receiver_lun;
5022                 ipmb->slave_addr = intf->event_receiver;
5023         } else if (intf->local_sel_device) {
5024                 /*
5025                  * The event receiver was not valid (or was
5026                  * me), but I am an SEL device, just dump it
5027                  * in my SEL.
5028                  */
5029                 si = (struct ipmi_system_interface_addr *) &addr;
5030                 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
5031                 si->channel = IPMI_BMC_CHANNEL;
5032                 si->lun = 0;
5033         } else
5034                 return; /* No where to send the event. */
5035 
5036         msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */
5037         msg.cmd = IPMI_ADD_SEL_ENTRY_CMD;
5038         msg.data = data;
5039         msg.data_len = 16;
5040 
5041         j = 0;
5042         while (*p) {
5043                 int size = strlen(p);
5044 
5045                 if (size > 11)
5046                         size = 11;
5047                 data[0] = 0;
5048                 data[1] = 0;
5049                 data[2] = 0xf0; /* OEM event without timestamp. */
5050                 data[3] = intf->addrinfo[0].address;
5051                 data[4] = j++; /* sequence # */
5052                 /*
5053                  * Always give 11 bytes, so strncpy will fill
5054                  * it with zeroes for me.
5055                  */
5056                 strncpy(data+5, p, 11);
5057                 p += size;
5058 
5059                 ipmi_panic_request_and_wait(intf, &addr, &msg);
5060         }
5061 }
5062 
5063 static int has_panicked;
5064 
5065 static int panic_event(struct notifier_block *this,
5066                        unsigned long         event,
5067                        void                  *ptr)
5068 {
5069         struct ipmi_smi *intf;
5070         struct ipmi_user *user;
5071 
5072         if (has_panicked)
5073                 return NOTIFY_DONE;
5074         has_panicked = 1;
5075 
5076         /* For every registered interface, set it to run to completion. */
5077         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
5078                 if (!intf->handlers || intf->intf_num == -1)
5079                         /* Interface is not ready. */
5080                         continue;
5081 
5082                 if (!intf->handlers->poll)
5083                         continue;
5084 
5085                 /*
5086                  * If we were interrupted while locking xmit_msgs_lock or
5087                  * waiting_rcv_msgs_lock, the corresponding list may be
5088                  * corrupted.  In this case, drop items on the list for
5089                  * the safety.
5090                  */
5091                 if (!spin_trylock(&intf->xmit_msgs_lock)) {
5092                         INIT_LIST_HEAD(&intf->xmit_msgs);
5093                         INIT_LIST_HEAD(&intf->hp_xmit_msgs);
5094                 } else
5095                         spin_unlock(&intf->xmit_msgs_lock);
5096 
5097                 if (!spin_trylock(&intf->waiting_rcv_msgs_lock))
5098                         INIT_LIST_HEAD(&intf->waiting_rcv_msgs);
5099                 else
5100                         spin_unlock(&intf->waiting_rcv_msgs_lock);
5101 
5102                 intf->run_to_completion = 1;
5103                 if (intf->handlers->set_run_to_completion)
5104                         intf->handlers->set_run_to_completion(intf->send_info,
5105                                                               1);
5106 
5107                 list_for_each_entry_rcu(user, &intf->users, link) {
5108                         if (user->handler->ipmi_panic_handler)
5109                                 user->handler->ipmi_panic_handler(
5110                                         user->handler_data);
5111                 }
5112 
5113                 send_panic_events(intf, ptr);
5114         }
5115 
5116         return NOTIFY_DONE;
5117 }
5118 
5119 /* Must be called with ipmi_interfaces_mutex held. */
5120 static int ipmi_register_driver(void)
5121 {
5122         int rv;
5123 
5124         if (drvregistered)
5125                 return 0;
5126 
5127         rv = driver_register(&ipmidriver.driver);
5128         if (rv)
5129                 pr_err("Could not register IPMI driver\n");
5130         else
5131                 drvregistered = true;
5132         return rv;
5133 }
5134 
5135 static struct notifier_block panic_block = {
5136         .notifier_call  = panic_event,
5137         .next           = NULL,
5138         .priority       = 200   /* priority: INT_MAX >= x >= 0 */
5139 };
5140 
5141 static int ipmi_init_msghandler(void)
5142 {
5143         int rv;
5144 
5145         mutex_lock(&ipmi_interfaces_mutex);
5146         rv = ipmi_register_driver();
5147         if (rv)
5148                 goto out;
5149         if (initialized)
5150                 goto out;
5151 
5152         init_srcu_struct(&ipmi_interfaces_srcu);
5153 
5154         timer_setup(&ipmi_timer, ipmi_timeout, 0);
5155         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
5156 
5157         atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
5158 
5159         initialized = true;
5160 
5161 out:
5162         mutex_unlock(&ipmi_interfaces_mutex);
5163         return rv;
5164 }
5165 
5166 static int __init ipmi_init_msghandler_mod(void)
5167 {
5168         int rv;
5169 
5170         pr_info("version " IPMI_DRIVER_VERSION "\n");
5171 
5172         mutex_lock(&ipmi_interfaces_mutex);
5173         rv = ipmi_register_driver();
5174         mutex_unlock(&ipmi_interfaces_mutex);
5175 
5176         return rv;
5177 }
5178 
5179 static void __exit cleanup_ipmi(void)
5180 {
5181         int count;
5182 
5183         if (initialized) {
5184                 atomic_notifier_chain_unregister(&panic_notifier_list,
5185                                                  &panic_block);
5186 
5187                 /*
5188                  * This can't be called if any interfaces exist, so no worry
5189                  * about shutting down the interfaces.
5190                  */
5191 
5192                 /*
5193                  * Tell the timer to stop, then wait for it to stop.  This
5194                  * avoids problems with race conditions removing the timer
5195                  * here.
5196                  */
5197                 atomic_set(&stop_operation, 1);
5198                 del_timer_sync(&ipmi_timer);
5199 
5200                 initialized = false;
5201 
5202                 /* Check for buffer leaks. */
5203                 count = atomic_read(&smi_msg_inuse_count);
5204                 if (count != 0)
5205                         pr_warn("SMI message count %d at exit\n", count);
5206                 count = atomic_read(&recv_msg_inuse_count);
5207                 if (count != 0)
5208                         pr_warn("recv message count %d at exit\n", count);
5209 
5210                 cleanup_srcu_struct(&ipmi_interfaces_srcu);
5211         }
5212         if (drvregistered)
5213                 driver_unregister(&ipmidriver.driver);
5214 }
5215 module_exit(cleanup_ipmi);
5216 
5217 module_init(ipmi_init_msghandler_mod);
5218 MODULE_LICENSE("GPL");
5219 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
5220 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI"
5221                    " interface.");
5222 MODULE_VERSION(IPMI_DRIVER_VERSION);
5223 MODULE_SOFTDEP("post: ipmi_devintf");
/* [<][>][^][v][top][bottom][index][help] */
root/drivers/char/ipmi/ipmi_msghandler.c

DEFINITIONS
