brintos / linux-shallow public Read only

1// SPDX-License-Identifier: GPL-2.0+2/*3 * ipmi_msghandler.c4 *5 * Incoming and outgoing message routing for an IPMI interface.6 *7 * Author: MontaVista Software, Inc.8 *         Corey Minyard <minyard@mvista.com>9 *         source@mvista.com10 *11 * Copyright 2002 MontaVista Software Inc.12 */13 14#define pr_fmt(fmt) "IPMI message handler: " fmt15#define dev_fmt(fmt) pr_fmt(fmt)16 17#include <linux/module.h>18#include <linux/errno.h>19#include <linux/panic_notifier.h>20#include <linux/poll.h>21#include <linux/sched.h>22#include <linux/seq_file.h>23#include <linux/spinlock.h>24#include <linux/mutex.h>25#include <linux/slab.h>26#include <linux/ipmi.h>27#include <linux/ipmi_smi.h>28#include <linux/notifier.h>29#include <linux/init.h>30#include <linux/proc_fs.h>31#include <linux/rcupdate.h>32#include <linux/interrupt.h>33#include <linux/moduleparam.h>34#include <linux/workqueue.h>35#include <linux/uuid.h>36#include <linux/nospec.h>37#include <linux/vmalloc.h>38#include <linux/delay.h>39 40#define IPMI_DRIVER_VERSION "39.2"41 42static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);43static int ipmi_init_msghandler(void);44static void smi_recv_work(struct work_struct *t);45static void handle_new_recv_msgs(struct ipmi_smi *intf);46static void need_waiter(struct ipmi_smi *intf);47static int handle_one_recv_msg(struct ipmi_smi *intf,48			       struct ipmi_smi_msg *msg);49 50static bool initialized;51static bool drvregistered;52 53/* Numbers in this enumerator should be mapped to ipmi_panic_event_str */54enum ipmi_panic_event_op {55	IPMI_SEND_PANIC_EVENT_NONE,56	IPMI_SEND_PANIC_EVENT,57	IPMI_SEND_PANIC_EVENT_STRING,58	IPMI_SEND_PANIC_EVENT_MAX59};60 61/* Indices in this array should be mapped to enum ipmi_panic_event_op */62static const char *const ipmi_panic_event_str[] = { "none", "event", "string", NULL };63 64#ifdef CONFIG_IPMI_PANIC_STRING65#define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT_STRING66#elif defined(CONFIG_IPMI_PANIC_EVENT)67#define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT68#else69#define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT_NONE70#endif71 72static enum ipmi_panic_event_op ipmi_send_panic_event = IPMI_PANIC_DEFAULT;73 74static int panic_op_write_handler(const char *val,75				  const struct kernel_param *kp)76{77	char valcp[16];78	int e;79 80	strscpy(valcp, val, sizeof(valcp));81	e = match_string(ipmi_panic_event_str, -1, strstrip(valcp));82	if (e < 0)83		return e;84 85	ipmi_send_panic_event = e;86	return 0;87}88 89static int panic_op_read_handler(char *buffer, const struct kernel_param *kp)90{91	const char *event_str;92 93	if (ipmi_send_panic_event >= IPMI_SEND_PANIC_EVENT_MAX)94		event_str = "???";95	else96		event_str = ipmi_panic_event_str[ipmi_send_panic_event];97 98	return sprintf(buffer, "%s\n", event_str);99}100 101static const struct kernel_param_ops panic_op_ops = {102	.set = panic_op_write_handler,103	.get = panic_op_read_handler104};105module_param_cb(panic_op, &panic_op_ops, NULL, 0600);106MODULE_PARM_DESC(panic_op, "Sets if the IPMI driver will attempt to store panic information in the event log in the event of a panic.  Set to 'none' for no, 'event' for a single event, or 'string' for a generic event and the panic string in IPMI OEM events.");107 108 109#define MAX_EVENTS_IN_QUEUE	25110 111/* Remain in auto-maintenance mode for this amount of time (in ms). */112static unsigned long maintenance_mode_timeout_ms = 30000;113module_param(maintenance_mode_timeout_ms, ulong, 0644);114MODULE_PARM_DESC(maintenance_mode_timeout_ms,115		 "The time (milliseconds) after the last maintenance message that the connection stays in maintenance mode.");116 117/*118 * Don't let a message sit in a queue forever, always time it with at lest119 * the max message timer.  This is in milliseconds.120 */121#define MAX_MSG_TIMEOUT		60000122 123/*124 * Timeout times below are in milliseconds, and are done off a 1125 * second timer.  So setting the value to 1000 would mean anything126 * between 0 and 1000ms.  So really the only reasonable minimum127 * setting it 2000ms, which is between 1 and 2 seconds.128 */129 130/* The default timeout for message retries. */131static unsigned long default_retry_ms = 2000;132module_param(default_retry_ms, ulong, 0644);133MODULE_PARM_DESC(default_retry_ms,134		 "The time (milliseconds) between retry sends");135 136/* The default timeout for maintenance mode message retries. */137static unsigned long default_maintenance_retry_ms = 3000;138module_param(default_maintenance_retry_ms, ulong, 0644);139MODULE_PARM_DESC(default_maintenance_retry_ms,140		 "The time (milliseconds) between retry sends in maintenance mode");141 142/* The default maximum number of retries */143static unsigned int default_max_retries = 4;144module_param(default_max_retries, uint, 0644);145MODULE_PARM_DESC(default_max_retries,146		 "The time (milliseconds) between retry sends in maintenance mode");147 148/* The default maximum number of users that may register. */149static unsigned int max_users = 30;150module_param(max_users, uint, 0644);151MODULE_PARM_DESC(max_users,152		 "The most users that may use the IPMI stack at one time.");153 154/* The default maximum number of message a user may have outstanding. */155static unsigned int max_msgs_per_user = 100;156module_param(max_msgs_per_user, uint, 0644);157MODULE_PARM_DESC(max_msgs_per_user,158		 "The most message a user may have outstanding.");159 160/* Call every ~1000 ms. */161#define IPMI_TIMEOUT_TIME	1000162 163/* How many jiffies does it take to get to the timeout time. */164#define IPMI_TIMEOUT_JIFFIES	((IPMI_TIMEOUT_TIME * HZ) / 1000)165 166/*167 * Request events from the queue every second (this is the number of168 * IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the169 * future, IPMI will add a way to know immediately if an event is in170 * the queue and this silliness can go away.171 */172#define IPMI_REQUEST_EV_TIME	(1000 / (IPMI_TIMEOUT_TIME))173 174/* How long should we cache dynamic device IDs? */175#define IPMI_DYN_DEV_ID_EXPIRY	(10 * HZ)176 177/*178 * The main "user" data structure.179 */180struct ipmi_user {181	struct list_head link;182 183	/*184	 * Set to NULL when the user is destroyed, a pointer to myself185	 * so srcu_dereference can be used on it.186	 */187	struct ipmi_user *self;188	struct srcu_struct release_barrier;189 190	struct kref refcount;191 192	/* The upper layer that handles receive messages. */193	const struct ipmi_user_hndl *handler;194	void             *handler_data;195 196	/* The interface this user is bound to. */197	struct ipmi_smi *intf;198 199	/* Does this interface receive IPMI events? */200	bool gets_events;201 202	atomic_t nr_msgs;203 204	/* Free must run in process context for RCU cleanup. */205	struct work_struct remove_work;206};207 208static struct workqueue_struct *remove_work_wq;209 210static struct ipmi_user *acquire_ipmi_user(struct ipmi_user *user, int *index)211	__acquires(user->release_barrier)212{213	struct ipmi_user *ruser;214 215	*index = srcu_read_lock(&user->release_barrier);216	ruser = srcu_dereference(user->self, &user->release_barrier);217	if (!ruser)218		srcu_read_unlock(&user->release_barrier, *index);219	return ruser;220}221 222static void release_ipmi_user(struct ipmi_user *user, int index)223{224	srcu_read_unlock(&user->release_barrier, index);225}226 227struct cmd_rcvr {228	struct list_head link;229 230	struct ipmi_user *user;231	unsigned char netfn;232	unsigned char cmd;233	unsigned int  chans;234 235	/*236	 * This is used to form a linked lised during mass deletion.237	 * Since this is in an RCU list, we cannot use the link above238	 * or change any data until the RCU period completes.  So we239	 * use this next variable during mass deletion so we can have240	 * a list and don't have to wait and restart the search on241	 * every individual deletion of a command.242	 */243	struct cmd_rcvr *next;244};245 246struct seq_table {247	unsigned int         inuse : 1;248	unsigned int         broadcast : 1;249 250	unsigned long        timeout;251	unsigned long        orig_timeout;252	unsigned int         retries_left;253 254	/*255	 * To verify on an incoming send message response that this is256	 * the message that the response is for, we keep a sequence id257	 * and increment it every time we send a message.258	 */259	long                 seqid;260 261	/*262	 * This is held so we can properly respond to the message on a263	 * timeout, and it is used to hold the temporary data for264	 * retransmission, too.265	 */266	struct ipmi_recv_msg *recv_msg;267};268 269/*270 * Store the information in a msgid (long) to allow us to find a271 * sequence table entry from the msgid.272 */273#define STORE_SEQ_IN_MSGID(seq, seqid) \274	((((seq) & 0x3f) << 26) | ((seqid) & 0x3ffffff))275 276#define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \277	do {								\278		seq = (((msgid) >> 26) & 0x3f);				\279		seqid = ((msgid) & 0x3ffffff);				\280	} while (0)281 282#define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3ffffff)283 284#define IPMI_MAX_CHANNELS       16285struct ipmi_channel {286	unsigned char medium;287	unsigned char protocol;288};289 290struct ipmi_channel_set {291	struct ipmi_channel c[IPMI_MAX_CHANNELS];292};293 294struct ipmi_my_addrinfo {295	/*296	 * My slave address.  This is initialized to IPMI_BMC_SLAVE_ADDR,297	 * but may be changed by the user.298	 */299	unsigned char address;300 301	/*302	 * My LUN.  This should generally stay the SMS LUN, but just in303	 * case...304	 */305	unsigned char lun;306};307 308/*309 * Note that the product id, manufacturer id, guid, and device id are310 * immutable in this structure, so dyn_mutex is not required for311 * accessing those.  If those change on a BMC, a new BMC is allocated.312 */313struct bmc_device {314	struct platform_device pdev;315	struct list_head       intfs; /* Interfaces on this BMC. */316	struct ipmi_device_id  id;317	struct ipmi_device_id  fetch_id;318	int                    dyn_id_set;319	unsigned long          dyn_id_expiry;320	struct mutex           dyn_mutex; /* Protects id, intfs, & dyn* */321	guid_t                 guid;322	guid_t                 fetch_guid;323	int                    dyn_guid_set;324	struct kref	       usecount;325	struct work_struct     remove_work;326	unsigned char	       cc; /* completion code */327};328#define to_bmc_device(x) container_of((x), struct bmc_device, pdev.dev)329 330static int bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,331			     struct ipmi_device_id *id,332			     bool *guid_set, guid_t *guid);333 334/*335 * Various statistics for IPMI, these index stats[] in the ipmi_smi336 * structure.337 */338enum ipmi_stat_indexes {339	/* Commands we got from the user that were invalid. */340	IPMI_STAT_sent_invalid_commands = 0,341 342	/* Commands we sent to the MC. */343	IPMI_STAT_sent_local_commands,344 345	/* Responses from the MC that were delivered to a user. */346	IPMI_STAT_handled_local_responses,347 348	/* Responses from the MC that were not delivered to a user. */349	IPMI_STAT_unhandled_local_responses,350 351	/* Commands we sent out to the IPMB bus. */352	IPMI_STAT_sent_ipmb_commands,353 354	/* Commands sent on the IPMB that had errors on the SEND CMD */355	IPMI_STAT_sent_ipmb_command_errs,356 357	/* Each retransmit increments this count. */358	IPMI_STAT_retransmitted_ipmb_commands,359 360	/*361	 * When a message times out (runs out of retransmits) this is362	 * incremented.363	 */364	IPMI_STAT_timed_out_ipmb_commands,365 366	/*367	 * This is like above, but for broadcasts.  Broadcasts are368	 * *not* included in the above count (they are expected to369	 * time out).370	 */371	IPMI_STAT_timed_out_ipmb_broadcasts,372 373	/* Responses I have sent to the IPMB bus. */374	IPMI_STAT_sent_ipmb_responses,375 376	/* The response was delivered to the user. */377	IPMI_STAT_handled_ipmb_responses,378 379	/* The response had invalid data in it. */380	IPMI_STAT_invalid_ipmb_responses,381 382	/* The response didn't have anyone waiting for it. */383	IPMI_STAT_unhandled_ipmb_responses,384 385	/* Commands we sent out to the IPMB bus. */386	IPMI_STAT_sent_lan_commands,387 388	/* Commands sent on the IPMB that had errors on the SEND CMD */389	IPMI_STAT_sent_lan_command_errs,390 391	/* Each retransmit increments this count. */392	IPMI_STAT_retransmitted_lan_commands,393 394	/*395	 * When a message times out (runs out of retransmits) this is396	 * incremented.397	 */398	IPMI_STAT_timed_out_lan_commands,399 400	/* Responses I have sent to the IPMB bus. */401	IPMI_STAT_sent_lan_responses,402 403	/* The response was delivered to the user. */404	IPMI_STAT_handled_lan_responses,405 406	/* The response had invalid data in it. */407	IPMI_STAT_invalid_lan_responses,408 409	/* The response didn't have anyone waiting for it. */410	IPMI_STAT_unhandled_lan_responses,411 412	/* The command was delivered to the user. */413	IPMI_STAT_handled_commands,414 415	/* The command had invalid data in it. */416	IPMI_STAT_invalid_commands,417 418	/* The command didn't have anyone waiting for it. */419	IPMI_STAT_unhandled_commands,420 421	/* Invalid data in an event. */422	IPMI_STAT_invalid_events,423 424	/* Events that were received with the proper format. */425	IPMI_STAT_events,426 427	/* Retransmissions on IPMB that failed. */428	IPMI_STAT_dropped_rexmit_ipmb_commands,429 430	/* Retransmissions on LAN that failed. */431	IPMI_STAT_dropped_rexmit_lan_commands,432 433	/* This *must* remain last, add new values above this. */434	IPMI_NUM_STATS435};436 437 438#define IPMI_IPMB_NUM_SEQ	64439struct ipmi_smi {440	struct module *owner;441 442	/* What interface number are we? */443	int intf_num;444 445	struct kref refcount;446 447	/* Set when the interface is being unregistered. */448	bool in_shutdown;449 450	/* Used for a list of interfaces. */451	struct list_head link;452 453	/*454	 * The list of upper layers that are using me.  seq_lock write455	 * protects this.  Read protection is with srcu.456	 */457	struct list_head users;458	struct srcu_struct users_srcu;459	atomic_t nr_users;460	struct device_attribute nr_users_devattr;461	struct device_attribute nr_msgs_devattr;462 463 464	/* Used for wake ups at startup. */465	wait_queue_head_t waitq;466 467	/*468	 * Prevents the interface from being unregistered when the469	 * interface is used by being looked up through the BMC470	 * structure.471	 */472	struct mutex bmc_reg_mutex;473 474	struct bmc_device tmp_bmc;475	struct bmc_device *bmc;476	bool bmc_registered;477	struct list_head bmc_link;478	char *my_dev_name;479	bool in_bmc_register;  /* Handle recursive situations.  Yuck. */480	struct work_struct bmc_reg_work;481 482	const struct ipmi_smi_handlers *handlers;483	void                     *send_info;484 485	/* Driver-model device for the system interface. */486	struct device          *si_dev;487 488	/*489	 * A table of sequence numbers for this interface.  We use the490	 * sequence numbers for IPMB messages that go out of the491	 * interface to match them up with their responses.  A routine492	 * is called periodically to time the items in this list.493	 */494	spinlock_t       seq_lock;495	struct seq_table seq_table[IPMI_IPMB_NUM_SEQ];496	int curr_seq;497 498	/*499	 * Messages queued for delivery.  If delivery fails (out of memory500	 * for instance), They will stay in here to be processed later in a501	 * periodic timer interrupt.  The workqueue is for handling received502	 * messages directly from the handler.503	 */504	spinlock_t       waiting_rcv_msgs_lock;505	struct list_head waiting_rcv_msgs;506	atomic_t	 watchdog_pretimeouts_to_deliver;507	struct work_struct recv_work;508 509	spinlock_t             xmit_msgs_lock;510	struct list_head       xmit_msgs;511	struct ipmi_smi_msg    *curr_msg;512	struct list_head       hp_xmit_msgs;513 514	/*515	 * The list of command receivers that are registered for commands516	 * on this interface.517	 */518	struct mutex     cmd_rcvrs_mutex;519	struct list_head cmd_rcvrs;520 521	/*522	 * Events that were queues because no one was there to receive523	 * them.524	 */525	spinlock_t       events_lock; /* For dealing with event stuff. */526	struct list_head waiting_events;527	unsigned int     waiting_events_count; /* How many events in queue? */528	char             delivering_events;529	char             event_msg_printed;530 531	/* How many users are waiting for events? */532	atomic_t         event_waiters;533	unsigned int     ticks_to_req_ev;534 535	spinlock_t       watch_lock; /* For dealing with watch stuff below. */536 537	/* How many users are waiting for commands? */538	unsigned int     command_waiters;539 540	/* How many users are waiting for watchdogs? */541	unsigned int     watchdog_waiters;542 543	/* How many users are waiting for message responses? */544	unsigned int     response_waiters;545 546	/*547	 * Tells what the lower layer has last been asked to watch for,548	 * messages and/or watchdogs.  Protected by watch_lock.549	 */550	unsigned int     last_watch_mask;551 552	/*553	 * The event receiver for my BMC, only really used at panic554	 * shutdown as a place to store this.555	 */556	unsigned char event_receiver;557	unsigned char event_receiver_lun;558	unsigned char local_sel_device;559	unsigned char local_event_generator;560 561	/* For handling of maintenance mode. */562	int maintenance_mode;563	bool maintenance_mode_enable;564	int auto_maintenance_timeout;565	spinlock_t maintenance_mode_lock; /* Used in a timer... */566 567	/*568	 * If we are doing maintenance on something on IPMB, extend569	 * the timeout time to avoid timeouts writing firmware and570	 * such.571	 */572	int ipmb_maintenance_mode_timeout;573 574	/*575	 * A cheap hack, if this is non-null and a message to an576	 * interface comes in with a NULL user, call this routine with577	 * it.  Note that the message will still be freed by the578	 * caller.  This only works on the system interface.579	 *580	 * Protected by bmc_reg_mutex.581	 */582	void (*null_user_handler)(struct ipmi_smi *intf,583				  struct ipmi_recv_msg *msg);584 585	/*586	 * When we are scanning the channels for an SMI, this will587	 * tell which channel we are scanning.588	 */589	int curr_channel;590 591	/* Channel information */592	struct ipmi_channel_set *channel_list;593	unsigned int curr_working_cset; /* First index into the following. */594	struct ipmi_channel_set wchannels[2];595	struct ipmi_my_addrinfo addrinfo[IPMI_MAX_CHANNELS];596	bool channels_ready;597 598	atomic_t stats[IPMI_NUM_STATS];599 600	/*601	 * run_to_completion duplicate of smb_info, smi_info602	 * and ipmi_serial_info structures. Used to decrease numbers of603	 * parameters passed by "low" level IPMI code.604	 */605	int run_to_completion;606};607#define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev)608 609static void __get_guid(struct ipmi_smi *intf);610static void __ipmi_bmc_unregister(struct ipmi_smi *intf);611static int __ipmi_bmc_register(struct ipmi_smi *intf,612			       struct ipmi_device_id *id,613			       bool guid_set, guid_t *guid, int intf_num);614static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id);615 616 617/*618 * The driver model view of the IPMI messaging driver.619 */620static struct platform_driver ipmidriver = {621	.driver = {622		.name = "ipmi",623		.bus = &platform_bus_type624	}625};626/*627 * This mutex keeps us from adding the same BMC twice.628 */629static DEFINE_MUTEX(ipmidriver_mutex);630 631static LIST_HEAD(ipmi_interfaces);632static DEFINE_MUTEX(ipmi_interfaces_mutex);633#define ipmi_interfaces_mutex_held() \634	lockdep_is_held(&ipmi_interfaces_mutex)635static struct srcu_struct ipmi_interfaces_srcu;636 637/*638 * List of watchers that want to know when smi's are added and deleted.639 */640static LIST_HEAD(smi_watchers);641static DEFINE_MUTEX(smi_watchers_mutex);642 643#define ipmi_inc_stat(intf, stat) \644	atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])645#define ipmi_get_stat(intf, stat) \646	((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))647 648static const char * const addr_src_to_str[] = {649	"invalid", "hotmod", "hardcoded", "SPMI", "ACPI", "SMBIOS", "PCI",650	"device-tree", "platform"651};652 653const char *ipmi_addr_src_to_str(enum ipmi_addr_src src)654{655	if (src >= SI_LAST)656		src = 0; /* Invalid */657	return addr_src_to_str[src];658}659EXPORT_SYMBOL(ipmi_addr_src_to_str);660 661static int is_lan_addr(struct ipmi_addr *addr)662{663	return addr->addr_type == IPMI_LAN_ADDR_TYPE;664}665 666static int is_ipmb_addr(struct ipmi_addr *addr)667{668	return addr->addr_type == IPMI_IPMB_ADDR_TYPE;669}670 671static int is_ipmb_bcast_addr(struct ipmi_addr *addr)672{673	return addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE;674}675 676static int is_ipmb_direct_addr(struct ipmi_addr *addr)677{678	return addr->addr_type == IPMI_IPMB_DIRECT_ADDR_TYPE;679}680 681static void free_recv_msg_list(struct list_head *q)682{683	struct ipmi_recv_msg *msg, *msg2;684 685	list_for_each_entry_safe(msg, msg2, q, link) {686		list_del(&msg->link);687		ipmi_free_recv_msg(msg);688	}689}690 691static void free_smi_msg_list(struct list_head *q)692{693	struct ipmi_smi_msg *msg, *msg2;694 695	list_for_each_entry_safe(msg, msg2, q, link) {696		list_del(&msg->link);697		ipmi_free_smi_msg(msg);698	}699}700 701static void clean_up_interface_data(struct ipmi_smi *intf)702{703	int              i;704	struct cmd_rcvr  *rcvr, *rcvr2;705	struct list_head list;706 707	cancel_work_sync(&intf->recv_work);708 709	free_smi_msg_list(&intf->waiting_rcv_msgs);710	free_recv_msg_list(&intf->waiting_events);711 712	/*713	 * Wholesale remove all the entries from the list in the714	 * interface and wait for RCU to know that none are in use.715	 */716	mutex_lock(&intf->cmd_rcvrs_mutex);717	INIT_LIST_HEAD(&list);718	list_splice_init_rcu(&intf->cmd_rcvrs, &list, synchronize_rcu);719	mutex_unlock(&intf->cmd_rcvrs_mutex);720 721	list_for_each_entry_safe(rcvr, rcvr2, &list, link)722		kfree(rcvr);723 724	for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {725		if ((intf->seq_table[i].inuse)726					&& (intf->seq_table[i].recv_msg))727			ipmi_free_recv_msg(intf->seq_table[i].recv_msg);728	}729}730 731static void intf_free(struct kref *ref)732{733	struct ipmi_smi *intf = container_of(ref, struct ipmi_smi, refcount);734 735	clean_up_interface_data(intf);736	kfree(intf);737}738 739int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)740{741	struct ipmi_smi *intf;742	int index, rv;743 744	/*745	 * Make sure the driver is actually initialized, this handles746	 * problems with initialization order.747	 */748	rv = ipmi_init_msghandler();749	if (rv)750		return rv;751 752	mutex_lock(&smi_watchers_mutex);753 754	list_add(&watcher->link, &smi_watchers);755 756	index = srcu_read_lock(&ipmi_interfaces_srcu);757	list_for_each_entry_rcu(intf, &ipmi_interfaces, link,758			lockdep_is_held(&smi_watchers_mutex)) {759		int intf_num = READ_ONCE(intf->intf_num);760 761		if (intf_num == -1)762			continue;763		watcher->new_smi(intf_num, intf->si_dev);764	}765	srcu_read_unlock(&ipmi_interfaces_srcu, index);766 767	mutex_unlock(&smi_watchers_mutex);768 769	return 0;770}771EXPORT_SYMBOL(ipmi_smi_watcher_register);772 773int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher)774{775	mutex_lock(&smi_watchers_mutex);776	list_del(&watcher->link);777	mutex_unlock(&smi_watchers_mutex);778	return 0;779}780EXPORT_SYMBOL(ipmi_smi_watcher_unregister);781 782/*783 * Must be called with smi_watchers_mutex held.784 */785static void786call_smi_watchers(int i, struct device *dev)787{788	struct ipmi_smi_watcher *w;789 790	mutex_lock(&smi_watchers_mutex);791	list_for_each_entry(w, &smi_watchers, link) {792		if (try_module_get(w->owner)) {793			w->new_smi(i, dev);794			module_put(w->owner);795		}796	}797	mutex_unlock(&smi_watchers_mutex);798}799 800static int801ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)802{803	if (addr1->addr_type != addr2->addr_type)804		return 0;805 806	if (addr1->channel != addr2->channel)807		return 0;808 809	if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {810		struct ipmi_system_interface_addr *smi_addr1811		    = (struct ipmi_system_interface_addr *) addr1;812		struct ipmi_system_interface_addr *smi_addr2813		    = (struct ipmi_system_interface_addr *) addr2;814		return (smi_addr1->lun == smi_addr2->lun);815	}816 817	if (is_ipmb_addr(addr1) || is_ipmb_bcast_addr(addr1)) {818		struct ipmi_ipmb_addr *ipmb_addr1819		    = (struct ipmi_ipmb_addr *) addr1;820		struct ipmi_ipmb_addr *ipmb_addr2821		    = (struct ipmi_ipmb_addr *) addr2;822 823		return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr)824			&& (ipmb_addr1->lun == ipmb_addr2->lun));825	}826 827	if (is_ipmb_direct_addr(addr1)) {828		struct ipmi_ipmb_direct_addr *daddr1829			= (struct ipmi_ipmb_direct_addr *) addr1;830		struct ipmi_ipmb_direct_addr *daddr2831			= (struct ipmi_ipmb_direct_addr *) addr2;832 833		return daddr1->slave_addr == daddr2->slave_addr &&834			daddr1->rq_lun == daddr2->rq_lun &&835			daddr1->rs_lun == daddr2->rs_lun;836	}837 838	if (is_lan_addr(addr1)) {839		struct ipmi_lan_addr *lan_addr1840			= (struct ipmi_lan_addr *) addr1;841		struct ipmi_lan_addr *lan_addr2842		    = (struct ipmi_lan_addr *) addr2;843 844		return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID)845			&& (lan_addr1->local_SWID == lan_addr2->local_SWID)846			&& (lan_addr1->session_handle847			    == lan_addr2->session_handle)848			&& (lan_addr1->lun == lan_addr2->lun));849	}850 851	return 1;852}853 854int ipmi_validate_addr(struct ipmi_addr *addr, int len)855{856	if (len < sizeof(struct ipmi_system_interface_addr))857		return -EINVAL;858 859	if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {860		if (addr->channel != IPMI_BMC_CHANNEL)861			return -EINVAL;862		return 0;863	}864 865	if ((addr->channel == IPMI_BMC_CHANNEL)866	    || (addr->channel >= IPMI_MAX_CHANNELS)867	    || (addr->channel < 0))868		return -EINVAL;869 870	if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {871		if (len < sizeof(struct ipmi_ipmb_addr))872			return -EINVAL;873		return 0;874	}875 876	if (is_ipmb_direct_addr(addr)) {877		struct ipmi_ipmb_direct_addr *daddr = (void *) addr;878 879		if (addr->channel != 0)880			return -EINVAL;881		if (len < sizeof(struct ipmi_ipmb_direct_addr))882			return -EINVAL;883 884		if (daddr->slave_addr & 0x01)885			return -EINVAL;886		if (daddr->rq_lun >= 4)887			return -EINVAL;888		if (daddr->rs_lun >= 4)889			return -EINVAL;890		return 0;891	}892 893	if (is_lan_addr(addr)) {894		if (len < sizeof(struct ipmi_lan_addr))895			return -EINVAL;896		return 0;897	}898 899	return -EINVAL;900}901EXPORT_SYMBOL(ipmi_validate_addr);902 903unsigned int ipmi_addr_length(int addr_type)904{905	if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)906		return sizeof(struct ipmi_system_interface_addr);907 908	if ((addr_type == IPMI_IPMB_ADDR_TYPE)909			|| (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))910		return sizeof(struct ipmi_ipmb_addr);911 912	if (addr_type == IPMI_IPMB_DIRECT_ADDR_TYPE)913		return sizeof(struct ipmi_ipmb_direct_addr);914 915	if (addr_type == IPMI_LAN_ADDR_TYPE)916		return sizeof(struct ipmi_lan_addr);917 918	return 0;919}920EXPORT_SYMBOL(ipmi_addr_length);921 922static int deliver_response(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)923{924	int rv = 0;925 926	if (!msg->user) {927		/* Special handling for NULL users. */928		if (intf->null_user_handler) {929			intf->null_user_handler(intf, msg);930		} else {931			/* No handler, so give up. */932			rv = -EINVAL;933		}934		ipmi_free_recv_msg(msg);935	} else if (oops_in_progress) {936		/*937		 * If we are running in the panic context, calling the938		 * receive handler doesn't much meaning and has a deadlock939		 * risk.  At this moment, simply skip it in that case.940		 */941		ipmi_free_recv_msg(msg);942		atomic_dec(&msg->user->nr_msgs);943	} else {944		int index;945		struct ipmi_user *user = acquire_ipmi_user(msg->user, &index);946 947		if (user) {948			atomic_dec(&user->nr_msgs);949			user->handler->ipmi_recv_hndl(msg, user->handler_data);950			release_ipmi_user(user, index);951		} else {952			/* User went away, give up. */953			ipmi_free_recv_msg(msg);954			rv = -EINVAL;955		}956	}957 958	return rv;959}960 961static void deliver_local_response(struct ipmi_smi *intf,962				   struct ipmi_recv_msg *msg)963{964	if (deliver_response(intf, msg))965		ipmi_inc_stat(intf, unhandled_local_responses);966	else967		ipmi_inc_stat(intf, handled_local_responses);968}969 970static void deliver_err_response(struct ipmi_smi *intf,971				 struct ipmi_recv_msg *msg, int err)972{973	msg->recv_type = IPMI_RESPONSE_RECV_TYPE;974	msg->msg_data[0] = err;975	msg->msg.netfn |= 1; /* Convert to a response. */976	msg->msg.data_len = 1;977	msg->msg.data = msg->msg_data;978	deliver_local_response(intf, msg);979}980 981static void smi_add_watch(struct ipmi_smi *intf, unsigned int flags)982{983	unsigned long iflags;984 985	if (!intf->handlers->set_need_watch)986		return;987 988	spin_lock_irqsave(&intf->watch_lock, iflags);989	if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES)990		intf->response_waiters++;991 992	if (flags & IPMI_WATCH_MASK_CHECK_WATCHDOG)993		intf->watchdog_waiters++;994 995	if (flags & IPMI_WATCH_MASK_CHECK_COMMANDS)996		intf->command_waiters++;997 998	if ((intf->last_watch_mask & flags) != flags) {999		intf->last_watch_mask |= flags;1000		intf->handlers->set_need_watch(intf->send_info,1001					       intf->last_watch_mask);1002	}1003	spin_unlock_irqrestore(&intf->watch_lock, iflags);1004}1005 1006static void smi_remove_watch(struct ipmi_smi *intf, unsigned int flags)1007{1008	unsigned long iflags;1009 1010	if (!intf->handlers->set_need_watch)1011		return;1012 1013	spin_lock_irqsave(&intf->watch_lock, iflags);1014	if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES)1015		intf->response_waiters--;1016 1017	if (flags & IPMI_WATCH_MASK_CHECK_WATCHDOG)1018		intf->watchdog_waiters--;1019 1020	if (flags & IPMI_WATCH_MASK_CHECK_COMMANDS)1021		intf->command_waiters--;1022 1023	flags = 0;1024	if (intf->response_waiters)1025		flags |= IPMI_WATCH_MASK_CHECK_MESSAGES;1026	if (intf->watchdog_waiters)1027		flags |= IPMI_WATCH_MASK_CHECK_WATCHDOG;1028	if (intf->command_waiters)1029		flags |= IPMI_WATCH_MASK_CHECK_COMMANDS;1030 1031	if (intf->last_watch_mask != flags) {1032		intf->last_watch_mask = flags;1033		intf->handlers->set_need_watch(intf->send_info,1034					       intf->last_watch_mask);1035	}1036	spin_unlock_irqrestore(&intf->watch_lock, iflags);1037}1038 1039/*1040 * Find the next sequence number not being used and add the given1041 * message with the given timeout to the sequence table.  This must be1042 * called with the interface's seq_lock held.1043 */1044static int intf_next_seq(struct ipmi_smi      *intf,1045			 struct ipmi_recv_msg *recv_msg,1046			 unsigned long        timeout,1047			 int                  retries,1048			 int                  broadcast,1049			 unsigned char        *seq,1050			 long                 *seqid)1051{1052	int          rv = 0;1053	unsigned int i;1054 1055	if (timeout == 0)1056		timeout = default_retry_ms;1057	if (retries < 0)1058		retries = default_max_retries;1059 1060	for (i = intf->curr_seq; (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;1061					i = (i+1)%IPMI_IPMB_NUM_SEQ) {1062		if (!intf->seq_table[i].inuse)1063			break;1064	}1065 1066	if (!intf->seq_table[i].inuse) {1067		intf->seq_table[i].recv_msg = recv_msg;1068 1069		/*1070		 * Start with the maximum timeout, when the send response1071		 * comes in we will start the real timer.1072		 */1073		intf->seq_table[i].timeout = MAX_MSG_TIMEOUT;1074		intf->seq_table[i].orig_timeout = timeout;1075		intf->seq_table[i].retries_left = retries;1076		intf->seq_table[i].broadcast = broadcast;1077		intf->seq_table[i].inuse = 1;1078		intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid);1079		*seq = i;1080		*seqid = intf->seq_table[i].seqid;1081		intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;1082		smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);1083		need_waiter(intf);1084	} else {1085		rv = -EAGAIN;1086	}1087 1088	return rv;1089}1090 1091/*1092 * Return the receive message for the given sequence number and1093 * release the sequence number so it can be reused.  Some other data1094 * is passed in to be sure the message matches up correctly (to help1095 * guard against message coming in after their timeout and the1096 * sequence number being reused).1097 */1098static int intf_find_seq(struct ipmi_smi      *intf,1099			 unsigned char        seq,1100			 short                channel,1101			 unsigned char        cmd,1102			 unsigned char        netfn,1103			 struct ipmi_addr     *addr,1104			 struct ipmi_recv_msg **recv_msg)1105{1106	int           rv = -ENODEV;1107	unsigned long flags;1108 1109	if (seq >= IPMI_IPMB_NUM_SEQ)1110		return -EINVAL;1111 1112	spin_lock_irqsave(&intf->seq_lock, flags);1113	if (intf->seq_table[seq].inuse) {1114		struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg;1115 1116		if ((msg->addr.channel == channel) && (msg->msg.cmd == cmd)1117				&& (msg->msg.netfn == netfn)1118				&& (ipmi_addr_equal(addr, &msg->addr))) {1119			*recv_msg = msg;1120			intf->seq_table[seq].inuse = 0;1121			smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);1122			rv = 0;1123		}1124	}1125	spin_unlock_irqrestore(&intf->seq_lock, flags);1126 1127	return rv;1128}1129 1130 1131/* Start the timer for a specific sequence table entry. */1132static int intf_start_seq_timer(struct ipmi_smi *intf,1133				long       msgid)1134{1135	int           rv = -ENODEV;1136	unsigned long flags;1137	unsigned char seq;1138	unsigned long seqid;1139 1140 1141	GET_SEQ_FROM_MSGID(msgid, seq, seqid);1142 1143	spin_lock_irqsave(&intf->seq_lock, flags);1144	/*1145	 * We do this verification because the user can be deleted1146	 * while a message is outstanding.1147	 */1148	if ((intf->seq_table[seq].inuse)1149				&& (intf->seq_table[seq].seqid == seqid)) {1150		struct seq_table *ent = &intf->seq_table[seq];1151		ent->timeout = ent->orig_timeout;1152		rv = 0;1153	}1154	spin_unlock_irqrestore(&intf->seq_lock, flags);1155 1156	return rv;1157}1158 1159/* Got an error for the send message for a specific sequence number. */1160static int intf_err_seq(struct ipmi_smi *intf,1161			long         msgid,1162			unsigned int err)1163{1164	int                  rv = -ENODEV;1165	unsigned long        flags;1166	unsigned char        seq;1167	unsigned long        seqid;1168	struct ipmi_recv_msg *msg = NULL;1169 1170 1171	GET_SEQ_FROM_MSGID(msgid, seq, seqid);1172 1173	spin_lock_irqsave(&intf->seq_lock, flags);1174	/*1175	 * We do this verification because the user can be deleted1176	 * while a message is outstanding.1177	 */1178	if ((intf->seq_table[seq].inuse)1179				&& (intf->seq_table[seq].seqid == seqid)) {1180		struct seq_table *ent = &intf->seq_table[seq];1181 1182		ent->inuse = 0;1183		smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);1184		msg = ent->recv_msg;1185		rv = 0;1186	}1187	spin_unlock_irqrestore(&intf->seq_lock, flags);1188 1189	if (msg)1190		deliver_err_response(intf, msg, err);1191 1192	return rv;1193}1194 1195static void free_user_work(struct work_struct *work)1196{1197	struct ipmi_user *user = container_of(work, struct ipmi_user,1198					      remove_work);1199 1200	cleanup_srcu_struct(&user->release_barrier);1201	vfree(user);1202}1203 1204int ipmi_create_user(unsigned int          if_num,1205		     const struct ipmi_user_hndl *handler,1206		     void                  *handler_data,1207		     struct ipmi_user      **user)1208{1209	unsigned long flags;1210	struct ipmi_user *new_user;1211	int           rv, index;1212	struct ipmi_smi *intf;1213 1214	/*1215	 * There is no module usecount here, because it's not1216	 * required.  Since this can only be used by and called from1217	 * other modules, they will implicitly use this module, and1218	 * thus this can't be removed unless the other modules are1219	 * removed.1220	 */1221 1222	if (handler == NULL)1223		return -EINVAL;1224 1225	/*1226	 * Make sure the driver is actually initialized, this handles1227	 * problems with initialization order.1228	 */1229	rv = ipmi_init_msghandler();1230	if (rv)1231		return rv;1232 1233	new_user = vzalloc(sizeof(*new_user));1234	if (!new_user)1235		return -ENOMEM;1236 1237	index = srcu_read_lock(&ipmi_interfaces_srcu);1238	list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {1239		if (intf->intf_num == if_num)1240			goto found;1241	}1242	/* Not found, return an error */1243	rv = -EINVAL;1244	goto out_kfree;1245 1246 found:1247	if (atomic_add_return(1, &intf->nr_users) > max_users) {1248		rv = -EBUSY;1249		goto out_kfree;1250	}1251 1252	INIT_WORK(&new_user->remove_work, free_user_work);1253 1254	rv = init_srcu_struct(&new_user->release_barrier);1255	if (rv)1256		goto out_kfree;1257 1258	if (!try_module_get(intf->owner)) {1259		rv = -ENODEV;1260		goto out_kfree;1261	}1262 1263	/* Note that each existing user holds a refcount to the interface. */1264	kref_get(&intf->refcount);1265 1266	atomic_set(&new_user->nr_msgs, 0);1267	kref_init(&new_user->refcount);1268	new_user->handler = handler;1269	new_user->handler_data = handler_data;1270	new_user->intf = intf;1271	new_user->gets_events = false;1272 1273	rcu_assign_pointer(new_user->self, new_user);1274	spin_lock_irqsave(&intf->seq_lock, flags);1275	list_add_rcu(&new_user->link, &intf->users);1276	spin_unlock_irqrestore(&intf->seq_lock, flags);1277	if (handler->ipmi_watchdog_pretimeout)1278		/* User wants pretimeouts, so make sure to watch for them. */1279		smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG);1280	srcu_read_unlock(&ipmi_interfaces_srcu, index);1281	*user = new_user;1282	return 0;1283 1284out_kfree:1285	atomic_dec(&intf->nr_users);1286	srcu_read_unlock(&ipmi_interfaces_srcu, index);1287	vfree(new_user);1288	return rv;1289}1290EXPORT_SYMBOL(ipmi_create_user);1291 1292int ipmi_get_smi_info(int if_num, struct ipmi_smi_info *data)1293{1294	int rv, index;1295	struct ipmi_smi *intf;1296 1297	index = srcu_read_lock(&ipmi_interfaces_srcu);1298	list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {1299		if (intf->intf_num == if_num)1300			goto found;1301	}1302	srcu_read_unlock(&ipmi_interfaces_srcu, index);1303 1304	/* Not found, return an error */1305	return -EINVAL;1306 1307found:1308	if (!intf->handlers->get_smi_info)1309		rv = -ENOTTY;1310	else1311		rv = intf->handlers->get_smi_info(intf->send_info, data);1312	srcu_read_unlock(&ipmi_interfaces_srcu, index);1313 1314	return rv;1315}1316EXPORT_SYMBOL(ipmi_get_smi_info);1317 1318static void free_user(struct kref *ref)1319{1320	struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount);1321 1322	/* SRCU cleanup must happen in workqueue context. */1323	queue_work(remove_work_wq, &user->remove_work);1324}1325 1326static void _ipmi_destroy_user(struct ipmi_user *user)1327{1328	struct ipmi_smi  *intf = user->intf;1329	int              i;1330	unsigned long    flags;1331	struct cmd_rcvr  *rcvr;1332	struct cmd_rcvr  *rcvrs = NULL;1333	struct module    *owner;1334 1335	if (!acquire_ipmi_user(user, &i)) {1336		/*1337		 * The user has already been cleaned up, just make sure1338		 * nothing is using it and return.1339		 */1340		synchronize_srcu(&user->release_barrier);1341		return;1342	}1343 1344	rcu_assign_pointer(user->self, NULL);1345	release_ipmi_user(user, i);1346 1347	synchronize_srcu(&user->release_barrier);1348 1349	if (user->handler->shutdown)1350		user->handler->shutdown(user->handler_data);1351 1352	if (user->handler->ipmi_watchdog_pretimeout)1353		smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG);1354 1355	if (user->gets_events)1356		atomic_dec(&intf->event_waiters);1357 1358	/* Remove the user from the interface's sequence table. */1359	spin_lock_irqsave(&intf->seq_lock, flags);1360	list_del_rcu(&user->link);1361	atomic_dec(&intf->nr_users);1362 1363	for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {1364		if (intf->seq_table[i].inuse1365		    && (intf->seq_table[i].recv_msg->user == user)) {1366			intf->seq_table[i].inuse = 0;1367			smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);1368			ipmi_free_recv_msg(intf->seq_table[i].recv_msg);1369		}1370	}1371	spin_unlock_irqrestore(&intf->seq_lock, flags);1372 1373	/*1374	 * Remove the user from the command receiver's table.  First1375	 * we build a list of everything (not using the standard link,1376	 * since other things may be using it till we do1377	 * synchronize_srcu()) then free everything in that list.1378	 */1379	mutex_lock(&intf->cmd_rcvrs_mutex);1380	list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link,1381				lockdep_is_held(&intf->cmd_rcvrs_mutex)) {1382		if (rcvr->user == user) {1383			list_del_rcu(&rcvr->link);1384			rcvr->next = rcvrs;1385			rcvrs = rcvr;1386		}1387	}1388	mutex_unlock(&intf->cmd_rcvrs_mutex);1389	synchronize_rcu();1390	while (rcvrs) {1391		rcvr = rcvrs;1392		rcvrs = rcvr->next;1393		kfree(rcvr);1394	}1395 1396	owner = intf->owner;1397	kref_put(&intf->refcount, intf_free);1398	module_put(owner);1399}1400 1401int ipmi_destroy_user(struct ipmi_user *user)1402{1403	_ipmi_destroy_user(user);1404 1405	kref_put(&user->refcount, free_user);1406 1407	return 0;1408}1409EXPORT_SYMBOL(ipmi_destroy_user);1410 1411int ipmi_get_version(struct ipmi_user *user,1412		     unsigned char *major,1413		     unsigned char *minor)1414{1415	struct ipmi_device_id id;1416	int rv, index;1417 1418	user = acquire_ipmi_user(user, &index);1419	if (!user)1420		return -ENODEV;1421 1422	rv = bmc_get_device_id(user->intf, NULL, &id, NULL, NULL);1423	if (!rv) {1424		*major = ipmi_version_major(&id);1425		*minor = ipmi_version_minor(&id);1426	}1427	release_ipmi_user(user, index);1428 1429	return rv;1430}1431EXPORT_SYMBOL(ipmi_get_version);1432 1433int ipmi_set_my_address(struct ipmi_user *user,1434			unsigned int  channel,1435			unsigned char address)1436{1437	int index, rv = 0;1438 1439	user = acquire_ipmi_user(user, &index);1440	if (!user)1441		return -ENODEV;1442 1443	if (channel >= IPMI_MAX_CHANNELS) {1444		rv = -EINVAL;1445	} else {1446		channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);1447		user->intf->addrinfo[channel].address = address;1448	}1449	release_ipmi_user(user, index);1450 1451	return rv;1452}1453EXPORT_SYMBOL(ipmi_set_my_address);1454 1455int ipmi_get_my_address(struct ipmi_user *user,1456			unsigned int  channel,1457			unsigned char *address)1458{1459	int index, rv = 0;1460 1461	user = acquire_ipmi_user(user, &index);1462	if (!user)1463		return -ENODEV;1464 1465	if (channel >= IPMI_MAX_CHANNELS) {1466		rv = -EINVAL;1467	} else {1468		channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);1469		*address = user->intf->addrinfo[channel].address;1470	}1471	release_ipmi_user(user, index);1472 1473	return rv;1474}1475EXPORT_SYMBOL(ipmi_get_my_address);1476 1477int ipmi_set_my_LUN(struct ipmi_user *user,1478		    unsigned int  channel,1479		    unsigned char LUN)1480{1481	int index, rv = 0;1482 1483	user = acquire_ipmi_user(user, &index);1484	if (!user)1485		return -ENODEV;1486 1487	if (channel >= IPMI_MAX_CHANNELS) {1488		rv = -EINVAL;1489	} else {1490		channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);1491		user->intf->addrinfo[channel].lun = LUN & 0x3;1492	}1493	release_ipmi_user(user, index);1494 1495	return rv;1496}1497EXPORT_SYMBOL(ipmi_set_my_LUN);1498 1499int ipmi_get_my_LUN(struct ipmi_user *user,1500		    unsigned int  channel,1501		    unsigned char *address)1502{1503	int index, rv = 0;1504 1505	user = acquire_ipmi_user(user, &index);1506	if (!user)1507		return -ENODEV;1508 1509	if (channel >= IPMI_MAX_CHANNELS) {1510		rv = -EINVAL;1511	} else {1512		channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);1513		*address = user->intf->addrinfo[channel].lun;1514	}1515	release_ipmi_user(user, index);1516 1517	return rv;1518}1519EXPORT_SYMBOL(ipmi_get_my_LUN);1520 1521int ipmi_get_maintenance_mode(struct ipmi_user *user)1522{1523	int mode, index;1524	unsigned long flags;1525 1526	user = acquire_ipmi_user(user, &index);1527	if (!user)1528		return -ENODEV;1529 1530	spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags);1531	mode = user->intf->maintenance_mode;1532	spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags);1533	release_ipmi_user(user, index);1534 1535	return mode;1536}1537EXPORT_SYMBOL(ipmi_get_maintenance_mode);1538 1539static void maintenance_mode_update(struct ipmi_smi *intf)1540{1541	if (intf->handlers->set_maintenance_mode)1542		intf->handlers->set_maintenance_mode(1543			intf->send_info, intf->maintenance_mode_enable);1544}1545 1546int ipmi_set_maintenance_mode(struct ipmi_user *user, int mode)1547{1548	int rv = 0, index;1549	unsigned long flags;1550	struct ipmi_smi *intf = user->intf;1551 1552	user = acquire_ipmi_user(user, &index);1553	if (!user)1554		return -ENODEV;1555 1556	spin_lock_irqsave(&intf->maintenance_mode_lock, flags);1557	if (intf->maintenance_mode != mode) {1558		switch (mode) {1559		case IPMI_MAINTENANCE_MODE_AUTO:1560			intf->maintenance_mode_enable1561				= (intf->auto_maintenance_timeout > 0);1562			break;1563 1564		case IPMI_MAINTENANCE_MODE_OFF:1565			intf->maintenance_mode_enable = false;1566			break;1567 1568		case IPMI_MAINTENANCE_MODE_ON:1569			intf->maintenance_mode_enable = true;1570			break;1571 1572		default:1573			rv = -EINVAL;1574			goto out_unlock;1575		}1576		intf->maintenance_mode = mode;1577 1578		maintenance_mode_update(intf);1579	}1580 out_unlock:1581	spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags);1582	release_ipmi_user(user, index);1583 1584	return rv;1585}1586EXPORT_SYMBOL(ipmi_set_maintenance_mode);1587 1588int ipmi_set_gets_events(struct ipmi_user *user, bool val)1589{1590	unsigned long        flags;1591	struct ipmi_smi      *intf = user->intf;1592	struct ipmi_recv_msg *msg, *msg2;1593	struct list_head     msgs;1594	int index;1595 1596	user = acquire_ipmi_user(user, &index);1597	if (!user)1598		return -ENODEV;1599 1600	INIT_LIST_HEAD(&msgs);1601 1602	spin_lock_irqsave(&intf->events_lock, flags);1603	if (user->gets_events == val)1604		goto out;1605 1606	user->gets_events = val;1607 1608	if (val) {1609		if (atomic_inc_return(&intf->event_waiters) == 1)1610			need_waiter(intf);1611	} else {1612		atomic_dec(&intf->event_waiters);1613	}1614 1615	if (intf->delivering_events)1616		/*1617		 * Another thread is delivering events for this, so1618		 * let it handle any new events.1619		 */1620		goto out;1621 1622	/* Deliver any queued events. */1623	while (user->gets_events && !list_empty(&intf->waiting_events)) {1624		list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link)1625			list_move_tail(&msg->link, &msgs);1626		intf->waiting_events_count = 0;1627		if (intf->event_msg_printed) {1628			dev_warn(intf->si_dev, "Event queue no longer full\n");1629			intf->event_msg_printed = 0;1630		}1631 1632		intf->delivering_events = 1;1633		spin_unlock_irqrestore(&intf->events_lock, flags);1634 1635		list_for_each_entry_safe(msg, msg2, &msgs, link) {1636			msg->user = user;1637			kref_get(&user->refcount);1638			deliver_local_response(intf, msg);1639		}1640 1641		spin_lock_irqsave(&intf->events_lock, flags);1642		intf->delivering_events = 0;1643	}1644 1645 out:1646	spin_unlock_irqrestore(&intf->events_lock, flags);1647	release_ipmi_user(user, index);1648 1649	return 0;1650}1651EXPORT_SYMBOL(ipmi_set_gets_events);1652 1653static struct cmd_rcvr *find_cmd_rcvr(struct ipmi_smi *intf,1654				      unsigned char netfn,1655				      unsigned char cmd,1656				      unsigned char chan)1657{1658	struct cmd_rcvr *rcvr;1659 1660	list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link,1661				lockdep_is_held(&intf->cmd_rcvrs_mutex)) {1662		if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)1663					&& (rcvr->chans & (1 << chan)))1664			return rcvr;1665	}1666	return NULL;1667}1668 1669static int is_cmd_rcvr_exclusive(struct ipmi_smi *intf,1670				 unsigned char netfn,1671				 unsigned char cmd,1672				 unsigned int  chans)1673{1674	struct cmd_rcvr *rcvr;1675 1676	list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link,1677				lockdep_is_held(&intf->cmd_rcvrs_mutex)) {1678		if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)1679					&& (rcvr->chans & chans))1680			return 0;1681	}1682	return 1;1683}1684 1685int ipmi_register_for_cmd(struct ipmi_user *user,1686			  unsigned char netfn,1687			  unsigned char cmd,1688			  unsigned int  chans)1689{1690	struct ipmi_smi *intf = user->intf;1691	struct cmd_rcvr *rcvr;1692	int rv = 0, index;1693 1694	user = acquire_ipmi_user(user, &index);1695	if (!user)1696		return -ENODEV;1697 1698	rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);1699	if (!rcvr) {1700		rv = -ENOMEM;1701		goto out_release;1702	}1703	rcvr->cmd = cmd;1704	rcvr->netfn = netfn;1705	rcvr->chans = chans;1706	rcvr->user = user;1707 1708	mutex_lock(&intf->cmd_rcvrs_mutex);1709	/* Make sure the command/netfn is not already registered. */1710	if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) {1711		rv = -EBUSY;1712		goto out_unlock;1713	}1714 1715	smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS);1716 1717	list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);1718 1719out_unlock:1720	mutex_unlock(&intf->cmd_rcvrs_mutex);1721	if (rv)1722		kfree(rcvr);1723out_release:1724	release_ipmi_user(user, index);1725 1726	return rv;1727}1728EXPORT_SYMBOL(ipmi_register_for_cmd);1729 1730int ipmi_unregister_for_cmd(struct ipmi_user *user,1731			    unsigned char netfn,1732			    unsigned char cmd,1733			    unsigned int  chans)1734{1735	struct ipmi_smi *intf = user->intf;1736	struct cmd_rcvr *rcvr;1737	struct cmd_rcvr *rcvrs = NULL;1738	int i, rv = -ENOENT, index;1739 1740	user = acquire_ipmi_user(user, &index);1741	if (!user)1742		return -ENODEV;1743 1744	mutex_lock(&intf->cmd_rcvrs_mutex);1745	for (i = 0; i < IPMI_NUM_CHANNELS; i++) {1746		if (((1 << i) & chans) == 0)1747			continue;1748		rcvr = find_cmd_rcvr(intf, netfn, cmd, i);1749		if (rcvr == NULL)1750			continue;1751		if (rcvr->user == user) {1752			rv = 0;1753			rcvr->chans &= ~chans;1754			if (rcvr->chans == 0) {1755				list_del_rcu(&rcvr->link);1756				rcvr->next = rcvrs;1757				rcvrs = rcvr;1758			}1759		}1760	}1761	mutex_unlock(&intf->cmd_rcvrs_mutex);1762	synchronize_rcu();1763	release_ipmi_user(user, index);1764	while (rcvrs) {1765		smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS);1766		rcvr = rcvrs;1767		rcvrs = rcvr->next;1768		kfree(rcvr);1769	}1770 1771	return rv;1772}1773EXPORT_SYMBOL(ipmi_unregister_for_cmd);1774 1775unsigned char1776ipmb_checksum(unsigned char *data, int size)1777{1778	unsigned char csum = 0;1779 1780	for (; size > 0; size--, data++)1781		csum += *data;1782 1783	return -csum;1784}1785EXPORT_SYMBOL(ipmb_checksum);1786 1787static inline void format_ipmb_msg(struct ipmi_smi_msg   *smi_msg,1788				   struct kernel_ipmi_msg *msg,1789				   struct ipmi_ipmb_addr *ipmb_addr,1790				   long                  msgid,1791				   unsigned char         ipmb_seq,1792				   int                   broadcast,1793				   unsigned char         source_address,1794				   unsigned char         source_lun)1795{1796	int i = broadcast;1797 1798	/* Format the IPMB header data. */1799	smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);1800	smi_msg->data[1] = IPMI_SEND_MSG_CMD;1801	smi_msg->data[2] = ipmb_addr->channel;1802	if (broadcast)1803		smi_msg->data[3] = 0;1804	smi_msg->data[i+3] = ipmb_addr->slave_addr;1805	smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3);1806	smi_msg->data[i+5] = ipmb_checksum(&smi_msg->data[i + 3], 2);1807	smi_msg->data[i+6] = source_address;1808	smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun;1809	smi_msg->data[i+8] = msg->cmd;1810 1811	/* Now tack on the data to the message. */1812	if (msg->data_len > 0)1813		memcpy(&smi_msg->data[i + 9], msg->data, msg->data_len);1814	smi_msg->data_size = msg->data_len + 9;1815 1816	/* Now calculate the checksum and tack it on. */1817	smi_msg->data[i+smi_msg->data_size]1818		= ipmb_checksum(&smi_msg->data[i + 6], smi_msg->data_size - 6);1819 1820	/*1821	 * Add on the checksum size and the offset from the1822	 * broadcast.1823	 */1824	smi_msg->data_size += 1 + i;1825 1826	smi_msg->msgid = msgid;1827}1828 1829static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,1830				  struct kernel_ipmi_msg *msg,1831				  struct ipmi_lan_addr  *lan_addr,1832				  long                  msgid,1833				  unsigned char         ipmb_seq,1834				  unsigned char         source_lun)1835{1836	/* Format the IPMB header data. */1837	smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);1838	smi_msg->data[1] = IPMI_SEND_MSG_CMD;1839	smi_msg->data[2] = lan_addr->channel;1840	smi_msg->data[3] = lan_addr->session_handle;1841	smi_msg->data[4] = lan_addr->remote_SWID;1842	smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3);1843	smi_msg->data[6] = ipmb_checksum(&smi_msg->data[4], 2);1844	smi_msg->data[7] = lan_addr->local_SWID;1845	smi_msg->data[8] = (ipmb_seq << 2) | source_lun;1846	smi_msg->data[9] = msg->cmd;1847 1848	/* Now tack on the data to the message. */1849	if (msg->data_len > 0)1850		memcpy(&smi_msg->data[10], msg->data, msg->data_len);1851	smi_msg->data_size = msg->data_len + 10;1852 1853	/* Now calculate the checksum and tack it on. */1854	smi_msg->data[smi_msg->data_size]1855		= ipmb_checksum(&smi_msg->data[7], smi_msg->data_size - 7);1856 1857	/*1858	 * Add on the checksum size and the offset from the1859	 * broadcast.1860	 */1861	smi_msg->data_size += 1;1862 1863	smi_msg->msgid = msgid;1864}1865 1866static struct ipmi_smi_msg *smi_add_send_msg(struct ipmi_smi *intf,1867					     struct ipmi_smi_msg *smi_msg,1868					     int priority)1869{1870	if (intf->curr_msg) {1871		if (priority > 0)1872			list_add_tail(&smi_msg->link, &intf->hp_xmit_msgs);1873		else1874			list_add_tail(&smi_msg->link, &intf->xmit_msgs);1875		smi_msg = NULL;1876	} else {1877		intf->curr_msg = smi_msg;1878	}1879 1880	return smi_msg;1881}1882 1883static void smi_send(struct ipmi_smi *intf,1884		     const struct ipmi_smi_handlers *handlers,1885		     struct ipmi_smi_msg *smi_msg, int priority)1886{1887	int run_to_completion = intf->run_to_completion;1888	unsigned long flags = 0;1889 1890	if (!run_to_completion)1891		spin_lock_irqsave(&intf->xmit_msgs_lock, flags);1892	smi_msg = smi_add_send_msg(intf, smi_msg, priority);1893 1894	if (!run_to_completion)1895		spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);1896 1897	if (smi_msg)1898		handlers->sender(intf->send_info, smi_msg);1899}1900 1901static bool is_maintenance_mode_cmd(struct kernel_ipmi_msg *msg)1902{1903	return (((msg->netfn == IPMI_NETFN_APP_REQUEST)1904		 && ((msg->cmd == IPMI_COLD_RESET_CMD)1905		     || (msg->cmd == IPMI_WARM_RESET_CMD)))1906		|| (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST));1907}1908 1909static int i_ipmi_req_sysintf(struct ipmi_smi        *intf,1910			      struct ipmi_addr       *addr,1911			      long                   msgid,1912			      struct kernel_ipmi_msg *msg,1913			      struct ipmi_smi_msg    *smi_msg,1914			      struct ipmi_recv_msg   *recv_msg,1915			      int                    retries,1916			      unsigned int           retry_time_ms)1917{1918	struct ipmi_system_interface_addr *smi_addr;1919 1920	if (msg->netfn & 1)1921		/* Responses are not allowed to the SMI. */1922		return -EINVAL;1923 1924	smi_addr = (struct ipmi_system_interface_addr *) addr;1925	if (smi_addr->lun > 3) {1926		ipmi_inc_stat(intf, sent_invalid_commands);1927		return -EINVAL;1928	}1929 1930	memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr));1931 1932	if ((msg->netfn == IPMI_NETFN_APP_REQUEST)1933	    && ((msg->cmd == IPMI_SEND_MSG_CMD)1934		|| (msg->cmd == IPMI_GET_MSG_CMD)1935		|| (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD))) {1936		/*1937		 * We don't let the user do these, since we manage1938		 * the sequence numbers.1939		 */1940		ipmi_inc_stat(intf, sent_invalid_commands);1941		return -EINVAL;1942	}1943 1944	if (is_maintenance_mode_cmd(msg)) {1945		unsigned long flags;1946 1947		spin_lock_irqsave(&intf->maintenance_mode_lock, flags);1948		intf->auto_maintenance_timeout1949			= maintenance_mode_timeout_ms;1950		if (!intf->maintenance_mode1951		    && !intf->maintenance_mode_enable) {1952			intf->maintenance_mode_enable = true;1953			maintenance_mode_update(intf);1954		}1955		spin_unlock_irqrestore(&intf->maintenance_mode_lock,1956				       flags);1957	}1958 1959	if (msg->data_len + 2 > IPMI_MAX_MSG_LENGTH) {1960		ipmi_inc_stat(intf, sent_invalid_commands);1961		return -EMSGSIZE;1962	}1963 1964	smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3);1965	smi_msg->data[1] = msg->cmd;1966	smi_msg->msgid = msgid;1967	smi_msg->user_data = recv_msg;1968	if (msg->data_len > 0)1969		memcpy(&smi_msg->data[2], msg->data, msg->data_len);1970	smi_msg->data_size = msg->data_len + 2;1971	ipmi_inc_stat(intf, sent_local_commands);1972 1973	return 0;1974}1975 1976static int i_ipmi_req_ipmb(struct ipmi_smi        *intf,1977			   struct ipmi_addr       *addr,1978			   long                   msgid,1979			   struct kernel_ipmi_msg *msg,1980			   struct ipmi_smi_msg    *smi_msg,1981			   struct ipmi_recv_msg   *recv_msg,1982			   unsigned char          source_address,1983			   unsigned char          source_lun,1984			   int                    retries,1985			   unsigned int           retry_time_ms)1986{1987	struct ipmi_ipmb_addr *ipmb_addr;1988	unsigned char ipmb_seq;1989	long seqid;1990	int broadcast = 0;1991	struct ipmi_channel *chans;1992	int rv = 0;1993 1994	if (addr->channel >= IPMI_MAX_CHANNELS) {1995		ipmi_inc_stat(intf, sent_invalid_commands);1996		return -EINVAL;1997	}1998 1999	chans = READ_ONCE(intf->channel_list)->c;2000 2001	if (chans[addr->channel].medium != IPMI_CHANNEL_MEDIUM_IPMB) {2002		ipmi_inc_stat(intf, sent_invalid_commands);2003		return -EINVAL;2004	}2005 2006	if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) {2007		/*2008		 * Broadcasts add a zero at the beginning of the2009		 * message, but otherwise is the same as an IPMB2010		 * address.2011		 */2012		addr->addr_type = IPMI_IPMB_ADDR_TYPE;2013		broadcast = 1;2014		retries = 0; /* Don't retry broadcasts. */2015	}2016 2017	/*2018	 * 9 for the header and 1 for the checksum, plus2019	 * possibly one for the broadcast.2020	 */2021	if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) {2022		ipmi_inc_stat(intf, sent_invalid_commands);2023		return -EMSGSIZE;2024	}2025 2026	ipmb_addr = (struct ipmi_ipmb_addr *) addr;2027	if (ipmb_addr->lun > 3) {2028		ipmi_inc_stat(intf, sent_invalid_commands);2029		return -EINVAL;2030	}2031 2032	memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr));2033 2034	if (recv_msg->msg.netfn & 0x1) {2035		/*2036		 * It's a response, so use the user's sequence2037		 * from msgid.2038		 */2039		ipmi_inc_stat(intf, sent_ipmb_responses);2040		format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid,2041				msgid, broadcast,2042				source_address, source_lun);2043 2044		/*2045		 * Save the receive message so we can use it2046		 * to deliver the response.2047		 */2048		smi_msg->user_data = recv_msg;2049	} else {2050		/* It's a command, so get a sequence for it. */2051		unsigned long flags;2052 2053		spin_lock_irqsave(&intf->seq_lock, flags);2054 2055		if (is_maintenance_mode_cmd(msg))2056			intf->ipmb_maintenance_mode_timeout =2057				maintenance_mode_timeout_ms;2058 2059		if (intf->ipmb_maintenance_mode_timeout && retry_time_ms == 0)2060			/* Different default in maintenance mode */2061			retry_time_ms = default_maintenance_retry_ms;2062 2063		/*2064		 * Create a sequence number with a 1 second2065		 * timeout and 4 retries.2066		 */2067		rv = intf_next_seq(intf,2068				   recv_msg,2069				   retry_time_ms,2070				   retries,2071				   broadcast,2072				   &ipmb_seq,2073				   &seqid);2074		if (rv)2075			/*2076			 * We have used up all the sequence numbers,2077			 * probably, so abort.2078			 */2079			goto out_err;2080 2081		ipmi_inc_stat(intf, sent_ipmb_commands);2082 2083		/*2084		 * Store the sequence number in the message,2085		 * so that when the send message response2086		 * comes back we can start the timer.2087		 */2088		format_ipmb_msg(smi_msg, msg, ipmb_addr,2089				STORE_SEQ_IN_MSGID(ipmb_seq, seqid),2090				ipmb_seq, broadcast,2091				source_address, source_lun);2092 2093		/*2094		 * Copy the message into the recv message data, so we2095		 * can retransmit it later if necessary.2096		 */2097		memcpy(recv_msg->msg_data, smi_msg->data,2098		       smi_msg->data_size);2099		recv_msg->msg.data = recv_msg->msg_data;2100		recv_msg->msg.data_len = smi_msg->data_size;2101 2102		/*2103		 * We don't unlock until here, because we need2104		 * to copy the completed message into the2105		 * recv_msg before we release the lock.2106		 * Otherwise, race conditions may bite us.  I2107		 * know that's pretty paranoid, but I prefer2108		 * to be correct.2109		 */2110out_err:2111		spin_unlock_irqrestore(&intf->seq_lock, flags);2112	}2113 2114	return rv;2115}2116 2117static int i_ipmi_req_ipmb_direct(struct ipmi_smi        *intf,2118				  struct ipmi_addr       *addr,2119				  long			 msgid,2120				  struct kernel_ipmi_msg *msg,2121				  struct ipmi_smi_msg    *smi_msg,2122				  struct ipmi_recv_msg   *recv_msg,2123				  unsigned char          source_lun)2124{2125	struct ipmi_ipmb_direct_addr *daddr;2126	bool is_cmd = !(recv_msg->msg.netfn & 0x1);2127 2128	if (!(intf->handlers->flags & IPMI_SMI_CAN_HANDLE_IPMB_DIRECT))2129		return -EAFNOSUPPORT;2130 2131	/* Responses must have a completion code. */2132	if (!is_cmd && msg->data_len < 1) {2133		ipmi_inc_stat(intf, sent_invalid_commands);2134		return -EINVAL;2135	}2136 2137	if ((msg->data_len + 4) > IPMI_MAX_MSG_LENGTH) {2138		ipmi_inc_stat(intf, sent_invalid_commands);2139		return -EMSGSIZE;2140	}2141 2142	daddr = (struct ipmi_ipmb_direct_addr *) addr;2143	if (daddr->rq_lun > 3 || daddr->rs_lun > 3) {2144		ipmi_inc_stat(intf, sent_invalid_commands);2145		return -EINVAL;2146	}2147 2148	smi_msg->type = IPMI_SMI_MSG_TYPE_IPMB_DIRECT;2149	smi_msg->msgid = msgid;2150 2151	if (is_cmd) {2152		smi_msg->data[0] = msg->netfn << 2 | daddr->rs_lun;2153		smi_msg->data[2] = recv_msg->msgid << 2 | daddr->rq_lun;2154	} else {2155		smi_msg->data[0] = msg->netfn << 2 | daddr->rq_lun;2156		smi_msg->data[2] = recv_msg->msgid << 2 | daddr->rs_lun;2157	}2158	smi_msg->data[1] = daddr->slave_addr;2159	smi_msg->data[3] = msg->cmd;2160 2161	memcpy(smi_msg->data + 4, msg->data, msg->data_len);2162	smi_msg->data_size = msg->data_len + 4;2163 2164	smi_msg->user_data = recv_msg;2165 2166	return 0;2167}2168 2169static int i_ipmi_req_lan(struct ipmi_smi        *intf,2170			  struct ipmi_addr       *addr,2171			  long                   msgid,2172			  struct kernel_ipmi_msg *msg,2173			  struct ipmi_smi_msg    *smi_msg,2174			  struct ipmi_recv_msg   *recv_msg,2175			  unsigned char          source_lun,2176			  int                    retries,2177			  unsigned int           retry_time_ms)2178{2179	struct ipmi_lan_addr  *lan_addr;2180	unsigned char ipmb_seq;2181	long seqid;2182	struct ipmi_channel *chans;2183	int rv = 0;2184 2185	if (addr->channel >= IPMI_MAX_CHANNELS) {2186		ipmi_inc_stat(intf, sent_invalid_commands);2187		return -EINVAL;2188	}2189 2190	chans = READ_ONCE(intf->channel_list)->c;2191 2192	if ((chans[addr->channel].medium2193				!= IPMI_CHANNEL_MEDIUM_8023LAN)2194			&& (chans[addr->channel].medium2195			    != IPMI_CHANNEL_MEDIUM_ASYNC)) {2196		ipmi_inc_stat(intf, sent_invalid_commands);2197		return -EINVAL;2198	}2199 2200	/* 11 for the header and 1 for the checksum. */2201	if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) {2202		ipmi_inc_stat(intf, sent_invalid_commands);2203		return -EMSGSIZE;2204	}2205 2206	lan_addr = (struct ipmi_lan_addr *) addr;2207	if (lan_addr->lun > 3) {2208		ipmi_inc_stat(intf, sent_invalid_commands);2209		return -EINVAL;2210	}2211 2212	memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr));2213 2214	if (recv_msg->msg.netfn & 0x1) {2215		/*2216		 * It's a response, so use the user's sequence2217		 * from msgid.2218		 */2219		ipmi_inc_stat(intf, sent_lan_responses);2220		format_lan_msg(smi_msg, msg, lan_addr, msgid,2221			       msgid, source_lun);2222 2223		/*2224		 * Save the receive message so we can use it2225		 * to deliver the response.2226		 */2227		smi_msg->user_data = recv_msg;2228	} else {2229		/* It's a command, so get a sequence for it. */2230		unsigned long flags;2231 2232		spin_lock_irqsave(&intf->seq_lock, flags);2233 2234		/*2235		 * Create a sequence number with a 1 second2236		 * timeout and 4 retries.2237		 */2238		rv = intf_next_seq(intf,2239				   recv_msg,2240				   retry_time_ms,2241				   retries,2242				   0,2243				   &ipmb_seq,2244				   &seqid);2245		if (rv)2246			/*2247			 * We have used up all the sequence numbers,2248			 * probably, so abort.2249			 */2250			goto out_err;2251 2252		ipmi_inc_stat(intf, sent_lan_commands);2253 2254		/*2255		 * Store the sequence number in the message,2256		 * so that when the send message response2257		 * comes back we can start the timer.2258		 */2259		format_lan_msg(smi_msg, msg, lan_addr,2260			       STORE_SEQ_IN_MSGID(ipmb_seq, seqid),2261			       ipmb_seq, source_lun);2262 2263		/*2264		 * Copy the message into the recv message data, so we2265		 * can retransmit it later if necessary.2266		 */2267		memcpy(recv_msg->msg_data, smi_msg->data,2268		       smi_msg->data_size);2269		recv_msg->msg.data = recv_msg->msg_data;2270		recv_msg->msg.data_len = smi_msg->data_size;2271 2272		/*2273		 * We don't unlock until here, because we need2274		 * to copy the completed message into the2275		 * recv_msg before we release the lock.2276		 * Otherwise, race conditions may bite us.  I2277		 * know that's pretty paranoid, but I prefer2278		 * to be correct.2279		 */2280out_err:2281		spin_unlock_irqrestore(&intf->seq_lock, flags);2282	}2283 2284	return rv;2285}2286 2287/*2288 * Separate from ipmi_request so that the user does not have to be2289 * supplied in certain circumstances (mainly at panic time).  If2290 * messages are supplied, they will be freed, even if an error2291 * occurs.2292 */2293static int i_ipmi_request(struct ipmi_user     *user,2294			  struct ipmi_smi      *intf,2295			  struct ipmi_addr     *addr,2296			  long                 msgid,2297			  struct kernel_ipmi_msg *msg,2298			  void                 *user_msg_data,2299			  void                 *supplied_smi,2300			  struct ipmi_recv_msg *supplied_recv,2301			  int                  priority,2302			  unsigned char        source_address,2303			  unsigned char        source_lun,2304			  int                  retries,2305			  unsigned int         retry_time_ms)2306{2307	struct ipmi_smi_msg *smi_msg;2308	struct ipmi_recv_msg *recv_msg;2309	int rv = 0;2310 2311	if (user) {2312		if (atomic_add_return(1, &user->nr_msgs) > max_msgs_per_user) {2313			/* Decrement will happen at the end of the routine. */2314			rv = -EBUSY;2315			goto out;2316		}2317	}2318 2319	if (supplied_recv)2320		recv_msg = supplied_recv;2321	else {2322		recv_msg = ipmi_alloc_recv_msg();2323		if (recv_msg == NULL) {2324			rv = -ENOMEM;2325			goto out;2326		}2327	}2328	recv_msg->user_msg_data = user_msg_data;2329 2330	if (supplied_smi)2331		smi_msg = supplied_smi;2332	else {2333		smi_msg = ipmi_alloc_smi_msg();2334		if (smi_msg == NULL) {2335			if (!supplied_recv)2336				ipmi_free_recv_msg(recv_msg);2337			rv = -ENOMEM;2338			goto out;2339		}2340	}2341 2342	rcu_read_lock();2343	if (intf->in_shutdown) {2344		rv = -ENODEV;2345		goto out_err;2346	}2347 2348	recv_msg->user = user;2349	if (user)2350		/* The put happens when the message is freed. */2351		kref_get(&user->refcount);2352	recv_msg->msgid = msgid;2353	/*2354	 * Store the message to send in the receive message so timeout2355	 * responses can get the proper response data.2356	 */2357	recv_msg->msg = *msg;2358 2359	if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {2360		rv = i_ipmi_req_sysintf(intf, addr, msgid, msg, smi_msg,2361					recv_msg, retries, retry_time_ms);2362	} else if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {2363		rv = i_ipmi_req_ipmb(intf, addr, msgid, msg, smi_msg, recv_msg,2364				     source_address, source_lun,2365				     retries, retry_time_ms);2366	} else if (is_ipmb_direct_addr(addr)) {2367		rv = i_ipmi_req_ipmb_direct(intf, addr, msgid, msg, smi_msg,2368					    recv_msg, source_lun);2369	} else if (is_lan_addr(addr)) {2370		rv = i_ipmi_req_lan(intf, addr, msgid, msg, smi_msg, recv_msg,2371				    source_lun, retries, retry_time_ms);2372	} else {2373	    /* Unknown address type. */2374		ipmi_inc_stat(intf, sent_invalid_commands);2375		rv = -EINVAL;2376	}2377 2378	if (rv) {2379out_err:2380		ipmi_free_smi_msg(smi_msg);2381		ipmi_free_recv_msg(recv_msg);2382	} else {2383		dev_dbg(intf->si_dev, "Send: %*ph\n",2384			smi_msg->data_size, smi_msg->data);2385 2386		smi_send(intf, intf->handlers, smi_msg, priority);2387	}2388	rcu_read_unlock();2389 2390out:2391	if (rv && user)2392		atomic_dec(&user->nr_msgs);2393	return rv;2394}2395 2396static int check_addr(struct ipmi_smi  *intf,2397		      struct ipmi_addr *addr,2398		      unsigned char    *saddr,2399		      unsigned char    *lun)2400{2401	if (addr->channel >= IPMI_MAX_CHANNELS)2402		return -EINVAL;2403	addr->channel = array_index_nospec(addr->channel, IPMI_MAX_CHANNELS);2404	*lun = intf->addrinfo[addr->channel].lun;2405	*saddr = intf->addrinfo[addr->channel].address;2406	return 0;2407}2408 2409int ipmi_request_settime(struct ipmi_user *user,2410			 struct ipmi_addr *addr,2411			 long             msgid,2412			 struct kernel_ipmi_msg  *msg,2413			 void             *user_msg_data,2414			 int              priority,2415			 int              retries,2416			 unsigned int     retry_time_ms)2417{2418	unsigned char saddr = 0, lun = 0;2419	int rv, index;2420 2421	if (!user)2422		return -EINVAL;2423 2424	user = acquire_ipmi_user(user, &index);2425	if (!user)2426		return -ENODEV;2427 2428	rv = check_addr(user->intf, addr, &saddr, &lun);2429	if (!rv)2430		rv = i_ipmi_request(user,2431				    user->intf,2432				    addr,2433				    msgid,2434				    msg,2435				    user_msg_data,2436				    NULL, NULL,2437				    priority,2438				    saddr,2439				    lun,2440				    retries,2441				    retry_time_ms);2442 2443	release_ipmi_user(user, index);2444	return rv;2445}2446EXPORT_SYMBOL(ipmi_request_settime);2447 2448int ipmi_request_supply_msgs(struct ipmi_user     *user,2449			     struct ipmi_addr     *addr,2450			     long                 msgid,2451			     struct kernel_ipmi_msg *msg,2452			     void                 *user_msg_data,2453			     void                 *supplied_smi,2454			     struct ipmi_recv_msg *supplied_recv,2455			     int                  priority)2456{2457	unsigned char saddr = 0, lun = 0;2458	int rv, index;2459 2460	if (!user)2461		return -EINVAL;2462 2463	user = acquire_ipmi_user(user, &index);2464	if (!user)2465		return -ENODEV;2466 2467	rv = check_addr(user->intf, addr, &saddr, &lun);2468	if (!rv)2469		rv = i_ipmi_request(user,2470				    user->intf,2471				    addr,2472				    msgid,2473				    msg,2474				    user_msg_data,2475				    supplied_smi,2476				    supplied_recv,2477				    priority,2478				    saddr,2479				    lun,2480				    -1, 0);2481 2482	release_ipmi_user(user, index);2483	return rv;2484}2485EXPORT_SYMBOL(ipmi_request_supply_msgs);2486 2487static void bmc_device_id_handler(struct ipmi_smi *intf,2488				  struct ipmi_recv_msg *msg)2489{2490	int rv;2491 2492	if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE)2493			|| (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)2494			|| (msg->msg.cmd != IPMI_GET_DEVICE_ID_CMD)) {2495		dev_warn(intf->si_dev,2496			 "invalid device_id msg: addr_type=%d netfn=%x cmd=%x\n",2497			 msg->addr.addr_type, msg->msg.netfn, msg->msg.cmd);2498		return;2499	}2500 2501	if (msg->msg.data[0]) {2502		dev_warn(intf->si_dev, "device id fetch failed: 0x%2.2x\n",2503			 msg->msg.data[0]);2504		intf->bmc->dyn_id_set = 0;2505		goto out;2506	}2507 2508	rv = ipmi_demangle_device_id(msg->msg.netfn, msg->msg.cmd,2509			msg->msg.data, msg->msg.data_len, &intf->bmc->fetch_id);2510	if (rv) {2511		dev_warn(intf->si_dev, "device id demangle failed: %d\n", rv);2512		/* record completion code when error */2513		intf->bmc->cc = msg->msg.data[0];2514		intf->bmc->dyn_id_set = 0;2515	} else {2516		/*2517		 * Make sure the id data is available before setting2518		 * dyn_id_set.2519		 */2520		smp_wmb();2521		intf->bmc->dyn_id_set = 1;2522	}2523out:2524	wake_up(&intf->waitq);2525}2526 2527static int2528send_get_device_id_cmd(struct ipmi_smi *intf)2529{2530	struct ipmi_system_interface_addr si;2531	struct kernel_ipmi_msg msg;2532 2533	si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;2534	si.channel = IPMI_BMC_CHANNEL;2535	si.lun = 0;2536 2537	msg.netfn = IPMI_NETFN_APP_REQUEST;2538	msg.cmd = IPMI_GET_DEVICE_ID_CMD;2539	msg.data = NULL;2540	msg.data_len = 0;2541 2542	return i_ipmi_request(NULL,2543			      intf,2544			      (struct ipmi_addr *) &si,2545			      0,2546			      &msg,2547			      intf,2548			      NULL,2549			      NULL,2550			      0,2551			      intf->addrinfo[0].address,2552			      intf->addrinfo[0].lun,2553			      -1, 0);2554}2555 2556static int __get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc)2557{2558	int rv;2559	unsigned int retry_count = 0;2560 2561	intf->null_user_handler = bmc_device_id_handler;2562 2563retry:2564	bmc->cc = 0;2565	bmc->dyn_id_set = 2;2566 2567	rv = send_get_device_id_cmd(intf);2568	if (rv)2569		goto out_reset_handler;2570 2571	wait_event(intf->waitq, bmc->dyn_id_set != 2);2572 2573	if (!bmc->dyn_id_set) {2574		if (bmc->cc != IPMI_CC_NO_ERROR &&2575		    ++retry_count <= GET_DEVICE_ID_MAX_RETRY) {2576			msleep(500);2577			dev_warn(intf->si_dev,2578			    "BMC returned 0x%2.2x, retry get bmc device id\n",2579			    bmc->cc);2580			goto retry;2581		}2582 2583		rv = -EIO; /* Something went wrong in the fetch. */2584	}2585 2586	/* dyn_id_set makes the id data available. */2587	smp_rmb();2588 2589out_reset_handler:2590	intf->null_user_handler = NULL;2591 2592	return rv;2593}2594 2595/*2596 * Fetch the device id for the bmc/interface.  You must pass in either2597 * bmc or intf, this code will get the other one.  If the data has2598 * been recently fetched, this will just use the cached data.  Otherwise2599 * it will run a new fetch.2600 *2601 * Except for the first time this is called (in ipmi_add_smi()),2602 * this will always return good data;2603 */2604static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,2605			       struct ipmi_device_id *id,2606			       bool *guid_set, guid_t *guid, int intf_num)2607{2608	int rv = 0;2609	int prev_dyn_id_set, prev_guid_set;2610	bool intf_set = intf != NULL;2611 2612	if (!intf) {2613		mutex_lock(&bmc->dyn_mutex);2614retry_bmc_lock:2615		if (list_empty(&bmc->intfs)) {2616			mutex_unlock(&bmc->dyn_mutex);2617			return -ENOENT;2618		}2619		intf = list_first_entry(&bmc->intfs, struct ipmi_smi,2620					bmc_link);2621		kref_get(&intf->refcount);2622		mutex_unlock(&bmc->dyn_mutex);2623		mutex_lock(&intf->bmc_reg_mutex);2624		mutex_lock(&bmc->dyn_mutex);2625		if (intf != list_first_entry(&bmc->intfs, struct ipmi_smi,2626					     bmc_link)) {2627			mutex_unlock(&intf->bmc_reg_mutex);2628			kref_put(&intf->refcount, intf_free);2629			goto retry_bmc_lock;2630		}2631	} else {2632		mutex_lock(&intf->bmc_reg_mutex);2633		bmc = intf->bmc;2634		mutex_lock(&bmc->dyn_mutex);2635		kref_get(&intf->refcount);2636	}2637 2638	/* If we have a valid and current ID, just return that. */2639	if (intf->in_bmc_register ||2640	    (bmc->dyn_id_set && time_is_after_jiffies(bmc->dyn_id_expiry)))2641		goto out_noprocessing;2642 2643	prev_guid_set = bmc->dyn_guid_set;2644	__get_guid(intf);2645 2646	prev_dyn_id_set = bmc->dyn_id_set;2647	rv = __get_device_id(intf, bmc);2648	if (rv)2649		goto out;2650 2651	/*2652	 * The guid, device id, manufacturer id, and product id should2653	 * not change on a BMC.  If it does we have to do some dancing.2654	 */2655	if (!intf->bmc_registered2656	    || (!prev_guid_set && bmc->dyn_guid_set)2657	    || (!prev_dyn_id_set && bmc->dyn_id_set)2658	    || (prev_guid_set && bmc->dyn_guid_set2659		&& !guid_equal(&bmc->guid, &bmc->fetch_guid))2660	    || bmc->id.device_id != bmc->fetch_id.device_id2661	    || bmc->id.manufacturer_id != bmc->fetch_id.manufacturer_id2662	    || bmc->id.product_id != bmc->fetch_id.product_id) {2663		struct ipmi_device_id id = bmc->fetch_id;2664		int guid_set = bmc->dyn_guid_set;2665		guid_t guid;2666 2667		guid = bmc->fetch_guid;2668		mutex_unlock(&bmc->dyn_mutex);2669 2670		__ipmi_bmc_unregister(intf);2671		/* Fill in the temporary BMC for good measure. */2672		intf->bmc->id = id;2673		intf->bmc->dyn_guid_set = guid_set;2674		intf->bmc->guid = guid;2675		if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num))2676			need_waiter(intf); /* Retry later on an error. */2677		else2678			__scan_channels(intf, &id);2679 2680 2681		if (!intf_set) {2682			/*2683			 * We weren't given the interface on the2684			 * command line, so restart the operation on2685			 * the next interface for the BMC.2686			 */2687			mutex_unlock(&intf->bmc_reg_mutex);2688			mutex_lock(&bmc->dyn_mutex);2689			goto retry_bmc_lock;2690		}2691 2692		/* We have a new BMC, set it up. */2693		bmc = intf->bmc;2694		mutex_lock(&bmc->dyn_mutex);2695		goto out_noprocessing;2696	} else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id)))2697		/* Version info changes, scan the channels again. */2698		__scan_channels(intf, &bmc->fetch_id);2699 2700	bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY;2701 2702out:2703	if (rv && prev_dyn_id_set) {2704		rv = 0; /* Ignore failures if we have previous data. */2705		bmc->dyn_id_set = prev_dyn_id_set;2706	}2707	if (!rv) {2708		bmc->id = bmc->fetch_id;2709		if (bmc->dyn_guid_set)2710			bmc->guid = bmc->fetch_guid;2711		else if (prev_guid_set)2712			/*2713			 * The guid used to be valid and it failed to fetch,2714			 * just use the cached value.2715			 */2716			bmc->dyn_guid_set = prev_guid_set;2717	}2718out_noprocessing:2719	if (!rv) {2720		if (id)2721			*id = bmc->id;2722 2723		if (guid_set)2724			*guid_set = bmc->dyn_guid_set;2725 2726		if (guid && bmc->dyn_guid_set)2727			*guid =  bmc->guid;2728	}2729 2730	mutex_unlock(&bmc->dyn_mutex);2731	mutex_unlock(&intf->bmc_reg_mutex);2732 2733	kref_put(&intf->refcount, intf_free);2734	return rv;2735}2736 2737static int bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,2738			     struct ipmi_device_id *id,2739			     bool *guid_set, guid_t *guid)2740{2741	return __bmc_get_device_id(intf, bmc, id, guid_set, guid, -1);2742}2743 2744static ssize_t device_id_show(struct device *dev,2745			      struct device_attribute *attr,2746			      char *buf)2747{2748	struct bmc_device *bmc = to_bmc_device(dev);2749	struct ipmi_device_id id;2750	int rv;2751 2752	rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);2753	if (rv)2754		return rv;2755 2756	return sysfs_emit(buf, "%u\n", id.device_id);2757}2758static DEVICE_ATTR_RO(device_id);2759 2760static ssize_t provides_device_sdrs_show(struct device *dev,2761					 struct device_attribute *attr,2762					 char *buf)2763{2764	struct bmc_device *bmc = to_bmc_device(dev);2765	struct ipmi_device_id id;2766	int rv;2767 2768	rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);2769	if (rv)2770		return rv;2771 2772	return sysfs_emit(buf, "%u\n", (id.device_revision & 0x80) >> 7);2773}2774static DEVICE_ATTR_RO(provides_device_sdrs);2775 2776static ssize_t revision_show(struct device *dev, struct device_attribute *attr,2777			     char *buf)2778{2779	struct bmc_device *bmc = to_bmc_device(dev);2780	struct ipmi_device_id id;2781	int rv;2782 2783	rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);2784	if (rv)2785		return rv;2786 2787	return sysfs_emit(buf, "%u\n", id.device_revision & 0x0F);2788}2789static DEVICE_ATTR_RO(revision);2790 2791static ssize_t firmware_revision_show(struct device *dev,2792				      struct device_attribute *attr,2793				      char *buf)2794{2795	struct bmc_device *bmc = to_bmc_device(dev);2796	struct ipmi_device_id id;2797	int rv;2798 2799	rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);2800	if (rv)2801		return rv;2802 2803	return sysfs_emit(buf, "%u.%x\n", id.firmware_revision_1,2804			id.firmware_revision_2);2805}2806static DEVICE_ATTR_RO(firmware_revision);2807 2808static ssize_t ipmi_version_show(struct device *dev,2809				 struct device_attribute *attr,2810				 char *buf)2811{2812	struct bmc_device *bmc = to_bmc_device(dev);2813	struct ipmi_device_id id;2814	int rv;2815 2816	rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);2817	if (rv)2818		return rv;2819 2820	return sysfs_emit(buf, "%u.%u\n",2821			ipmi_version_major(&id),2822			ipmi_version_minor(&id));2823}2824static DEVICE_ATTR_RO(ipmi_version);2825 2826static ssize_t add_dev_support_show(struct device *dev,2827				    struct device_attribute *attr,2828				    char *buf)2829{2830	struct bmc_device *bmc = to_bmc_device(dev);2831	struct ipmi_device_id id;2832	int rv;2833 2834	rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);2835	if (rv)2836		return rv;2837 2838	return sysfs_emit(buf, "0x%02x\n", id.additional_device_support);2839}2840static DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show,2841		   NULL);2842 2843static ssize_t manufacturer_id_show(struct device *dev,2844				    struct device_attribute *attr,2845				    char *buf)2846{2847	struct bmc_device *bmc = to_bmc_device(dev);2848	struct ipmi_device_id id;2849	int rv;2850 2851	rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);2852	if (rv)2853		return rv;2854 2855	return sysfs_emit(buf, "0x%6.6x\n", id.manufacturer_id);2856}2857static DEVICE_ATTR_RO(manufacturer_id);2858 2859static ssize_t product_id_show(struct device *dev,2860			       struct device_attribute *attr,2861			       char *buf)2862{2863	struct bmc_device *bmc = to_bmc_device(dev);2864	struct ipmi_device_id id;2865	int rv;2866 2867	rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);2868	if (rv)2869		return rv;2870 2871	return sysfs_emit(buf, "0x%4.4x\n", id.product_id);2872}2873static DEVICE_ATTR_RO(product_id);2874 2875static ssize_t aux_firmware_rev_show(struct device *dev,2876				     struct device_attribute *attr,2877				     char *buf)2878{2879	struct bmc_device *bmc = to_bmc_device(dev);2880	struct ipmi_device_id id;2881	int rv;2882 2883	rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);2884	if (rv)2885		return rv;2886 2887	return sysfs_emit(buf, "0x%02x 0x%02x 0x%02x 0x%02x\n",2888			id.aux_firmware_revision[3],2889			id.aux_firmware_revision[2],2890			id.aux_firmware_revision[1],2891			id.aux_firmware_revision[0]);2892}2893static DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL);2894 2895static ssize_t guid_show(struct device *dev, struct device_attribute *attr,2896			 char *buf)2897{2898	struct bmc_device *bmc = to_bmc_device(dev);2899	bool guid_set;2900	guid_t guid;2901	int rv;2902 2903	rv = bmc_get_device_id(NULL, bmc, NULL, &guid_set, &guid);2904	if (rv)2905		return rv;2906	if (!guid_set)2907		return -ENOENT;2908 2909	return sysfs_emit(buf, "%pUl\n", &guid);2910}2911static DEVICE_ATTR_RO(guid);2912 2913static struct attribute *bmc_dev_attrs[] = {2914	&dev_attr_device_id.attr,2915	&dev_attr_provides_device_sdrs.attr,2916	&dev_attr_revision.attr,2917	&dev_attr_firmware_revision.attr,2918	&dev_attr_ipmi_version.attr,2919	&dev_attr_additional_device_support.attr,2920	&dev_attr_manufacturer_id.attr,2921	&dev_attr_product_id.attr,2922	&dev_attr_aux_firmware_revision.attr,2923	&dev_attr_guid.attr,2924	NULL2925};2926 2927static umode_t bmc_dev_attr_is_visible(struct kobject *kobj,2928				       struct attribute *attr, int idx)2929{2930	struct device *dev = kobj_to_dev(kobj);2931	struct bmc_device *bmc = to_bmc_device(dev);2932	umode_t mode = attr->mode;2933	int rv;2934 2935	if (attr == &dev_attr_aux_firmware_revision.attr) {2936		struct ipmi_device_id id;2937 2938		rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);2939		return (!rv && id.aux_firmware_revision_set) ? mode : 0;2940	}2941	if (attr == &dev_attr_guid.attr) {2942		bool guid_set;2943 2944		rv = bmc_get_device_id(NULL, bmc, NULL, &guid_set, NULL);2945		return (!rv && guid_set) ? mode : 0;2946	}2947	return mode;2948}2949 2950static const struct attribute_group bmc_dev_attr_group = {2951	.attrs		= bmc_dev_attrs,2952	.is_visible	= bmc_dev_attr_is_visible,2953};2954 2955static const struct attribute_group *bmc_dev_attr_groups[] = {2956	&bmc_dev_attr_group,2957	NULL2958};2959 2960static const struct device_type bmc_device_type = {2961	.groups		= bmc_dev_attr_groups,2962};2963 2964static int __find_bmc_guid(struct device *dev, const void *data)2965{2966	const guid_t *guid = data;2967	struct bmc_device *bmc;2968	int rv;2969 2970	if (dev->type != &bmc_device_type)2971		return 0;2972 2973	bmc = to_bmc_device(dev);2974	rv = bmc->dyn_guid_set && guid_equal(&bmc->guid, guid);2975	if (rv)2976		rv = kref_get_unless_zero(&bmc->usecount);2977	return rv;2978}2979 2980/*2981 * Returns with the bmc's usecount incremented, if it is non-NULL.2982 */2983static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv,2984					     guid_t *guid)2985{2986	struct device *dev;2987	struct bmc_device *bmc = NULL;2988 2989	dev = driver_find_device(drv, NULL, guid, __find_bmc_guid);2990	if (dev) {2991		bmc = to_bmc_device(dev);2992		put_device(dev);2993	}2994	return bmc;2995}2996 2997struct prod_dev_id {2998	unsigned int  product_id;2999	unsigned char device_id;3000};3001 3002static int __find_bmc_prod_dev_id(struct device *dev, const void *data)3003{3004	const struct prod_dev_id *cid = data;3005	struct bmc_device *bmc;3006	int rv;3007 3008	if (dev->type != &bmc_device_type)3009		return 0;3010 3011	bmc = to_bmc_device(dev);3012	rv = (bmc->id.product_id == cid->product_id3013	      && bmc->id.device_id == cid->device_id);3014	if (rv)3015		rv = kref_get_unless_zero(&bmc->usecount);3016	return rv;3017}3018 3019/*3020 * Returns with the bmc's usecount incremented, if it is non-NULL.3021 */3022static struct bmc_device *ipmi_find_bmc_prod_dev_id(3023	struct device_driver *drv,3024	unsigned int product_id, unsigned char device_id)3025{3026	struct prod_dev_id id = {3027		.product_id = product_id,3028		.device_id = device_id,3029	};3030	struct device *dev;3031	struct bmc_device *bmc = NULL;3032 3033	dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id);3034	if (dev) {3035		bmc = to_bmc_device(dev);3036		put_device(dev);3037	}3038	return bmc;3039}3040 3041static DEFINE_IDA(ipmi_bmc_ida);3042 3043static void3044release_bmc_device(struct device *dev)3045{3046	kfree(to_bmc_device(dev));3047}3048 3049static void cleanup_bmc_work(struct work_struct *work)3050{3051	struct bmc_device *bmc = container_of(work, struct bmc_device,3052					      remove_work);3053	int id = bmc->pdev.id; /* Unregister overwrites id */3054 3055	platform_device_unregister(&bmc->pdev);3056	ida_free(&ipmi_bmc_ida, id);3057}3058 3059static void3060cleanup_bmc_device(struct kref *ref)3061{3062	struct bmc_device *bmc = container_of(ref, struct bmc_device, usecount);3063 3064	/*3065	 * Remove the platform device in a work queue to avoid issues3066	 * with removing the device attributes while reading a device3067	 * attribute.3068	 */3069	queue_work(remove_work_wq, &bmc->remove_work);3070}3071 3072/*3073 * Must be called with intf->bmc_reg_mutex held.3074 */3075static void __ipmi_bmc_unregister(struct ipmi_smi *intf)3076{3077	struct bmc_device *bmc = intf->bmc;3078 3079	if (!intf->bmc_registered)3080		return;3081 3082	sysfs_remove_link(&intf->si_dev->kobj, "bmc");3083	sysfs_remove_link(&bmc->pdev.dev.kobj, intf->my_dev_name);3084	kfree(intf->my_dev_name);3085	intf->my_dev_name = NULL;3086 3087	mutex_lock(&bmc->dyn_mutex);3088	list_del(&intf->bmc_link);3089	mutex_unlock(&bmc->dyn_mutex);3090	intf->bmc = &intf->tmp_bmc;3091	kref_put(&bmc->usecount, cleanup_bmc_device);3092	intf->bmc_registered = false;3093}3094 3095static void ipmi_bmc_unregister(struct ipmi_smi *intf)3096{3097	mutex_lock(&intf->bmc_reg_mutex);3098	__ipmi_bmc_unregister(intf);3099	mutex_unlock(&intf->bmc_reg_mutex);3100}3101 3102/*3103 * Must be called with intf->bmc_reg_mutex held.3104 */3105static int __ipmi_bmc_register(struct ipmi_smi *intf,3106			       struct ipmi_device_id *id,3107			       bool guid_set, guid_t *guid, int intf_num)3108{3109	int               rv;3110	struct bmc_device *bmc;3111	struct bmc_device *old_bmc;3112 3113	/*3114	 * platform_device_register() can cause bmc_reg_mutex to3115	 * be claimed because of the is_visible functions of3116	 * the attributes.  Eliminate possible recursion and3117	 * release the lock.3118	 */3119	intf->in_bmc_register = true;3120	mutex_unlock(&intf->bmc_reg_mutex);3121 3122	/*3123	 * Try to find if there is an bmc_device struct3124	 * representing the interfaced BMC already3125	 */3126	mutex_lock(&ipmidriver_mutex);3127	if (guid_set)3128		old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, guid);3129	else3130		old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,3131						    id->product_id,3132						    id->device_id);3133 3134	/*3135	 * If there is already an bmc_device, free the new one,3136	 * otherwise register the new BMC device3137	 */3138	if (old_bmc) {3139		bmc = old_bmc;3140		/*3141		 * Note: old_bmc already has usecount incremented by3142		 * the BMC find functions.3143		 */3144		intf->bmc = old_bmc;3145		mutex_lock(&bmc->dyn_mutex);3146		list_add_tail(&intf->bmc_link, &bmc->intfs);3147		mutex_unlock(&bmc->dyn_mutex);3148 3149		dev_info(intf->si_dev,3150			 "interfacing existing BMC (man_id: 0x%6.6x, prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",3151			 bmc->id.manufacturer_id,3152			 bmc->id.product_id,3153			 bmc->id.device_id);3154	} else {3155		bmc = kzalloc(sizeof(*bmc), GFP_KERNEL);3156		if (!bmc) {3157			rv = -ENOMEM;3158			goto out;3159		}3160		INIT_LIST_HEAD(&bmc->intfs);3161		mutex_init(&bmc->dyn_mutex);3162		INIT_WORK(&bmc->remove_work, cleanup_bmc_work);3163 3164		bmc->id = *id;3165		bmc->dyn_id_set = 1;3166		bmc->dyn_guid_set = guid_set;3167		bmc->guid = *guid;3168		bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY;3169 3170		bmc->pdev.name = "ipmi_bmc";3171 3172		rv = ida_alloc(&ipmi_bmc_ida, GFP_KERNEL);3173		if (rv < 0) {3174			kfree(bmc);3175			goto out;3176		}3177 3178		bmc->pdev.dev.driver = &ipmidriver.driver;3179		bmc->pdev.id = rv;3180		bmc->pdev.dev.release = release_bmc_device;3181		bmc->pdev.dev.type = &bmc_device_type;3182		kref_init(&bmc->usecount);3183 3184		intf->bmc = bmc;3185		mutex_lock(&bmc->dyn_mutex);3186		list_add_tail(&intf->bmc_link, &bmc->intfs);3187		mutex_unlock(&bmc->dyn_mutex);3188 3189		rv = platform_device_register(&bmc->pdev);3190		if (rv) {3191			dev_err(intf->si_dev,3192				"Unable to register bmc device: %d\n",3193				rv);3194			goto out_list_del;3195		}3196 3197		dev_info(intf->si_dev,3198			 "Found new BMC (man_id: 0x%6.6x, prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",3199			 bmc->id.manufacturer_id,3200			 bmc->id.product_id,3201			 bmc->id.device_id);3202	}3203 3204	/*3205	 * create symlink from system interface device to bmc device3206	 * and back.3207	 */3208	rv = sysfs_create_link(&intf->si_dev->kobj, &bmc->pdev.dev.kobj, "bmc");3209	if (rv) {3210		dev_err(intf->si_dev, "Unable to create bmc symlink: %d\n", rv);3211		goto out_put_bmc;3212	}3213 3214	if (intf_num == -1)3215		intf_num = intf->intf_num;3216	intf->my_dev_name = kasprintf(GFP_KERNEL, "ipmi%d", intf_num);3217	if (!intf->my_dev_name) {3218		rv = -ENOMEM;3219		dev_err(intf->si_dev, "Unable to allocate link from BMC: %d\n",3220			rv);3221		goto out_unlink1;3222	}3223 3224	rv = sysfs_create_link(&bmc->pdev.dev.kobj, &intf->si_dev->kobj,3225			       intf->my_dev_name);3226	if (rv) {3227		dev_err(intf->si_dev, "Unable to create symlink to bmc: %d\n",3228			rv);3229		goto out_free_my_dev_name;3230	}3231 3232	intf->bmc_registered = true;3233 3234out:3235	mutex_unlock(&ipmidriver_mutex);3236	mutex_lock(&intf->bmc_reg_mutex);3237	intf->in_bmc_register = false;3238	return rv;3239 3240 3241out_free_my_dev_name:3242	kfree(intf->my_dev_name);3243	intf->my_dev_name = NULL;3244 3245out_unlink1:3246	sysfs_remove_link(&intf->si_dev->kobj, "bmc");3247 3248out_put_bmc:3249	mutex_lock(&bmc->dyn_mutex);3250	list_del(&intf->bmc_link);3251	mutex_unlock(&bmc->dyn_mutex);3252	intf->bmc = &intf->tmp_bmc;3253	kref_put(&bmc->usecount, cleanup_bmc_device);3254	goto out;3255 3256out_list_del:3257	mutex_lock(&bmc->dyn_mutex);3258	list_del(&intf->bmc_link);3259	mutex_unlock(&bmc->dyn_mutex);3260	intf->bmc = &intf->tmp_bmc;3261	put_device(&bmc->pdev.dev);3262	goto out;3263}3264 3265static int3266send_guid_cmd(struct ipmi_smi *intf, int chan)3267{3268	struct kernel_ipmi_msg            msg;3269	struct ipmi_system_interface_addr si;3270 3271	si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;3272	si.channel = IPMI_BMC_CHANNEL;3273	si.lun = 0;3274 3275	msg.netfn = IPMI_NETFN_APP_REQUEST;3276	msg.cmd = IPMI_GET_DEVICE_GUID_CMD;3277	msg.data = NULL;3278	msg.data_len = 0;3279	return i_ipmi_request(NULL,3280			      intf,3281			      (struct ipmi_addr *) &si,3282			      0,3283			      &msg,3284			      intf,3285			      NULL,3286			      NULL,3287			      0,3288			      intf->addrinfo[0].address,3289			      intf->addrinfo[0].lun,3290			      -1, 0);3291}3292 3293static void guid_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)3294{3295	struct bmc_device *bmc = intf->bmc;3296 3297	if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE)3298	    || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)3299	    || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD))3300		/* Not for me */3301		return;3302 3303	if (msg->msg.data[0] != 0) {3304		/* Error from getting the GUID, the BMC doesn't have one. */3305		bmc->dyn_guid_set = 0;3306		goto out;3307	}3308 3309	if (msg->msg.data_len < UUID_SIZE + 1) {3310		bmc->dyn_guid_set = 0;3311		dev_warn(intf->si_dev,3312			 "The GUID response from the BMC was too short, it was %d but should have been %d.  Assuming GUID is not available.\n",3313			 msg->msg.data_len, UUID_SIZE + 1);3314		goto out;3315	}3316 3317	import_guid(&bmc->fetch_guid, msg->msg.data + 1);3318	/*3319	 * Make sure the guid data is available before setting3320	 * dyn_guid_set.3321	 */3322	smp_wmb();3323	bmc->dyn_guid_set = 1;3324 out:3325	wake_up(&intf->waitq);3326}3327 3328static void __get_guid(struct ipmi_smi *intf)3329{3330	int rv;3331	struct bmc_device *bmc = intf->bmc;3332 3333	bmc->dyn_guid_set = 2;3334	intf->null_user_handler = guid_handler;3335	rv = send_guid_cmd(intf, 0);3336	if (rv)3337		/* Send failed, no GUID available. */3338		bmc->dyn_guid_set = 0;3339	else3340		wait_event(intf->waitq, bmc->dyn_guid_set != 2);3341 3342	/* dyn_guid_set makes the guid data available. */3343	smp_rmb();3344 3345	intf->null_user_handler = NULL;3346}3347 3348static int3349send_channel_info_cmd(struct ipmi_smi *intf, int chan)3350{3351	struct kernel_ipmi_msg            msg;3352	unsigned char                     data[1];3353	struct ipmi_system_interface_addr si;3354 3355	si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;3356	si.channel = IPMI_BMC_CHANNEL;3357	si.lun = 0;3358 3359	msg.netfn = IPMI_NETFN_APP_REQUEST;3360	msg.cmd = IPMI_GET_CHANNEL_INFO_CMD;3361	msg.data = data;3362	msg.data_len = 1;3363	data[0] = chan;3364	return i_ipmi_request(NULL,3365			      intf,3366			      (struct ipmi_addr *) &si,3367			      0,3368			      &msg,3369			      intf,3370			      NULL,3371			      NULL,3372			      0,3373			      intf->addrinfo[0].address,3374			      intf->addrinfo[0].lun,3375			      -1, 0);3376}3377 3378static void3379channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)3380{3381	int rv = 0;3382	int ch;3383	unsigned int set = intf->curr_working_cset;3384	struct ipmi_channel *chans;3385 3386	if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)3387	    && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)3388	    && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD)) {3389		/* It's the one we want */3390		if (msg->msg.data[0] != 0) {3391			/* Got an error from the channel, just go on. */3392			if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) {3393				/*3394				 * If the MC does not support this3395				 * command, that is legal.  We just3396				 * assume it has one IPMB at channel3397				 * zero.3398				 */3399				intf->wchannels[set].c[0].medium3400					= IPMI_CHANNEL_MEDIUM_IPMB;3401				intf->wchannels[set].c[0].protocol3402					= IPMI_CHANNEL_PROTOCOL_IPMB;3403 3404				intf->channel_list = intf->wchannels + set;3405				intf->channels_ready = true;3406				wake_up(&intf->waitq);3407				goto out;3408			}3409			goto next_channel;3410		}3411		if (msg->msg.data_len < 4) {3412			/* Message not big enough, just go on. */3413			goto next_channel;3414		}3415		ch = intf->curr_channel;3416		chans = intf->wchannels[set].c;3417		chans[ch].medium = msg->msg.data[2] & 0x7f;3418		chans[ch].protocol = msg->msg.data[3] & 0x1f;3419 3420 next_channel:3421		intf->curr_channel++;3422		if (intf->curr_channel >= IPMI_MAX_CHANNELS) {3423			intf->channel_list = intf->wchannels + set;3424			intf->channels_ready = true;3425			wake_up(&intf->waitq);3426		} else {3427			intf->channel_list = intf->wchannels + set;3428			intf->channels_ready = true;3429			rv = send_channel_info_cmd(intf, intf->curr_channel);3430		}3431 3432		if (rv) {3433			/* Got an error somehow, just give up. */3434			dev_warn(intf->si_dev,3435				 "Error sending channel information for channel %d: %d\n",3436				 intf->curr_channel, rv);3437 3438			intf->channel_list = intf->wchannels + set;3439			intf->channels_ready = true;3440			wake_up(&intf->waitq);3441		}3442	}3443 out:3444	return;3445}3446 3447/*3448 * Must be holding intf->bmc_reg_mutex to call this.3449 */3450static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id)3451{3452	int rv;3453 3454	if (ipmi_version_major(id) > 13455			|| (ipmi_version_major(id) == 13456			    && ipmi_version_minor(id) >= 5)) {3457		unsigned int set;3458 3459		/*3460		 * Start scanning the channels to see what is3461		 * available.3462		 */3463		set = !intf->curr_working_cset;3464		intf->curr_working_cset = set;3465		memset(&intf->wchannels[set], 0,3466		       sizeof(struct ipmi_channel_set));3467 3468		intf->null_user_handler = channel_handler;3469		intf->curr_channel = 0;3470		rv = send_channel_info_cmd(intf, 0);3471		if (rv) {3472			dev_warn(intf->si_dev,3473				 "Error sending channel information for channel 0, %d\n",3474				 rv);3475			intf->null_user_handler = NULL;3476			return -EIO;3477		}3478 3479		/* Wait for the channel info to be read. */3480		wait_event(intf->waitq, intf->channels_ready);3481		intf->null_user_handler = NULL;3482	} else {3483		unsigned int set = intf->curr_working_cset;3484 3485		/* Assume a single IPMB channel at zero. */3486		intf->wchannels[set].c[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;3487		intf->wchannels[set].c[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB;3488		intf->channel_list = intf->wchannels + set;3489		intf->channels_ready = true;3490	}3491 3492	return 0;3493}3494 3495static void ipmi_poll(struct ipmi_smi *intf)3496{3497	if (intf->handlers->poll)3498		intf->handlers->poll(intf->send_info);3499	/* In case something came in */3500	handle_new_recv_msgs(intf);3501}3502 3503void ipmi_poll_interface(struct ipmi_user *user)3504{3505	ipmi_poll(user->intf);3506}3507EXPORT_SYMBOL(ipmi_poll_interface);3508 3509static ssize_t nr_users_show(struct device *dev,3510			     struct device_attribute *attr,3511			     char *buf)3512{3513	struct ipmi_smi *intf = container_of(attr,3514			 struct ipmi_smi, nr_users_devattr);3515 3516	return sysfs_emit(buf, "%d\n", atomic_read(&intf->nr_users));3517}3518static DEVICE_ATTR_RO(nr_users);3519 3520static ssize_t nr_msgs_show(struct device *dev,3521			    struct device_attribute *attr,3522			    char *buf)3523{3524	struct ipmi_smi *intf = container_of(attr,3525			 struct ipmi_smi, nr_msgs_devattr);3526	struct ipmi_user *user;3527	int index;3528	unsigned int count = 0;3529 3530	index = srcu_read_lock(&intf->users_srcu);3531	list_for_each_entry_rcu(user, &intf->users, link)3532		count += atomic_read(&user->nr_msgs);3533	srcu_read_unlock(&intf->users_srcu, index);3534 3535	return sysfs_emit(buf, "%u\n", count);3536}3537static DEVICE_ATTR_RO(nr_msgs);3538 3539static void redo_bmc_reg(struct work_struct *work)3540{3541	struct ipmi_smi *intf = container_of(work, struct ipmi_smi,3542					     bmc_reg_work);3543 3544	if (!intf->in_shutdown)3545		bmc_get_device_id(intf, NULL, NULL, NULL, NULL);3546 3547	kref_put(&intf->refcount, intf_free);3548}3549 3550int ipmi_add_smi(struct module         *owner,3551		 const struct ipmi_smi_handlers *handlers,3552		 void		       *send_info,3553		 struct device         *si_dev,3554		 unsigned char         slave_addr)3555{3556	int              i, j;3557	int              rv;3558	struct ipmi_smi *intf, *tintf;3559	struct list_head *link;3560	struct ipmi_device_id id;3561 3562	/*3563	 * Make sure the driver is actually initialized, this handles3564	 * problems with initialization order.3565	 */3566	rv = ipmi_init_msghandler();3567	if (rv)3568		return rv;3569 3570	intf = kzalloc(sizeof(*intf), GFP_KERNEL);3571	if (!intf)3572		return -ENOMEM;3573 3574	rv = init_srcu_struct(&intf->users_srcu);3575	if (rv) {3576		kfree(intf);3577		return rv;3578	}3579 3580	intf->owner = owner;3581	intf->bmc = &intf->tmp_bmc;3582	INIT_LIST_HEAD(&intf->bmc->intfs);3583	mutex_init(&intf->bmc->dyn_mutex);3584	INIT_LIST_HEAD(&intf->bmc_link);3585	mutex_init(&intf->bmc_reg_mutex);3586	intf->intf_num = -1; /* Mark it invalid for now. */3587	kref_init(&intf->refcount);3588	INIT_WORK(&intf->bmc_reg_work, redo_bmc_reg);3589	intf->si_dev = si_dev;3590	for (j = 0; j < IPMI_MAX_CHANNELS; j++) {3591		intf->addrinfo[j].address = IPMI_BMC_SLAVE_ADDR;3592		intf->addrinfo[j].lun = 2;3593	}3594	if (slave_addr != 0)3595		intf->addrinfo[0].address = slave_addr;3596	INIT_LIST_HEAD(&intf->users);3597	atomic_set(&intf->nr_users, 0);3598	intf->handlers = handlers;3599	intf->send_info = send_info;3600	spin_lock_init(&intf->seq_lock);3601	for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) {3602		intf->seq_table[j].inuse = 0;3603		intf->seq_table[j].seqid = 0;3604	}3605	intf->curr_seq = 0;3606	spin_lock_init(&intf->waiting_rcv_msgs_lock);3607	INIT_LIST_HEAD(&intf->waiting_rcv_msgs);3608	INIT_WORK(&intf->recv_work, smi_recv_work);3609	atomic_set(&intf->watchdog_pretimeouts_to_deliver, 0);3610	spin_lock_init(&intf->xmit_msgs_lock);3611	INIT_LIST_HEAD(&intf->xmit_msgs);3612	INIT_LIST_HEAD(&intf->hp_xmit_msgs);3613	spin_lock_init(&intf->events_lock);3614	spin_lock_init(&intf->watch_lock);3615	atomic_set(&intf->event_waiters, 0);3616	intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;3617	INIT_LIST_HEAD(&intf->waiting_events);3618	intf->waiting_events_count = 0;3619	mutex_init(&intf->cmd_rcvrs_mutex);3620	spin_lock_init(&intf->maintenance_mode_lock);3621	INIT_LIST_HEAD(&intf->cmd_rcvrs);3622	init_waitqueue_head(&intf->waitq);3623	for (i = 0; i < IPMI_NUM_STATS; i++)3624		atomic_set(&intf->stats[i], 0);3625 3626	mutex_lock(&ipmi_interfaces_mutex);3627	/* Look for a hole in the numbers. */3628	i = 0;3629	link = &ipmi_interfaces;3630	list_for_each_entry_rcu(tintf, &ipmi_interfaces, link,3631				ipmi_interfaces_mutex_held()) {3632		if (tintf->intf_num != i) {3633			link = &tintf->link;3634			break;3635		}3636		i++;3637	}3638	/* Add the new interface in numeric order. */3639	if (i == 0)3640		list_add_rcu(&intf->link, &ipmi_interfaces);3641	else3642		list_add_tail_rcu(&intf->link, link);3643 3644	rv = handlers->start_processing(send_info, intf);3645	if (rv)3646		goto out_err;3647 3648	rv = __bmc_get_device_id(intf, NULL, &id, NULL, NULL, i);3649	if (rv) {3650		dev_err(si_dev, "Unable to get the device id: %d\n", rv);3651		goto out_err_started;3652	}3653 3654	mutex_lock(&intf->bmc_reg_mutex);3655	rv = __scan_channels(intf, &id);3656	mutex_unlock(&intf->bmc_reg_mutex);3657	if (rv)3658		goto out_err_bmc_reg;3659 3660	intf->nr_users_devattr = dev_attr_nr_users;3661	sysfs_attr_init(&intf->nr_users_devattr.attr);3662	rv = device_create_file(intf->si_dev, &intf->nr_users_devattr);3663	if (rv)3664		goto out_err_bmc_reg;3665 3666	intf->nr_msgs_devattr = dev_attr_nr_msgs;3667	sysfs_attr_init(&intf->nr_msgs_devattr.attr);3668	rv = device_create_file(intf->si_dev, &intf->nr_msgs_devattr);3669	if (rv) {3670		device_remove_file(intf->si_dev, &intf->nr_users_devattr);3671		goto out_err_bmc_reg;3672	}3673 3674	/*3675	 * Keep memory order straight for RCU readers.  Make3676	 * sure everything else is committed to memory before3677	 * setting intf_num to mark the interface valid.3678	 */3679	smp_wmb();3680	intf->intf_num = i;3681	mutex_unlock(&ipmi_interfaces_mutex);3682 3683	/* After this point the interface is legal to use. */3684	call_smi_watchers(i, intf->si_dev);3685 3686	return 0;3687 3688 out_err_bmc_reg:3689	ipmi_bmc_unregister(intf);3690 out_err_started:3691	if (intf->handlers->shutdown)3692		intf->handlers->shutdown(intf->send_info);3693 out_err:3694	list_del_rcu(&intf->link);3695	mutex_unlock(&ipmi_interfaces_mutex);3696	synchronize_srcu(&ipmi_interfaces_srcu);3697	cleanup_srcu_struct(&intf->users_srcu);3698	kref_put(&intf->refcount, intf_free);3699 3700	return rv;3701}3702EXPORT_SYMBOL(ipmi_add_smi);3703 3704static void deliver_smi_err_response(struct ipmi_smi *intf,3705				     struct ipmi_smi_msg *msg,3706				     unsigned char err)3707{3708	int rv;3709	msg->rsp[0] = msg->data[0] | 4;3710	msg->rsp[1] = msg->data[1];3711	msg->rsp[2] = err;3712	msg->rsp_size = 3;3713 3714	/* This will never requeue, but it may ask us to free the message. */3715	rv = handle_one_recv_msg(intf, msg);3716	if (rv == 0)3717		ipmi_free_smi_msg(msg);3718}3719 3720static void cleanup_smi_msgs(struct ipmi_smi *intf)3721{3722	int              i;3723	struct seq_table *ent;3724	struct ipmi_smi_msg *msg;3725	struct list_head *entry;3726	struct list_head tmplist;3727 3728	/* Clear out our transmit queues and hold the messages. */3729	INIT_LIST_HEAD(&tmplist);3730	list_splice_tail(&intf->hp_xmit_msgs, &tmplist);3731	list_splice_tail(&intf->xmit_msgs, &tmplist);3732 3733	/* Current message first, to preserve order */3734	while (intf->curr_msg && !list_empty(&intf->waiting_rcv_msgs)) {3735		/* Wait for the message to clear out. */3736		schedule_timeout(1);3737	}3738 3739	/* No need for locks, the interface is down. */3740 3741	/*3742	 * Return errors for all pending messages in queue and in the3743	 * tables waiting for remote responses.3744	 */3745	while (!list_empty(&tmplist)) {3746		entry = tmplist.next;3747		list_del(entry);3748		msg = list_entry(entry, struct ipmi_smi_msg, link);3749		deliver_smi_err_response(intf, msg, IPMI_ERR_UNSPECIFIED);3750	}3751 3752	for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {3753		ent = &intf->seq_table[i];3754		if (!ent->inuse)3755			continue;3756		deliver_err_response(intf, ent->recv_msg, IPMI_ERR_UNSPECIFIED);3757	}3758}3759 3760void ipmi_unregister_smi(struct ipmi_smi *intf)3761{3762	struct ipmi_smi_watcher *w;3763	int intf_num, index;3764 3765	if (!intf)3766		return;3767	intf_num = intf->intf_num;3768	mutex_lock(&ipmi_interfaces_mutex);3769	intf->intf_num = -1;3770	intf->in_shutdown = true;3771	list_del_rcu(&intf->link);3772	mutex_unlock(&ipmi_interfaces_mutex);3773	synchronize_srcu(&ipmi_interfaces_srcu);3774 3775	/* At this point no users can be added to the interface. */3776 3777	device_remove_file(intf->si_dev, &intf->nr_msgs_devattr);3778	device_remove_file(intf->si_dev, &intf->nr_users_devattr);3779 3780	/*3781	 * Call all the watcher interfaces to tell them that3782	 * an interface is going away.3783	 */3784	mutex_lock(&smi_watchers_mutex);3785	list_for_each_entry(w, &smi_watchers, link)3786		w->smi_gone(intf_num);3787	mutex_unlock(&smi_watchers_mutex);3788 3789	index = srcu_read_lock(&intf->users_srcu);3790	while (!list_empty(&intf->users)) {3791		struct ipmi_user *user =3792			container_of(list_next_rcu(&intf->users),3793				     struct ipmi_user, link);3794 3795		_ipmi_destroy_user(user);3796	}3797	srcu_read_unlock(&intf->users_srcu, index);3798 3799	if (intf->handlers->shutdown)3800		intf->handlers->shutdown(intf->send_info);3801 3802	cleanup_smi_msgs(intf);3803 3804	ipmi_bmc_unregister(intf);3805 3806	cleanup_srcu_struct(&intf->users_srcu);3807	kref_put(&intf->refcount, intf_free);3808}3809EXPORT_SYMBOL(ipmi_unregister_smi);3810 3811static int handle_ipmb_get_msg_rsp(struct ipmi_smi *intf,3812				   struct ipmi_smi_msg *msg)3813{3814	struct ipmi_ipmb_addr ipmb_addr;3815	struct ipmi_recv_msg  *recv_msg;3816 3817	/*3818	 * This is 11, not 10, because the response must contain a3819	 * completion code.3820	 */3821	if (msg->rsp_size < 11) {3822		/* Message not big enough, just ignore it. */3823		ipmi_inc_stat(intf, invalid_ipmb_responses);3824		return 0;3825	}3826 3827	if (msg->rsp[2] != 0) {3828		/* An error getting the response, just ignore it. */3829		return 0;3830	}3831 3832	ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE;3833	ipmb_addr.slave_addr = msg->rsp[6];3834	ipmb_addr.channel = msg->rsp[3] & 0x0f;3835	ipmb_addr.lun = msg->rsp[7] & 3;3836 3837	/*3838	 * It's a response from a remote entity.  Look up the sequence3839	 * number and handle the response.3840	 */3841	if (intf_find_seq(intf,3842			  msg->rsp[7] >> 2,3843			  msg->rsp[3] & 0x0f,3844			  msg->rsp[8],3845			  (msg->rsp[4] >> 2) & (~1),3846			  (struct ipmi_addr *) &ipmb_addr,3847			  &recv_msg)) {3848		/*3849		 * We were unable to find the sequence number,3850		 * so just nuke the message.3851		 */3852		ipmi_inc_stat(intf, unhandled_ipmb_responses);3853		return 0;3854	}3855 3856	memcpy(recv_msg->msg_data, &msg->rsp[9], msg->rsp_size - 9);3857	/*3858	 * The other fields matched, so no need to set them, except3859	 * for netfn, which needs to be the response that was3860	 * returned, not the request value.3861	 */3862	recv_msg->msg.netfn = msg->rsp[4] >> 2;3863	recv_msg->msg.data = recv_msg->msg_data;3864	recv_msg->msg.data_len = msg->rsp_size - 10;3865	recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;3866	if (deliver_response(intf, recv_msg))3867		ipmi_inc_stat(intf, unhandled_ipmb_responses);3868	else3869		ipmi_inc_stat(intf, handled_ipmb_responses);3870 3871	return 0;3872}3873 3874static int handle_ipmb_get_msg_cmd(struct ipmi_smi *intf,3875				   struct ipmi_smi_msg *msg)3876{3877	struct cmd_rcvr          *rcvr;3878	int                      rv = 0;3879	unsigned char            netfn;3880	unsigned char            cmd;3881	unsigned char            chan;3882	struct ipmi_user         *user = NULL;3883	struct ipmi_ipmb_addr    *ipmb_addr;3884	struct ipmi_recv_msg     *recv_msg;3885 3886	if (msg->rsp_size < 10) {3887		/* Message not big enough, just ignore it. */3888		ipmi_inc_stat(intf, invalid_commands);3889		return 0;3890	}3891 3892	if (msg->rsp[2] != 0) {3893		/* An error getting the response, just ignore it. */3894		return 0;3895	}3896 3897	netfn = msg->rsp[4] >> 2;3898	cmd = msg->rsp[8];3899	chan = msg->rsp[3] & 0xf;3900 3901	rcu_read_lock();3902	rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);3903	if (rcvr) {3904		user = rcvr->user;3905		kref_get(&user->refcount);3906	} else3907		user = NULL;3908	rcu_read_unlock();3909 3910	if (user == NULL) {3911		/* We didn't find a user, deliver an error response. */3912		ipmi_inc_stat(intf, unhandled_commands);3913 3914		msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);3915		msg->data[1] = IPMI_SEND_MSG_CMD;3916		msg->data[2] = msg->rsp[3];3917		msg->data[3] = msg->rsp[6];3918		msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3);3919		msg->data[5] = ipmb_checksum(&msg->data[3], 2);3920		msg->data[6] = intf->addrinfo[msg->rsp[3] & 0xf].address;3921		/* rqseq/lun */3922		msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3);3923		msg->data[8] = msg->rsp[8]; /* cmd */3924		msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE;3925		msg->data[10] = ipmb_checksum(&msg->data[6], 4);3926		msg->data_size = 11;3927 3928		dev_dbg(intf->si_dev, "Invalid command: %*ph\n",3929			msg->data_size, msg->data);3930 3931		rcu_read_lock();3932		if (!intf->in_shutdown) {3933			smi_send(intf, intf->handlers, msg, 0);3934			/*3935			 * We used the message, so return the value3936			 * that causes it to not be freed or3937			 * queued.3938			 */3939			rv = -1;3940		}3941		rcu_read_unlock();3942	} else {3943		recv_msg = ipmi_alloc_recv_msg();3944		if (!recv_msg) {3945			/*3946			 * We couldn't allocate memory for the3947			 * message, so requeue it for handling3948			 * later.3949			 */3950			rv = 1;3951			kref_put(&user->refcount, free_user);3952		} else {3953			/* Extract the source address from the data. */3954			ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;3955			ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE;3956			ipmb_addr->slave_addr = msg->rsp[6];3957			ipmb_addr->lun = msg->rsp[7] & 3;3958			ipmb_addr->channel = msg->rsp[3] & 0xf;3959 3960			/*3961			 * Extract the rest of the message information3962			 * from the IPMB header.3963			 */3964			recv_msg->user = user;3965			recv_msg->recv_type = IPMI_CMD_RECV_TYPE;3966			recv_msg->msgid = msg->rsp[7] >> 2;3967			recv_msg->msg.netfn = msg->rsp[4] >> 2;3968			recv_msg->msg.cmd = msg->rsp[8];3969			recv_msg->msg.data = recv_msg->msg_data;3970 3971			/*3972			 * We chop off 10, not 9 bytes because the checksum3973			 * at the end also needs to be removed.3974			 */3975			recv_msg->msg.data_len = msg->rsp_size - 10;3976			memcpy(recv_msg->msg_data, &msg->rsp[9],3977			       msg->rsp_size - 10);3978			if (deliver_response(intf, recv_msg))3979				ipmi_inc_stat(intf, unhandled_commands);3980			else3981				ipmi_inc_stat(intf, handled_commands);3982		}3983	}3984 3985	return rv;3986}3987 3988static int handle_ipmb_direct_rcv_cmd(struct ipmi_smi *intf,3989				      struct ipmi_smi_msg *msg)3990{3991	struct cmd_rcvr          *rcvr;3992	int                      rv = 0;3993	struct ipmi_user         *user = NULL;3994	struct ipmi_ipmb_direct_addr *daddr;3995	struct ipmi_recv_msg     *recv_msg;3996	unsigned char netfn = msg->rsp[0] >> 2;3997	unsigned char cmd = msg->rsp[3];3998 3999	rcu_read_lock();4000	/* We always use channel 0 for direct messages. */4001	rcvr = find_cmd_rcvr(intf, netfn, cmd, 0);4002	if (rcvr) {4003		user = rcvr->user;4004		kref_get(&user->refcount);4005	} else4006		user = NULL;4007	rcu_read_unlock();4008 4009	if (user == NULL) {4010		/* We didn't find a user, deliver an error response. */4011		ipmi_inc_stat(intf, unhandled_commands);4012 4013		msg->data[0] = (netfn + 1) << 2;4014		msg->data[0] |= msg->rsp[2] & 0x3; /* rqLUN */4015		msg->data[1] = msg->rsp[1]; /* Addr */4016		msg->data[2] = msg->rsp[2] & ~0x3; /* rqSeq */4017		msg->data[2] |= msg->rsp[0] & 0x3; /* rsLUN */4018		msg->data[3] = cmd;4019		msg->data[4] = IPMI_INVALID_CMD_COMPLETION_CODE;4020		msg->data_size = 5;4021 4022		rcu_read_lock();4023		if (!intf->in_shutdown) {4024			smi_send(intf, intf->handlers, msg, 0);4025			/*4026			 * We used the message, so return the value4027			 * that causes it to not be freed or4028			 * queued.4029			 */4030			rv = -1;4031		}4032		rcu_read_unlock();4033	} else {4034		recv_msg = ipmi_alloc_recv_msg();4035		if (!recv_msg) {4036			/*4037			 * We couldn't allocate memory for the4038			 * message, so requeue it for handling4039			 * later.4040			 */4041			rv = 1;4042			kref_put(&user->refcount, free_user);4043		} else {4044			/* Extract the source address from the data. */4045			daddr = (struct ipmi_ipmb_direct_addr *)&recv_msg->addr;4046			daddr->addr_type = IPMI_IPMB_DIRECT_ADDR_TYPE;4047			daddr->channel = 0;4048			daddr->slave_addr = msg->rsp[1];4049			daddr->rs_lun = msg->rsp[0] & 3;4050			daddr->rq_lun = msg->rsp[2] & 3;4051 4052			/*4053			 * Extract the rest of the message information4054			 * from the IPMB header.4055			 */4056			recv_msg->user = user;4057			recv_msg->recv_type = IPMI_CMD_RECV_TYPE;4058			recv_msg->msgid = (msg->rsp[2] >> 2);4059			recv_msg->msg.netfn = msg->rsp[0] >> 2;4060			recv_msg->msg.cmd = msg->rsp[3];4061			recv_msg->msg.data = recv_msg->msg_data;4062 4063			recv_msg->msg.data_len = msg->rsp_size - 4;4064			memcpy(recv_msg->msg_data, msg->rsp + 4,4065			       msg->rsp_size - 4);4066			if (deliver_response(intf, recv_msg))4067				ipmi_inc_stat(intf, unhandled_commands);4068			else4069				ipmi_inc_stat(intf, handled_commands);4070		}4071	}4072 4073	return rv;4074}4075 4076static int handle_ipmb_direct_rcv_rsp(struct ipmi_smi *intf,4077				      struct ipmi_smi_msg *msg)4078{4079	struct ipmi_recv_msg *recv_msg;4080	struct ipmi_ipmb_direct_addr *daddr;4081 4082	recv_msg = msg->user_data;4083	if (recv_msg == NULL) {4084		dev_warn(intf->si_dev,4085			 "IPMI direct message received with no owner. This could be because of a malformed message, or because of a hardware error.  Contact your hardware vendor for assistance.\n");4086		return 0;4087	}4088 4089	recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;4090	recv_msg->msgid = msg->msgid;4091	daddr = (struct ipmi_ipmb_direct_addr *) &recv_msg->addr;4092	daddr->addr_type = IPMI_IPMB_DIRECT_ADDR_TYPE;4093	daddr->channel = 0;4094	daddr->slave_addr = msg->rsp[1];4095	daddr->rq_lun = msg->rsp[0] & 3;4096	daddr->rs_lun = msg->rsp[2] & 3;4097	recv_msg->msg.netfn = msg->rsp[0] >> 2;4098	recv_msg->msg.cmd = msg->rsp[3];4099	memcpy(recv_msg->msg_data, &msg->rsp[4], msg->rsp_size - 4);4100	recv_msg->msg.data = recv_msg->msg_data;4101	recv_msg->msg.data_len = msg->rsp_size - 4;4102	deliver_local_response(intf, recv_msg);4103 4104	return 0;4105}4106 4107static int handle_lan_get_msg_rsp(struct ipmi_smi *intf,4108				  struct ipmi_smi_msg *msg)4109{4110	struct ipmi_lan_addr  lan_addr;4111	struct ipmi_recv_msg  *recv_msg;4112 4113 4114	/*4115	 * This is 13, not 12, because the response must contain a4116	 * completion code.4117	 */4118	if (msg->rsp_size < 13) {4119		/* Message not big enough, just ignore it. */4120		ipmi_inc_stat(intf, invalid_lan_responses);4121		return 0;4122	}4123 4124	if (msg->rsp[2] != 0) {4125		/* An error getting the response, just ignore it. */4126		return 0;4127	}4128 4129	lan_addr.addr_type = IPMI_LAN_ADDR_TYPE;4130	lan_addr.session_handle = msg->rsp[4];4131	lan_addr.remote_SWID = msg->rsp[8];4132	lan_addr.local_SWID = msg->rsp[5];4133	lan_addr.channel = msg->rsp[3] & 0x0f;4134	lan_addr.privilege = msg->rsp[3] >> 4;4135	lan_addr.lun = msg->rsp[9] & 3;4136 4137	/*4138	 * It's a response from a remote entity.  Look up the sequence4139	 * number and handle the response.4140	 */4141	if (intf_find_seq(intf,4142			  msg->rsp[9] >> 2,4143			  msg->rsp[3] & 0x0f,4144			  msg->rsp[10],4145			  (msg->rsp[6] >> 2) & (~1),4146			  (struct ipmi_addr *) &lan_addr,4147			  &recv_msg)) {4148		/*4149		 * We were unable to find the sequence number,4150		 * so just nuke the message.4151		 */4152		ipmi_inc_stat(intf, unhandled_lan_responses);4153		return 0;4154	}4155 4156	memcpy(recv_msg->msg_data, &msg->rsp[11], msg->rsp_size - 11);4157	/*4158	 * The other fields matched, so no need to set them, except4159	 * for netfn, which needs to be the response that was4160	 * returned, not the request value.4161	 */4162	recv_msg->msg.netfn = msg->rsp[6] >> 2;4163	recv_msg->msg.data = recv_msg->msg_data;4164	recv_msg->msg.data_len = msg->rsp_size - 12;4165	recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;4166	if (deliver_response(intf, recv_msg))4167		ipmi_inc_stat(intf, unhandled_lan_responses);4168	else4169		ipmi_inc_stat(intf, handled_lan_responses);4170 4171	return 0;4172}4173 4174static int handle_lan_get_msg_cmd(struct ipmi_smi *intf,4175				  struct ipmi_smi_msg *msg)4176{4177	struct cmd_rcvr          *rcvr;4178	int                      rv = 0;4179	unsigned char            netfn;4180	unsigned char            cmd;4181	unsigned char            chan;4182	struct ipmi_user         *user = NULL;4183	struct ipmi_lan_addr     *lan_addr;4184	struct ipmi_recv_msg     *recv_msg;4185 4186	if (msg->rsp_size < 12) {4187		/* Message not big enough, just ignore it. */4188		ipmi_inc_stat(intf, invalid_commands);4189		return 0;4190	}4191 4192	if (msg->rsp[2] != 0) {4193		/* An error getting the response, just ignore it. */4194		return 0;4195	}4196 4197	netfn = msg->rsp[6] >> 2;4198	cmd = msg->rsp[10];4199	chan = msg->rsp[3] & 0xf;4200 4201	rcu_read_lock();4202	rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);4203	if (rcvr) {4204		user = rcvr->user;4205		kref_get(&user->refcount);4206	} else4207		user = NULL;4208	rcu_read_unlock();4209 4210	if (user == NULL) {4211		/* We didn't find a user, just give up. */4212		ipmi_inc_stat(intf, unhandled_commands);4213 4214		/*4215		 * Don't do anything with these messages, just allow4216		 * them to be freed.4217		 */4218		rv = 0;4219	} else {4220		recv_msg = ipmi_alloc_recv_msg();4221		if (!recv_msg) {4222			/*4223			 * We couldn't allocate memory for the4224			 * message, so requeue it for handling later.4225			 */4226			rv = 1;4227			kref_put(&user->refcount, free_user);4228		} else {4229			/* Extract the source address from the data. */4230			lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;4231			lan_addr->addr_type = IPMI_LAN_ADDR_TYPE;4232			lan_addr->session_handle = msg->rsp[4];4233			lan_addr->remote_SWID = msg->rsp[8];4234			lan_addr->local_SWID = msg->rsp[5];4235			lan_addr->lun = msg->rsp[9] & 3;4236			lan_addr->channel = msg->rsp[3] & 0xf;4237			lan_addr->privilege = msg->rsp[3] >> 4;4238 4239			/*4240			 * Extract the rest of the message information4241			 * from the IPMB header.4242			 */4243			recv_msg->user = user;4244			recv_msg->recv_type = IPMI_CMD_RECV_TYPE;4245			recv_msg->msgid = msg->rsp[9] >> 2;4246			recv_msg->msg.netfn = msg->rsp[6] >> 2;4247			recv_msg->msg.cmd = msg->rsp[10];4248			recv_msg->msg.data = recv_msg->msg_data;4249 4250			/*4251			 * We chop off 12, not 11 bytes because the checksum4252			 * at the end also needs to be removed.4253			 */4254			recv_msg->msg.data_len = msg->rsp_size - 12;4255			memcpy(recv_msg->msg_data, &msg->rsp[11],4256			       msg->rsp_size - 12);4257			if (deliver_response(intf, recv_msg))4258				ipmi_inc_stat(intf, unhandled_commands);4259			else4260				ipmi_inc_stat(intf, handled_commands);4261		}4262	}4263 4264	return rv;4265}4266 4267/*4268 * This routine will handle "Get Message" command responses with4269 * channels that use an OEM Medium. The message format belongs to4270 * the OEM.  See IPMI 2.0 specification, Chapter 6 and4271 * Chapter 22, sections 22.6 and 22.24 for more details.4272 */4273static int handle_oem_get_msg_cmd(struct ipmi_smi *intf,4274				  struct ipmi_smi_msg *msg)4275{4276	struct cmd_rcvr       *rcvr;4277	int                   rv = 0;4278	unsigned char         netfn;4279	unsigned char         cmd;4280	unsigned char         chan;4281	struct ipmi_user *user = NULL;4282	struct ipmi_system_interface_addr *smi_addr;4283	struct ipmi_recv_msg  *recv_msg;4284 4285	/*4286	 * We expect the OEM SW to perform error checking4287	 * so we just do some basic sanity checks4288	 */4289	if (msg->rsp_size < 4) {4290		/* Message not big enough, just ignore it. */4291		ipmi_inc_stat(intf, invalid_commands);4292		return 0;4293	}4294 4295	if (msg->rsp[2] != 0) {4296		/* An error getting the response, just ignore it. */4297		return 0;4298	}4299 4300	/*4301	 * This is an OEM Message so the OEM needs to know how4302	 * handle the message. We do no interpretation.4303	 */4304	netfn = msg->rsp[0] >> 2;4305	cmd = msg->rsp[1];4306	chan = msg->rsp[3] & 0xf;4307 4308	rcu_read_lock();4309	rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);4310	if (rcvr) {4311		user = rcvr->user;4312		kref_get(&user->refcount);4313	} else4314		user = NULL;4315	rcu_read_unlock();4316 4317	if (user == NULL) {4318		/* We didn't find a user, just give up. */4319		ipmi_inc_stat(intf, unhandled_commands);4320 4321		/*4322		 * Don't do anything with these messages, just allow4323		 * them to be freed.4324		 */4325 4326		rv = 0;4327	} else {4328		recv_msg = ipmi_alloc_recv_msg();4329		if (!recv_msg) {4330			/*4331			 * We couldn't allocate memory for the4332			 * message, so requeue it for handling4333			 * later.4334			 */4335			rv = 1;4336			kref_put(&user->refcount, free_user);4337		} else {4338			/*4339			 * OEM Messages are expected to be delivered via4340			 * the system interface to SMS software.  We might4341			 * need to visit this again depending on OEM4342			 * requirements4343			 */4344			smi_addr = ((struct ipmi_system_interface_addr *)4345				    &recv_msg->addr);4346			smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;4347			smi_addr->channel = IPMI_BMC_CHANNEL;4348			smi_addr->lun = msg->rsp[0] & 3;4349 4350			recv_msg->user = user;4351			recv_msg->user_msg_data = NULL;4352			recv_msg->recv_type = IPMI_OEM_RECV_TYPE;4353			recv_msg->msg.netfn = msg->rsp[0] >> 2;4354			recv_msg->msg.cmd = msg->rsp[1];4355			recv_msg->msg.data = recv_msg->msg_data;4356 4357			/*4358			 * The message starts at byte 4 which follows the4359			 * Channel Byte in the "GET MESSAGE" command4360			 */4361			recv_msg->msg.data_len = msg->rsp_size - 4;4362			memcpy(recv_msg->msg_data, &msg->rsp[4],4363			       msg->rsp_size - 4);4364			if (deliver_response(intf, recv_msg))4365				ipmi_inc_stat(intf, unhandled_commands);4366			else4367				ipmi_inc_stat(intf, handled_commands);4368		}4369	}4370 4371	return rv;4372}4373 4374static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg,4375				     struct ipmi_smi_msg  *msg)4376{4377	struct ipmi_system_interface_addr *smi_addr;4378 4379	recv_msg->msgid = 0;4380	smi_addr = (struct ipmi_system_interface_addr *) &recv_msg->addr;4381	smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;4382	smi_addr->channel = IPMI_BMC_CHANNEL;4383	smi_addr->lun = msg->rsp[0] & 3;4384	recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE;4385	recv_msg->msg.netfn = msg->rsp[0] >> 2;4386	recv_msg->msg.cmd = msg->rsp[1];4387	memcpy(recv_msg->msg_data, &msg->rsp[3], msg->rsp_size - 3);4388	recv_msg->msg.data = recv_msg->msg_data;4389	recv_msg->msg.data_len = msg->rsp_size - 3;4390}4391 4392static int handle_read_event_rsp(struct ipmi_smi *intf,4393				 struct ipmi_smi_msg *msg)4394{4395	struct ipmi_recv_msg *recv_msg, *recv_msg2;4396	struct list_head     msgs;4397	struct ipmi_user     *user;4398	int rv = 0, deliver_count = 0, index;4399	unsigned long        flags;4400 4401	if (msg->rsp_size < 19) {4402		/* Message is too small to be an IPMB event. */4403		ipmi_inc_stat(intf, invalid_events);4404		return 0;4405	}4406 4407	if (msg->rsp[2] != 0) {4408		/* An error getting the event, just ignore it. */4409		return 0;4410	}4411 4412	INIT_LIST_HEAD(&msgs);4413 4414	spin_lock_irqsave(&intf->events_lock, flags);4415 4416	ipmi_inc_stat(intf, events);4417 4418	/*4419	 * Allocate and fill in one message for every user that is4420	 * getting events.4421	 */4422	index = srcu_read_lock(&intf->users_srcu);4423	list_for_each_entry_rcu(user, &intf->users, link) {4424		if (!user->gets_events)4425			continue;4426 4427		recv_msg = ipmi_alloc_recv_msg();4428		if (!recv_msg) {4429			rcu_read_unlock();4430			list_for_each_entry_safe(recv_msg, recv_msg2, &msgs,4431						 link) {4432				list_del(&recv_msg->link);4433				ipmi_free_recv_msg(recv_msg);4434			}4435			/*4436			 * We couldn't allocate memory for the4437			 * message, so requeue it for handling4438			 * later.4439			 */4440			rv = 1;4441			goto out;4442		}4443 4444		deliver_count++;4445 4446		copy_event_into_recv_msg(recv_msg, msg);4447		recv_msg->user = user;4448		kref_get(&user->refcount);4449		list_add_tail(&recv_msg->link, &msgs);4450	}4451	srcu_read_unlock(&intf->users_srcu, index);4452 4453	if (deliver_count) {4454		/* Now deliver all the messages. */4455		list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {4456			list_del(&recv_msg->link);4457			deliver_local_response(intf, recv_msg);4458		}4459	} else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) {4460		/*4461		 * No one to receive the message, put it in queue if there's4462		 * not already too many things in the queue.4463		 */4464		recv_msg = ipmi_alloc_recv_msg();4465		if (!recv_msg) {4466			/*4467			 * We couldn't allocate memory for the4468			 * message, so requeue it for handling4469			 * later.4470			 */4471			rv = 1;4472			goto out;4473		}4474 4475		copy_event_into_recv_msg(recv_msg, msg);4476		list_add_tail(&recv_msg->link, &intf->waiting_events);4477		intf->waiting_events_count++;4478	} else if (!intf->event_msg_printed) {4479		/*4480		 * There's too many things in the queue, discard this4481		 * message.4482		 */4483		dev_warn(intf->si_dev,4484			 "Event queue full, discarding incoming events\n");4485		intf->event_msg_printed = 1;4486	}4487 4488 out:4489	spin_unlock_irqrestore(&intf->events_lock, flags);4490 4491	return rv;4492}4493 4494static int handle_bmc_rsp(struct ipmi_smi *intf,4495			  struct ipmi_smi_msg *msg)4496{4497	struct ipmi_recv_msg *recv_msg;4498	struct ipmi_system_interface_addr *smi_addr;4499 4500	recv_msg = msg->user_data;4501	if (recv_msg == NULL) {4502		dev_warn(intf->si_dev,4503			 "IPMI SMI message received with no owner. This could be because of a malformed message, or because of a hardware error.  Contact your hardware vendor for assistance.\n");4504		return 0;4505	}4506 4507	recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;4508	recv_msg->msgid = msg->msgid;4509	smi_addr = ((struct ipmi_system_interface_addr *)4510		    &recv_msg->addr);4511	smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;4512	smi_addr->channel = IPMI_BMC_CHANNEL;4513	smi_addr->lun = msg->rsp[0] & 3;4514	recv_msg->msg.netfn = msg->rsp[0] >> 2;4515	recv_msg->msg.cmd = msg->rsp[1];4516	memcpy(recv_msg->msg_data, &msg->rsp[2], msg->rsp_size - 2);4517	recv_msg->msg.data = recv_msg->msg_data;4518	recv_msg->msg.data_len = msg->rsp_size - 2;4519	deliver_local_response(intf, recv_msg);4520 4521	return 0;4522}4523 4524/*4525 * Handle a received message.  Return 1 if the message should be requeued,4526 * 0 if the message should be freed, or -1 if the message should not4527 * be freed or requeued.4528 */4529static int handle_one_recv_msg(struct ipmi_smi *intf,4530			       struct ipmi_smi_msg *msg)4531{4532	int requeue = 0;4533	int chan;4534	unsigned char cc;4535	bool is_cmd = !((msg->rsp[0] >> 2) & 1);4536 4537	dev_dbg(intf->si_dev, "Recv: %*ph\n", msg->rsp_size, msg->rsp);4538 4539	if (msg->rsp_size < 2) {4540		/* Message is too small to be correct. */4541		dev_warn(intf->si_dev,4542			 "BMC returned too small a message for netfn %x cmd %x, got %d bytes\n",4543			 (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size);4544 4545return_unspecified:4546		/* Generate an error response for the message. */4547		msg->rsp[0] = msg->data[0] | (1 << 2);4548		msg->rsp[1] = msg->data[1];4549		msg->rsp[2] = IPMI_ERR_UNSPECIFIED;4550		msg->rsp_size = 3;4551	} else if (msg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) {4552		/* commands must have at least 4 bytes, responses 5. */4553		if (is_cmd && (msg->rsp_size < 4)) {4554			ipmi_inc_stat(intf, invalid_commands);4555			goto out;4556		}4557		if (!is_cmd && (msg->rsp_size < 5)) {4558			ipmi_inc_stat(intf, invalid_ipmb_responses);4559			/* Construct a valid error response. */4560			msg->rsp[0] = msg->data[0] & 0xfc; /* NetFN */4561			msg->rsp[0] |= (1 << 2); /* Make it a response */4562			msg->rsp[0] |= msg->data[2] & 3; /* rqLUN */4563			msg->rsp[1] = msg->data[1]; /* Addr */4564			msg->rsp[2] = msg->data[2] & 0xfc; /* rqSeq */4565			msg->rsp[2] |= msg->data[0] & 0x3; /* rsLUN */4566			msg->rsp[3] = msg->data[3]; /* Cmd */4567			msg->rsp[4] = IPMI_ERR_UNSPECIFIED;4568			msg->rsp_size = 5;4569		}4570	} else if ((msg->data_size >= 2)4571	    && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))4572	    && (msg->data[1] == IPMI_SEND_MSG_CMD)4573	    && (msg->user_data == NULL)) {4574 4575		if (intf->in_shutdown)4576			goto out;4577 4578		/*4579		 * This is the local response to a command send, start4580		 * the timer for these.  The user_data will not be4581		 * NULL if this is a response send, and we will let4582		 * response sends just go through.4583		 */4584 4585		/*4586		 * Check for errors, if we get certain errors (ones4587		 * that mean basically we can try again later), we4588		 * ignore them and start the timer.  Otherwise we4589		 * report the error immediately.4590		 */4591		if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)4592		    && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)4593		    && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)4594		    && (msg->rsp[2] != IPMI_BUS_ERR)4595		    && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {4596			int ch = msg->rsp[3] & 0xf;4597			struct ipmi_channel *chans;4598 4599			/* Got an error sending the message, handle it. */4600 4601			chans = READ_ONCE(intf->channel_list)->c;4602			if ((chans[ch].medium == IPMI_CHANNEL_MEDIUM_8023LAN)4603			    || (chans[ch].medium == IPMI_CHANNEL_MEDIUM_ASYNC))4604				ipmi_inc_stat(intf, sent_lan_command_errs);4605			else4606				ipmi_inc_stat(intf, sent_ipmb_command_errs);4607			intf_err_seq(intf, msg->msgid, msg->rsp[2]);4608		} else4609			/* The message was sent, start the timer. */4610			intf_start_seq_timer(intf, msg->msgid);4611		requeue = 0;4612		goto out;4613	} else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1))4614		   || (msg->rsp[1] != msg->data[1])) {4615		/*4616		 * The NetFN and Command in the response is not even4617		 * marginally correct.4618		 */4619		dev_warn(intf->si_dev,4620			 "BMC returned incorrect response, expected netfn %x cmd %x, got netfn %x cmd %x\n",4621			 (msg->data[0] >> 2) | 1, msg->data[1],4622			 msg->rsp[0] >> 2, msg->rsp[1]);4623 4624		goto return_unspecified;4625	}4626 4627	if (msg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) {4628		if ((msg->data[0] >> 2) & 1) {4629			/* It's a response to a sent response. */4630			chan = 0;4631			cc = msg->rsp[4];4632			goto process_response_response;4633		}4634		if (is_cmd)4635			requeue = handle_ipmb_direct_rcv_cmd(intf, msg);4636		else4637			requeue = handle_ipmb_direct_rcv_rsp(intf, msg);4638	} else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))4639		   && (msg->rsp[1] == IPMI_SEND_MSG_CMD)4640		   && (msg->user_data != NULL)) {4641		/*4642		 * It's a response to a response we sent.  For this we4643		 * deliver a send message response to the user.4644		 */4645		struct ipmi_recv_msg *recv_msg;4646 4647		chan = msg->data[2] & 0x0f;4648		if (chan >= IPMI_MAX_CHANNELS)4649			/* Invalid channel number */4650			goto out;4651		cc = msg->rsp[2];4652 4653process_response_response:4654		recv_msg = msg->user_data;4655 4656		requeue = 0;4657		if (!recv_msg)4658			goto out;4659 4660		recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE;4661		recv_msg->msg.data = recv_msg->msg_data;4662		recv_msg->msg_data[0] = cc;4663		recv_msg->msg.data_len = 1;4664		deliver_local_response(intf, recv_msg);4665	} else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))4666		   && (msg->rsp[1] == IPMI_GET_MSG_CMD)) {4667		struct ipmi_channel   *chans;4668 4669		/* It's from the receive queue. */4670		chan = msg->rsp[3] & 0xf;4671		if (chan >= IPMI_MAX_CHANNELS) {4672			/* Invalid channel number */4673			requeue = 0;4674			goto out;4675		}4676 4677		/*4678		 * We need to make sure the channels have been initialized.4679		 * The channel_handler routine will set the "curr_channel"4680		 * equal to or greater than IPMI_MAX_CHANNELS when all the4681		 * channels for this interface have been initialized.4682		 */4683		if (!intf->channels_ready) {4684			requeue = 0; /* Throw the message away */4685			goto out;4686		}4687 4688		chans = READ_ONCE(intf->channel_list)->c;4689 4690		switch (chans[chan].medium) {4691		case IPMI_CHANNEL_MEDIUM_IPMB:4692			if (msg->rsp[4] & 0x04) {4693				/*4694				 * It's a response, so find the4695				 * requesting message and send it up.4696				 */4697				requeue = handle_ipmb_get_msg_rsp(intf, msg);4698			} else {4699				/*4700				 * It's a command to the SMS from some other4701				 * entity.  Handle that.4702				 */4703				requeue = handle_ipmb_get_msg_cmd(intf, msg);4704			}4705			break;4706 4707		case IPMI_CHANNEL_MEDIUM_8023LAN:4708		case IPMI_CHANNEL_MEDIUM_ASYNC:4709			if (msg->rsp[6] & 0x04) {4710				/*4711				 * It's a response, so find the4712				 * requesting message and send it up.4713				 */4714				requeue = handle_lan_get_msg_rsp(intf, msg);4715			} else {4716				/*4717				 * It's a command to the SMS from some other4718				 * entity.  Handle that.4719				 */4720				requeue = handle_lan_get_msg_cmd(intf, msg);4721			}4722			break;4723 4724		default:4725			/* Check for OEM Channels.  Clients had better4726			   register for these commands. */4727			if ((chans[chan].medium >= IPMI_CHANNEL_MEDIUM_OEM_MIN)4728			    && (chans[chan].medium4729				<= IPMI_CHANNEL_MEDIUM_OEM_MAX)) {4730				requeue = handle_oem_get_msg_cmd(intf, msg);4731			} else {4732				/*4733				 * We don't handle the channel type, so just4734				 * free the message.4735				 */4736				requeue = 0;4737			}4738		}4739 4740	} else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))4741		   && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD)) {4742		/* It's an asynchronous event. */4743		requeue = handle_read_event_rsp(intf, msg);4744	} else {4745		/* It's a response from the local BMC. */4746		requeue = handle_bmc_rsp(intf, msg);4747	}4748 4749 out:4750	return requeue;4751}4752 4753/*4754 * If there are messages in the queue or pretimeouts, handle them.4755 */4756static void handle_new_recv_msgs(struct ipmi_smi *intf)4757{4758	struct ipmi_smi_msg  *smi_msg;4759	unsigned long        flags = 0;4760	int                  rv;4761	int                  run_to_completion = intf->run_to_completion;4762 4763	/* See if any waiting messages need to be processed. */4764	if (!run_to_completion)4765		spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);4766	while (!list_empty(&intf->waiting_rcv_msgs)) {4767		smi_msg = list_entry(intf->waiting_rcv_msgs.next,4768				     struct ipmi_smi_msg, link);4769		list_del(&smi_msg->link);4770		if (!run_to_completion)4771			spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,4772					       flags);4773		rv = handle_one_recv_msg(intf, smi_msg);4774		if (!run_to_completion)4775			spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);4776		if (rv > 0) {4777			/*4778			 * To preserve message order, quit if we4779			 * can't handle a message.  Add the message4780			 * back at the head, this is safe because this4781			 * workqueue is the only thing that pulls the4782			 * messages.4783			 */4784			list_add(&smi_msg->link, &intf->waiting_rcv_msgs);4785			break;4786		} else {4787			if (rv == 0)4788				/* Message handled */4789				ipmi_free_smi_msg(smi_msg);4790			/* If rv < 0, fatal error, del but don't free. */4791		}4792	}4793	if (!run_to_completion)4794		spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, flags);4795 4796	/*4797	 * If the pretimout count is non-zero, decrement one from it and4798	 * deliver pretimeouts to all the users.4799	 */4800	if (atomic_add_unless(&intf->watchdog_pretimeouts_to_deliver, -1, 0)) {4801		struct ipmi_user *user;4802		int index;4803 4804		index = srcu_read_lock(&intf->users_srcu);4805		list_for_each_entry_rcu(user, &intf->users, link) {4806			if (user->handler->ipmi_watchdog_pretimeout)4807				user->handler->ipmi_watchdog_pretimeout(4808					user->handler_data);4809		}4810		srcu_read_unlock(&intf->users_srcu, index);4811	}4812}4813 4814static void smi_recv_work(struct work_struct *t)4815{4816	unsigned long flags = 0; /* keep us warning-free. */4817	struct ipmi_smi *intf = from_work(intf, t, recv_work);4818	int run_to_completion = intf->run_to_completion;4819	struct ipmi_smi_msg *newmsg = NULL;4820 4821	/*4822	 * Start the next message if available.4823	 *4824	 * Do this here, not in the actual receiver, because we may deadlock4825	 * because the lower layer is allowed to hold locks while calling4826	 * message delivery.4827	 */4828 4829	rcu_read_lock();4830 4831	if (!run_to_completion)4832		spin_lock_irqsave(&intf->xmit_msgs_lock, flags);4833	if (intf->curr_msg == NULL && !intf->in_shutdown) {4834		struct list_head *entry = NULL;4835 4836		/* Pick the high priority queue first. */4837		if (!list_empty(&intf->hp_xmit_msgs))4838			entry = intf->hp_xmit_msgs.next;4839		else if (!list_empty(&intf->xmit_msgs))4840			entry = intf->xmit_msgs.next;4841 4842		if (entry) {4843			list_del(entry);4844			newmsg = list_entry(entry, struct ipmi_smi_msg, link);4845			intf->curr_msg = newmsg;4846		}4847	}4848 4849	if (!run_to_completion)4850		spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);4851	if (newmsg)4852		intf->handlers->sender(intf->send_info, newmsg);4853 4854	rcu_read_unlock();4855 4856	handle_new_recv_msgs(intf);4857}4858 4859/* Handle a new message from the lower layer. */4860void ipmi_smi_msg_received(struct ipmi_smi *intf,4861			   struct ipmi_smi_msg *msg)4862{4863	unsigned long flags = 0; /* keep us warning-free. */4864	int run_to_completion = intf->run_to_completion;4865 4866	/*4867	 * To preserve message order, we keep a queue and deliver from4868	 * a workqueue.4869	 */4870	if (!run_to_completion)4871		spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);4872	list_add_tail(&msg->link, &intf->waiting_rcv_msgs);4873	if (!run_to_completion)4874		spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,4875				       flags);4876 4877	if (!run_to_completion)4878		spin_lock_irqsave(&intf->xmit_msgs_lock, flags);4879	/*4880	 * We can get an asynchronous event or receive message in addition4881	 * to commands we send.4882	 */4883	if (msg == intf->curr_msg)4884		intf->curr_msg = NULL;4885	if (!run_to_completion)4886		spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);4887 4888	if (run_to_completion)4889		smi_recv_work(&intf->recv_work);4890	else4891		queue_work(system_bh_wq, &intf->recv_work);4892}4893EXPORT_SYMBOL(ipmi_smi_msg_received);4894 4895void ipmi_smi_watchdog_pretimeout(struct ipmi_smi *intf)4896{4897	if (intf->in_shutdown)4898		return;4899 4900	atomic_set(&intf->watchdog_pretimeouts_to_deliver, 1);4901	queue_work(system_bh_wq, &intf->recv_work);4902}4903EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout);4904 4905static struct ipmi_smi_msg *4906smi_from_recv_msg(struct ipmi_smi *intf, struct ipmi_recv_msg *recv_msg,4907		  unsigned char seq, long seqid)4908{4909	struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg();4910	if (!smi_msg)4911		/*4912		 * If we can't allocate the message, then just return, we4913		 * get 4 retries, so this should be ok.4914		 */4915		return NULL;4916 4917	memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len);4918	smi_msg->data_size = recv_msg->msg.data_len;4919	smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);4920 4921	dev_dbg(intf->si_dev, "Resend: %*ph\n",4922		smi_msg->data_size, smi_msg->data);4923 4924	return smi_msg;4925}4926 4927static void check_msg_timeout(struct ipmi_smi *intf, struct seq_table *ent,4928			      struct list_head *timeouts,4929			      unsigned long timeout_period,4930			      int slot, unsigned long *flags,4931			      bool *need_timer)4932{4933	struct ipmi_recv_msg *msg;4934 4935	if (intf->in_shutdown)4936		return;4937 4938	if (!ent->inuse)4939		return;4940 4941	if (timeout_period < ent->timeout) {4942		ent->timeout -= timeout_period;4943		*need_timer = true;4944		return;4945	}4946 4947	if (ent->retries_left == 0) {4948		/* The message has used all its retries. */4949		ent->inuse = 0;4950		smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);4951		msg = ent->recv_msg;4952		list_add_tail(&msg->link, timeouts);4953		if (ent->broadcast)4954			ipmi_inc_stat(intf, timed_out_ipmb_broadcasts);4955		else if (is_lan_addr(&ent->recv_msg->addr))4956			ipmi_inc_stat(intf, timed_out_lan_commands);4957		else4958			ipmi_inc_stat(intf, timed_out_ipmb_commands);4959	} else {4960		struct ipmi_smi_msg *smi_msg;4961		/* More retries, send again. */4962 4963		*need_timer = true;4964 4965		/*4966		 * Start with the max timer, set to normal timer after4967		 * the message is sent.4968		 */4969		ent->timeout = MAX_MSG_TIMEOUT;4970		ent->retries_left--;4971		smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot,4972					    ent->seqid);4973		if (!smi_msg) {4974			if (is_lan_addr(&ent->recv_msg->addr))4975				ipmi_inc_stat(intf,4976					      dropped_rexmit_lan_commands);4977			else4978				ipmi_inc_stat(intf,4979					      dropped_rexmit_ipmb_commands);4980			return;4981		}4982 4983		spin_unlock_irqrestore(&intf->seq_lock, *flags);4984 4985		/*4986		 * Send the new message.  We send with a zero4987		 * priority.  It timed out, I doubt time is that4988		 * critical now, and high priority messages are really4989		 * only for messages to the local MC, which don't get4990		 * resent.4991		 */4992		if (intf->handlers) {4993			if (is_lan_addr(&ent->recv_msg->addr))4994				ipmi_inc_stat(intf,4995					      retransmitted_lan_commands);4996			else4997				ipmi_inc_stat(intf,4998					      retransmitted_ipmb_commands);4999 5000			smi_send(intf, intf->handlers, smi_msg, 0);5001		} else5002			ipmi_free_smi_msg(smi_msg);5003 5004		spin_lock_irqsave(&intf->seq_lock, *flags);5005	}5006}5007 5008static bool ipmi_timeout_handler(struct ipmi_smi *intf,5009				 unsigned long timeout_period)5010{5011	struct list_head     timeouts;5012	struct ipmi_recv_msg *msg, *msg2;5013	unsigned long        flags;5014	int                  i;5015	bool                 need_timer = false;5016 5017	if (!intf->bmc_registered) {5018		kref_get(&intf->refcount);5019		if (!schedule_work(&intf->bmc_reg_work)) {5020			kref_put(&intf->refcount, intf_free);5021			need_timer = true;5022		}5023	}5024 5025	/*5026	 * Go through the seq table and find any messages that5027	 * have timed out, putting them in the timeouts5028	 * list.5029	 */5030	INIT_LIST_HEAD(&timeouts);5031	spin_lock_irqsave(&intf->seq_lock, flags);5032	if (intf->ipmb_maintenance_mode_timeout) {5033		if (intf->ipmb_maintenance_mode_timeout <= timeout_period)5034			intf->ipmb_maintenance_mode_timeout = 0;5035		else5036			intf->ipmb_maintenance_mode_timeout -= timeout_period;5037	}5038	for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)5039		check_msg_timeout(intf, &intf->seq_table[i],5040				  &timeouts, timeout_period, i,5041				  &flags, &need_timer);5042	spin_unlock_irqrestore(&intf->seq_lock, flags);5043 5044	list_for_each_entry_safe(msg, msg2, &timeouts, link)5045		deliver_err_response(intf, msg, IPMI_TIMEOUT_COMPLETION_CODE);5046 5047	/*5048	 * Maintenance mode handling.  Check the timeout5049	 * optimistically before we claim the lock.  It may5050	 * mean a timeout gets missed occasionally, but that5051	 * only means the timeout gets extended by one period5052	 * in that case.  No big deal, and it avoids the lock5053	 * most of the time.5054	 */5055	if (intf->auto_maintenance_timeout > 0) {5056		spin_lock_irqsave(&intf->maintenance_mode_lock, flags);5057		if (intf->auto_maintenance_timeout > 0) {5058			intf->auto_maintenance_timeout5059				-= timeout_period;5060			if (!intf->maintenance_mode5061			    && (intf->auto_maintenance_timeout <= 0)) {5062				intf->maintenance_mode_enable = false;5063				maintenance_mode_update(intf);5064			}5065		}5066		spin_unlock_irqrestore(&intf->maintenance_mode_lock,5067				       flags);5068	}5069 5070	queue_work(system_bh_wq, &intf->recv_work);5071 5072	return need_timer;5073}5074 5075static void ipmi_request_event(struct ipmi_smi *intf)5076{5077	/* No event requests when in maintenance mode. */5078	if (intf->maintenance_mode_enable)5079		return;5080 5081	if (!intf->in_shutdown)5082		intf->handlers->request_events(intf->send_info);5083}5084 5085static struct timer_list ipmi_timer;5086 5087static atomic_t stop_operation;5088 5089static void ipmi_timeout(struct timer_list *unused)5090{5091	struct ipmi_smi *intf;5092	bool need_timer = false;5093	int index;5094 5095	if (atomic_read(&stop_operation))5096		return;5097 5098	index = srcu_read_lock(&ipmi_interfaces_srcu);5099	list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {5100		if (atomic_read(&intf->event_waiters)) {5101			intf->ticks_to_req_ev--;5102			if (intf->ticks_to_req_ev == 0) {5103				ipmi_request_event(intf);5104				intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;5105			}5106			need_timer = true;5107		}5108 5109		need_timer |= ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME);5110	}5111	srcu_read_unlock(&ipmi_interfaces_srcu, index);5112 5113	if (need_timer)5114		mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);5115}5116 5117static void need_waiter(struct ipmi_smi *intf)5118{5119	/* Racy, but worst case we start the timer twice. */5120	if (!timer_pending(&ipmi_timer))5121		mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);5122}5123 5124static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0);5125static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);5126 5127static void free_smi_msg(struct ipmi_smi_msg *msg)5128{5129	atomic_dec(&smi_msg_inuse_count);5130	/* Try to keep as much stuff out of the panic path as possible. */5131	if (!oops_in_progress)5132		kfree(msg);5133}5134 5135struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)5136{5137	struct ipmi_smi_msg *rv;5138	rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC);5139	if (rv) {5140		rv->done = free_smi_msg;5141		rv->user_data = NULL;5142		rv->type = IPMI_SMI_MSG_TYPE_NORMAL;5143		atomic_inc(&smi_msg_inuse_count);5144	}5145	return rv;5146}5147EXPORT_SYMBOL(ipmi_alloc_smi_msg);5148 5149static void free_recv_msg(struct ipmi_recv_msg *msg)5150{5151	atomic_dec(&recv_msg_inuse_count);5152	/* Try to keep as much stuff out of the panic path as possible. */5153	if (!oops_in_progress)5154		kfree(msg);5155}5156 5157static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)5158{5159	struct ipmi_recv_msg *rv;5160 5161	rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC);5162	if (rv) {5163		rv->user = NULL;5164		rv->done = free_recv_msg;5165		atomic_inc(&recv_msg_inuse_count);5166	}5167	return rv;5168}5169 5170void ipmi_free_recv_msg(struct ipmi_recv_msg *msg)5171{5172	if (msg->user && !oops_in_progress)5173		kref_put(&msg->user->refcount, free_user);5174	msg->done(msg);5175}5176EXPORT_SYMBOL(ipmi_free_recv_msg);5177 5178static atomic_t panic_done_count = ATOMIC_INIT(0);5179 5180static void dummy_smi_done_handler(struct ipmi_smi_msg *msg)5181{5182	atomic_dec(&panic_done_count);5183}5184 5185static void dummy_recv_done_handler(struct ipmi_recv_msg *msg)5186{5187	atomic_dec(&panic_done_count);5188}5189 5190/*5191 * Inside a panic, send a message and wait for a response.5192 */5193static void ipmi_panic_request_and_wait(struct ipmi_smi *intf,5194					struct ipmi_addr *addr,5195					struct kernel_ipmi_msg *msg)5196{5197	struct ipmi_smi_msg  smi_msg;5198	struct ipmi_recv_msg recv_msg;5199	int rv;5200 5201	smi_msg.done = dummy_smi_done_handler;5202	recv_msg.done = dummy_recv_done_handler;5203	atomic_add(2, &panic_done_count);5204	rv = i_ipmi_request(NULL,5205			    intf,5206			    addr,5207			    0,5208			    msg,5209			    intf,5210			    &smi_msg,5211			    &recv_msg,5212			    0,5213			    intf->addrinfo[0].address,5214			    intf->addrinfo[0].lun,5215			    0, 1); /* Don't retry, and don't wait. */5216	if (rv)5217		atomic_sub(2, &panic_done_count);5218	else if (intf->handlers->flush_messages)5219		intf->handlers->flush_messages(intf->send_info);5220 5221	while (atomic_read(&panic_done_count) != 0)5222		ipmi_poll(intf);5223}5224 5225static void event_receiver_fetcher(struct ipmi_smi *intf,5226				   struct ipmi_recv_msg *msg)5227{5228	if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)5229	    && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE)5230	    && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD)5231	    && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {5232		/* A get event receiver command, save it. */5233		intf->event_receiver = msg->msg.data[1];5234		intf->event_receiver_lun = msg->msg.data[2] & 0x3;5235	}5236}5237 5238static void device_id_fetcher(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)5239{5240	if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)5241	    && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)5242	    && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD)5243	    && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {5244		/*5245		 * A get device id command, save if we are an event5246		 * receiver or generator.5247		 */5248		intf->local_sel_device = (msg->msg.data[6] >> 2) & 1;5249		intf->local_event_generator = (msg->msg.data[6] >> 5) & 1;5250	}5251}5252 5253static void send_panic_events(struct ipmi_smi *intf, char *str)5254{5255	struct kernel_ipmi_msg msg;5256	unsigned char data[16];5257	struct ipmi_system_interface_addr *si;5258	struct ipmi_addr addr;5259	char *p = str;5260	struct ipmi_ipmb_addr *ipmb;5261	int j;5262 5263	if (ipmi_send_panic_event == IPMI_SEND_PANIC_EVENT_NONE)5264		return;5265 5266	si = (struct ipmi_system_interface_addr *) &addr;5267	si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;5268	si->channel = IPMI_BMC_CHANNEL;5269	si->lun = 0;5270 5271	/* Fill in an event telling that we have failed. */5272	msg.netfn = 0x04; /* Sensor or Event. */5273	msg.cmd = 2; /* Platform event command. */5274	msg.data = data;5275	msg.data_len = 8;5276	data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */5277	data[1] = 0x03; /* This is for IPMI 1.0. */5278	data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */5279	data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */5280	data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */5281 5282	/*5283	 * Put a few breadcrumbs in.  Hopefully later we can add more things5284	 * to make the panic events more useful.5285	 */5286	if (str) {5287		data[3] = str[0];5288		data[6] = str[1];5289		data[7] = str[2];5290	}5291 5292	/* Send the event announcing the panic. */5293	ipmi_panic_request_and_wait(intf, &addr, &msg);5294 5295	/*5296	 * On every interface, dump a bunch of OEM event holding the5297	 * string.5298	 */5299	if (ipmi_send_panic_event != IPMI_SEND_PANIC_EVENT_STRING || !str)5300		return;5301 5302	/*5303	 * intf_num is used as an marker to tell if the5304	 * interface is valid.  Thus we need a read barrier to5305	 * make sure data fetched before checking intf_num5306	 * won't be used.5307	 */5308	smp_rmb();5309 5310	/*5311	 * First job here is to figure out where to send the5312	 * OEM events.  There's no way in IPMI to send OEM5313	 * events using an event send command, so we have to5314	 * find the SEL to put them in and stick them in5315	 * there.5316	 */5317 5318	/* Get capabilities from the get device id. */5319	intf->local_sel_device = 0;5320	intf->local_event_generator = 0;5321	intf->event_receiver = 0;5322 5323	/* Request the device info from the local MC. */5324	msg.netfn = IPMI_NETFN_APP_REQUEST;5325	msg.cmd = IPMI_GET_DEVICE_ID_CMD;5326	msg.data = NULL;5327	msg.data_len = 0;5328	intf->null_user_handler = device_id_fetcher;5329	ipmi_panic_request_and_wait(intf, &addr, &msg);5330 5331	if (intf->local_event_generator) {5332		/* Request the event receiver from the local MC. */5333		msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST;5334		msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD;5335		msg.data = NULL;5336		msg.data_len = 0;5337		intf->null_user_handler = event_receiver_fetcher;5338		ipmi_panic_request_and_wait(intf, &addr, &msg);5339	}5340	intf->null_user_handler = NULL;5341 5342	/*5343	 * Validate the event receiver.  The low bit must not5344	 * be 1 (it must be a valid IPMB address), it cannot5345	 * be zero, and it must not be my address.5346	 */5347	if (((intf->event_receiver & 1) == 0)5348	    && (intf->event_receiver != 0)5349	    && (intf->event_receiver != intf->addrinfo[0].address)) {5350		/*5351		 * The event receiver is valid, send an IPMB5352		 * message.5353		 */5354		ipmb = (struct ipmi_ipmb_addr *) &addr;5355		ipmb->addr_type = IPMI_IPMB_ADDR_TYPE;5356		ipmb->channel = 0; /* FIXME - is this right? */5357		ipmb->lun = intf->event_receiver_lun;5358		ipmb->slave_addr = intf->event_receiver;5359	} else if (intf->local_sel_device) {5360		/*5361		 * The event receiver was not valid (or was5362		 * me), but I am an SEL device, just dump it5363		 * in my SEL.5364		 */5365		si = (struct ipmi_system_interface_addr *) &addr;5366		si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;5367		si->channel = IPMI_BMC_CHANNEL;5368		si->lun = 0;5369	} else5370		return; /* No where to send the event. */5371 5372	msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */5373	msg.cmd = IPMI_ADD_SEL_ENTRY_CMD;5374	msg.data = data;5375	msg.data_len = 16;5376 5377	j = 0;5378	while (*p) {5379		int size = strnlen(p, 11);5380 5381		data[0] = 0;5382		data[1] = 0;5383		data[2] = 0xf0; /* OEM event without timestamp. */5384		data[3] = intf->addrinfo[0].address;5385		data[4] = j++; /* sequence # */5386 5387		memcpy_and_pad(data+5, 11, p, size, '\0');5388		p += size;5389 5390		ipmi_panic_request_and_wait(intf, &addr, &msg);5391	}5392}5393 5394static int has_panicked;5395 5396static int panic_event(struct notifier_block *this,5397		       unsigned long         event,5398		       void                  *ptr)5399{5400	struct ipmi_smi *intf;5401	struct ipmi_user *user;5402 5403	if (has_panicked)5404		return NOTIFY_DONE;5405	has_panicked = 1;5406 5407	/* For every registered interface, set it to run to completion. */5408	list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {5409		if (!intf->handlers || intf->intf_num == -1)5410			/* Interface is not ready. */5411			continue;5412 5413		if (!intf->handlers->poll)5414			continue;5415 5416		/*5417		 * If we were interrupted while locking xmit_msgs_lock or5418		 * waiting_rcv_msgs_lock, the corresponding list may be5419		 * corrupted.  In this case, drop items on the list for5420		 * the safety.5421		 */5422		if (!spin_trylock(&intf->xmit_msgs_lock)) {5423			INIT_LIST_HEAD(&intf->xmit_msgs);5424			INIT_LIST_HEAD(&intf->hp_xmit_msgs);5425		} else5426			spin_unlock(&intf->xmit_msgs_lock);5427 5428		if (!spin_trylock(&intf->waiting_rcv_msgs_lock))5429			INIT_LIST_HEAD(&intf->waiting_rcv_msgs);5430		else5431			spin_unlock(&intf->waiting_rcv_msgs_lock);5432 5433		intf->run_to_completion = 1;5434		if (intf->handlers->set_run_to_completion)5435			intf->handlers->set_run_to_completion(intf->send_info,5436							      1);5437 5438		list_for_each_entry_rcu(user, &intf->users, link) {5439			if (user->handler->ipmi_panic_handler)5440				user->handler->ipmi_panic_handler(5441					user->handler_data);5442		}5443 5444		send_panic_events(intf, ptr);5445	}5446 5447	return NOTIFY_DONE;5448}5449 5450/* Must be called with ipmi_interfaces_mutex held. */5451static int ipmi_register_driver(void)5452{5453	int rv;5454 5455	if (drvregistered)5456		return 0;5457 5458	rv = driver_register(&ipmidriver.driver);5459	if (rv)5460		pr_err("Could not register IPMI driver\n");5461	else5462		drvregistered = true;5463	return rv;5464}5465 5466static struct notifier_block panic_block = {5467	.notifier_call	= panic_event,5468	.next		= NULL,5469	.priority	= 200	/* priority: INT_MAX >= x >= 0 */5470};5471 5472static int ipmi_init_msghandler(void)5473{5474	int rv;5475 5476	mutex_lock(&ipmi_interfaces_mutex);5477	rv = ipmi_register_driver();5478	if (rv)5479		goto out;5480	if (initialized)5481		goto out;5482 5483	rv = init_srcu_struct(&ipmi_interfaces_srcu);5484	if (rv)5485		goto out;5486 5487	remove_work_wq = create_singlethread_workqueue("ipmi-msghandler-remove-wq");5488	if (!remove_work_wq) {5489		pr_err("unable to create ipmi-msghandler-remove-wq workqueue");5490		rv = -ENOMEM;5491		goto out_wq;5492	}5493 5494	timer_setup(&ipmi_timer, ipmi_timeout, 0);5495	mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);5496 5497	atomic_notifier_chain_register(&panic_notifier_list, &panic_block);5498 5499	initialized = true;5500 5501out_wq:5502	if (rv)5503		cleanup_srcu_struct(&ipmi_interfaces_srcu);5504out:5505	mutex_unlock(&ipmi_interfaces_mutex);5506	return rv;5507}5508 5509static int __init ipmi_init_msghandler_mod(void)5510{5511	int rv;5512 5513	pr_info("version " IPMI_DRIVER_VERSION "\n");5514 5515	mutex_lock(&ipmi_interfaces_mutex);5516	rv = ipmi_register_driver();5517	mutex_unlock(&ipmi_interfaces_mutex);5518 5519	return rv;5520}5521 5522static void __exit cleanup_ipmi(void)5523{5524	int count;5525 5526	if (initialized) {5527		destroy_workqueue(remove_work_wq);5528 5529		atomic_notifier_chain_unregister(&panic_notifier_list,5530						 &panic_block);5531 5532		/*5533		 * This can't be called if any interfaces exist, so no worry5534		 * about shutting down the interfaces.5535		 */5536 5537		/*5538		 * Tell the timer to stop, then wait for it to stop.  This5539		 * avoids problems with race conditions removing the timer5540		 * here.5541		 */5542		atomic_set(&stop_operation, 1);5543		del_timer_sync(&ipmi_timer);5544 5545		initialized = false;5546 5547		/* Check for buffer leaks. */5548		count = atomic_read(&smi_msg_inuse_count);5549		if (count != 0)5550			pr_warn("SMI message count %d at exit\n", count);5551		count = atomic_read(&recv_msg_inuse_count);5552		if (count != 0)5553			pr_warn("recv message count %d at exit\n", count);5554 5555		cleanup_srcu_struct(&ipmi_interfaces_srcu);5556	}5557	if (drvregistered)5558		driver_unregister(&ipmidriver.driver);5559}5560module_exit(cleanup_ipmi);5561 5562module_init(ipmi_init_msghandler_mod);5563MODULE_LICENSE("GPL");5564MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");5565MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI interface.");5566MODULE_VERSION(IPMI_DRIVER_VERSION);5567MODULE_SOFTDEP("post: ipmi_devintf");5568