drivers/char/ipmi/ipmi_msghandler.c

   1 /*
   2  * ipmi_msghandler.c
   3  *
   4  * Incoming and outgoing message routing for an IPMI interface.
   5  *
   6  * Author: MontaVista Software, Inc.
   7  *         Corey Minyard <minyard@mvista.com>
   8  *         source@mvista.com
   9  *
  10  * Copyright 2002 MontaVista Software Inc.
  11  *
  12  *  This program is free software; you can redistribute it and/or modify it
  13  *  under the terms of the GNU General Public License as published by the
  14  *  Free Software Foundation; either version 2 of the License, or (at your
  15  *  option) any later version.
  16  *
  17  *
  18  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  19  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  20  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  *  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  23  *  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
  24  *  OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  25  *  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
  26  *  TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  27  *  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  *
  29  *  You should have received a copy of the GNU General Public License along
  30  *  with this program; if not, write to the Free Software Foundation, Inc.,
  31  *  675 Mass Ave, Cambridge, MA 02139, USA.
  32  */
  33
  34 #include <linux/config.h>
  35 #include <linux/module.h>
  36 #include <linux/errno.h>
  37 #include <asm/system.h>
  38 #include <linux/sched.h>
  39 #include <linux/poll.h>
  40 #include <linux/spinlock.h>
  41 #include <linux/rwsem.h>
  42 #include <linux/slab.h>
  43 #include <linux/ipmi.h>
  44 #include <linux/ipmi_smi.h>
  45 #include <linux/notifier.h>
  46 #include <linux/init.h>
  47 #include <linux/proc_fs.h>
  48
  49 #define PFX "IPMI message handler: "
  50 #define IPMI_MSGHANDLER_VERSION "v33"
  51
  52 struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);
  53 static int ipmi_init_msghandler(void);
  54
  55 static int initialized = 0;
  56
  57 static struct proc_dir_entry *proc_ipmi_root = NULL;
  58
  59 #define MAX_EVENTS_IN_QUEUE     25
  60
  61 /* Don't let a message sit in a queue forever, always time it with at lest
  62    the max message timer.  This is in milliseconds. */
  63 #define MAX_MSG_TIMEOUT         60000
  64
  65 struct ipmi_user
  66 {
  67         struct list_head link;
  68
  69         /* The upper layer that handles receive messages. */
  70         struct ipmi_user_hndl *handler;
  71         void             *handler_data;
  72
  73         /* The interface this user is bound to. */
  74         ipmi_smi_t intf;
  75
  76         /* Does this interface receive IPMI events? */
  77         int gets_events;
  78 };
  79
  80 struct cmd_rcvr
  81 {
  82         struct list_head link;
  83
  84         ipmi_user_t   user;
  85         unsigned char netfn;
  86         unsigned char cmd;
  87 };
  88
  89 struct seq_table
  90 {
  91         unsigned int         inuse : 1;
  92         unsigned int         broadcast : 1;
  93
  94         unsigned long        timeout;
  95         unsigned long        orig_timeout;
  96         unsigned int         retries_left;
  97
  98         /* To verify on an incoming send message response that this is
  99            the message that the response is for, we keep a sequence id
 100            and increment it every time we send a message. */
 101         long                 seqid;
 102
 103         /* This is held so we can properly respond to the message on a
 104            timeout, and it is used to hold the temporary data for
 105            retransmission, too. */
 106         struct ipmi_recv_msg *recv_msg;
 107 };
 108
 109 /* Store the information in a msgid (long) to allow us to find a
 110    sequence table entry from the msgid. */
 111 #define STORE_SEQ_IN_MSGID(seq, seqid) (((seq&0xff)<<26) | (seqid&0x3ffffff))
 112
 113 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \
 114         do {                                                            \
 115                 seq = ((msgid >> 26) & 0x3f);                           \
 116                 seqid = (msgid & 0x3fffff);                             \
 117         } while(0)
 118
 119 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3fffff)
 120
 121 struct ipmi_channel
 122 {
 123         unsigned char medium;
 124         unsigned char protocol;
 125 };
 126
 127 struct ipmi_proc_entry
 128 {
 129         char                   *name;
 130         struct ipmi_proc_entry *next;
 131 };
 132
 133 #define IPMI_IPMB_NUM_SEQ       64
 134 #define IPMI_MAX_CHANNELS       8
 135 struct ipmi_smi
 136 {
 137         /* What interface number are we? */
 138         int intf_num;
 139
 140         /* The list of upper layers that are using me.  We read-lock
 141            this when delivering messages to the upper layer to keep
 142            the user from going away while we are processing the
 143            message.  This means that you cannot add or delete a user
 144            from the receive callback. */
 145         rwlock_t                users_lock;
 146         struct list_head        users;
 147
 148         /* Used for wake ups at startup. */
 149         wait_queue_head_t waitq;
 150
 151         /* The IPMI version of the BMC on the other end. */
 152         unsigned char       version_major;
 153         unsigned char       version_minor;
 154
 155         /* This is the lower-layer's sender routine. */
 156         struct ipmi_smi_handlers *handlers;
 157         void                     *send_info;
 158
 159         /* A list of proc entries for this interface.  This does not
 160            need a lock, only one thread creates it and only one thread
 161            destroys it. */
 162         struct ipmi_proc_entry *proc_entries;
 163
 164         /* A table of sequence numbers for this interface.  We use the
 165            sequence numbers for IPMB messages that go out of the
 166            interface to match them up with their responses.  A routine
 167            is called periodically to time the items in this list. */
 168         spinlock_t       seq_lock;
 169         struct seq_table seq_table[IPMI_IPMB_NUM_SEQ];
 170         int curr_seq;
 171
 172         /* Messages that were delayed for some reason (out of memory,
 173            for instance), will go in here to be processed later in a
 174            periodic timer interrupt. */
 175         spinlock_t       waiting_msgs_lock;
 176         struct list_head waiting_msgs;
 177
 178         /* The list of command receivers that are registered for commands
 179            on this interface. */
 180         rwlock_t         cmd_rcvr_lock;
 181         struct list_head cmd_rcvrs;
 182
 183         /* Events that were queues because no one was there to receive
 184            them. */
 185         spinlock_t       events_lock; /* For dealing with event stuff. */
 186         struct list_head waiting_events;
 187         unsigned int     waiting_events_count; /* How many events in queue? */
 188
 189         /* This will be non-null if someone registers to receive all
 190            IPMI commands (this is for interface emulation).  There
 191            may not be any things in the cmd_rcvrs list above when
 192            this is registered. */
 193         ipmi_user_t all_cmd_rcvr;
 194
 195         /* My slave address.  This is initialized to IPMI_BMC_SLAVE_ADDR,
 196            but may be changed by the user. */
 197         unsigned char my_address;
 198
 199         /* My LUN.  This should generally stay the SMS LUN, but just in
 200            case... */
 201         unsigned char my_lun;
 202
 203         /* The event receiver for my BMC, only really used at panic
 204            shutdown as a place to store this. */
 205         unsigned char event_receiver;
 206         unsigned char event_receiver_lun;
 207         unsigned char local_sel_device;
 208         unsigned char local_event_generator;
 209
 210         /* A cheap hack, if this is non-null and a message to an
 211            interface comes in with a NULL user, call this routine with
 212            it.  Note that the message will still be freed by the
 213            caller.  This only works on the system interface. */
 214         void (*null_user_handler)(ipmi_smi_t intf, struct ipmi_smi_msg *msg);
 215
 216         /* When we are scanning the channels for an SMI, this will
 217            tell which channel we are scanning. */
 218         int curr_channel;
 219
 220         /* Channel information */
 221         struct ipmi_channel channels[IPMI_MAX_CHANNELS];
 222
 223         /* Proc FS stuff. */
 224         struct proc_dir_entry *proc_dir;
 225         char                  proc_dir_name[10];
 226
 227         spinlock_t   counter_lock; /* For making counters atomic. */
 228
 229         /* Commands we got that were invalid. */
 230         unsigned int sent_invalid_commands;
 231
 232         /* Commands we sent to the MC. */
 233         unsigned int sent_local_commands;
 234         /* Responses from the MC that were delivered to a user. */
 235         unsigned int handled_local_responses;
 236         /* Responses from the MC that were not delivered to a user. */
 237         unsigned int unhandled_local_responses;
 238
 239         /* Commands we sent out to the IPMB bus. */
 240         unsigned int sent_ipmb_commands;
 241         /* Commands sent on the IPMB that had errors on the SEND CMD */
 242         unsigned int sent_ipmb_command_errs;
 243         /* Each retransmit increments this count. */
 244         unsigned int retransmitted_ipmb_commands;
 245         /* When a message times out (runs out of retransmits) this is
 246            incremented. */
 247         unsigned int timed_out_ipmb_commands;
 248
 249         /* This is like above, but for broadcasts.  Broadcasts are
 250            *not* included in the above count (they are expected to
 251            time out). */
 252         unsigned int timed_out_ipmb_broadcasts;
 253
 254         /* Responses I have sent to the IPMB bus. */
 255         unsigned int sent_ipmb_responses;
 256
 257         /* The response was delivered to the user. */
 258         unsigned int handled_ipmb_responses;
 259         /* The response had invalid data in it. */
 260         unsigned int invalid_ipmb_responses;
 261         /* The response didn't have anyone waiting for it. */
 262         unsigned int unhandled_ipmb_responses;
 263
 264         /* Commands we sent out to the IPMB bus. */
 265         unsigned int sent_lan_commands;
 266         /* Commands sent on the IPMB that had errors on the SEND CMD */
 267         unsigned int sent_lan_command_errs;
 268         /* Each retransmit increments this count. */
 269         unsigned int retransmitted_lan_commands;
 270         /* When a message times out (runs out of retransmits) this is
 271            incremented. */
 272         unsigned int timed_out_lan_commands;
 273
 274         /* Responses I have sent to the IPMB bus. */
 275         unsigned int sent_lan_responses;
 276
 277         /* The response was delivered to the user. */
 278         unsigned int handled_lan_responses;
 279         /* The response had invalid data in it. */
 280         unsigned int invalid_lan_responses;
 281         /* The response didn't have anyone waiting for it. */
 282         unsigned int unhandled_lan_responses;
 283
 284         /* The command was delivered to the user. */
 285         unsigned int handled_commands;
 286         /* The command had invalid data in it. */
 287         unsigned int invalid_commands;
 288         /* The command didn't have anyone waiting for it. */
 289         unsigned int unhandled_commands;
 290
 291         /* Invalid data in an event. */
 292         unsigned int invalid_events;
 293         /* Events that were received with the proper format. */
 294         unsigned int events;
 295 };
 296
 297 int
 298 ipmi_register_all_cmd_rcvr(ipmi_user_t user)
 299 {
 300         unsigned long flags;
 301         int           rv = -EBUSY;
 302
 303         write_lock_irqsave(&(user->intf->users_lock), flags);
 304         write_lock(&(user->intf->cmd_rcvr_lock));
 305         if ((user->intf->all_cmd_rcvr == NULL)
 306             && (list_empty(&(user->intf->cmd_rcvrs))))
 307         {
 308                 user->intf->all_cmd_rcvr = user;
 309                 rv = 0;
 310         }
 311         write_unlock(&(user->intf->cmd_rcvr_lock));
 312         write_unlock_irqrestore(&(user->intf->users_lock), flags);
 313         return rv;
 314 }
 315
 316 int
 317 ipmi_unregister_all_cmd_rcvr(ipmi_user_t user)
 318 {
 319         unsigned long flags;
 320         int           rv = -EINVAL;
 321
 322         write_lock_irqsave(&(user->intf->users_lock), flags);
 323         write_lock(&(user->intf->cmd_rcvr_lock));
 324         if (user->intf->all_cmd_rcvr == user)
 325         {
 326                 user->intf->all_cmd_rcvr = NULL;
 327                 rv = 0;
 328         }
 329         write_unlock(&(user->intf->cmd_rcvr_lock));
 330         write_unlock_irqrestore(&(user->intf->users_lock), flags);
 331         return rv;
 332 }
 333
 334
 335 #define MAX_IPMI_INTERFACES 4
 336 static ipmi_smi_t ipmi_interfaces[MAX_IPMI_INTERFACES];
 337
 338 /* Used to keep interfaces from going away while operations are
 339    operating on interfaces.  Grab read if you are not modifying the
 340    interfaces, write if you are. */
 341 static DECLARE_RWSEM(interfaces_sem);
 342
 343 /* Directly protects the ipmi_interfaces data structure.  This is
 344    claimed in the timer interrupt. */
 345 static spinlock_t interfaces_lock = SPIN_LOCK_UNLOCKED;
 346
 347 /* List of watchers that want to know when smi's are added and
 348    deleted. */
 349 static struct list_head smi_watchers = LIST_HEAD_INIT(smi_watchers);
 350 static DECLARE_RWSEM(smi_watchers_sem);
 351
 352 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 353 {
 354         int i;
 355
 356         down_read(&interfaces_sem);
 357         down_write(&smi_watchers_sem);
 358         list_add(&(watcher->link), &smi_watchers);
 359         for (i=0; i<MAX_IPMI_INTERFACES; i++) {
 360                 if (ipmi_interfaces[i] != NULL) {
 361                         watcher->new_smi(i);
 362                 }
 363         }
 364         up_write(&smi_watchers_sem);
 365         up_read(&interfaces_sem);
 366         return 0;
 367 }
 368
 369 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher)
 370 {
 371         down_write(&smi_watchers_sem);
 372         list_del(&(watcher->link));
 373         up_write(&smi_watchers_sem);
 374         return 0;
 375 }
 376
 377 static void
 378 call_smi_watchers(int i)
 379 {
 380         struct ipmi_smi_watcher *w;
 381
 382         down_read(&smi_watchers_sem);
 383         list_for_each_entry(w, &smi_watchers, link) {
 384                 if (try_module_get(w->owner)) {
 385                         w->new_smi(i);
 386                         module_put(w->owner);
 387                 }
 388         }
 389         up_read(&smi_watchers_sem);
 390 }
 391
 392 int
 393 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)
 394 {
 395         if (addr1->addr_type != addr2->addr_type)
 396                 return 0;
 397
 398         if (addr1->channel != addr2->channel)
 399                 return 0;
 400
 401         if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 402                 struct ipmi_system_interface_addr *smi_addr1
 403                     = (struct ipmi_system_interface_addr *) addr1;
 404                 struct ipmi_system_interface_addr *smi_addr2
 405                     = (struct ipmi_system_interface_addr *) addr2;
 406                 return (smi_addr1->lun == smi_addr2->lun);
 407         }
 408
 409         if ((addr1->addr_type == IPMI_IPMB_ADDR_TYPE)
 410             || (addr1->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 411         {
 412                 struct ipmi_ipmb_addr *ipmb_addr1
 413                     = (struct ipmi_ipmb_addr *) addr1;
 414                 struct ipmi_ipmb_addr *ipmb_addr2
 415                     = (struct ipmi_ipmb_addr *) addr2;
 416
 417                 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr)
 418                         && (ipmb_addr1->lun == ipmb_addr2->lun));
 419         }
 420
 421         if (addr1->addr_type == IPMI_LAN_ADDR_TYPE) {
 422                 struct ipmi_lan_addr *lan_addr1
 423                         = (struct ipmi_lan_addr *) addr1;
 424                 struct ipmi_lan_addr *lan_addr2
 425                     = (struct ipmi_lan_addr *) addr2;
 426
 427                 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID)
 428                         && (lan_addr1->local_SWID == lan_addr2->local_SWID)
 429                         && (lan_addr1->session_handle
 430                             == lan_addr2->session_handle)
 431                         && (lan_addr1->lun == lan_addr2->lun));
 432         }
 433
 434         return 1;
 435 }
 436
 437 int ipmi_validate_addr(struct ipmi_addr *addr, int len)
 438 {
 439         if (len < sizeof(struct ipmi_system_interface_addr)) {
 440                 return -EINVAL;
 441         }
 442
 443         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 444                 if (addr->channel != IPMI_BMC_CHANNEL)
 445                         return -EINVAL;
 446                 return 0;
 447         }
 448
 449         if ((addr->channel == IPMI_BMC_CHANNEL)
 450             || (addr->channel >= IPMI_NUM_CHANNELS)
 451             || (addr->channel < 0))
 452                 return -EINVAL;
 453
 454         if ((addr->addr_type == IPMI_IPMB_ADDR_TYPE)
 455             || (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 456         {
 457                 if (len < sizeof(struct ipmi_ipmb_addr)) {
 458                         return -EINVAL;
 459                 }
 460                 return 0;
 461         }
 462
 463         if (addr->addr_type == IPMI_LAN_ADDR_TYPE) {
 464                 if (len < sizeof(struct ipmi_lan_addr)) {
 465                         return -EINVAL;
 466                 }
 467                 return 0;
 468         }
 469
 470         return -EINVAL;
 471 }
 472
 473 unsigned int ipmi_addr_length(int addr_type)
 474 {
 475         if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
 476                 return sizeof(struct ipmi_system_interface_addr);
 477
 478         if ((addr_type == IPMI_IPMB_ADDR_TYPE)
 479             || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 480         {
 481                 return sizeof(struct ipmi_ipmb_addr);
 482         }
 483
 484         return 0;
 485 }
 486
 487 static void deliver_response(struct ipmi_recv_msg *msg)
 488 {
 489         msg->user->handler->ipmi_recv_hndl(msg, msg->user->handler_data);
 490 }
 491
 492 /* Find the next sequence number not being used and add the given
 493    message with the given timeout to the sequence table.  This must be
 494    called with the interface's seq_lock held. */
 495 static int intf_next_seq(ipmi_smi_t           intf,
 496                          struct ipmi_recv_msg *recv_msg,
 497                          unsigned long        timeout,
 498                          int                  retries,
 499                          int                  broadcast,
 500                          unsigned char        *seq,
 501                          long                 *seqid)
 502 {
 503         int          rv = 0;
 504         unsigned int i;
 505
 506         for (i=intf->curr_seq;
 507              (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;
 508              i=(i+1)%IPMI_IPMB_NUM_SEQ)
 509         {
 510                 if (! intf->seq_table[i].inuse)
 511                         break;
 512         }
 513
 514         if (! intf->seq_table[i].inuse) {
 515                 intf->seq_table[i].recv_msg = recv_msg;
 516
 517                 /* Start with the maximum timeout, when the send response
 518                    comes in we will start the real timer. */
 519                 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT;
 520                 intf->seq_table[i].orig_timeout = timeout;
 521                 intf->seq_table[i].retries_left = retries;
 522                 intf->seq_table[i].broadcast = broadcast;
 523                 intf->seq_table[i].inuse = 1;
 524                 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid);
 525                 *seq = i;
 526                 *seqid = intf->seq_table[i].seqid;
 527                 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
 528         } else {
 529                 rv = -EAGAIN;
 530         }
 531
 532         return rv;
 533 }
 534
 535 /* Return the receive message for the given sequence number and
 536    release the sequence number so it can be reused.  Some other data
 537    is passed in to be sure the message matches up correctly (to help
 538    guard against message coming in after their timeout and the
 539    sequence number being reused). */
 540 static int intf_find_seq(ipmi_smi_t           intf,
 541                          unsigned char        seq,
 542                          short                channel,
 543                          unsigned char        cmd,
 544                          unsigned char        netfn,
 545                          struct ipmi_addr     *addr,
 546                          struct ipmi_recv_msg **recv_msg)
 547 {
 548         int           rv = -ENODEV;
 549         unsigned long flags;
 550
 551         if (seq >= IPMI_IPMB_NUM_SEQ)
 552                 return -EINVAL;
 553
 554         spin_lock_irqsave(&(intf->seq_lock), flags);
 555         if (intf->seq_table[seq].inuse) {
 556                 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg;
 557
 558                 if ((msg->addr.channel == channel)
 559                     && (msg->msg.cmd == cmd)
 560                     && (msg->msg.netfn == netfn)
 561                     && (ipmi_addr_equal(addr, &(msg->addr))))
 562                 {
 563                         *recv_msg = msg;
 564                         intf->seq_table[seq].inuse = 0;
 565                         rv = 0;
 566                 }
 567         }
 568         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 569
 570         return rv;
 571 }
 572
 573
 574 /* Start the timer for a specific sequence table entry. */
 575 static int intf_start_seq_timer(ipmi_smi_t intf,
 576                                 long       msgid)
 577 {
 578         int           rv = -ENODEV;
 579         unsigned long flags;
 580         unsigned char seq;
 581         unsigned long seqid;
 582
 583
 584         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 585
 586         spin_lock_irqsave(&(intf->seq_lock), flags);
 587         /* We do this verification because the user can be deleted
 588            while a message is outstanding. */
 589         if ((intf->seq_table[seq].inuse)
 590             && (intf->seq_table[seq].seqid == seqid))
 591         {
 592                 struct seq_table *ent = &(intf->seq_table[seq]);
 593                 ent->timeout = ent->orig_timeout;
 594                 rv = 0;
 595         }
 596         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 597
 598         return rv;
 599 }
 600
 601 /* Got an error for the send message for a specific sequence number. */
 602 static int intf_err_seq(ipmi_smi_t   intf,
 603                         long         msgid,
 604                         unsigned int err)
 605 {
 606         int                  rv = -ENODEV;
 607         unsigned long        flags;
 608         unsigned char        seq;
 609         unsigned long        seqid;
 610         struct ipmi_recv_msg *msg = NULL;
 611
 612
 613         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 614
 615         spin_lock_irqsave(&(intf->seq_lock), flags);
 616         /* We do this verification because the user can be deleted
 617            while a message is outstanding. */
 618         if ((intf->seq_table[seq].inuse)
 619             && (intf->seq_table[seq].seqid == seqid))
 620         {
 621                 struct seq_table *ent = &(intf->seq_table[seq]);
 622
 623                 ent->inuse = 0;
 624                 msg = ent->recv_msg;
 625                 rv = 0;
 626         }
 627         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 628
 629         if (msg) {
 630                 msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
 631                 msg->msg_data[0] = err;
 632                 msg->msg.netfn |= 1; /* Convert to a response. */
 633                 msg->msg.data_len = 1;
 634                 msg->msg.data = msg->msg_data;
 635                 deliver_response(msg);
 636         }
 637
 638         return rv;
 639 }
 640
 641
 642 int ipmi_create_user(unsigned int          if_num,
 643                      struct ipmi_user_hndl *handler,
 644                      void                  *handler_data,
 645                      ipmi_user_t           *user)
 646 {
 647         unsigned long flags;
 648         ipmi_user_t   new_user;
 649         int           rv = 0;
 650
 651         /* There is no module usecount here, because it's not
 652            required.  Since this can only be used by and called from
 653            other modules, they will implicitly use this module, and
 654            thus this can't be removed unless the other modules are
 655            removed. */
 656
 657         if (handler == NULL)
 658                 return -EINVAL;
 659
 660         /* Make sure the driver is actually initialized, this handles
 661            problems with initialization order. */
 662         if (!initialized) {
 663                 rv = ipmi_init_msghandler();
 664                 if (rv)
 665                         return rv;
 666
 667                 /* The init code doesn't return an error if it was turned
 668                    off, but it won't initialize.  Check that. */
 669                 if (!initialized)
 670                         return -ENODEV;
 671         }
 672
 673         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
 674         if (! new_user)
 675                 return -ENOMEM;
 676
 677         down_read(&interfaces_sem);
 678         if ((if_num > MAX_IPMI_INTERFACES) || ipmi_interfaces[if_num] == NULL)
 679         {
 680                 rv = -EINVAL;
 681                 goto out_unlock;
 682         }
 683
 684         new_user->handler = handler;
 685         new_user->handler_data = handler_data;
 686         new_user->intf = ipmi_interfaces[if_num];
 687         new_user->gets_events = 0;
 688
 689         if (!try_module_get(new_user->intf->handlers->owner)) {
 690                 rv = -ENODEV;
 691                 goto out_unlock;
 692         }
 693
 694         write_lock_irqsave(&new_user->intf->users_lock, flags);
 695         list_add_tail(&new_user->link, &new_user->intf->users);
 696         write_unlock_irqrestore(&new_user->intf->users_lock, flags);
 697
 698  out_unlock:
 699         if (rv) {
 700                 kfree(new_user);
 701         } else {
 702                 *user = new_user;
 703         }
 704
 705         up_read(&interfaces_sem);
 706         return rv;
 707 }
 708
 709 static int ipmi_destroy_user_nolock(ipmi_user_t user)
 710 {
 711         int              rv = -ENODEV;
 712         ipmi_user_t      t_user;
 713         struct cmd_rcvr  *rcvr, *rcvr2;
 714         int              i;
 715         unsigned long    flags;
 716
 717         /* Find the user and delete them from the list. */
 718         list_for_each_entry(t_user, &(user->intf->users), link) {
 719                 if (t_user == user) {
 720                         list_del(&t_user->link);
 721                         rv = 0;
 722                         break;
 723                 }
 724         }
 725
 726         if (rv) {
 727                 goto out_unlock;
 728         }
 729
 730         /* Remove the user from the interfaces sequence table. */
 731         spin_lock_irqsave(&(user->intf->seq_lock), flags);
 732         for (i=0; i<IPMI_IPMB_NUM_SEQ; i++) {
 733                 if (user->intf->seq_table[i].inuse
 734                     && (user->intf->seq_table[i].recv_msg->user == user))
 735                 {
 736                         user->intf->seq_table[i].inuse = 0;
 737                 }
 738         }
 739         spin_unlock_irqrestore(&(user->intf->seq_lock), flags);
 740
 741         /* Remove the user from the command receiver's table. */
 742         write_lock_irqsave(&(user->intf->cmd_rcvr_lock), flags);
 743         list_for_each_entry_safe(rcvr, rcvr2, &(user->intf->cmd_rcvrs), link) {
 744                 if (rcvr->user == user) {
 745                         list_del(&rcvr->link);
 746                         kfree(rcvr);
 747                 }
 748         }
 749         write_unlock_irqrestore(&(user->intf->cmd_rcvr_lock), flags);
 750
 751         kfree(user);
 752
 753  out_unlock:
 754
 755         return rv;
 756 }
 757
 758 int ipmi_destroy_user(ipmi_user_t user)
 759 {
 760         int           rv;
 761         ipmi_smi_t    intf = user->intf;
 762         unsigned long flags;
 763
 764         down_read(&interfaces_sem);
 765         write_lock_irqsave(&intf->users_lock, flags);
 766         rv = ipmi_destroy_user_nolock(user);
 767         if (!rv)
 768                 module_put(intf->handlers->owner);
 769
 770         write_unlock_irqrestore(&intf->users_lock, flags);
 771         up_read(&interfaces_sem);
 772         return rv;
 773 }
 774
 775 void ipmi_get_version(ipmi_user_t   user,
 776                       unsigned char *major,
 777                       unsigned char *minor)
 778 {
 779         *major = user->intf->version_major;
 780         *minor = user->intf->version_minor;
 781 }
 782
 783 void ipmi_set_my_address(ipmi_user_t   user,
 784                          unsigned char address)
 785 {
 786         user->intf->my_address = address;
 787 }
 788
 789 unsigned char ipmi_get_my_address(ipmi_user_t user)
 790 {
 791         return user->intf->my_address;
 792 }
 793
 794 void ipmi_set_my_LUN(ipmi_user_t   user,
 795                      unsigned char LUN)
 796 {
 797         user->intf->my_lun = LUN & 0x3;
 798 }
 799
 800 unsigned char ipmi_get_my_LUN(ipmi_user_t user)
 801 {
 802         return user->intf->my_lun;
 803 }
 804
 805 int ipmi_set_gets_events(ipmi_user_t user, int val)
 806 {
 807         unsigned long         flags;
 808         struct ipmi_recv_msg  *msg, *msg2;
 809
 810         read_lock(&(user->intf->users_lock));
 811         spin_lock_irqsave(&(user->intf->events_lock), flags);
 812         user->gets_events = val;
 813
 814         if (val) {
 815                 /* Deliver any queued events. */
 816                 list_for_each_entry_safe(msg, msg2, &(user->intf->waiting_events), link) {
 817                         list_del(&msg->link);
 818                         msg->user = user;
 819                         deliver_response(msg);
 820                 }
 821         }
 822
 823         spin_unlock_irqrestore(&(user->intf->events_lock), flags);
 824         read_unlock(&(user->intf->users_lock));
 825
 826         return 0;
 827 }
 828
 829 int ipmi_register_for_cmd(ipmi_user_t   user,
 830                           unsigned char netfn,
 831                           unsigned char cmd)
 832 {
 833         struct cmd_rcvr  *cmp;
 834         unsigned long    flags;
 835         struct cmd_rcvr  *rcvr;
 836         int              rv = 0;
 837
 838
 839         rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);
 840         if (! rcvr)
 841                 return -ENOMEM;
 842
 843         read_lock(&(user->intf->users_lock));
 844         write_lock_irqsave(&(user->intf->cmd_rcvr_lock), flags);
 845         if (user->intf->all_cmd_rcvr != NULL) {
 846                 rv = -EBUSY;
 847                 goto out_unlock;
 848         }
 849
 850         /* Make sure the command/netfn is not already registered. */
 851         list_for_each_entry(cmp, &(user->intf->cmd_rcvrs), link) {
 852                 if ((cmp->netfn == netfn) && (cmp->cmd == cmd)) {
 853                         rv = -EBUSY;
 854                         break;
 855                 }
 856         }
 857
 858         if (! rv) {
 859                 rcvr->cmd = cmd;
 860                 rcvr->netfn = netfn;
 861                 rcvr->user = user;
 862                 list_add_tail(&(rcvr->link), &(user->intf->cmd_rcvrs));
 863         }
 864  out_unlock:
 865         write_unlock_irqrestore(&(user->intf->cmd_rcvr_lock), flags);
 866         read_unlock(&(user->intf->users_lock));
 867
 868         if (rv)
 869                 kfree(rcvr);
 870
 871         return rv;
 872 }
 873
 874 int ipmi_unregister_for_cmd(ipmi_user_t   user,
 875                             unsigned char netfn,
 876                             unsigned char cmd)
 877 {
 878         unsigned long    flags;
 879         struct cmd_rcvr  *rcvr;
 880         int              rv = -ENOENT;
 881
 882         read_lock(&(user->intf->users_lock));
 883         write_lock_irqsave(&(user->intf->cmd_rcvr_lock), flags);
 884         /* Make sure the command/netfn is not already registered. */
 885         list_for_each_entry(rcvr, &(user->intf->cmd_rcvrs), link) {
 886                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)) {
 887                         rv = 0;
 888                         list_del(&rcvr->link);
 889                         kfree(rcvr);
 890                         break;
 891                 }
 892         }
 893         write_unlock_irqrestore(&(user->intf->cmd_rcvr_lock), flags);
 894         read_unlock(&(user->intf->users_lock));
 895
 896         return rv;
 897 }
 898
 899 void ipmi_user_set_run_to_completion(ipmi_user_t user, int val)
 900 {
 901         user->intf->handlers->set_run_to_completion(user->intf->send_info,
 902                                                     val);
 903 }
 904
 905 static unsigned char
 906 ipmb_checksum(unsigned char *data, int size)
 907 {
 908         unsigned char csum = 0;
 909
 910         for (; size > 0; size--, data++)
 911                 csum += *data;
 912
 913         return -csum;
 914 }
 915
 916 static inline void format_ipmb_msg(struct ipmi_smi_msg   *smi_msg,
 917                                    struct kernel_ipmi_msg *msg,
 918                                    struct ipmi_ipmb_addr *ipmb_addr,
 919                                    long                  msgid,
 920                                    unsigned char         ipmb_seq,
 921                                    int                   broadcast,
 922                                    unsigned char         source_address,
 923                                    unsigned char         source_lun)
 924 {
 925         int i = broadcast;
 926
 927         /* Format the IPMB header data. */
 928         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
 929         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
 930         smi_msg->data[2] = ipmb_addr->channel;
 931         if (broadcast)
 932                 smi_msg->data[3] = 0;
 933         smi_msg->data[i+3] = ipmb_addr->slave_addr;
 934         smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3);
 935         smi_msg->data[i+5] = ipmb_checksum(&(smi_msg->data[i+3]), 2);
 936         smi_msg->data[i+6] = source_address;
 937         smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun;
 938         smi_msg->data[i+8] = msg->cmd;
 939
 940         /* Now tack on the data to the message. */
 941         if (msg->data_len > 0)
 942                 memcpy(&(smi_msg->data[i+9]), msg->data,
 943                        msg->data_len);
 944         smi_msg->data_size = msg->data_len + 9;
 945
 946         /* Now calculate the checksum and tack it on. */
 947         smi_msg->data[i+smi_msg->data_size]
 948                 = ipmb_checksum(&(smi_msg->data[i+6]),
 949                                 smi_msg->data_size-6);
 950
 951         /* Add on the checksum size and the offset from the
 952            broadcast. */
 953         smi_msg->data_size += 1 + i;
 954
 955         smi_msg->msgid = msgid;
 956 }
 957
 958 static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,
 959                                   struct kernel_ipmi_msg *msg,
 960                                   struct ipmi_lan_addr  *lan_addr,
 961                                   long                  msgid,
 962                                   unsigned char         ipmb_seq,
 963                                   unsigned char         source_lun)
 964 {
 965         /* Format the IPMB header data. */
 966         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
 967         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
 968         smi_msg->data[2] = lan_addr->channel;
 969         smi_msg->data[3] = lan_addr->session_handle;
 970         smi_msg->data[4] = lan_addr->remote_SWID;
 971         smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3);
 972         smi_msg->data[6] = ipmb_checksum(&(smi_msg->data[4]), 2);
 973         smi_msg->data[7] = lan_addr->local_SWID;
 974         smi_msg->data[8] = (ipmb_seq << 2) | source_lun;
 975         smi_msg->data[9] = msg->cmd;
 976
 977         /* Now tack on the data to the message. */
 978         if (msg->data_len > 0)
 979                 memcpy(&(smi_msg->data[10]), msg->data,
 980                        msg->data_len);
 981         smi_msg->data_size = msg->data_len + 10;
 982
 983         /* Now calculate the checksum and tack it on. */
 984         smi_msg->data[smi_msg->data_size]
 985                 = ipmb_checksum(&(smi_msg->data[7]),
 986                                 smi_msg->data_size-7);
 987
 988         /* Add on the checksum size and the offset from the
 989            broadcast. */
 990         smi_msg->data_size += 1;
 991
 992         smi_msg->msgid = msgid;
 993 }
 994
 995 /* Separate from ipmi_request so that the user does not have to be
 996    supplied in certain circumstances (mainly at panic time).  If
 997    messages are supplied, they will be freed, even if an error
 998    occurs. */
 999 static inline int i_ipmi_request(ipmi_user_t          user,
1000                                  ipmi_smi_t           intf,
1001                                  struct ipmi_addr     *addr,
1002                                  long                 msgid,
1003                                  struct kernel_ipmi_msg *msg,
1004                                  void                 *user_msg_data,
1005                                  void                 *supplied_smi,
1006                                  struct ipmi_recv_msg *supplied_recv,
1007                                  int                  priority,
1008                                  unsigned char        source_address,
1009                                  unsigned char        source_lun,
1010                                  int                  retries,
1011                                  unsigned int         retry_time_ms)
1012 {
1013         int                  rv = 0;
1014         struct ipmi_smi_msg  *smi_msg;
1015         struct ipmi_recv_msg *recv_msg;
1016         unsigned long        flags;
1017
1018
1019         if (supplied_recv) {
1020                 recv_msg = supplied_recv;
1021         } else {
1022                 recv_msg = ipmi_alloc_recv_msg();
1023                 if (recv_msg == NULL) {
1024                         return -ENOMEM;
1025                 }
1026         }
1027         recv_msg->user_msg_data = user_msg_data;
1028
1029         if (supplied_smi) {
1030                 smi_msg = (struct ipmi_smi_msg *) supplied_smi;
1031         } else {
1032                 smi_msg = ipmi_alloc_smi_msg();
1033                 if (smi_msg == NULL) {
1034                         ipmi_free_recv_msg(recv_msg);
1035                         return -ENOMEM;
1036                 }
1037         }
1038
1039         recv_msg->user = user;
1040         recv_msg->msgid = msgid;
1041         /* Store the message to send in the receive message so timeout
1042            responses can get the proper response data. */
1043         recv_msg->msg = *msg;
1044
1045         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
1046                 struct ipmi_system_interface_addr *smi_addr;
1047
1048                 if (msg->netfn & 1) {
1049                         /* Responses are not allowed to the SMI. */
1050                         rv = -EINVAL;
1051                         goto out_err;
1052                 }
1053
1054                 smi_addr = (struct ipmi_system_interface_addr *) addr;
1055                 if (smi_addr->lun > 3) {
1056                         spin_lock_irqsave(&intf->counter_lock, flags);
1057                         intf->sent_invalid_commands++;
1058                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1059                         rv = -EINVAL;
1060                         goto out_err;
1061                 }
1062
1063                 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr));
1064
1065                 if ((msg->netfn == IPMI_NETFN_APP_REQUEST)
1066                     && ((msg->cmd == IPMI_SEND_MSG_CMD)
1067                         || (msg->cmd == IPMI_GET_MSG_CMD)
1068                         || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD)))
1069                 {
1070                         /* We don't let the user do these, since we manage
1071                            the sequence numbers. */
1072                         spin_lock_irqsave(&intf->counter_lock, flags);
1073                         intf->sent_invalid_commands++;
1074                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1075                         rv = -EINVAL;
1076                         goto out_err;
1077                 }
1078
1079                 if ((msg->data_len + 2) > IPMI_MAX_MSG_LENGTH) {
1080                         spin_lock_irqsave(&intf->counter_lock, flags);
1081                         intf->sent_invalid_commands++;
1082                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1083                         rv = -EMSGSIZE;
1084                         goto out_err;
1085                 }
1086
1087                 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3);
1088                 smi_msg->data[1] = msg->cmd;
1089                 smi_msg->msgid = msgid;
1090                 smi_msg->user_data = recv_msg;
1091                 if (msg->data_len > 0)
1092                         memcpy(&(smi_msg->data[2]), msg->data, msg->data_len);
1093                 smi_msg->data_size = msg->data_len + 2;
1094                 spin_lock_irqsave(&intf->counter_lock, flags);
1095                 intf->sent_local_commands++;
1096                 spin_unlock_irqrestore(&intf->counter_lock, flags);
1097         } else if ((addr->addr_type == IPMI_IPMB_ADDR_TYPE)
1098                    || (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
1099         {
1100                 struct ipmi_ipmb_addr *ipmb_addr;
1101                 unsigned char         ipmb_seq;
1102                 long                  seqid;
1103                 int                   broadcast = 0;
1104
1105                 if (addr->channel > IPMI_NUM_CHANNELS) {
1106                         spin_lock_irqsave(&intf->counter_lock, flags);
1107                         intf->sent_invalid_commands++;
1108                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1109                         rv = -EINVAL;
1110                         goto out_err;
1111                 }
1112
1113                 if (intf->channels[addr->channel].medium
1114                     != IPMI_CHANNEL_MEDIUM_IPMB)
1115                 {
1116                         spin_lock_irqsave(&intf->counter_lock, flags);
1117                         intf->sent_invalid_commands++;
1118                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1119                         rv = -EINVAL;
1120                         goto out_err;
1121                 }
1122
1123                 if (retries < 0) {
1124                     if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)
1125                         retries = 0; /* Don't retry broadcasts. */
1126                     else
1127                         retries = 4;
1128                 }
1129                 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) {
1130                     /* Broadcasts add a zero at the beginning of the
1131                        message, but otherwise is the same as an IPMB
1132                        address. */
1133                     addr->addr_type = IPMI_IPMB_ADDR_TYPE;
1134                     broadcast = 1;
1135                 }
1136
1137
1138                 /* Default to 1 second retries. */
1139                 if (retry_time_ms == 0)
1140                     retry_time_ms = 1000;
1141
1142                 /* 9 for the header and 1 for the checksum, plus
1143                    possibly one for the broadcast. */
1144                 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) {
1145                         spin_lock_irqsave(&intf->counter_lock, flags);
1146                         intf->sent_invalid_commands++;
1147                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1148                         rv = -EMSGSIZE;
1149                         goto out_err;
1150                 }
1151
1152                 ipmb_addr = (struct ipmi_ipmb_addr *) addr;
1153                 if (ipmb_addr->lun > 3) {
1154                         spin_lock_irqsave(&intf->counter_lock, flags);
1155                         intf->sent_invalid_commands++;
1156                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1157                         rv = -EINVAL;
1158                         goto out_err;
1159                 }
1160
1161                 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr));
1162
1163                 if (recv_msg->msg.netfn & 0x1) {
1164                         /* It's a response, so use the user's sequence
1165                            from msgid. */
1166                         spin_lock_irqsave(&intf->counter_lock, flags);
1167                         intf->sent_ipmb_responses++;
1168                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1169                         format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid,
1170                                         msgid, broadcast,
1171                                         source_address, source_lun);
1172
1173                         /* Save the receive message so we can use it
1174                            to deliver the response. */
1175                         smi_msg->user_data = recv_msg;
1176                 } else {
1177                         /* It's a command, so get a sequence for it. */
1178
1179                         spin_lock_irqsave(&(intf->seq_lock), flags);
1180
1181                         spin_lock(&intf->counter_lock);
1182                         intf->sent_ipmb_commands++;
1183                         spin_unlock(&intf->counter_lock);
1184
1185                         /* Create a sequence number with a 1 second
1186                            timeout and 4 retries. */
1187                         rv = intf_next_seq(intf,
1188                                            recv_msg,
1189                                            retry_time_ms,
1190                                            retries,
1191                                            broadcast,
1192                                            &ipmb_seq,
1193                                            &seqid);
1194                         if (rv) {
1195                                 /* We have used up all the sequence numbers,
1196                                    probably, so abort. */
1197                                 spin_unlock_irqrestore(&(intf->seq_lock),
1198                                                        flags);
1199                                 goto out_err;
1200                         }
1201
1202                         /* Store the sequence number in the message,
1203                            so that when the send message response
1204                            comes back we can start the timer. */
1205                         format_ipmb_msg(smi_msg, msg, ipmb_addr,
1206                                         STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1207                                         ipmb_seq, broadcast,
1208                                         source_address, source_lun);
1209
1210                         /* Copy the message into the recv message data, so we
1211                            can retransmit it later if necessary. */
1212                         memcpy(recv_msg->msg_data, smi_msg->data,
1213                                smi_msg->data_size);
1214                         recv_msg->msg.data = recv_msg->msg_data;
1215                         recv_msg->msg.data_len = smi_msg->data_size;
1216
1217                         /* We don't unlock until here, because we need
1218                            to copy the completed message into the
1219                            recv_msg before we release the lock.
1220                            Otherwise, race conditions may bite us.  I
1221                            know that's pretty paranoid, but I prefer
1222                            to be correct. */
1223                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1224                 }
1225         } else if (addr->addr_type == IPMI_LAN_ADDR_TYPE) {
1226                 struct ipmi_lan_addr  *lan_addr;
1227                 unsigned char         ipmb_seq;
1228                 long                  seqid;
1229
1230                 if (addr->channel > IPMI_NUM_CHANNELS) {
1231                         spin_lock_irqsave(&intf->counter_lock, flags);
1232                         intf->sent_invalid_commands++;
1233                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1234                         rv = -EINVAL;
1235                         goto out_err;
1236                 }
1237
1238                 if ((intf->channels[addr->channel].medium
1239                     != IPMI_CHANNEL_MEDIUM_8023LAN)
1240                     && (intf->channels[addr->channel].medium
1241                         != IPMI_CHANNEL_MEDIUM_ASYNC))
1242                 {
1243                         spin_lock_irqsave(&intf->counter_lock, flags);
1244                         intf->sent_invalid_commands++;
1245                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1246                         rv = -EINVAL;
1247                         goto out_err;
1248                 }
1249
1250                 retries = 4;
1251
1252                 /* Default to 1 second retries. */
1253                 if (retry_time_ms == 0)
1254                     retry_time_ms = 1000;
1255
1256                 /* 11 for the header and 1 for the checksum. */
1257                 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) {
1258                         spin_lock_irqsave(&intf->counter_lock, flags);
1259                         intf->sent_invalid_commands++;
1260                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1261                         rv = -EMSGSIZE;
1262                         goto out_err;
1263                 }
1264
1265                 lan_addr = (struct ipmi_lan_addr *) addr;
1266                 if (lan_addr->lun > 3) {
1267                         spin_lock_irqsave(&intf->counter_lock, flags);
1268                         intf->sent_invalid_commands++;
1269                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1270                         rv = -EINVAL;
1271                         goto out_err;
1272                 }
1273
1274                 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr));
1275
1276                 if (recv_msg->msg.netfn & 0x1) {
1277                         /* It's a response, so use the user's sequence
1278                            from msgid. */
1279                         spin_lock_irqsave(&intf->counter_lock, flags);
1280                         intf->sent_lan_responses++;
1281                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1282                         format_lan_msg(smi_msg, msg, lan_addr, msgid,
1283                                        msgid, source_lun);
1284
1285                         /* Save the receive message so we can use it
1286                            to deliver the response. */
1287                         smi_msg->user_data = recv_msg;
1288                 } else {
1289                         /* It's a command, so get a sequence for it. */
1290
1291                         spin_lock_irqsave(&(intf->seq_lock), flags);
1292
1293                         spin_lock(&intf->counter_lock);
1294                         intf->sent_lan_commands++;
1295                         spin_unlock(&intf->counter_lock);
1296
1297                         /* Create a sequence number with a 1 second
1298                            timeout and 4 retries. */
1299                         rv = intf_next_seq(intf,
1300                                            recv_msg,
1301                                            retry_time_ms,
1302                                            retries,
1303                                            0,
1304                                            &ipmb_seq,
1305                                            &seqid);
1306                         if (rv) {
1307                                 /* We have used up all the sequence numbers,
1308                                    probably, so abort. */
1309                                 spin_unlock_irqrestore(&(intf->seq_lock),
1310                                                        flags);
1311                                 goto out_err;
1312                         }
1313
1314                         /* Store the sequence number in the message,
1315                            so that when the send message response
1316                            comes back we can start the timer. */
1317                         format_lan_msg(smi_msg, msg, lan_addr,
1318                                        STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1319                                        ipmb_seq, source_lun);
1320
1321                         /* Copy the message into the recv message data, so we
1322                            can retransmit it later if necessary. */
1323                         memcpy(recv_msg->msg_data, smi_msg->data,
1324                                smi_msg->data_size);
1325                         recv_msg->msg.data = recv_msg->msg_data;
1326                         recv_msg->msg.data_len = smi_msg->data_size;
1327
1328                         /* We don't unlock until here, because we need
1329                            to copy the completed message into the
1330                            recv_msg before we release the lock.
1331                            Otherwise, race conditions may bite us.  I
1332                            know that's pretty paranoid, but I prefer
1333                            to be correct. */
1334                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1335                 }
1336         } else {
1337             /* Unknown address type. */
1338                 spin_lock_irqsave(&intf->counter_lock, flags);
1339                 intf->sent_invalid_commands++;
1340                 spin_unlock_irqrestore(&intf->counter_lock, flags);
1341                 rv = -EINVAL;
1342                 goto out_err;
1343         }
1344
1345 #ifdef DEBUG_MSGING
1346         {
1347                 int m;
1348                 for (m=0; m<smi_msg->data_size; m++)
1349                         printk(" %2.2x", smi_msg->data[m]);
1350                 printk("\n");
1351         }
1352 #endif
1353         intf->handlers->sender(intf->send_info, smi_msg, priority);
1354
1355         return 0;
1356
1357  out_err:
1358         ipmi_free_smi_msg(smi_msg);
1359         ipmi_free_recv_msg(recv_msg);
1360         return rv;
1361 }
1362
1363 int ipmi_request(ipmi_user_t      user,
1364                  struct ipmi_addr *addr,
1365                  long             msgid,
1366                  struct kernel_ipmi_msg  *msg,
1367                  void             *user_msg_data,
1368                  int              priority)
1369 {
1370         return i_ipmi_request(user,
1371                               user->intf,
1372                               addr,
1373                               msgid,
1374                               msg,
1375                               user_msg_data,
1376                               NULL, NULL,
1377                               priority,
1378                               user->intf->my_address,
1379                               user->intf->my_lun,
1380                               -1, 0);
1381 }
1382
1383 int ipmi_request_settime(ipmi_user_t      user,
1384                          struct ipmi_addr *addr,
1385                          long             msgid,
1386                          struct kernel_ipmi_msg  *msg,
1387                          void             *user_msg_data,
1388                          int              priority,
1389                          int              retries,
1390                          unsigned int     retry_time_ms)
1391 {
1392         return i_ipmi_request(user,
1393                               user->intf,
1394                               addr,
1395                               msgid,
1396                               msg,
1397                               user_msg_data,
1398                               NULL, NULL,
1399                               priority,
1400                               user->intf->my_address,
1401                               user->intf->my_lun,
1402                               retries,
1403                               retry_time_ms);
1404 }
1405
1406 int ipmi_request_supply_msgs(ipmi_user_t          user,
1407                              struct ipmi_addr     *addr,
1408                              long                 msgid,
1409                              struct kernel_ipmi_msg *msg,
1410                              void                 *user_msg_data,
1411                              void                 *supplied_smi,
1412                              struct ipmi_recv_msg *supplied_recv,
1413                              int                  priority)
1414 {
1415         return i_ipmi_request(user,
1416                               user->intf,
1417                               addr,
1418                               msgid,
1419                               msg,
1420                               user_msg_data,
1421                               supplied_smi,
1422                               supplied_recv,
1423                               priority,
1424                               user->intf->my_address,
1425                               user->intf->my_lun,
1426                               -1, 0);
1427 }
1428
1429 int ipmi_request_with_source(ipmi_user_t      user,
1430                              struct ipmi_addr *addr,
1431                              long             msgid,
1432                              struct kernel_ipmi_msg  *msg,
1433                              void             *user_msg_data,
1434                              int              priority,
1435                              unsigned char    source_address,
1436                              unsigned char    source_lun)
1437 {
1438         return i_ipmi_request(user,
1439                               user->intf,
1440                               addr,
1441                               msgid,
1442                               msg,
1443                               user_msg_data,
1444                               NULL, NULL,
1445                               priority,
1446                               source_address,
1447                               source_lun,
1448                               -1, 0);
1449 }
1450
1451 static int ipmb_file_read_proc(char *page, char **start, off_t off,
1452                                int count, int *eof, void *data)
1453 {
1454         char       *out = (char *) page;
1455         ipmi_smi_t intf = data;
1456
1457         return sprintf(out, "%x\n", intf->my_address);
1458 }
1459
1460 static int version_file_read_proc(char *page, char **start, off_t off,
1461                                   int count, int *eof, void *data)
1462 {
1463         char       *out = (char *) page;
1464         ipmi_smi_t intf = data;
1465
1466         return sprintf(out, "%d.%d\n",
1467                        intf->version_major, intf->version_minor);
1468 }
1469
1470 static int stat_file_read_proc(char *page, char **start, off_t off,
1471                                int count, int *eof, void *data)
1472 {
1473         char       *out = (char *) page;
1474         ipmi_smi_t intf = data;
1475
1476         out += sprintf(out, "sent_invalid_commands:       %d\n",
1477                        intf->sent_invalid_commands);
1478         out += sprintf(out, "sent_local_commands:         %d\n",
1479                        intf->sent_local_commands);
1480         out += sprintf(out, "handled_local_responses:     %d\n",
1481                        intf->handled_local_responses);
1482         out += sprintf(out, "unhandled_local_responses:   %d\n",
1483                        intf->unhandled_local_responses);
1484         out += sprintf(out, "sent_ipmb_commands:          %d\n",
1485                        intf->sent_ipmb_commands);
1486         out += sprintf(out, "sent_ipmb_command_errs:      %d\n",
1487                        intf->sent_ipmb_command_errs);
1488         out += sprintf(out, "retransmitted_ipmb_commands: %d\n",
1489                        intf->retransmitted_ipmb_commands);
1490         out += sprintf(out, "timed_out_ipmb_commands:     %d\n",
1491                        intf->timed_out_ipmb_commands);
1492         out += sprintf(out, "timed_out_ipmb_broadcasts:   %d\n",
1493                        intf->timed_out_ipmb_broadcasts);
1494         out += sprintf(out, "sent_ipmb_responses:         %d\n",
1495                        intf->sent_ipmb_responses);
1496         out += sprintf(out, "handled_ipmb_responses:      %d\n",
1497                        intf->handled_ipmb_responses);
1498         out += sprintf(out, "invalid_ipmb_responses:      %d\n",
1499                        intf->invalid_ipmb_responses);
1500         out += sprintf(out, "unhandled_ipmb_responses:    %d\n",
1501                        intf->unhandled_ipmb_responses);
1502         out += sprintf(out, "sent_lan_commands:           %d\n",
1503                        intf->sent_lan_commands);
1504         out += sprintf(out, "sent_lan_command_errs:       %d\n",
1505                        intf->sent_lan_command_errs);
1506         out += sprintf(out, "retransmitted_lan_commands:  %d\n",
1507                        intf->retransmitted_lan_commands);
1508         out += sprintf(out, "timed_out_lan_commands:      %d\n",
1509                        intf->timed_out_lan_commands);
1510         out += sprintf(out, "sent_lan_responses:          %d\n",
1511                        intf->sent_lan_responses);
1512         out += sprintf(out, "handled_lan_responses:       %d\n",
1513                        intf->handled_lan_responses);
1514         out += sprintf(out, "invalid_lan_responses:       %d\n",
1515                        intf->invalid_lan_responses);
1516         out += sprintf(out, "unhandled_lan_responses:     %d\n",
1517                        intf->unhandled_lan_responses);
1518         out += sprintf(out, "handled_commands:            %d\n",
1519                        intf->handled_commands);
1520         out += sprintf(out, "invalid_commands:            %d\n",
1521                        intf->invalid_commands);
1522         out += sprintf(out, "unhandled_commands:          %d\n",
1523                        intf->unhandled_commands);
1524         out += sprintf(out, "invalid_events:              %d\n",
1525                        intf->invalid_events);
1526         out += sprintf(out, "events:                      %d\n",
1527                        intf->events);
1528
1529         return (out - ((char *) page));
1530 }
1531
1532 int ipmi_smi_add_proc_entry(ipmi_smi_t smi, char *name,
1533                             read_proc_t *read_proc, write_proc_t *write_proc,
1534                             void *data, struct module *owner)
1535 {
1536         struct proc_dir_entry  *file;
1537         int                    rv = 0;
1538         struct ipmi_proc_entry *entry;
1539
1540         /* Create a list element. */
1541         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
1542         if (!entry)
1543                 return -ENOMEM;
1544         entry->name = kmalloc(strlen(name)+1, GFP_KERNEL);
1545         if (!entry->name) {
1546                 kfree(entry);
1547                 return -ENOMEM;
1548         }
1549         strcpy(entry->name, name);
1550
1551         file = create_proc_entry(name, 0, smi->proc_dir);
1552         if (!file) {
1553                 kfree(entry->name);
1554                 kfree(entry);
1555                 rv = -ENOMEM;
1556         } else {
1557                 file->nlink = 1;
1558                 file->data = data;
1559                 file->read_proc = read_proc;
1560                 file->write_proc = write_proc;
1561                 file->owner = owner;
1562
1563                 /* Stick it on the list. */
1564                 entry->next = smi->proc_entries;
1565                 smi->proc_entries = entry;
1566         }
1567
1568         return rv;
1569 }
1570
1571 static int add_proc_entries(ipmi_smi_t smi, int num)
1572 {
1573         int rv = 0;
1574
1575         sprintf(smi->proc_dir_name, "%d", num);
1576         smi->proc_dir = proc_mkdir(smi->proc_dir_name, proc_ipmi_root);
1577         if (!smi->proc_dir)
1578                 rv = -ENOMEM;
1579         else {
1580                 smi->proc_dir->owner = THIS_MODULE;
1581         }
1582
1583         if (rv == 0)
1584                 rv = ipmi_smi_add_proc_entry(smi, "stats",
1585                                              stat_file_read_proc, NULL,
1586                                              smi, THIS_MODULE);
1587
1588         if (rv == 0)
1589                 rv = ipmi_smi_add_proc_entry(smi, "ipmb",
1590                                              ipmb_file_read_proc, NULL,
1591                                              smi, THIS_MODULE);
1592
1593         if (rv == 0)
1594                 rv = ipmi_smi_add_proc_entry(smi, "version",
1595                                              version_file_read_proc, NULL,
1596                                              smi, THIS_MODULE);
1597
1598         return rv;
1599 }
1600
1601 static void remove_proc_entries(ipmi_smi_t smi)
1602 {
1603         struct ipmi_proc_entry *entry;
1604
1605         while (smi->proc_entries) {
1606                 entry = smi->proc_entries;
1607                 smi->proc_entries = entry->next;
1608
1609                 remove_proc_entry(entry->name, smi->proc_dir);
1610                 kfree(entry->name);
1611                 kfree(entry);
1612         }
1613         remove_proc_entry(smi->proc_dir_name, proc_ipmi_root);
1614 }
1615
1616 static int
1617 send_channel_info_cmd(ipmi_smi_t intf, int chan)
1618 {
1619         struct kernel_ipmi_msg            msg;
1620         unsigned char                     data[1];
1621         struct ipmi_system_interface_addr si;
1622
1623         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
1624         si.channel = IPMI_BMC_CHANNEL;
1625         si.lun = 0;
1626
1627         msg.netfn = IPMI_NETFN_APP_REQUEST;
1628         msg.cmd = IPMI_GET_CHANNEL_INFO_CMD;
1629         msg.data = data;
1630         msg.data_len = 1;
1631         data[0] = chan;
1632         return i_ipmi_request(NULL,
1633                               intf,
1634                               (struct ipmi_addr *) &si,
1635                               0,
1636                               &msg,
1637                               NULL,
1638                               NULL,
1639                               NULL,
1640                               0,
1641                               intf->my_address,
1642                               intf->my_lun,
1643                               -1, 0);
1644 }
1645
1646 static void
1647 channel_handler(ipmi_smi_t intf, struct ipmi_smi_msg *msg)
1648 {
1649         int rv = 0;
1650         int chan;
1651
1652         if ((msg->rsp[0] == (IPMI_NETFN_APP_RESPONSE << 2))
1653             && (msg->rsp[1] == IPMI_GET_CHANNEL_INFO_CMD))
1654         {
1655                 /* It's the one we want */
1656                 if (msg->rsp[2] != 0) {
1657                         /* Got an error from the channel, just go on. */
1658
1659                         if (msg->rsp[2] == IPMI_INVALID_COMMAND_ERR) {
1660                                 /* If the MC does not support this
1661                                    command, that is legal.  We just
1662                                    assume it has one IPMB at channel
1663                                    zero. */
1664                                 intf->channels[0].medium
1665                                         = IPMI_CHANNEL_MEDIUM_IPMB;
1666                                 intf->channels[0].protocol
1667                                         = IPMI_CHANNEL_PROTOCOL_IPMB;
1668                                 rv = -ENOSYS;
1669
1670                                 intf->curr_channel = IPMI_MAX_CHANNELS;
1671                                 wake_up(&intf->waitq);
1672                                 goto out;
1673                         }
1674                         goto next_channel;
1675                 }
1676                 if (msg->rsp_size < 6) {
1677                         /* Message not big enough, just go on. */
1678                         goto next_channel;
1679                 }
1680                 chan = intf->curr_channel;
1681                 intf->channels[chan].medium = msg->rsp[4] & 0x7f;
1682                 intf->channels[chan].protocol = msg->rsp[5] & 0x1f;
1683
1684         next_channel:
1685                 intf->curr_channel++;
1686                 if (intf->curr_channel >= IPMI_MAX_CHANNELS)
1687                         wake_up(&intf->waitq);
1688                 else
1689                         rv = send_channel_info_cmd(intf, intf->curr_channel);
1690
1691                 if (rv) {
1692                         /* Got an error somehow, just give up. */
1693                         intf->curr_channel = IPMI_MAX_CHANNELS;
1694                         wake_up(&intf->waitq);
1695
1696                         printk(KERN_WARNING PFX
1697                                "Error sending channel information: %d\n",
1698                                rv);
1699                 }
1700         }
1701  out:
1702         return;
1703 }
1704
1705 void ipmi_poll_interface(ipmi_user_t user)
1706 {
1707         ipmi_smi_t intf = user->intf;
1708
1709         if (intf->handlers->poll)
1710                 intf->handlers->poll(intf->send_info);
1711 }
1712
1713 int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
1714                       void                     *send_info,
1715                       unsigned char            version_major,
1716                       unsigned char            version_minor,
1717                       ipmi_smi_t               *intf)
1718 {
1719         int              i, j;
1720         int              rv;
1721         ipmi_smi_t       new_intf;
1722         unsigned long    flags;
1723
1724
1725         /* Make sure the driver is actually initialized, this handles
1726            problems with initialization order. */
1727         if (!initialized) {
1728                 rv = ipmi_init_msghandler();
1729                 if (rv)
1730                         return rv;
1731                 /* The init code doesn't return an error if it was turned
1732                    off, but it won't initialize.  Check that. */
1733                 if (!initialized)
1734                         return -ENODEV;
1735         }
1736
1737         new_intf = kmalloc(sizeof(*new_intf), GFP_KERNEL);
1738         if (!new_intf)
1739                 return -ENOMEM;
1740         memset(new_intf, 0, sizeof(*new_intf));
1741
1742         new_intf->proc_dir = NULL;
1743
1744         rv = -ENOMEM;
1745
1746         down_write(&interfaces_sem);
1747         for (i=0; i<MAX_IPMI_INTERFACES; i++) {
1748                 if (ipmi_interfaces[i] == NULL) {
1749                         new_intf->intf_num = i;
1750                         new_intf->version_major = version_major;
1751                         new_intf->version_minor = version_minor;
1752                         new_intf->my_address = IPMI_BMC_SLAVE_ADDR;
1753                         new_intf->my_lun = 2;  /* the SMS LUN. */
1754                         rwlock_init(&(new_intf->users_lock));
1755                         INIT_LIST_HEAD(&(new_intf->users));
1756                         new_intf->handlers = handlers;
1757                         new_intf->send_info = send_info;
1758                         spin_lock_init(&(new_intf->seq_lock));
1759                         for (j=0; j<IPMI_IPMB_NUM_SEQ; j++) {
1760                                 new_intf->seq_table[j].inuse = 0;
1761                                 new_intf->seq_table[j].seqid = 0;
1762                         }
1763                         new_intf->curr_seq = 0;
1764                         spin_lock_init(&(new_intf->waiting_msgs_lock));
1765                         INIT_LIST_HEAD(&(new_intf->waiting_msgs));
1766                         spin_lock_init(&(new_intf->events_lock));
1767                         INIT_LIST_HEAD(&(new_intf->waiting_events));
1768                         new_intf->waiting_events_count = 0;
1769                         rwlock_init(&(new_intf->cmd_rcvr_lock));
1770                         init_waitqueue_head(&new_intf->waitq);
1771                         INIT_LIST_HEAD(&(new_intf->cmd_rcvrs));
1772                         new_intf->all_cmd_rcvr = NULL;
1773
1774                         spin_lock_init(&(new_intf->counter_lock));
1775
1776                         spin_lock_irqsave(&interfaces_lock, flags);
1777                         ipmi_interfaces[i] = new_intf;
1778                         spin_unlock_irqrestore(&interfaces_lock, flags);
1779
1780                         rv = 0;
1781                         *intf = new_intf;
1782                         break;
1783                 }
1784         }
1785
1786         downgrade_write(&interfaces_sem);
1787
1788         if (rv == 0)
1789                 rv = add_proc_entries(*intf, i);
1790
1791         if (rv == 0) {
1792                 if ((version_major > 1)
1793                     || ((version_major == 1) && (version_minor >= 5)))
1794                 {
1795                         /* Start scanning the channels to see what is
1796                            available. */
1797                         (*intf)->null_user_handler = channel_handler;
1798                         (*intf)->curr_channel = 0;
1799                         rv = send_channel_info_cmd(*intf, 0);
1800                         if (rv)
1801                                 goto out;
1802
1803                         /* Wait for the channel info to be read. */
1804                         up_read(&interfaces_sem);
1805                         wait_event((*intf)->waitq,
1806                                    ((*intf)->curr_channel>=IPMI_MAX_CHANNELS));
1807                         down_read(&interfaces_sem);
1808
1809                         if (ipmi_interfaces[i] != new_intf)
1810                                 /* Well, it went away.  Just return. */
1811                                 goto out;
1812                 } else {
1813                         /* Assume a single IPMB channel at zero. */
1814                         (*intf)->channels[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;
1815                         (*intf)->channels[0].protocol
1816                                 = IPMI_CHANNEL_PROTOCOL_IPMB;
1817                 }
1818
1819                 /* Call all the watcher interfaces to tell
1820                    them that a new interface is available. */
1821                 call_smi_watchers(i);
1822         }
1823
1824  out:
1825         up_read(&interfaces_sem);
1826
1827         if (rv) {
1828                 if (new_intf->proc_dir)
1829                         remove_proc_entries(new_intf);
1830                 kfree(new_intf);
1831         }
1832
1833         return rv;
1834 }
1835
1836 static void free_recv_msg_list(struct list_head *q)
1837 {
1838         struct ipmi_recv_msg *msg, *msg2;
1839
1840         list_for_each_entry_safe(msg, msg2, q, link) {
1841                 list_del(&msg->link);
1842                 ipmi_free_recv_msg(msg);
1843         }
1844 }
1845
1846 static void free_cmd_rcvr_list(struct list_head *q)
1847 {
1848         struct cmd_rcvr  *rcvr, *rcvr2;
1849
1850         list_for_each_entry_safe(rcvr, rcvr2, q, link) {
1851                 list_del(&rcvr->link);
1852                 kfree(rcvr);
1853         }
1854 }
1855
1856 static void clean_up_interface_data(ipmi_smi_t intf)
1857 {
1858         int i;
1859
1860         free_recv_msg_list(&(intf->waiting_msgs));
1861         free_recv_msg_list(&(intf->waiting_events));
1862         free_cmd_rcvr_list(&(intf->cmd_rcvrs));
1863
1864         for (i=0; i<IPMI_IPMB_NUM_SEQ; i++) {
1865                 if ((intf->seq_table[i].inuse)
1866                     && (intf->seq_table[i].recv_msg))
1867                 {
1868                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
1869                 }
1870         }
1871 }
1872
1873 int ipmi_unregister_smi(ipmi_smi_t intf)
1874 {
1875         int                     rv = -ENODEV;
1876         int                     i;
1877         struct ipmi_smi_watcher *w;
1878         unsigned long           flags;
1879
1880         down_write(&interfaces_sem);
1881         if (list_empty(&(intf->users)))
1882         {
1883                 for (i=0; i<MAX_IPMI_INTERFACES; i++) {
1884                         if (ipmi_interfaces[i] == intf) {
1885                                 remove_proc_entries(intf);
1886                                 spin_lock_irqsave(&interfaces_lock, flags);
1887                                 ipmi_interfaces[i] = NULL;
1888                                 clean_up_interface_data(intf);
1889                                 spin_unlock_irqrestore(&interfaces_lock,flags);
1890                                 kfree(intf);
1891                                 rv = 0;
1892                                 goto out_call_watcher;
1893                         }
1894                 }
1895         } else {
1896                 rv = -EBUSY;
1897         }
1898         up_write(&interfaces_sem);
1899
1900         return rv;
1901
1902  out_call_watcher:
1903         downgrade_write(&interfaces_sem);
1904
1905         /* Call all the watcher interfaces to tell them that
1906            an interface is gone. */
1907         down_read(&smi_watchers_sem);
1908         list_for_each_entry(w, &smi_watchers, link) {
1909                 w->smi_gone(i);
1910         }
1911         up_read(&smi_watchers_sem);
1912         up_read(&interfaces_sem);
1913         return 0;
1914 }
1915
1916 static int handle_ipmb_get_msg_rsp(ipmi_smi_t          intf,
1917                                    struct ipmi_smi_msg *msg)
1918 {
1919         struct ipmi_ipmb_addr ipmb_addr;
1920         struct ipmi_recv_msg  *recv_msg;
1921         unsigned long         flags;
1922
1923
1924         /* This is 11, not 10, because the response must contain a
1925          * completion code. */
1926         if (msg->rsp_size < 11) {
1927                 /* Message not big enough, just ignore it. */
1928                 spin_lock_irqsave(&intf->counter_lock, flags);
1929                 intf->invalid_ipmb_responses++;
1930                 spin_unlock_irqrestore(&intf->counter_lock, flags);
1931                 return 0;
1932         }
1933
1934         if (msg->rsp[2] != 0) {
1935                 /* An error getting the response, just ignore it. */
1936                 return 0;
1937         }
1938
1939         ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE;
1940         ipmb_addr.slave_addr = msg->rsp[6];
1941         ipmb_addr.channel = msg->rsp[3] & 0x0f;
1942         ipmb_addr.lun = msg->rsp[7] & 3;
1943
1944         /* It's a response from a remote entity.  Look up the sequence
1945            number and handle the response. */
1946         if (intf_find_seq(intf,
1947                           msg->rsp[7] >> 2,
1948                           msg->rsp[3] & 0x0f,
1949                           msg->rsp[8],
1950                           (msg->rsp[4] >> 2) & (~1),
1951                           (struct ipmi_addr *) &(ipmb_addr),
1952                           &recv_msg))
1953         {
1954                 /* We were unable to find the sequence number,
1955                    so just nuke the message. */
1956                 spin_lock_irqsave(&intf->counter_lock, flags);
1957                 intf->unhandled_ipmb_responses++;
1958                 spin_unlock_irqrestore(&intf->counter_lock, flags);
1959                 return 0;
1960         }
1961
1962         memcpy(recv_msg->msg_data,
1963                &(msg->rsp[9]),
1964                msg->rsp_size - 9);
1965         /* THe other fields matched, so no need to set them, except
1966            for netfn, which needs to be the response that was
1967            returned, not the request value. */
1968         recv_msg->msg.netfn = msg->rsp[4] >> 2;
1969         recv_msg->msg.data = recv_msg->msg_data;
1970         recv_msg->msg.data_len = msg->rsp_size - 10;
1971         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
1972         spin_lock_irqsave(&intf->counter_lock, flags);
1973         intf->handled_ipmb_responses++;
1974         spin_unlock_irqrestore(&intf->counter_lock, flags);
1975         deliver_response(recv_msg);
1976
1977         return 0;
1978 }
1979
1980 static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
1981                                    struct ipmi_smi_msg *msg)
1982 {
1983         struct cmd_rcvr       *rcvr;
1984         int                   rv = 0;
1985         unsigned char         netfn;
1986         unsigned char         cmd;
1987         ipmi_user_t           user = NULL;
1988         struct ipmi_ipmb_addr *ipmb_addr;
1989         struct ipmi_recv_msg  *recv_msg;
1990         unsigned long         flags;
1991
1992         if (msg->rsp_size < 10) {
1993                 /* Message not big enough, just ignore it. */
1994                 spin_lock_irqsave(&intf->counter_lock, flags);
1995                 intf->invalid_commands++;
1996                 spin_unlock_irqrestore(&intf->counter_lock, flags);
1997                 return 0;
1998         }
1999
2000         if (msg->rsp[2] != 0) {
2001                 /* An error getting the response, just ignore it. */
2002                 return 0;
2003         }
2004
2005         netfn = msg->rsp[4] >> 2;
2006         cmd = msg->rsp[8];
2007
2008         read_lock(&(intf->cmd_rcvr_lock));
2009
2010         if (intf->all_cmd_rcvr) {
2011                 user = intf->all_cmd_rcvr;
2012         } else {
2013                 /* Find the command/netfn. */
2014                 list_for_each_entry(rcvr, &(intf->cmd_rcvrs), link) {
2015                         if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)) {
2016                                 user = rcvr->user;
2017                                 break;
2018                         }
2019                 }
2020         }
2021         read_unlock(&(intf->cmd_rcvr_lock));
2022
2023         if (user == NULL) {
2024                 /* We didn't find a user, deliver an error response. */
2025                 spin_lock_irqsave(&intf->counter_lock, flags);
2026                 intf->unhandled_commands++;
2027                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2028
2029                 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
2030                 msg->data[1] = IPMI_SEND_MSG_CMD;
2031                 msg->data[2] = msg->rsp[3];
2032                 msg->data[3] = msg->rsp[6];
2033                 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3);
2034                 msg->data[5] = ipmb_checksum(&(msg->data[3]), 2);
2035                 msg->data[6] = intf->my_address;
2036                 /* rqseq/lun */
2037                 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3);
2038                 msg->data[8] = msg->rsp[8]; /* cmd */
2039                 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE;
2040                 msg->data[10] = ipmb_checksum(&(msg->data[6]), 4);
2041                 msg->data_size = 11;
2042
2043 #ifdef DEBUG_MSGING
2044         {
2045                 int m;
2046                 printk("Invalid command:");
2047                 for (m=0; m<msg->data_size; m++)
2048                         printk(" %2.2x", msg->data[m]);
2049                 printk("\n");
2050         }
2051 #endif
2052                 intf->handlers->sender(intf->send_info, msg, 0);
2053
2054                 rv = -1; /* We used the message, so return the value that
2055                             causes it to not be freed or queued. */
2056         } else {
2057                 /* Deliver the message to the user. */
2058                 spin_lock_irqsave(&intf->counter_lock, flags);
2059                 intf->handled_commands++;
2060                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2061
2062                 recv_msg = ipmi_alloc_recv_msg();
2063                 if (! recv_msg) {
2064                         /* We couldn't allocate memory for the
2065                            message, so requeue it for handling
2066                            later. */
2067                         rv = 1;
2068                 } else {
2069                         /* Extract the source address from the data. */
2070                         ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
2071                         ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE;
2072                         ipmb_addr->slave_addr = msg->rsp[6];
2073                         ipmb_addr->lun = msg->rsp[7] & 3;
2074                         ipmb_addr->channel = msg->rsp[3] & 0xf;
2075
2076                         /* Extract the rest of the message information
2077                            from the IPMB header.*/
2078                         recv_msg->user = user;
2079                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
2080                         recv_msg->msgid = msg->rsp[7] >> 2;
2081                         recv_msg->msg.netfn = msg->rsp[4] >> 2;
2082                         recv_msg->msg.cmd = msg->rsp[8];
2083                         recv_msg->msg.data = recv_msg->msg_data;
2084
2085                         /* We chop off 10, not 9 bytes because the checksum
2086                            at the end also needs to be removed. */
2087                         recv_msg->msg.data_len = msg->rsp_size - 10;
2088                         memcpy(recv_msg->msg_data,
2089                                &(msg->rsp[9]),
2090                                msg->rsp_size - 10);
2091                         deliver_response(recv_msg);
2092                 }
2093         }
2094
2095         return rv;
2096 }
2097
2098 static int handle_lan_get_msg_rsp(ipmi_smi_t          intf,
2099                                   struct ipmi_smi_msg *msg)
2100 {
2101         struct ipmi_lan_addr  lan_addr;
2102         struct ipmi_recv_msg  *recv_msg;
2103         unsigned long         flags;
2104
2105
2106         /* This is 13, not 12, because the response must contain a
2107          * completion code. */
2108         if (msg->rsp_size < 13) {
2109                 /* Message not big enough, just ignore it. */
2110                 spin_lock_irqsave(&intf->counter_lock, flags);
2111                 intf->invalid_lan_responses++;
2112                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2113                 return 0;
2114         }
2115
2116         if (msg->rsp[2] != 0) {
2117                 /* An error getting the response, just ignore it. */
2118                 return 0;
2119         }
2120
2121         lan_addr.addr_type = IPMI_LAN_ADDR_TYPE;
2122         lan_addr.session_handle = msg->rsp[4];
2123         lan_addr.remote_SWID = msg->rsp[8];
2124         lan_addr.local_SWID = msg->rsp[5];
2125         lan_addr.channel = msg->rsp[3] & 0x0f;
2126         lan_addr.privilege = msg->rsp[3] >> 4;
2127         lan_addr.lun = msg->rsp[9] & 3;
2128
2129         /* It's a response from a remote entity.  Look up the sequence
2130            number and handle the response. */
2131         if (intf_find_seq(intf,
2132                           msg->rsp[9] >> 2,
2133                           msg->rsp[3] & 0x0f,
2134                           msg->rsp[10],
2135                           (msg->rsp[6] >> 2) & (~1),
2136                           (struct ipmi_addr *) &(lan_addr),
2137                           &recv_msg))
2138         {
2139                 /* We were unable to find the sequence number,
2140                    so just nuke the message. */
2141                 spin_lock_irqsave(&intf->counter_lock, flags);
2142                 intf->unhandled_lan_responses++;
2143                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2144                 return 0;
2145         }
2146
2147         memcpy(recv_msg->msg_data,
2148                &(msg->rsp[11]),
2149                msg->rsp_size - 11);
2150         /* The other fields matched, so no need to set them, except
2151            for netfn, which needs to be the response that was
2152            returned, not the request value. */
2153         recv_msg->msg.netfn = msg->rsp[6] >> 2;
2154         recv_msg->msg.data = recv_msg->msg_data;
2155         recv_msg->msg.data_len = msg->rsp_size - 12;
2156         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
2157         spin_lock_irqsave(&intf->counter_lock, flags);
2158         intf->handled_lan_responses++;
2159         spin_unlock_irqrestore(&intf->counter_lock, flags);
2160         deliver_response(recv_msg);
2161
2162         return 0;
2163 }
2164
2165 static int handle_lan_get_msg_cmd(ipmi_smi_t          intf,
2166                                   struct ipmi_smi_msg *msg)
2167 {
2168         struct cmd_rcvr       *rcvr;
2169         int                   rv = 0;
2170         unsigned char         netfn;
2171         unsigned char         cmd;
2172         ipmi_user_t           user = NULL;
2173         struct ipmi_lan_addr  *lan_addr;
2174         struct ipmi_recv_msg  *recv_msg;
2175         unsigned long         flags;
2176
2177         if (msg->rsp_size < 12) {
2178                 /* Message not big enough, just ignore it. */
2179                 spin_lock_irqsave(&intf->counter_lock, flags);
2180                 intf->invalid_commands++;
2181                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2182                 return 0;
2183         }
2184
2185         if (msg->rsp[2] != 0) {
2186                 /* An error getting the response, just ignore it. */
2187                 return 0;
2188         }
2189
2190         netfn = msg->rsp[6] >> 2;
2191         cmd = msg->rsp[10];
2192
2193         read_lock(&(intf->cmd_rcvr_lock));
2194
2195         if (intf->all_cmd_rcvr) {
2196                 user = intf->all_cmd_rcvr;
2197         } else {
2198                 /* Find the command/netfn. */
2199                 list_for_each_entry(rcvr, &(intf->cmd_rcvrs), link) {
2200                         if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)) {
2201                                 user = rcvr->user;
2202                                 break;
2203                         }
2204                 }
2205         }
2206         read_unlock(&(intf->cmd_rcvr_lock));
2207
2208         if (user == NULL) {
2209                 /* We didn't find a user, deliver an error response. */
2210                 spin_lock_irqsave(&intf->counter_lock, flags);
2211                 intf->unhandled_commands++;
2212                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2213
2214                 rv = 0; /* Don't do anything with these messages, just
2215                            allow them to be freed. */
2216         } else {
2217                 /* Deliver the message to the user. */
2218                 spin_lock_irqsave(&intf->counter_lock, flags);
2219                 intf->handled_commands++;
2220                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2221
2222                 recv_msg = ipmi_alloc_recv_msg();
2223                 if (! recv_msg) {
2224                         /* We couldn't allocate memory for the
2225                            message, so requeue it for handling
2226                            later. */
2227                         rv = 1;
2228                 } else {
2229                         /* Extract the source address from the data. */
2230                         lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
2231                         lan_addr->addr_type = IPMI_LAN_ADDR_TYPE;
2232                         lan_addr->session_handle = msg->rsp[4];
2233                         lan_addr->remote_SWID = msg->rsp[8];
2234                         lan_addr->local_SWID = msg->rsp[5];
2235                         lan_addr->lun = msg->rsp[9] & 3;
2236                         lan_addr->channel = msg->rsp[3] & 0xf;
2237                         lan_addr->privilege = msg->rsp[3] >> 4;
2238
2239                         /* Extract the rest of the message information
2240                            from the IPMB header.*/
2241                         recv_msg->user = user;
2242                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
2243                         recv_msg->msgid = msg->rsp[9] >> 2;
2244                         recv_msg->msg.netfn = msg->rsp[6] >> 2;
2245                         recv_msg->msg.cmd = msg->rsp[10];
2246                         recv_msg->msg.data = recv_msg->msg_data;
2247
2248                         /* We chop off 12, not 11 bytes because the checksum
2249                            at the end also needs to be removed. */
2250                         recv_msg->msg.data_len = msg->rsp_size - 12;
2251                         memcpy(recv_msg->msg_data,
2252                                &(msg->rsp[11]),
2253                                msg->rsp_size - 12);
2254                         deliver_response(recv_msg);
2255                 }
2256         }
2257
2258         return rv;
2259 }
2260
2261 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg,
2262                                      struct ipmi_smi_msg  *msg)
2263 {
2264         struct ipmi_system_interface_addr *smi_addr;
2265
2266         recv_msg->msgid = 0;
2267         smi_addr = (struct ipmi_system_interface_addr *) &(recv_msg->addr);
2268         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2269         smi_addr->channel = IPMI_BMC_CHANNEL;
2270         smi_addr->lun = msg->rsp[0] & 3;
2271         recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE;
2272         recv_msg->msg.netfn = msg->rsp[0] >> 2;
2273         recv_msg->msg.cmd = msg->rsp[1];
2274         memcpy(recv_msg->msg_data, &(msg->rsp[3]), msg->rsp_size - 3);
2275         recv_msg->msg.data = recv_msg->msg_data;
2276         recv_msg->msg.data_len = msg->rsp_size - 3;
2277 }
2278
2279 /* This will be called with the intf->users_lock read-locked, so no need
2280    to do that here. */
2281 static int handle_read_event_rsp(ipmi_smi_t          intf,
2282                                  struct ipmi_smi_msg *msg)
2283 {
2284         struct ipmi_recv_msg *recv_msg, *recv_msg2;
2285         struct list_head     msgs;
2286         ipmi_user_t          user;
2287         int                  rv = 0;
2288         int                  deliver_count = 0;
2289         unsigned long        flags;
2290
2291         if (msg->rsp_size < 19) {
2292                 /* Message is too small to be an IPMB event. */
2293                 spin_lock_irqsave(&intf->counter_lock, flags);
2294                 intf->invalid_events++;
2295                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2296                 return 0;
2297         }
2298
2299         if (msg->rsp[2] != 0) {
2300                 /* An error getting the event, just ignore it. */
2301                 return 0;
2302         }
2303
2304         INIT_LIST_HEAD(&msgs);
2305
2306         spin_lock_irqsave(&(intf->events_lock), flags);
2307
2308         spin_lock(&intf->counter_lock);
2309         intf->events++;
2310         spin_unlock(&intf->counter_lock);
2311
2312         /* Allocate and fill in one message for every user that is getting
2313            events. */
2314         list_for_each_entry(user, &(intf->users), link) {
2315                 if (! user->gets_events)
2316                         continue;
2317
2318                 recv_msg = ipmi_alloc_recv_msg();
2319                 if (! recv_msg) {
2320                         list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
2321                                 list_del(&recv_msg->link);
2322                                 ipmi_free_recv_msg(recv_msg);
2323                         }
2324                         /* We couldn't allocate memory for the
2325                            message, so requeue it for handling
2326                            later. */
2327                         rv = 1;
2328                         goto out;
2329                 }
2330
2331                 deliver_count++;
2332
2333                 copy_event_into_recv_msg(recv_msg, msg);
2334                 recv_msg->user = user;
2335                 list_add_tail(&(recv_msg->link), &msgs);
2336         }
2337
2338         if (deliver_count) {
2339                 /* Now deliver all the messages. */
2340                 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
2341                         list_del(&recv_msg->link);
2342                         deliver_response(recv_msg);
2343                 }
2344         } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) {
2345                 /* No one to receive the message, put it in queue if there's
2346                    not already too many things in the queue. */
2347                 recv_msg = ipmi_alloc_recv_msg();
2348                 if (! recv_msg) {
2349                         /* We couldn't allocate memory for the
2350                            message, so requeue it for handling
2351                            later. */
2352                         rv = 1;
2353                         goto out;
2354                 }
2355
2356                 copy_event_into_recv_msg(recv_msg, msg);
2357                 list_add_tail(&(recv_msg->link), &(intf->waiting_events));
2358         } else {
2359                 /* There's too many things in the queue, discard this
2360                    message. */
2361                 printk(KERN_WARNING PFX "Event queue full, discarding an"
2362                        " incoming event\n");
2363         }
2364
2365  out:
2366         spin_unlock_irqrestore(&(intf->events_lock), flags);
2367
2368         return rv;
2369 }
2370
2371 static int handle_bmc_rsp(ipmi_smi_t          intf,
2372                           struct ipmi_smi_msg *msg)
2373 {
2374         struct ipmi_recv_msg *recv_msg;
2375         int                  found = 0;
2376         struct ipmi_user     *user;
2377         unsigned long        flags;
2378
2379         recv_msg = (struct ipmi_recv_msg *) msg->user_data;
2380
2381         /* Make sure the user still exists. */
2382         list_for_each_entry(user, &(intf->users), link) {
2383                 if (user == recv_msg->user) {
2384                         /* Found it, so we can deliver it */
2385                         found = 1;
2386                         break;
2387                 }
2388         }
2389
2390         if (!found) {
2391                 /* Special handling for NULL users. */
2392                 if (!recv_msg->user && intf->null_user_handler)
2393                         intf->null_user_handler(intf, msg);
2394                 /* The user for the message went away, so give up. */
2395                 spin_lock_irqsave(&intf->counter_lock, flags);
2396                 intf->unhandled_local_responses++;
2397                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2398                 ipmi_free_recv_msg(recv_msg);
2399         } else {
2400                 struct ipmi_system_interface_addr *smi_addr;
2401
2402                 spin_lock_irqsave(&intf->counter_lock, flags);
2403                 intf->handled_local_responses++;
2404                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2405                 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
2406                 recv_msg->msgid = msg->msgid;
2407                 smi_addr = ((struct ipmi_system_interface_addr *)
2408                             &(recv_msg->addr));
2409                 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2410                 smi_addr->channel = IPMI_BMC_CHANNEL;
2411                 smi_addr->lun = msg->rsp[0] & 3;
2412                 recv_msg->msg.netfn = msg->rsp[0] >> 2;
2413                 recv_msg->msg.cmd = msg->rsp[1];
2414                 memcpy(recv_msg->msg_data,
2415                        &(msg->rsp[2]),
2416                        msg->rsp_size - 2);
2417                 recv_msg->msg.data = recv_msg->msg_data;
2418                 recv_msg->msg.data_len = msg->rsp_size - 2;
2419                 deliver_response(recv_msg);
2420         }
2421
2422         return 0;
2423 }
2424
2425 /* Handle a new message.  Return 1 if the message should be requeued,
2426    0 if the message should be freed, or -1 if the message should not
2427    be freed or requeued. */
2428 static int handle_new_recv_msg(ipmi_smi_t          intf,
2429                                struct ipmi_smi_msg *msg)
2430 {
2431         int requeue;
2432         int chan;
2433
2434 #ifdef DEBUG_MSGING
2435         int m;
2436         printk("Recv:");
2437         for (m=0; m<msg->rsp_size; m++)
2438                 printk(" %2.2x", msg->rsp[m]);
2439         printk("\n");
2440 #endif
2441         if (msg->rsp_size < 2) {
2442                 /* Message is too small to be correct. */
2443                 printk(KERN_WARNING PFX "BMC returned to small a message"
2444                        " for netfn %x cmd %x, got %d bytes\n",
2445                        (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size);
2446
2447                 /* Generate an error response for the message. */
2448                 msg->rsp[0] = msg->data[0] | (1 << 2);
2449                 msg->rsp[1] = msg->data[1];
2450                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
2451                 msg->rsp_size = 3;
2452         } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1))/* Netfn */
2453                    || (msg->rsp[1] != msg->data[1]))              /* Command */
2454         {
2455                 /* The response is not even marginally correct. */
2456                 printk(KERN_WARNING PFX "BMC returned incorrect response,"
2457                        " expected netfn %x cmd %x, got netfn %x cmd %x\n",
2458                        (msg->data[0] >> 2) | 1, msg->data[1],
2459                        msg->rsp[0] >> 2, msg->rsp[1]);
2460
2461                 /* Generate an error response for the message. */
2462                 msg->rsp[0] = msg->data[0] | (1 << 2);
2463                 msg->rsp[1] = msg->data[1];
2464                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
2465                 msg->rsp_size = 3;
2466         }
2467
2468         if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
2469             && (msg->rsp[1] == IPMI_SEND_MSG_CMD)
2470             && (msg->user_data != NULL))
2471         {
2472                 /* It's a response to a response we sent.  For this we
2473                    deliver a send message response to the user. */
2474                 struct ipmi_recv_msg *recv_msg = msg->user_data;
2475
2476                 requeue = 0;
2477                 if (msg->rsp_size < 2)
2478                         /* Message is too small to be correct. */
2479                         goto out;
2480
2481                 chan = msg->data[2] & 0x0f;
2482                 if (chan >= IPMI_MAX_CHANNELS)
2483                         /* Invalid channel number */
2484                         goto out;
2485
2486                 if (recv_msg) {
2487                         recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE;
2488                         recv_msg->msg.data = recv_msg->msg_data;
2489                         recv_msg->msg.data_len = 1;
2490                         recv_msg->msg_data[0] = msg->rsp[2];
2491                         deliver_response(recv_msg);
2492                 }
2493         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
2494                    && (msg->rsp[1] == IPMI_GET_MSG_CMD))
2495         {
2496                 /* It's from the receive queue. */
2497                 chan = msg->rsp[3] & 0xf;
2498                 if (chan >= IPMI_MAX_CHANNELS) {
2499                         /* Invalid channel number */
2500                         requeue = 0;
2501                         goto out;
2502                 }
2503
2504                 switch (intf->channels[chan].medium) {
2505                 case IPMI_CHANNEL_MEDIUM_IPMB:
2506                         if (msg->rsp[4] & 0x04) {
2507                                 /* It's a response, so find the
2508                                    requesting message and send it up. */
2509                                 requeue = handle_ipmb_get_msg_rsp(intf, msg);
2510                         } else {
2511                                 /* It's a command to the SMS from some other
2512                                    entity.  Handle that. */
2513                                 requeue = handle_ipmb_get_msg_cmd(intf, msg);
2514                         }
2515                         break;
2516
2517                 case IPMI_CHANNEL_MEDIUM_8023LAN:
2518                 case IPMI_CHANNEL_MEDIUM_ASYNC:
2519                         if (msg->rsp[6] & 0x04) {
2520                                 /* It's a response, so find the
2521                                    requesting message and send it up. */
2522                                 requeue = handle_lan_get_msg_rsp(intf, msg);
2523                         } else {
2524                                 /* It's a command to the SMS from some other
2525                                    entity.  Handle that. */
2526                                 requeue = handle_lan_get_msg_cmd(intf, msg);
2527                         }
2528                         break;
2529
2530                 default:
2531                         /* We don't handle the channel type, so just
2532                          * free the message. */
2533                         requeue = 0;
2534                 }
2535
2536         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
2537                    && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD))
2538         {
2539                 /* It's an asyncronous event. */
2540                 requeue = handle_read_event_rsp(intf, msg);
2541         } else {
2542                 /* It's a response from the local BMC. */
2543                 requeue = handle_bmc_rsp(intf, msg);
2544         }
2545
2546  out:
2547         return requeue;
2548 }
2549
2550 /* Handle a new message from the lower layer. */
2551 void ipmi_smi_msg_received(ipmi_smi_t          intf,
2552                            struct ipmi_smi_msg *msg)
2553 {
2554         unsigned long flags;
2555         int           rv;
2556
2557
2558         /* Lock the user lock so the user can't go away while we are
2559            working on it. */
2560         read_lock(&(intf->users_lock));
2561
2562         if ((msg->data_size >= 2)
2563             && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
2564             && (msg->data[1] == IPMI_SEND_MSG_CMD)
2565             && (msg->user_data == NULL)) {
2566                 /* This is the local response to a command send, start
2567                    the timer for these.  The user_data will not be
2568                    NULL if this is a response send, and we will let
2569                    response sends just go through. */
2570
2571                 /* Check for errors, if we get certain errors (ones
2572                    that mean basically we can try again later), we
2573                    ignore them and start the timer.  Otherwise we
2574                    report the error immediately. */
2575                 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
2576                     && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
2577                     && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR))
2578                 {
2579                         int chan = msg->rsp[3] & 0xf;
2580
2581                         /* Got an error sending the message, handle it. */
2582                         spin_lock_irqsave(&intf->counter_lock, flags);
2583                         if (chan >= IPMI_MAX_CHANNELS)
2584                                 ; /* This shouldn't happen */
2585                         else if ((intf->channels[chan].medium
2586                                   == IPMI_CHANNEL_MEDIUM_8023LAN)
2587                                  || (intf->channels[chan].medium
2588                                      == IPMI_CHANNEL_MEDIUM_ASYNC))
2589                                 intf->sent_lan_command_errs++;
2590                         else
2591                                 intf->sent_ipmb_command_errs++;
2592                         spin_unlock_irqrestore(&intf->counter_lock, flags);
2593                         intf_err_seq(intf, msg->msgid, msg->rsp[2]);
2594                 } else {
2595                         /* The message was sent, start the timer. */
2596                         intf_start_seq_timer(intf, msg->msgid);
2597                 }
2598
2599                 ipmi_free_smi_msg(msg);
2600                 goto out_unlock;
2601         }
2602
2603         /* To preserve message order, if the list is not empty, we
2604            tack this message onto the end of the list. */
2605         spin_lock_irqsave(&(intf->waiting_msgs_lock), flags);
2606         if (!list_empty(&(intf->waiting_msgs))) {
2607                 list_add_tail(&(msg->link), &(intf->waiting_msgs));
2608                 spin_unlock(&(intf->waiting_msgs_lock));
2609                 goto out_unlock;
2610         }
2611         spin_unlock_irqrestore(&(intf->waiting_msgs_lock), flags);
2612
2613         rv = handle_new_recv_msg(intf, msg);
2614         if (rv > 0) {
2615                 /* Could not handle the message now, just add it to a
2616                    list to handle later. */
2617                 spin_lock(&(intf->waiting_msgs_lock));
2618                 list_add_tail(&(msg->link), &(intf->waiting_msgs));
2619                 spin_unlock(&(intf->waiting_msgs_lock));
2620         } else if (rv == 0) {
2621                 ipmi_free_smi_msg(msg);
2622         }
2623
2624  out_unlock:
2625         read_unlock(&(intf->users_lock));
2626 }
2627
2628 void ipmi_smi_watchdog_pretimeout(ipmi_smi_t intf)
2629 {
2630         ipmi_user_t user;
2631
2632         read_lock(&(intf->users_lock));
2633         list_for_each_entry(user, &(intf->users), link) {
2634                 if (! user->handler->ipmi_watchdog_pretimeout)
2635                         continue;
2636
2637                 user->handler->ipmi_watchdog_pretimeout(user->handler_data);
2638         }
2639         read_unlock(&(intf->users_lock));
2640 }
2641
2642 static void
2643 handle_msg_timeout(struct ipmi_recv_msg *msg)
2644 {
2645         msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
2646         msg->msg_data[0] = IPMI_TIMEOUT_COMPLETION_CODE;
2647         msg->msg.netfn |= 1; /* Convert to a response. */
2648         msg->msg.data_len = 1;
2649         msg->msg.data = msg->msg_data;
2650         deliver_response(msg);
2651 }
2652
2653 static void
2654 send_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
2655                    struct ipmi_smi_msg *smi_msg,
2656                    unsigned char seq, long seqid)
2657 {
2658         if (!smi_msg)
2659                 smi_msg = ipmi_alloc_smi_msg();
2660         if (!smi_msg)
2661                 /* If we can't allocate the message, then just return, we
2662                    get 4 retries, so this should be ok. */
2663                 return;
2664
2665         memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len);
2666         smi_msg->data_size = recv_msg->msg.data_len;
2667         smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);
2668
2669         /* Send the new message.  We send with a zero priority.  It
2670            timed out, I doubt time is that critical now, and high
2671            priority messages are really only for messages to the local
2672            MC, which don't get resent. */
2673         intf->handlers->sender(intf->send_info, smi_msg, 0);
2674
2675 #ifdef DEBUG_MSGING
2676         {
2677                 int m;
2678                 printk("Resend: ");
2679                 for (m=0; m<smi_msg->data_size; m++)
2680                         printk(" %2.2x", smi_msg->data[m]);
2681                 printk("\n");
2682         }
2683 #endif
2684 }
2685
2686 static void
2687 ipmi_timeout_handler(long timeout_period)
2688 {
2689         ipmi_smi_t           intf;
2690         struct list_head     timeouts;
2691         struct ipmi_recv_msg *msg, *msg2;
2692         struct ipmi_smi_msg  *smi_msg, *smi_msg2;
2693         unsigned long        flags;
2694         int                  i, j;
2695
2696         INIT_LIST_HEAD(&timeouts);
2697
2698         spin_lock(&interfaces_lock);
2699         for (i=0; i<MAX_IPMI_INTERFACES; i++) {
2700                 intf = ipmi_interfaces[i];
2701                 if (intf == NULL)
2702                         continue;
2703
2704                 read_lock(&(intf->users_lock));
2705
2706                 /* See if any waiting messages need to be processed. */
2707                 spin_lock_irqsave(&(intf->waiting_msgs_lock), flags);
2708                 list_for_each_entry_safe(smi_msg, smi_msg2, &(intf->waiting_msgs), link) {
2709                         if (! handle_new_recv_msg(intf, smi_msg)) {
2710                                 list_del(&smi_msg->link);
2711                                 ipmi_free_smi_msg(smi_msg);
2712                         } else {
2713                                 /* To preserve message order, quit if we
2714                                    can't handle a message. */
2715                                 break;
2716                         }
2717                 }
2718                 spin_unlock_irqrestore(&(intf->waiting_msgs_lock), flags);
2719
2720                 /* Go through the seq table and find any messages that
2721                    have timed out, putting them in the timeouts
2722                    list. */
2723                 spin_lock_irqsave(&(intf->seq_lock), flags);
2724                 for (j=0; j<IPMI_IPMB_NUM_SEQ; j++) {
2725                         struct seq_table *ent = &(intf->seq_table[j]);
2726                         if (!ent->inuse)
2727                                 continue;
2728
2729                         ent->timeout -= timeout_period;
2730                         if (ent->timeout > 0)
2731                                 continue;
2732
2733                         if (ent->retries_left == 0) {
2734                                 /* The message has used all its retries. */
2735                                 ent->inuse = 0;
2736                                 msg = ent->recv_msg;
2737                                 list_add_tail(&(msg->link), &timeouts);
2738                                 spin_lock(&intf->counter_lock);
2739                                 if (ent->broadcast)
2740                                         intf->timed_out_ipmb_broadcasts++;
2741                                 else if (ent->recv_msg->addr.addr_type
2742                                          == IPMI_LAN_ADDR_TYPE)
2743                                         intf->timed_out_lan_commands++;
2744                                 else
2745                                         intf->timed_out_ipmb_commands++;
2746                                 spin_unlock(&intf->counter_lock);
2747                         } else {
2748                                 /* More retries, send again. */
2749
2750                                 /* Start with the max timer, set to normal
2751                                    timer after the message is sent. */
2752                                 ent->timeout = MAX_MSG_TIMEOUT;
2753                                 ent->retries_left--;
2754                                 send_from_recv_msg(intf, ent->recv_msg, NULL,
2755                                                    j, ent->seqid);
2756                                 spin_lock(&intf->counter_lock);
2757                                 if (ent->recv_msg->addr.addr_type
2758                                     == IPMI_LAN_ADDR_TYPE)
2759                                         intf->retransmitted_lan_commands++;
2760                                 else
2761                                         intf->retransmitted_ipmb_commands++;
2762                                 spin_unlock(&intf->counter_lock);
2763                         }
2764                 }
2765                 spin_unlock_irqrestore(&(intf->seq_lock), flags);
2766
2767                 list_for_each_entry_safe(msg, msg2, &timeouts, link) {
2768                         handle_msg_timeout(msg);
2769                 }
2770
2771                 read_unlock(&(intf->users_lock));
2772         }
2773         spin_unlock(&interfaces_lock);
2774 }
2775
2776 static void ipmi_request_event(void)
2777 {
2778         ipmi_smi_t intf;
2779         int        i;
2780
2781         spin_lock(&interfaces_lock);
2782         for (i=0; i<MAX_IPMI_INTERFACES; i++) {
2783                 intf = ipmi_interfaces[i];
2784                 if (intf == NULL)
2785                         continue;
2786
2787                 intf->handlers->request_events(intf->send_info);
2788         }
2789         spin_unlock(&interfaces_lock);
2790 }
2791
2792 static struct timer_list ipmi_timer;
2793
2794 /* Call every ~100 ms. */
2795 #define IPMI_TIMEOUT_TIME       100
2796
2797 /* How many jiffies does it take to get to the timeout time. */
2798 #define IPMI_TIMEOUT_JIFFIES    ((IPMI_TIMEOUT_TIME * HZ) / 1000)
2799
2800 /* Request events from the queue every second (this is the number of
2801    IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the
2802    future, IPMI will add a way to know immediately if an event is in
2803    the queue and this silliness can go away. */
2804 #define IPMI_REQUEST_EV_TIME    (1000 / (IPMI_TIMEOUT_TIME))
2805
2806 static volatile int stop_operation = 0;
2807 static volatile int timer_stopped = 0;
2808 static unsigned int ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
2809
2810 static void ipmi_timeout(unsigned long data)
2811 {
2812         if (stop_operation) {
2813                 timer_stopped = 1;
2814                 return;
2815         }
2816
2817         ticks_to_req_ev--;
2818         if (ticks_to_req_ev == 0) {
2819                 ipmi_request_event();
2820                 ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
2821         }
2822
2823         ipmi_timeout_handler(IPMI_TIMEOUT_TIME);
2824
2825         ipmi_timer.expires += IPMI_TIMEOUT_JIFFIES;
2826         add_timer(&ipmi_timer);
2827 }
2828
2829
2830 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0);
2831 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);
2832
2833 /* FIXME - convert these to slabs. */
2834 static void free_smi_msg(struct ipmi_smi_msg *msg)
2835 {
2836         atomic_dec(&smi_msg_inuse_count);
2837         kfree(msg);
2838 }
2839
2840 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)
2841 {
2842         struct ipmi_smi_msg *rv;
2843         rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC);
2844         if (rv) {
2845                 rv->done = free_smi_msg;
2846                 rv->user_data = NULL;
2847                 atomic_inc(&smi_msg_inuse_count);
2848         }
2849         return rv;
2850 }
2851
2852 static void free_recv_msg(struct ipmi_recv_msg *msg)
2853 {
2854         atomic_dec(&recv_msg_inuse_count);
2855         kfree(msg);
2856 }
2857
2858 struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
2859 {
2860         struct ipmi_recv_msg *rv;
2861
2862         rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC);
2863         if (rv) {
2864                 rv->done = free_recv_msg;
2865                 atomic_inc(&recv_msg_inuse_count);
2866         }
2867         return rv;
2868 }
2869
2870 #ifdef CONFIG_IPMI_PANIC_EVENT
2871
2872 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg)
2873 {
2874 }
2875
2876 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg)
2877 {
2878 }
2879
2880 #ifdef CONFIG_IPMI_PANIC_STRING
2881 static void event_receiver_fetcher(ipmi_smi_t intf, struct ipmi_smi_msg *msg)
2882 {
2883         if ((msg->rsp[0] == (IPMI_NETFN_SENSOR_EVENT_RESPONSE << 2))
2884             && (msg->rsp[1] == IPMI_GET_EVENT_RECEIVER_CMD)
2885             && (msg->rsp[2] == IPMI_CC_NO_ERROR))
2886         {
2887                 /* A get event receiver command, save it. */
2888                 intf->event_receiver = msg->rsp[3];
2889                 intf->event_receiver_lun = msg->rsp[4] & 0x3;
2890         }
2891 }
2892
2893 static void device_id_fetcher(ipmi_smi_t intf, struct ipmi_smi_msg *msg)
2894 {
2895         if ((msg->rsp[0] == (IPMI_NETFN_APP_RESPONSE << 2))
2896             && (msg->rsp[1] == IPMI_GET_DEVICE_ID_CMD)
2897             && (msg->rsp[2] == IPMI_CC_NO_ERROR))
2898         {
2899                 /* A get device id command, save if we are an event
2900                    receiver or generator. */
2901                 intf->local_sel_device = (msg->rsp[8] >> 2) & 1;
2902                 intf->local_event_generator = (msg->rsp[8] >> 5) & 1;
2903         }
2904 }
2905 #endif
2906
2907 static void send_panic_events(char *str)
2908 {
2909         struct kernel_ipmi_msg            msg;
2910         ipmi_smi_t                        intf;
2911         unsigned char                     data[16];
2912         int                               i;
2913         struct ipmi_system_interface_addr *si;
2914         struct ipmi_addr                  addr;
2915         struct ipmi_smi_msg               smi_msg;
2916         struct ipmi_recv_msg              recv_msg;
2917
2918         si = (struct ipmi_system_interface_addr *) &addr;
2919         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2920         si->channel = IPMI_BMC_CHANNEL;
2921         si->lun = 0;
2922
2923         /* Fill in an event telling that we have failed. */
2924         msg.netfn = 0x04; /* Sensor or Event. */
2925         msg.cmd = 2; /* Platform event command. */
2926         msg.data = data;
2927         msg.data_len = 8;
2928         data[0] = 0x21; /* Kernel generator ID, IPMI table 5-4 */
2929         data[1] = 0x03; /* This is for IPMI 1.0. */
2930         data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */
2931         data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */
2932         data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */
2933
2934         /* Put a few breadcrumbs in.  Hopefully later we can add more things
2935            to make the panic events more useful. */
2936         if (str) {
2937                 data[3] = str[0];
2938                 data[6] = str[1];
2939                 data[7] = str[2];
2940         }
2941
2942         smi_msg.done = dummy_smi_done_handler;
2943         recv_msg.done = dummy_recv_done_handler;
2944
2945         /* For every registered interface, send the event. */
2946         for (i=0; i<MAX_IPMI_INTERFACES; i++) {
2947                 intf = ipmi_interfaces[i];
2948                 if (intf == NULL)
2949                         continue;
2950
2951                 /* Send the event announcing the panic. */
2952                 intf->handlers->set_run_to_completion(intf->send_info, 1);
2953                 i_ipmi_request(NULL,
2954                                intf,
2955                                &addr,
2956                                0,
2957                                &msg,
2958                                NULL,
2959                                &smi_msg,
2960                                &recv_msg,
2961                                0,
2962                                intf->my_address,
2963                                intf->my_lun,
2964                                0, 1); /* Don't retry, and don't wait. */
2965         }
2966
2967 #ifdef CONFIG_IPMI_PANIC_STRING
2968         /* On every interface, dump a bunch of OEM event holding the
2969            string. */
2970         if (!str)
2971                 return;
2972
2973         for (i=0; i<MAX_IPMI_INTERFACES; i++) {
2974                 char                  *p = str;
2975                 struct ipmi_ipmb_addr *ipmb;
2976                 int                   j;
2977
2978                 intf = ipmi_interfaces[i];
2979                 if (intf == NULL)
2980                         continue;
2981
2982                 /* First job here is to figure out where to send the
2983                    OEM events.  There's no way in IPMI to send OEM
2984                    events using an event send command, so we have to
2985                    find the SEL to put them in and stick them in
2986                    there. */
2987
2988                 /* Get capabilities from the get device id. */
2989                 intf->local_sel_device = 0;
2990                 intf->local_event_generator = 0;
2991                 intf->event_receiver = 0;
2992
2993                 /* Request the device info from the local MC. */
2994                 msg.netfn = IPMI_NETFN_APP_REQUEST;
2995                 msg.cmd = IPMI_GET_DEVICE_ID_CMD;
2996                 msg.data = NULL;
2997                 msg.data_len = 0;
2998                 intf->null_user_handler = device_id_fetcher;
2999                 i_ipmi_request(NULL,
3000                                intf,
3001                                &addr,
3002                                0,
3003                                &msg,
3004                                NULL,
3005                                &smi_msg,
3006                                &recv_msg,
3007                                0,
3008                                intf->my_address,
3009                                intf->my_lun,
3010                                0, 1); /* Don't retry, and don't wait. */
3011
3012                 if (intf->local_event_generator) {
3013                         /* Request the event receiver from the local MC. */
3014                         msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST;
3015                         msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD;
3016                         msg.data = NULL;
3017                         msg.data_len = 0;
3018                         intf->null_user_handler = event_receiver_fetcher;
3019                         i_ipmi_request(NULL,
3020                                        intf,
3021                                        &addr,
3022                                        0,
3023                                        &msg,
3024                                        NULL,
3025                                        &smi_msg,
3026                                        &recv_msg,
3027                                        0,
3028                                        intf->my_address,
3029                                        intf->my_lun,
3030                                        0, 1); /* no retry, and no wait. */
3031                 }
3032                 intf->null_user_handler = NULL;
3033
3034                 /* Validate the event receiver.  The low bit must not
3035                    be 1 (it must be a valid IPMB address), it cannot
3036                    be zero, and it must not be my address. */
3037                 if (((intf->event_receiver & 1) == 0)
3038                     && (intf->event_receiver != 0)
3039                     && (intf->event_receiver != intf->my_address))
3040                 {
3041                         /* The event receiver is valid, send an IPMB
3042                            message. */
3043                         ipmb = (struct ipmi_ipmb_addr *) &addr;
3044                         ipmb->addr_type = IPMI_IPMB_ADDR_TYPE;
3045                         ipmb->channel = 0; /* FIXME - is this right? */
3046                         ipmb->lun = intf->event_receiver_lun;
3047                         ipmb->slave_addr = intf->event_receiver;
3048                 } else if (intf->local_sel_device) {
3049                         /* The event receiver was not valid (or was
3050                            me), but I am an SEL device, just dump it
3051                            in my SEL. */
3052                         si = (struct ipmi_system_interface_addr *) &addr;
3053                         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3054                         si->channel = IPMI_BMC_CHANNEL;
3055                         si->lun = 0;
3056                 } else
3057                         continue; /* No where to send the event. */
3058
3059
3060                 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */
3061                 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD;
3062                 msg.data = data;
3063                 msg.data_len = 16;
3064
3065                 j = 0;
3066                 while (*p) {
3067                         int size = strlen(p);
3068
3069                         if (size > 11)
3070                                 size = 11;
3071                         data[0] = 0;
3072                         data[1] = 0;
3073                         data[2] = 0xf0; /* OEM event without timestamp. */
3074                         data[3] = intf->my_address;
3075                         data[4] = j++; /* sequence # */
3076                         /* Always give 11 bytes, so strncpy will fill
3077                            it with zeroes for me. */
3078                         strncpy(data+5, p, 11);
3079                         p += size;
3080
3081                         i_ipmi_request(NULL,
3082                                        intf,
3083                                        &addr,
3084                                        0,
3085                                        &msg,
3086                                        NULL,
3087                                        &smi_msg,
3088                                        &recv_msg,
3089                                        0,
3090                                        intf->my_address,
3091                                        intf->my_lun,
3092                                        0, 1); /* no retry, and no wait. */
3093                 }
3094         }
3095 #endif /* CONFIG_IPMI_PANIC_STRING */
3096 }
3097 #endif /* CONFIG_IPMI_PANIC_EVENT */
3098
3099 static int has_paniced = 0;
3100
3101 static int panic_event(struct notifier_block *this,
3102                        unsigned long         event,
3103                        void                  *ptr)
3104 {
3105         int        i;
3106         ipmi_smi_t intf;
3107
3108         if (has_paniced)
3109                 return NOTIFY_DONE;
3110         has_paniced = 1;
3111
3112         /* For every registered interface, set it to run to completion. */
3113         for (i=0; i<MAX_IPMI_INTERFACES; i++) {
3114                 intf = ipmi_interfaces[i];
3115                 if (intf == NULL)
3116                         continue;
3117
3118                 intf->handlers->set_run_to_completion(intf->send_info, 1);
3119         }
3120
3121 #ifdef CONFIG_IPMI_PANIC_EVENT
3122         send_panic_events(ptr);
3123 #endif
3124
3125         return NOTIFY_DONE;
3126 }
3127
3128 static struct notifier_block panic_block = {
3129         panic_event,
3130         NULL,
3131         200   /* priority: INT_MAX >= x >= 0 */
3132 };
3133
3134 static int ipmi_init_msghandler(void)
3135 {
3136         int i;
3137
3138         if (initialized)
3139                 return 0;
3140
3141         printk(KERN_INFO "ipmi message handler version "
3142                IPMI_MSGHANDLER_VERSION "\n");
3143
3144         for (i=0; i<MAX_IPMI_INTERFACES; i++) {
3145                 ipmi_interfaces[i] = NULL;
3146         }
3147
3148         proc_ipmi_root = proc_mkdir("ipmi", NULL);
3149         if (!proc_ipmi_root) {
3150             printk(KERN_ERR PFX "Unable to create IPMI proc dir");
3151             return -ENOMEM;
3152         }
3153
3154         proc_ipmi_root->owner = THIS_MODULE;
3155
3156         init_timer(&ipmi_timer);
3157         ipmi_timer.data = 0;
3158         ipmi_timer.function = ipmi_timeout;
3159         ipmi_timer.expires = jiffies + IPMI_TIMEOUT_JIFFIES;
3160         add_timer(&ipmi_timer);
3161
3162         notifier_chain_register(&panic_notifier_list, &panic_block);
3163
3164         initialized = 1;
3165
3166         return 0;
3167 }
3168
3169 static __init int ipmi_init_msghandler_mod(void)
3170 {
3171         ipmi_init_msghandler();
3172         return 0;
3173 }
3174
3175 static __exit void cleanup_ipmi(void)
3176 {
3177         int count;
3178
3179         if (!initialized)
3180                 return;
3181
3182         notifier_chain_unregister(&panic_notifier_list, &panic_block);
3183
3184         /* This can't be called if any interfaces exist, so no worry about
3185            shutting down the interfaces. */
3186
3187         /* Tell the timer to stop, then wait for it to stop.  This avoids
3188            problems with race conditions removing the timer here. */
3189         stop_operation = 1;
3190         while (!timer_stopped) {
3191                 set_current_state(TASK_UNINTERRUPTIBLE);
3192                 schedule_timeout(1);
3193         }
3194
3195         remove_proc_entry(proc_ipmi_root->name, &proc_root);
3196
3197         initialized = 0;
3198
3199         /* Check for buffer leaks. */
3200         count = atomic_read(&smi_msg_inuse_count);
3201         if (count != 0)
3202                 printk(KERN_WARNING PFX "SMI message count %d at exit\n",
3203                        count);
3204         count = atomic_read(&recv_msg_inuse_count);
3205         if (count != 0)
3206                 printk(KERN_WARNING PFX "recv message count %d at exit\n",
3207                        count);
3208 }
3209 module_exit(cleanup_ipmi);
3210
3211 module_init(ipmi_init_msghandler_mod);
3212 MODULE_LICENSE("GPL");
3213
3214 EXPORT_SYMBOL(ipmi_alloc_recv_msg);
3215 EXPORT_SYMBOL(ipmi_create_user);
3216 EXPORT_SYMBOL(ipmi_destroy_user);
3217 EXPORT_SYMBOL(ipmi_get_version);
3218 EXPORT_SYMBOL(ipmi_request);
3219 EXPORT_SYMBOL(ipmi_request_settime);
3220 EXPORT_SYMBOL(ipmi_request_supply_msgs);
3221 EXPORT_SYMBOL(ipmi_request_with_source);
3222 EXPORT_SYMBOL(ipmi_poll_interface);
3223 EXPORT_SYMBOL(ipmi_register_smi);
3224 EXPORT_SYMBOL(ipmi_unregister_smi);
3225 EXPORT_SYMBOL(ipmi_register_for_cmd);
3226 EXPORT_SYMBOL(ipmi_unregister_for_cmd);
3227 EXPORT_SYMBOL(ipmi_smi_msg_received);
3228 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout);
3229 EXPORT_SYMBOL(ipmi_alloc_smi_msg);
3230 EXPORT_SYMBOL(ipmi_register_all_cmd_rcvr);
3231 EXPORT_SYMBOL(ipmi_unregister_all_cmd_rcvr);
3232 EXPORT_SYMBOL(ipmi_addr_length);
3233 EXPORT_SYMBOL(ipmi_validate_addr);
3234 EXPORT_SYMBOL(ipmi_set_gets_events);
3235 EXPORT_SYMBOL(ipmi_addr_equal);
3236 EXPORT_SYMBOL(ipmi_smi_watcher_register);
3237 EXPORT_SYMBOL(ipmi_smi_watcher_unregister);
3238 EXPORT_SYMBOL(ipmi_set_my_address);
3239 EXPORT_SYMBOL(ipmi_get_my_address);
3240 EXPORT_SYMBOL(ipmi_set_my_LUN);
3241 EXPORT_SYMBOL(ipmi_get_my_LUN);
3242 EXPORT_SYMBOL(ipmi_smi_add_proc_entry);
3243 EXPORT_SYMBOL(ipmi_user_set_run_to_completion);