1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * ipmi_msghandler.c 4 * 5 * Incoming and outgoing message routing for an IPMI interface. 6 * 7 * Author: MontaVista Software, Inc. 8 * Corey Minyard <minyard@mvista.com> 9 * source@mvista.com 10 * 11 * Copyright 2002 MontaVista Software Inc. 12 */ 13 14 #define pr_fmt(fmt) "%s" fmt, "IPMI message handler: " 15 #define dev_fmt pr_fmt 16 17 #include <linux/module.h> 18 #include <linux/errno.h> 19 #include <linux/poll.h> 20 #include <linux/sched.h> 21 #include <linux/seq_file.h> 22 #include <linux/spinlock.h> 23 #include <linux/mutex.h> 24 #include <linux/slab.h> 25 #include <linux/ipmi.h> 26 #include <linux/ipmi_smi.h> 27 #include <linux/notifier.h> 28 #include <linux/init.h> 29 #include <linux/proc_fs.h> 30 #include <linux/rcupdate.h> 31 #include <linux/interrupt.h> 32 #include <linux/moduleparam.h> 33 #include <linux/workqueue.h> 34 #include <linux/uuid.h> 35 #include <linux/nospec.h> 36 37 #define IPMI_DRIVER_VERSION "39.2" 38 39 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void); 40 static int ipmi_init_msghandler(void); 41 static void smi_recv_tasklet(unsigned long); 42 static void handle_new_recv_msgs(struct ipmi_smi *intf); 43 static void need_waiter(struct ipmi_smi *intf); 44 static int handle_one_recv_msg(struct ipmi_smi *intf, 45 struct ipmi_smi_msg *msg); 46 47 #ifdef DEBUG 48 static void ipmi_debug_msg(const char *title, unsigned char *data, 49 unsigned int len) 50 { 51 int i, pos; 52 char buf[100]; 53 54 pos = snprintf(buf, sizeof(buf), "%s: ", title); 55 for (i = 0; i < len; i++) 56 pos += snprintf(buf + pos, sizeof(buf) - pos, 57 " %2.2x", data[i]); 58 pr_debug("%s\n", buf); 59 } 60 #else 61 static void ipmi_debug_msg(const char *title, unsigned char *data, 62 unsigned int len) 63 { } 64 #endif 65 66 static bool initialized; 67 static bool drvregistered; 68 69 enum ipmi_panic_event_op { 70 IPMI_SEND_PANIC_EVENT_NONE, 71 IPMI_SEND_PANIC_EVENT, 72 IPMI_SEND_PANIC_EVENT_STRING 73 }; 74 #ifdef CONFIG_IPMI_PANIC_STRING 75 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT_STRING 76 #elif defined(CONFIG_IPMI_PANIC_EVENT) 77 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT 78 #else 79 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT_NONE 80 #endif 81 static enum ipmi_panic_event_op ipmi_send_panic_event = IPMI_PANIC_DEFAULT; 82 83 static int panic_op_write_handler(const char *val, 84 const struct kernel_param *kp) 85 { 86 char valcp[16]; 87 char *s; 88 89 strncpy(valcp, val, 15); 90 valcp[15] = '\0'; 91 92 s = strstrip(valcp); 93 94 if (strcmp(s, "none") == 0) 95 ipmi_send_panic_event = IPMI_SEND_PANIC_EVENT_NONE; 96 else if (strcmp(s, "event") == 0) 97 ipmi_send_panic_event = IPMI_SEND_PANIC_EVENT; 98 else if (strcmp(s, "string") == 0) 99 ipmi_send_panic_event = IPMI_SEND_PANIC_EVENT_STRING; 100 else 101 return -EINVAL; 102 103 return 0; 104 } 105 106 static int panic_op_read_handler(char *buffer, const struct kernel_param *kp) 107 { 108 switch (ipmi_send_panic_event) { 109 case IPMI_SEND_PANIC_EVENT_NONE: 110 strcpy(buffer, "none"); 111 break; 112 113 case IPMI_SEND_PANIC_EVENT: 114 strcpy(buffer, "event"); 115 break; 116 117 case IPMI_SEND_PANIC_EVENT_STRING: 118 strcpy(buffer, "string"); 119 break; 120 121 default: 122 strcpy(buffer, "???"); 123 break; 124 } 125 126 return strlen(buffer); 127 } 128 129 static const struct kernel_param_ops panic_op_ops = { 130 .set = panic_op_write_handler, 131 .get = panic_op_read_handler 132 }; 133 module_param_cb(panic_op, &panic_op_ops, NULL, 0600); 134 MODULE_PARM_DESC(panic_op, "Sets if the IPMI driver will attempt to store panic information in the event log in the event of a panic. Set to 'none' for no, 'event' for a single event, or 'string' for a generic event and the panic string in IPMI OEM events."); 135 136 137 #define MAX_EVENTS_IN_QUEUE 25 138 139 /* Remain in auto-maintenance mode for this amount of time (in ms). */ 140 static unsigned long maintenance_mode_timeout_ms = 30000; 141 module_param(maintenance_mode_timeout_ms, ulong, 0644); 142 MODULE_PARM_DESC(maintenance_mode_timeout_ms, 143 "The time (milliseconds) after the last maintenance message that the connection stays in maintenance mode."); 144 145 /* 146 * Don't let a message sit in a queue forever, always time it with at lest 147 * the max message timer. This is in milliseconds. 148 */ 149 #define MAX_MSG_TIMEOUT 60000 150 151 /* 152 * Timeout times below are in milliseconds, and are done off a 1 153 * second timer. So setting the value to 1000 would mean anything 154 * between 0 and 1000ms. So really the only reasonable minimum 155 * setting it 2000ms, which is between 1 and 2 seconds. 156 */ 157 158 /* The default timeout for message retries. */ 159 static unsigned long default_retry_ms = 2000; 160 module_param(default_retry_ms, ulong, 0644); 161 MODULE_PARM_DESC(default_retry_ms, 162 "The time (milliseconds) between retry sends"); 163 164 /* The default timeout for maintenance mode message retries. */ 165 static unsigned long default_maintenance_retry_ms = 3000; 166 module_param(default_maintenance_retry_ms, ulong, 0644); 167 MODULE_PARM_DESC(default_maintenance_retry_ms, 168 "The time (milliseconds) between retry sends in maintenance mode"); 169 170 /* The default maximum number of retries */ 171 static unsigned int default_max_retries = 4; 172 module_param(default_max_retries, uint, 0644); 173 MODULE_PARM_DESC(default_max_retries, 174 "The time (milliseconds) between retry sends in maintenance mode"); 175 176 /* Call every ~1000 ms. */ 177 #define IPMI_TIMEOUT_TIME 1000 178 179 /* How many jiffies does it take to get to the timeout time. */ 180 #define IPMI_TIMEOUT_JIFFIES ((IPMI_TIMEOUT_TIME * HZ) / 1000) 181 182 /* 183 * Request events from the queue every second (this is the number of 184 * IPMI_TIMEOUT_TIMES between event requests). Hopefully, in the 185 * future, IPMI will add a way to know immediately if an event is in 186 * the queue and this silliness can go away. 187 */ 188 #define IPMI_REQUEST_EV_TIME (1000 / (IPMI_TIMEOUT_TIME)) 189 190 /* How long should we cache dynamic device IDs? */ 191 #define IPMI_DYN_DEV_ID_EXPIRY (10 * HZ) 192 193 /* 194 * The main "user" data structure. 195 */ 196 struct ipmi_user { 197 struct list_head link; 198 199 /* 200 * Set to NULL when the user is destroyed, a pointer to myself 201 * so srcu_dereference can be used on it. 202 */ 203 struct ipmi_user *self; 204 struct srcu_struct release_barrier; 205 206 struct kref refcount; 207 208 /* The upper layer that handles receive messages. */ 209 const struct ipmi_user_hndl *handler; 210 void *handler_data; 211 212 /* The interface this user is bound to. */ 213 struct ipmi_smi *intf; 214 215 /* Does this interface receive IPMI events? */ 216 bool gets_events; 217 218 /* Free must run in process context for RCU cleanup. */ 219 struct work_struct remove_work; 220 }; 221 222 static struct ipmi_user *acquire_ipmi_user(struct ipmi_user *user, int *index) 223 __acquires(user->release_barrier) 224 { 225 struct ipmi_user *ruser; 226 227 *index = srcu_read_lock(&user->release_barrier); 228 ruser = srcu_dereference(user->self, &user->release_barrier); 229 if (!ruser) 230 srcu_read_unlock(&user->release_barrier, *index); 231 return ruser; 232 } 233 234 static void release_ipmi_user(struct ipmi_user *user, int index) 235 { 236 srcu_read_unlock(&user->release_barrier, index); 237 } 238 239 struct cmd_rcvr { 240 struct list_head link; 241 242 struct ipmi_user *user; 243 unsigned char netfn; 244 unsigned char cmd; 245 unsigned int chans; 246 247 /* 248 * This is used to form a linked lised during mass deletion. 249 * Since this is in an RCU list, we cannot use the link above 250 * or change any data until the RCU period completes. So we 251 * use this next variable during mass deletion so we can have 252 * a list and don't have to wait and restart the search on 253 * every individual deletion of a command. 254 */ 255 struct cmd_rcvr *next; 256 }; 257 258 struct seq_table { 259 unsigned int inuse : 1; 260 unsigned int broadcast : 1; 261 262 unsigned long timeout; 263 unsigned long orig_timeout; 264 unsigned int retries_left; 265 266 /* 267 * To verify on an incoming send message response that this is 268 * the message that the response is for, we keep a sequence id 269 * and increment it every time we send a message. 270 */ 271 long seqid; 272 273 /* 274 * This is held so we can properly respond to the message on a 275 * timeout, and it is used to hold the temporary data for 276 * retransmission, too. 277 */ 278 struct ipmi_recv_msg *recv_msg; 279 }; 280 281 /* 282 * Store the information in a msgid (long) to allow us to find a 283 * sequence table entry from the msgid. 284 */ 285 #define STORE_SEQ_IN_MSGID(seq, seqid) \ 286 ((((seq) & 0x3f) << 26) | ((seqid) & 0x3ffffff)) 287 288 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \ 289 do { \ 290 seq = (((msgid) >> 26) & 0x3f); \ 291 seqid = ((msgid) & 0x3ffffff); \ 292 } while (0) 293 294 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3ffffff) 295 296 #define IPMI_MAX_CHANNELS 16 297 struct ipmi_channel { 298 unsigned char medium; 299 unsigned char protocol; 300 }; 301 302 struct ipmi_channel_set { 303 struct ipmi_channel c[IPMI_MAX_CHANNELS]; 304 }; 305 306 struct ipmi_my_addrinfo { 307 /* 308 * My slave address. This is initialized to IPMI_BMC_SLAVE_ADDR, 309 * but may be changed by the user. 310 */ 311 unsigned char address; 312 313 /* 314 * My LUN. This should generally stay the SMS LUN, but just in 315 * case... 316 */ 317 unsigned char lun; 318 }; 319 320 /* 321 * Note that the product id, manufacturer id, guid, and device id are 322 * immutable in this structure, so dyn_mutex is not required for 323 * accessing those. If those change on a BMC, a new BMC is allocated. 324 */ 325 struct bmc_device { 326 struct platform_device pdev; 327 struct list_head intfs; /* Interfaces on this BMC. */ 328 struct ipmi_device_id id; 329 struct ipmi_device_id fetch_id; 330 int dyn_id_set; 331 unsigned long dyn_id_expiry; 332 struct mutex dyn_mutex; /* Protects id, intfs, & dyn* */ 333 guid_t guid; 334 guid_t fetch_guid; 335 int dyn_guid_set; 336 struct kref usecount; 337 struct work_struct remove_work; 338 }; 339 #define to_bmc_device(x) container_of((x), struct bmc_device, pdev.dev) 340 341 static int bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, 342 struct ipmi_device_id *id, 343 bool *guid_set, guid_t *guid); 344 345 /* 346 * Various statistics for IPMI, these index stats[] in the ipmi_smi 347 * structure. 348 */ 349 enum ipmi_stat_indexes { 350 /* Commands we got from the user that were invalid. */ 351 IPMI_STAT_sent_invalid_commands = 0, 352 353 /* Commands we sent to the MC. */ 354 IPMI_STAT_sent_local_commands, 355 356 /* Responses from the MC that were delivered to a user. */ 357 IPMI_STAT_handled_local_responses, 358 359 /* Responses from the MC that were not delivered to a user. */ 360 IPMI_STAT_unhandled_local_responses, 361 362 /* Commands we sent out to the IPMB bus. */ 363 IPMI_STAT_sent_ipmb_commands, 364 365 /* Commands sent on the IPMB that had errors on the SEND CMD */ 366 IPMI_STAT_sent_ipmb_command_errs, 367 368 /* Each retransmit increments this count. */ 369 IPMI_STAT_retransmitted_ipmb_commands, 370 371 /* 372 * When a message times out (runs out of retransmits) this is 373 * incremented. 374 */ 375 IPMI_STAT_timed_out_ipmb_commands, 376 377 /* 378 * This is like above, but for broadcasts. Broadcasts are 379 * *not* included in the above count (they are expected to 380 * time out). 381 */ 382 IPMI_STAT_timed_out_ipmb_broadcasts, 383 384 /* Responses I have sent to the IPMB bus. */ 385 IPMI_STAT_sent_ipmb_responses, 386 387 /* The response was delivered to the user. */ 388 IPMI_STAT_handled_ipmb_responses, 389 390 /* The response had invalid data in it. */ 391 IPMI_STAT_invalid_ipmb_responses, 392 393 /* The response didn't have anyone waiting for it. */ 394 IPMI_STAT_unhandled_ipmb_responses, 395 396 /* Commands we sent out to the IPMB bus. */ 397 IPMI_STAT_sent_lan_commands, 398 399 /* Commands sent on the IPMB that had errors on the SEND CMD */ 400 IPMI_STAT_sent_lan_command_errs, 401 402 /* Each retransmit increments this count. */ 403 IPMI_STAT_retransmitted_lan_commands, 404 405 /* 406 * When a message times out (runs out of retransmits) this is 407 * incremented. 408 */ 409 IPMI_STAT_timed_out_lan_commands, 410 411 /* Responses I have sent to the IPMB bus. */ 412 IPMI_STAT_sent_lan_responses, 413 414 /* The response was delivered to the user. */ 415 IPMI_STAT_handled_lan_responses, 416 417 /* The response had invalid data in it. */ 418 IPMI_STAT_invalid_lan_responses, 419 420 /* The response didn't have anyone waiting for it. */ 421 IPMI_STAT_unhandled_lan_responses, 422 423 /* The command was delivered to the user. */ 424 IPMI_STAT_handled_commands, 425 426 /* The command had invalid data in it. */ 427 IPMI_STAT_invalid_commands, 428 429 /* The command didn't have anyone waiting for it. */ 430 IPMI_STAT_unhandled_commands, 431 432 /* Invalid data in an event. */ 433 IPMI_STAT_invalid_events, 434 435 /* Events that were received with the proper format. */ 436 IPMI_STAT_events, 437 438 /* Retransmissions on IPMB that failed. */ 439 IPMI_STAT_dropped_rexmit_ipmb_commands, 440 441 /* Retransmissions on LAN that failed. */ 442 IPMI_STAT_dropped_rexmit_lan_commands, 443 444 /* This *must* remain last, add new values above this. */ 445 IPMI_NUM_STATS 446 }; 447 448 449 #define IPMI_IPMB_NUM_SEQ 64 450 struct ipmi_smi { 451 /* What interface number are we? */ 452 int intf_num; 453 454 struct kref refcount; 455 456 /* Set when the interface is being unregistered. */ 457 bool in_shutdown; 458 459 /* Used for a list of interfaces. */ 460 struct list_head link; 461 462 /* 463 * The list of upper layers that are using me. seq_lock write 464 * protects this. Read protection is with srcu. 465 */ 466 struct list_head users; 467 struct srcu_struct users_srcu; 468 469 /* Used for wake ups at startup. */ 470 wait_queue_head_t waitq; 471 472 /* 473 * Prevents the interface from being unregistered when the 474 * interface is used by being looked up through the BMC 475 * structure. 476 */ 477 struct mutex bmc_reg_mutex; 478 479 struct bmc_device tmp_bmc; 480 struct bmc_device *bmc; 481 bool bmc_registered; 482 struct list_head bmc_link; 483 char *my_dev_name; 484 bool in_bmc_register; /* Handle recursive situations. Yuck. */ 485 struct work_struct bmc_reg_work; 486 487 const struct ipmi_smi_handlers *handlers; 488 void *send_info; 489 490 /* Driver-model device for the system interface. */ 491 struct device *si_dev; 492 493 /* 494 * A table of sequence numbers for this interface. We use the 495 * sequence numbers for IPMB messages that go out of the 496 * interface to match them up with their responses. A routine 497 * is called periodically to time the items in this list. 498 */ 499 spinlock_t seq_lock; 500 struct seq_table seq_table[IPMI_IPMB_NUM_SEQ]; 501 int curr_seq; 502 503 /* 504 * Messages queued for delivery. If delivery fails (out of memory 505 * for instance), They will stay in here to be processed later in a 506 * periodic timer interrupt. The tasklet is for handling received 507 * messages directly from the handler. 508 */ 509 spinlock_t waiting_rcv_msgs_lock; 510 struct list_head waiting_rcv_msgs; 511 atomic_t watchdog_pretimeouts_to_deliver; 512 struct tasklet_struct recv_tasklet; 513 514 spinlock_t xmit_msgs_lock; 515 struct list_head xmit_msgs; 516 struct ipmi_smi_msg *curr_msg; 517 struct list_head hp_xmit_msgs; 518 519 /* 520 * The list of command receivers that are registered for commands 521 * on this interface. 522 */ 523 struct mutex cmd_rcvrs_mutex; 524 struct list_head cmd_rcvrs; 525 526 /* 527 * Events that were queues because no one was there to receive 528 * them. 529 */ 530 spinlock_t events_lock; /* For dealing with event stuff. */ 531 struct list_head waiting_events; 532 unsigned int waiting_events_count; /* How many events in queue? */ 533 char delivering_events; 534 char event_msg_printed; 535 536 /* How many users are waiting for events? */ 537 atomic_t event_waiters; 538 unsigned int ticks_to_req_ev; 539 540 spinlock_t watch_lock; /* For dealing with watch stuff below. */ 541 542 /* How many users are waiting for commands? */ 543 unsigned int command_waiters; 544 545 /* How many users are waiting for watchdogs? */ 546 unsigned int watchdog_waiters; 547 548 /* How many users are waiting for message responses? */ 549 unsigned int response_waiters; 550 551 /* 552 * Tells what the lower layer has last been asked to watch for, 553 * messages and/or watchdogs. Protected by watch_lock. 554 */ 555 unsigned int last_watch_mask; 556 557 /* 558 * The event receiver for my BMC, only really used at panic 559 * shutdown as a place to store this. 560 */ 561 unsigned char event_receiver; 562 unsigned char event_receiver_lun; 563 unsigned char local_sel_device; 564 unsigned char local_event_generator; 565 566 /* For handling of maintenance mode. */ 567 int maintenance_mode; 568 bool maintenance_mode_enable; 569 int auto_maintenance_timeout; 570 spinlock_t maintenance_mode_lock; /* Used in a timer... */ 571 572 /* 573 * If we are doing maintenance on something on IPMB, extend 574 * the timeout time to avoid timeouts writing firmware and 575 * such. 576 */ 577 int ipmb_maintenance_mode_timeout; 578 579 /* 580 * A cheap hack, if this is non-null and a message to an 581 * interface comes in with a NULL user, call this routine with 582 * it. Note that the message will still be freed by the 583 * caller. This only works on the system interface. 584 * 585 * Protected by bmc_reg_mutex. 586 */ 587 void (*null_user_handler)(struct ipmi_smi *intf, 588 struct ipmi_recv_msg *msg); 589 590 /* 591 * When we are scanning the channels for an SMI, this will 592 * tell which channel we are scanning. 593 */ 594 int curr_channel; 595 596 /* Channel information */ 597 struct ipmi_channel_set *channel_list; 598 unsigned int curr_working_cset; /* First index into the following. */ 599 struct ipmi_channel_set wchannels[2]; 600 struct ipmi_my_addrinfo addrinfo[IPMI_MAX_CHANNELS]; 601 bool channels_ready; 602 603 atomic_t stats[IPMI_NUM_STATS]; 604 605 /* 606 * run_to_completion duplicate of smb_info, smi_info 607 * and ipmi_serial_info structures. Used to decrease numbers of 608 * parameters passed by "low" level IPMI code. 609 */ 610 int run_to_completion; 611 }; 612 #define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev) 613 614 static void __get_guid(struct ipmi_smi *intf); 615 static void __ipmi_bmc_unregister(struct ipmi_smi *intf); 616 static int __ipmi_bmc_register(struct ipmi_smi *intf, 617 struct ipmi_device_id *id, 618 bool guid_set, guid_t *guid, int intf_num); 619 static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id); 620 621 622 /** 623 * The driver model view of the IPMI messaging driver. 624 */ 625 static struct platform_driver ipmidriver = { 626 .driver = { 627 .name = "ipmi", 628 .bus = &platform_bus_type 629 } 630 }; 631 /* 632 * This mutex keeps us from adding the same BMC twice. 633 */ 634 static DEFINE_MUTEX(ipmidriver_mutex); 635 636 static LIST_HEAD(ipmi_interfaces); 637 static DEFINE_MUTEX(ipmi_interfaces_mutex); 638 static struct srcu_struct ipmi_interfaces_srcu; 639 640 /* 641 * List of watchers that want to know when smi's are added and deleted. 642 */ 643 static LIST_HEAD(smi_watchers); 644 static DEFINE_MUTEX(smi_watchers_mutex); 645 646 #define ipmi_inc_stat(intf, stat) \ 647 atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat]) 648 #define ipmi_get_stat(intf, stat) \ 649 ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat])) 650 651 static const char * const addr_src_to_str[] = { 652 "invalid", "hotmod", "hardcoded", "SPMI", "ACPI", "SMBIOS", "PCI", 653 "device-tree", "platform" 654 }; 655 656 const char *ipmi_addr_src_to_str(enum ipmi_addr_src src) 657 { 658 if (src >= SI_LAST) 659 src = 0; /* Invalid */ 660 return addr_src_to_str[src]; 661 } 662 EXPORT_SYMBOL(ipmi_addr_src_to_str); 663 664 static int is_lan_addr(struct ipmi_addr *addr) 665 { 666 return addr->addr_type == IPMI_LAN_ADDR_TYPE; 667 } 668 669 static int is_ipmb_addr(struct ipmi_addr *addr) 670 { 671 return addr->addr_type == IPMI_IPMB_ADDR_TYPE; 672 } 673 674 static int is_ipmb_bcast_addr(struct ipmi_addr *addr) 675 { 676 return addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE; 677 } 678 679 static void free_recv_msg_list(struct list_head *q) 680 { 681 struct ipmi_recv_msg *msg, *msg2; 682 683 list_for_each_entry_safe(msg, msg2, q, link) { 684 list_del(&msg->link); 685 ipmi_free_recv_msg(msg); 686 } 687 } 688 689 static void free_smi_msg_list(struct list_head *q) 690 { 691 struct ipmi_smi_msg *msg, *msg2; 692 693 list_for_each_entry_safe(msg, msg2, q, link) { 694 list_del(&msg->link); 695 ipmi_free_smi_msg(msg); 696 } 697 } 698 699 static void clean_up_interface_data(struct ipmi_smi *intf) 700 { 701 int i; 702 struct cmd_rcvr *rcvr, *rcvr2; 703 struct list_head list; 704 705 tasklet_kill(&intf->recv_tasklet); 706 707 free_smi_msg_list(&intf->waiting_rcv_msgs); 708 free_recv_msg_list(&intf->waiting_events); 709 710 /* 711 * Wholesale remove all the entries from the list in the 712 * interface and wait for RCU to know that none are in use. 713 */ 714 mutex_lock(&intf->cmd_rcvrs_mutex); 715 INIT_LIST_HEAD(&list); 716 list_splice_init_rcu(&intf->cmd_rcvrs, &list, synchronize_rcu); 717 mutex_unlock(&intf->cmd_rcvrs_mutex); 718 719 list_for_each_entry_safe(rcvr, rcvr2, &list, link) 720 kfree(rcvr); 721 722 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) { 723 if ((intf->seq_table[i].inuse) 724 && (intf->seq_table[i].recv_msg)) 725 ipmi_free_recv_msg(intf->seq_table[i].recv_msg); 726 } 727 } 728 729 static void intf_free(struct kref *ref) 730 { 731 struct ipmi_smi *intf = container_of(ref, struct ipmi_smi, refcount); 732 733 clean_up_interface_data(intf); 734 kfree(intf); 735 } 736 737 struct watcher_entry { 738 int intf_num; 739 struct ipmi_smi *intf; 740 struct list_head link; 741 }; 742 743 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher) 744 { 745 struct ipmi_smi *intf; 746 int index, rv; 747 748 /* 749 * Make sure the driver is actually initialized, this handles 750 * problems with initialization order. 751 */ 752 rv = ipmi_init_msghandler(); 753 if (rv) 754 return rv; 755 756 mutex_lock(&smi_watchers_mutex); 757 758 list_add(&watcher->link, &smi_watchers); 759 760 index = srcu_read_lock(&ipmi_interfaces_srcu); 761 list_for_each_entry_rcu(intf, &ipmi_interfaces, link) { 762 int intf_num = READ_ONCE(intf->intf_num); 763 764 if (intf_num == -1) 765 continue; 766 watcher->new_smi(intf_num, intf->si_dev); 767 } 768 srcu_read_unlock(&ipmi_interfaces_srcu, index); 769 770 mutex_unlock(&smi_watchers_mutex); 771 772 return 0; 773 } 774 EXPORT_SYMBOL(ipmi_smi_watcher_register); 775 776 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher) 777 { 778 mutex_lock(&smi_watchers_mutex); 779 list_del(&watcher->link); 780 mutex_unlock(&smi_watchers_mutex); 781 return 0; 782 } 783 EXPORT_SYMBOL(ipmi_smi_watcher_unregister); 784 785 /* 786 * Must be called with smi_watchers_mutex held. 787 */ 788 static void 789 call_smi_watchers(int i, struct device *dev) 790 { 791 struct ipmi_smi_watcher *w; 792 793 mutex_lock(&smi_watchers_mutex); 794 list_for_each_entry(w, &smi_watchers, link) { 795 if (try_module_get(w->owner)) { 796 w->new_smi(i, dev); 797 module_put(w->owner); 798 } 799 } 800 mutex_unlock(&smi_watchers_mutex); 801 } 802 803 static int 804 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2) 805 { 806 if (addr1->addr_type != addr2->addr_type) 807 return 0; 808 809 if (addr1->channel != addr2->channel) 810 return 0; 811 812 if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) { 813 struct ipmi_system_interface_addr *smi_addr1 814 = (struct ipmi_system_interface_addr *) addr1; 815 struct ipmi_system_interface_addr *smi_addr2 816 = (struct ipmi_system_interface_addr *) addr2; 817 return (smi_addr1->lun == smi_addr2->lun); 818 } 819 820 if (is_ipmb_addr(addr1) || is_ipmb_bcast_addr(addr1)) { 821 struct ipmi_ipmb_addr *ipmb_addr1 822 = (struct ipmi_ipmb_addr *) addr1; 823 struct ipmi_ipmb_addr *ipmb_addr2 824 = (struct ipmi_ipmb_addr *) addr2; 825 826 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr) 827 && (ipmb_addr1->lun == ipmb_addr2->lun)); 828 } 829 830 if (is_lan_addr(addr1)) { 831 struct ipmi_lan_addr *lan_addr1 832 = (struct ipmi_lan_addr *) addr1; 833 struct ipmi_lan_addr *lan_addr2 834 = (struct ipmi_lan_addr *) addr2; 835 836 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID) 837 && (lan_addr1->local_SWID == lan_addr2->local_SWID) 838 && (lan_addr1->session_handle 839 == lan_addr2->session_handle) 840 && (lan_addr1->lun == lan_addr2->lun)); 841 } 842 843 return 1; 844 } 845 846 int ipmi_validate_addr(struct ipmi_addr *addr, int len) 847 { 848 if (len < sizeof(struct ipmi_system_interface_addr)) 849 return -EINVAL; 850 851 if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) { 852 if (addr->channel != IPMI_BMC_CHANNEL) 853 return -EINVAL; 854 return 0; 855 } 856 857 if ((addr->channel == IPMI_BMC_CHANNEL) 858 || (addr->channel >= IPMI_MAX_CHANNELS) 859 || (addr->channel < 0)) 860 return -EINVAL; 861 862 if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) { 863 if (len < sizeof(struct ipmi_ipmb_addr)) 864 return -EINVAL; 865 return 0; 866 } 867 868 if (is_lan_addr(addr)) { 869 if (len < sizeof(struct ipmi_lan_addr)) 870 return -EINVAL; 871 return 0; 872 } 873 874 return -EINVAL; 875 } 876 EXPORT_SYMBOL(ipmi_validate_addr); 877 878 unsigned int ipmi_addr_length(int addr_type) 879 { 880 if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 881 return sizeof(struct ipmi_system_interface_addr); 882 883 if ((addr_type == IPMI_IPMB_ADDR_TYPE) 884 || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)) 885 return sizeof(struct ipmi_ipmb_addr); 886 887 if (addr_type == IPMI_LAN_ADDR_TYPE) 888 return sizeof(struct ipmi_lan_addr); 889 890 return 0; 891 } 892 EXPORT_SYMBOL(ipmi_addr_length); 893 894 static int deliver_response(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) 895 { 896 int rv = 0; 897 898 if (!msg->user) { 899 /* Special handling for NULL users. */ 900 if (intf->null_user_handler) { 901 intf->null_user_handler(intf, msg); 902 } else { 903 /* No handler, so give up. */ 904 rv = -EINVAL; 905 } 906 ipmi_free_recv_msg(msg); 907 } else if (!oops_in_progress) { 908 /* 909 * If we are running in the panic context, calling the 910 * receive handler doesn't much meaning and has a deadlock 911 * risk. At this moment, simply skip it in that case. 912 */ 913 int index; 914 struct ipmi_user *user = acquire_ipmi_user(msg->user, &index); 915 916 if (user) { 917 user->handler->ipmi_recv_hndl(msg, user->handler_data); 918 release_ipmi_user(user, index); 919 } else { 920 /* User went away, give up. */ 921 ipmi_free_recv_msg(msg); 922 rv = -EINVAL; 923 } 924 } 925 926 return rv; 927 } 928 929 static void deliver_local_response(struct ipmi_smi *intf, 930 struct ipmi_recv_msg *msg) 931 { 932 if (deliver_response(intf, msg)) 933 ipmi_inc_stat(intf, unhandled_local_responses); 934 else 935 ipmi_inc_stat(intf, handled_local_responses); 936 } 937 938 static void deliver_err_response(struct ipmi_smi *intf, 939 struct ipmi_recv_msg *msg, int err) 940 { 941 msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 942 msg->msg_data[0] = err; 943 msg->msg.netfn |= 1; /* Convert to a response. */ 944 msg->msg.data_len = 1; 945 msg->msg.data = msg->msg_data; 946 deliver_local_response(intf, msg); 947 } 948 949 static void smi_add_watch(struct ipmi_smi *intf, unsigned int flags) 950 { 951 unsigned long iflags; 952 953 if (!intf->handlers->set_need_watch) 954 return; 955 956 spin_lock_irqsave(&intf->watch_lock, iflags); 957 if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES) 958 intf->response_waiters++; 959 960 if (flags & IPMI_WATCH_MASK_CHECK_WATCHDOG) 961 intf->watchdog_waiters++; 962 963 if (flags & IPMI_WATCH_MASK_CHECK_COMMANDS) 964 intf->command_waiters++; 965 966 if ((intf->last_watch_mask & flags) != flags) { 967 intf->last_watch_mask |= flags; 968 intf->handlers->set_need_watch(intf->send_info, 969 intf->last_watch_mask); 970 } 971 spin_unlock_irqrestore(&intf->watch_lock, iflags); 972 } 973 974 static void smi_remove_watch(struct ipmi_smi *intf, unsigned int flags) 975 { 976 unsigned long iflags; 977 978 if (!intf->handlers->set_need_watch) 979 return; 980 981 spin_lock_irqsave(&intf->watch_lock, iflags); 982 if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES) 983 intf->response_waiters--; 984 985 if (flags & IPMI_WATCH_MASK_CHECK_WATCHDOG) 986 intf->watchdog_waiters--; 987 988 if (flags & IPMI_WATCH_MASK_CHECK_COMMANDS) 989 intf->command_waiters--; 990 991 flags = 0; 992 if (intf->response_waiters) 993 flags |= IPMI_WATCH_MASK_CHECK_MESSAGES; 994 if (intf->watchdog_waiters) 995 flags |= IPMI_WATCH_MASK_CHECK_WATCHDOG; 996 if (intf->command_waiters) 997 flags |= IPMI_WATCH_MASK_CHECK_COMMANDS; 998 999 if (intf->last_watch_mask != flags) { 1000 intf->last_watch_mask = flags; 1001 intf->handlers->set_need_watch(intf->send_info, 1002 intf->last_watch_mask); 1003 } 1004 spin_unlock_irqrestore(&intf->watch_lock, iflags); 1005 } 1006 1007 /* 1008 * Find the next sequence number not being used and add the given 1009 * message with the given timeout to the sequence table. This must be 1010 * called with the interface's seq_lock held. 1011 */ 1012 static int intf_next_seq(struct ipmi_smi *intf, 1013 struct ipmi_recv_msg *recv_msg, 1014 unsigned long timeout, 1015 int retries, 1016 int broadcast, 1017 unsigned char *seq, 1018 long *seqid) 1019 { 1020 int rv = 0; 1021 unsigned int i; 1022 1023 if (timeout == 0) 1024 timeout = default_retry_ms; 1025 if (retries < 0) 1026 retries = default_max_retries; 1027 1028 for (i = intf->curr_seq; (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq; 1029 i = (i+1)%IPMI_IPMB_NUM_SEQ) { 1030 if (!intf->seq_table[i].inuse) 1031 break; 1032 } 1033 1034 if (!intf->seq_table[i].inuse) { 1035 intf->seq_table[i].recv_msg = recv_msg; 1036 1037 /* 1038 * Start with the maximum timeout, when the send response 1039 * comes in we will start the real timer. 1040 */ 1041 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT; 1042 intf->seq_table[i].orig_timeout = timeout; 1043 intf->seq_table[i].retries_left = retries; 1044 intf->seq_table[i].broadcast = broadcast; 1045 intf->seq_table[i].inuse = 1; 1046 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid); 1047 *seq = i; 1048 *seqid = intf->seq_table[i].seqid; 1049 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ; 1050 smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 1051 need_waiter(intf); 1052 } else { 1053 rv = -EAGAIN; 1054 } 1055 1056 return rv; 1057 } 1058 1059 /* 1060 * Return the receive message for the given sequence number and 1061 * release the sequence number so it can be reused. Some other data 1062 * is passed in to be sure the message matches up correctly (to help 1063 * guard against message coming in after their timeout and the 1064 * sequence number being reused). 1065 */ 1066 static int intf_find_seq(struct ipmi_smi *intf, 1067 unsigned char seq, 1068 short channel, 1069 unsigned char cmd, 1070 unsigned char netfn, 1071 struct ipmi_addr *addr, 1072 struct ipmi_recv_msg **recv_msg) 1073 { 1074 int rv = -ENODEV; 1075 unsigned long flags; 1076 1077 if (seq >= IPMI_IPMB_NUM_SEQ) 1078 return -EINVAL; 1079 1080 spin_lock_irqsave(&intf->seq_lock, flags); 1081 if (intf->seq_table[seq].inuse) { 1082 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg; 1083 1084 if ((msg->addr.channel == channel) && (msg->msg.cmd == cmd) 1085 && (msg->msg.netfn == netfn) 1086 && (ipmi_addr_equal(addr, &msg->addr))) { 1087 *recv_msg = msg; 1088 intf->seq_table[seq].inuse = 0; 1089 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 1090 rv = 0; 1091 } 1092 } 1093 spin_unlock_irqrestore(&intf->seq_lock, flags); 1094 1095 return rv; 1096 } 1097 1098 1099 /* Start the timer for a specific sequence table entry. */ 1100 static int intf_start_seq_timer(struct ipmi_smi *intf, 1101 long msgid) 1102 { 1103 int rv = -ENODEV; 1104 unsigned long flags; 1105 unsigned char seq; 1106 unsigned long seqid; 1107 1108 1109 GET_SEQ_FROM_MSGID(msgid, seq, seqid); 1110 1111 spin_lock_irqsave(&intf->seq_lock, flags); 1112 /* 1113 * We do this verification because the user can be deleted 1114 * while a message is outstanding. 1115 */ 1116 if ((intf->seq_table[seq].inuse) 1117 && (intf->seq_table[seq].seqid == seqid)) { 1118 struct seq_table *ent = &intf->seq_table[seq]; 1119 ent->timeout = ent->orig_timeout; 1120 rv = 0; 1121 } 1122 spin_unlock_irqrestore(&intf->seq_lock, flags); 1123 1124 return rv; 1125 } 1126 1127 /* Got an error for the send message for a specific sequence number. */ 1128 static int intf_err_seq(struct ipmi_smi *intf, 1129 long msgid, 1130 unsigned int err) 1131 { 1132 int rv = -ENODEV; 1133 unsigned long flags; 1134 unsigned char seq; 1135 unsigned long seqid; 1136 struct ipmi_recv_msg *msg = NULL; 1137 1138 1139 GET_SEQ_FROM_MSGID(msgid, seq, seqid); 1140 1141 spin_lock_irqsave(&intf->seq_lock, flags); 1142 /* 1143 * We do this verification because the user can be deleted 1144 * while a message is outstanding. 1145 */ 1146 if ((intf->seq_table[seq].inuse) 1147 && (intf->seq_table[seq].seqid == seqid)) { 1148 struct seq_table *ent = &intf->seq_table[seq]; 1149 1150 ent->inuse = 0; 1151 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 1152 msg = ent->recv_msg; 1153 rv = 0; 1154 } 1155 spin_unlock_irqrestore(&intf->seq_lock, flags); 1156 1157 if (msg) 1158 deliver_err_response(intf, msg, err); 1159 1160 return rv; 1161 } 1162 1163 static void free_user_work(struct work_struct *work) 1164 { 1165 struct ipmi_user *user = container_of(work, struct ipmi_user, 1166 remove_work); 1167 1168 cleanup_srcu_struct(&user->release_barrier); 1169 kfree(user); 1170 } 1171 1172 int ipmi_create_user(unsigned int if_num, 1173 const struct ipmi_user_hndl *handler, 1174 void *handler_data, 1175 struct ipmi_user **user) 1176 { 1177 unsigned long flags; 1178 struct ipmi_user *new_user; 1179 int rv, index; 1180 struct ipmi_smi *intf; 1181 1182 /* 1183 * There is no module usecount here, because it's not 1184 * required. Since this can only be used by and called from 1185 * other modules, they will implicitly use this module, and 1186 * thus this can't be removed unless the other modules are 1187 * removed. 1188 */ 1189 1190 if (handler == NULL) 1191 return -EINVAL; 1192 1193 /* 1194 * Make sure the driver is actually initialized, this handles 1195 * problems with initialization order. 1196 */ 1197 rv = ipmi_init_msghandler(); 1198 if (rv) 1199 return rv; 1200 1201 new_user = kmalloc(sizeof(*new_user), GFP_KERNEL); 1202 if (!new_user) 1203 return -ENOMEM; 1204 1205 index = srcu_read_lock(&ipmi_interfaces_srcu); 1206 list_for_each_entry_rcu(intf, &ipmi_interfaces, link) { 1207 if (intf->intf_num == if_num) 1208 goto found; 1209 } 1210 /* Not found, return an error */ 1211 rv = -EINVAL; 1212 goto out_kfree; 1213 1214 found: 1215 INIT_WORK(&new_user->remove_work, free_user_work); 1216 1217 rv = init_srcu_struct(&new_user->release_barrier); 1218 if (rv) 1219 goto out_kfree; 1220 1221 /* Note that each existing user holds a refcount to the interface. */ 1222 kref_get(&intf->refcount); 1223 1224 kref_init(&new_user->refcount); 1225 new_user->handler = handler; 1226 new_user->handler_data = handler_data; 1227 new_user->intf = intf; 1228 new_user->gets_events = false; 1229 1230 rcu_assign_pointer(new_user->self, new_user); 1231 spin_lock_irqsave(&intf->seq_lock, flags); 1232 list_add_rcu(&new_user->link, &intf->users); 1233 spin_unlock_irqrestore(&intf->seq_lock, flags); 1234 if (handler->ipmi_watchdog_pretimeout) 1235 /* User wants pretimeouts, so make sure to watch for them. */ 1236 smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG); 1237 srcu_read_unlock(&ipmi_interfaces_srcu, index); 1238 *user = new_user; 1239 return 0; 1240 1241 out_kfree: 1242 srcu_read_unlock(&ipmi_interfaces_srcu, index); 1243 kfree(new_user); 1244 return rv; 1245 } 1246 EXPORT_SYMBOL(ipmi_create_user); 1247 1248 int ipmi_get_smi_info(int if_num, struct ipmi_smi_info *data) 1249 { 1250 int rv, index; 1251 struct ipmi_smi *intf; 1252 1253 index = srcu_read_lock(&ipmi_interfaces_srcu); 1254 list_for_each_entry_rcu(intf, &ipmi_interfaces, link) { 1255 if (intf->intf_num == if_num) 1256 goto found; 1257 } 1258 srcu_read_unlock(&ipmi_interfaces_srcu, index); 1259 1260 /* Not found, return an error */ 1261 return -EINVAL; 1262 1263 found: 1264 if (!intf->handlers->get_smi_info) 1265 rv = -ENOTTY; 1266 else 1267 rv = intf->handlers->get_smi_info(intf->send_info, data); 1268 srcu_read_unlock(&ipmi_interfaces_srcu, index); 1269 1270 return rv; 1271 } 1272 EXPORT_SYMBOL(ipmi_get_smi_info); 1273 1274 static void free_user(struct kref *ref) 1275 { 1276 struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount); 1277 1278 /* SRCU cleanup must happen in task context. */ 1279 schedule_work(&user->remove_work); 1280 } 1281 1282 static void _ipmi_destroy_user(struct ipmi_user *user) 1283 { 1284 struct ipmi_smi *intf = user->intf; 1285 int i; 1286 unsigned long flags; 1287 struct cmd_rcvr *rcvr; 1288 struct cmd_rcvr *rcvrs = NULL; 1289 1290 if (!acquire_ipmi_user(user, &i)) { 1291 /* 1292 * The user has already been cleaned up, just make sure 1293 * nothing is using it and return. 1294 */ 1295 synchronize_srcu(&user->release_barrier); 1296 return; 1297 } 1298 1299 rcu_assign_pointer(user->self, NULL); 1300 release_ipmi_user(user, i); 1301 1302 synchronize_srcu(&user->release_barrier); 1303 1304 if (user->handler->shutdown) 1305 user->handler->shutdown(user->handler_data); 1306 1307 if (user->handler->ipmi_watchdog_pretimeout) 1308 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG); 1309 1310 if (user->gets_events) 1311 atomic_dec(&intf->event_waiters); 1312 1313 /* Remove the user from the interface's sequence table. */ 1314 spin_lock_irqsave(&intf->seq_lock, flags); 1315 list_del_rcu(&user->link); 1316 1317 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) { 1318 if (intf->seq_table[i].inuse 1319 && (intf->seq_table[i].recv_msg->user == user)) { 1320 intf->seq_table[i].inuse = 0; 1321 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 1322 ipmi_free_recv_msg(intf->seq_table[i].recv_msg); 1323 } 1324 } 1325 spin_unlock_irqrestore(&intf->seq_lock, flags); 1326 1327 /* 1328 * Remove the user from the command receiver's table. First 1329 * we build a list of everything (not using the standard link, 1330 * since other things may be using it till we do 1331 * synchronize_srcu()) then free everything in that list. 1332 */ 1333 mutex_lock(&intf->cmd_rcvrs_mutex); 1334 list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) { 1335 if (rcvr->user == user) { 1336 list_del_rcu(&rcvr->link); 1337 rcvr->next = rcvrs; 1338 rcvrs = rcvr; 1339 } 1340 } 1341 mutex_unlock(&intf->cmd_rcvrs_mutex); 1342 synchronize_rcu(); 1343 while (rcvrs) { 1344 rcvr = rcvrs; 1345 rcvrs = rcvr->next; 1346 kfree(rcvr); 1347 } 1348 1349 kref_put(&intf->refcount, intf_free); 1350 } 1351 1352 int ipmi_destroy_user(struct ipmi_user *user) 1353 { 1354 _ipmi_destroy_user(user); 1355 1356 kref_put(&user->refcount, free_user); 1357 1358 return 0; 1359 } 1360 EXPORT_SYMBOL(ipmi_destroy_user); 1361 1362 int ipmi_get_version(struct ipmi_user *user, 1363 unsigned char *major, 1364 unsigned char *minor) 1365 { 1366 struct ipmi_device_id id; 1367 int rv, index; 1368 1369 user = acquire_ipmi_user(user, &index); 1370 if (!user) 1371 return -ENODEV; 1372 1373 rv = bmc_get_device_id(user->intf, NULL, &id, NULL, NULL); 1374 if (!rv) { 1375 *major = ipmi_version_major(&id); 1376 *minor = ipmi_version_minor(&id); 1377 } 1378 release_ipmi_user(user, index); 1379 1380 return rv; 1381 } 1382 EXPORT_SYMBOL(ipmi_get_version); 1383 1384 int ipmi_set_my_address(struct ipmi_user *user, 1385 unsigned int channel, 1386 unsigned char address) 1387 { 1388 int index, rv = 0; 1389 1390 user = acquire_ipmi_user(user, &index); 1391 if (!user) 1392 return -ENODEV; 1393 1394 if (channel >= IPMI_MAX_CHANNELS) { 1395 rv = -EINVAL; 1396 } else { 1397 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS); 1398 user->intf->addrinfo[channel].address = address; 1399 } 1400 release_ipmi_user(user, index); 1401 1402 return rv; 1403 } 1404 EXPORT_SYMBOL(ipmi_set_my_address); 1405 1406 int ipmi_get_my_address(struct ipmi_user *user, 1407 unsigned int channel, 1408 unsigned char *address) 1409 { 1410 int index, rv = 0; 1411 1412 user = acquire_ipmi_user(user, &index); 1413 if (!user) 1414 return -ENODEV; 1415 1416 if (channel >= IPMI_MAX_CHANNELS) { 1417 rv = -EINVAL; 1418 } else { 1419 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS); 1420 *address = user->intf->addrinfo[channel].address; 1421 } 1422 release_ipmi_user(user, index); 1423 1424 return rv; 1425 } 1426 EXPORT_SYMBOL(ipmi_get_my_address); 1427 1428 int ipmi_set_my_LUN(struct ipmi_user *user, 1429 unsigned int channel, 1430 unsigned char LUN) 1431 { 1432 int index, rv = 0; 1433 1434 user = acquire_ipmi_user(user, &index); 1435 if (!user) 1436 return -ENODEV; 1437 1438 if (channel >= IPMI_MAX_CHANNELS) { 1439 rv = -EINVAL; 1440 } else { 1441 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS); 1442 user->intf->addrinfo[channel].lun = LUN & 0x3; 1443 } 1444 release_ipmi_user(user, index); 1445 1446 return rv; 1447 } 1448 EXPORT_SYMBOL(ipmi_set_my_LUN); 1449 1450 int ipmi_get_my_LUN(struct ipmi_user *user, 1451 unsigned int channel, 1452 unsigned char *address) 1453 { 1454 int index, rv = 0; 1455 1456 user = acquire_ipmi_user(user, &index); 1457 if (!user) 1458 return -ENODEV; 1459 1460 if (channel >= IPMI_MAX_CHANNELS) { 1461 rv = -EINVAL; 1462 } else { 1463 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS); 1464 *address = user->intf->addrinfo[channel].lun; 1465 } 1466 release_ipmi_user(user, index); 1467 1468 return rv; 1469 } 1470 EXPORT_SYMBOL(ipmi_get_my_LUN); 1471 1472 int ipmi_get_maintenance_mode(struct ipmi_user *user) 1473 { 1474 int mode, index; 1475 unsigned long flags; 1476 1477 user = acquire_ipmi_user(user, &index); 1478 if (!user) 1479 return -ENODEV; 1480 1481 spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags); 1482 mode = user->intf->maintenance_mode; 1483 spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags); 1484 release_ipmi_user(user, index); 1485 1486 return mode; 1487 } 1488 EXPORT_SYMBOL(ipmi_get_maintenance_mode); 1489 1490 static void maintenance_mode_update(struct ipmi_smi *intf) 1491 { 1492 if (intf->handlers->set_maintenance_mode) 1493 intf->handlers->set_maintenance_mode( 1494 intf->send_info, intf->maintenance_mode_enable); 1495 } 1496 1497 int ipmi_set_maintenance_mode(struct ipmi_user *user, int mode) 1498 { 1499 int rv = 0, index; 1500 unsigned long flags; 1501 struct ipmi_smi *intf = user->intf; 1502 1503 user = acquire_ipmi_user(user, &index); 1504 if (!user) 1505 return -ENODEV; 1506 1507 spin_lock_irqsave(&intf->maintenance_mode_lock, flags); 1508 if (intf->maintenance_mode != mode) { 1509 switch (mode) { 1510 case IPMI_MAINTENANCE_MODE_AUTO: 1511 intf->maintenance_mode_enable 1512 = (intf->auto_maintenance_timeout > 0); 1513 break; 1514 1515 case IPMI_MAINTENANCE_MODE_OFF: 1516 intf->maintenance_mode_enable = false; 1517 break; 1518 1519 case IPMI_MAINTENANCE_MODE_ON: 1520 intf->maintenance_mode_enable = true; 1521 break; 1522 1523 default: 1524 rv = -EINVAL; 1525 goto out_unlock; 1526 } 1527 intf->maintenance_mode = mode; 1528 1529 maintenance_mode_update(intf); 1530 } 1531 out_unlock: 1532 spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags); 1533 release_ipmi_user(user, index); 1534 1535 return rv; 1536 } 1537 EXPORT_SYMBOL(ipmi_set_maintenance_mode); 1538 1539 int ipmi_set_gets_events(struct ipmi_user *user, bool val) 1540 { 1541 unsigned long flags; 1542 struct ipmi_smi *intf = user->intf; 1543 struct ipmi_recv_msg *msg, *msg2; 1544 struct list_head msgs; 1545 int index; 1546 1547 user = acquire_ipmi_user(user, &index); 1548 if (!user) 1549 return -ENODEV; 1550 1551 INIT_LIST_HEAD(&msgs); 1552 1553 spin_lock_irqsave(&intf->events_lock, flags); 1554 if (user->gets_events == val) 1555 goto out; 1556 1557 user->gets_events = val; 1558 1559 if (val) { 1560 if (atomic_inc_return(&intf->event_waiters) == 1) 1561 need_waiter(intf); 1562 } else { 1563 atomic_dec(&intf->event_waiters); 1564 } 1565 1566 if (intf->delivering_events) 1567 /* 1568 * Another thread is delivering events for this, so 1569 * let it handle any new events. 1570 */ 1571 goto out; 1572 1573 /* Deliver any queued events. */ 1574 while (user->gets_events && !list_empty(&intf->waiting_events)) { 1575 list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link) 1576 list_move_tail(&msg->link, &msgs); 1577 intf->waiting_events_count = 0; 1578 if (intf->event_msg_printed) { 1579 dev_warn(intf->si_dev, "Event queue no longer full\n"); 1580 intf->event_msg_printed = 0; 1581 } 1582 1583 intf->delivering_events = 1; 1584 spin_unlock_irqrestore(&intf->events_lock, flags); 1585 1586 list_for_each_entry_safe(msg, msg2, &msgs, link) { 1587 msg->user = user; 1588 kref_get(&user->refcount); 1589 deliver_local_response(intf, msg); 1590 } 1591 1592 spin_lock_irqsave(&intf->events_lock, flags); 1593 intf->delivering_events = 0; 1594 } 1595 1596 out: 1597 spin_unlock_irqrestore(&intf->events_lock, flags); 1598 release_ipmi_user(user, index); 1599 1600 return 0; 1601 } 1602 EXPORT_SYMBOL(ipmi_set_gets_events); 1603 1604 static struct cmd_rcvr *find_cmd_rcvr(struct ipmi_smi *intf, 1605 unsigned char netfn, 1606 unsigned char cmd, 1607 unsigned char chan) 1608 { 1609 struct cmd_rcvr *rcvr; 1610 1611 list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) { 1612 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd) 1613 && (rcvr->chans & (1 << chan))) 1614 return rcvr; 1615 } 1616 return NULL; 1617 } 1618 1619 static int is_cmd_rcvr_exclusive(struct ipmi_smi *intf, 1620 unsigned char netfn, 1621 unsigned char cmd, 1622 unsigned int chans) 1623 { 1624 struct cmd_rcvr *rcvr; 1625 1626 list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) { 1627 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd) 1628 && (rcvr->chans & chans)) 1629 return 0; 1630 } 1631 return 1; 1632 } 1633 1634 int ipmi_register_for_cmd(struct ipmi_user *user, 1635 unsigned char netfn, 1636 unsigned char cmd, 1637 unsigned int chans) 1638 { 1639 struct ipmi_smi *intf = user->intf; 1640 struct cmd_rcvr *rcvr; 1641 int rv = 0, index; 1642 1643 user = acquire_ipmi_user(user, &index); 1644 if (!user) 1645 return -ENODEV; 1646 1647 rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL); 1648 if (!rcvr) { 1649 rv = -ENOMEM; 1650 goto out_release; 1651 } 1652 rcvr->cmd = cmd; 1653 rcvr->netfn = netfn; 1654 rcvr->chans = chans; 1655 rcvr->user = user; 1656 1657 mutex_lock(&intf->cmd_rcvrs_mutex); 1658 /* Make sure the command/netfn is not already registered. */ 1659 if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) { 1660 rv = -EBUSY; 1661 goto out_unlock; 1662 } 1663 1664 smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS); 1665 1666 list_add_rcu(&rcvr->link, &intf->cmd_rcvrs); 1667 1668 out_unlock: 1669 mutex_unlock(&intf->cmd_rcvrs_mutex); 1670 if (rv) 1671 kfree(rcvr); 1672 out_release: 1673 release_ipmi_user(user, index); 1674 1675 return rv; 1676 } 1677 EXPORT_SYMBOL(ipmi_register_for_cmd); 1678 1679 int ipmi_unregister_for_cmd(struct ipmi_user *user, 1680 unsigned char netfn, 1681 unsigned char cmd, 1682 unsigned int chans) 1683 { 1684 struct ipmi_smi *intf = user->intf; 1685 struct cmd_rcvr *rcvr; 1686 struct cmd_rcvr *rcvrs = NULL; 1687 int i, rv = -ENOENT, index; 1688 1689 user = acquire_ipmi_user(user, &index); 1690 if (!user) 1691 return -ENODEV; 1692 1693 mutex_lock(&intf->cmd_rcvrs_mutex); 1694 for (i = 0; i < IPMI_NUM_CHANNELS; i++) { 1695 if (((1 << i) & chans) == 0) 1696 continue; 1697 rcvr = find_cmd_rcvr(intf, netfn, cmd, i); 1698 if (rcvr == NULL) 1699 continue; 1700 if (rcvr->user == user) { 1701 rv = 0; 1702 rcvr->chans &= ~chans; 1703 if (rcvr->chans == 0) { 1704 list_del_rcu(&rcvr->link); 1705 rcvr->next = rcvrs; 1706 rcvrs = rcvr; 1707 } 1708 } 1709 } 1710 mutex_unlock(&intf->cmd_rcvrs_mutex); 1711 synchronize_rcu(); 1712 release_ipmi_user(user, index); 1713 while (rcvrs) { 1714 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS); 1715 rcvr = rcvrs; 1716 rcvrs = rcvr->next; 1717 kfree(rcvr); 1718 } 1719 1720 return rv; 1721 } 1722 EXPORT_SYMBOL(ipmi_unregister_for_cmd); 1723 1724 static unsigned char 1725 ipmb_checksum(unsigned char *data, int size) 1726 { 1727 unsigned char csum = 0; 1728 1729 for (; size > 0; size--, data++) 1730 csum += *data; 1731 1732 return -csum; 1733 } 1734 1735 static inline void format_ipmb_msg(struct ipmi_smi_msg *smi_msg, 1736 struct kernel_ipmi_msg *msg, 1737 struct ipmi_ipmb_addr *ipmb_addr, 1738 long msgid, 1739 unsigned char ipmb_seq, 1740 int broadcast, 1741 unsigned char source_address, 1742 unsigned char source_lun) 1743 { 1744 int i = broadcast; 1745 1746 /* Format the IPMB header data. */ 1747 smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); 1748 smi_msg->data[1] = IPMI_SEND_MSG_CMD; 1749 smi_msg->data[2] = ipmb_addr->channel; 1750 if (broadcast) 1751 smi_msg->data[3] = 0; 1752 smi_msg->data[i+3] = ipmb_addr->slave_addr; 1753 smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3); 1754 smi_msg->data[i+5] = ipmb_checksum(&smi_msg->data[i + 3], 2); 1755 smi_msg->data[i+6] = source_address; 1756 smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun; 1757 smi_msg->data[i+8] = msg->cmd; 1758 1759 /* Now tack on the data to the message. */ 1760 if (msg->data_len > 0) 1761 memcpy(&smi_msg->data[i + 9], msg->data, msg->data_len); 1762 smi_msg->data_size = msg->data_len + 9; 1763 1764 /* Now calculate the checksum and tack it on. */ 1765 smi_msg->data[i+smi_msg->data_size] 1766 = ipmb_checksum(&smi_msg->data[i + 6], smi_msg->data_size - 6); 1767 1768 /* 1769 * Add on the checksum size and the offset from the 1770 * broadcast. 1771 */ 1772 smi_msg->data_size += 1 + i; 1773 1774 smi_msg->msgid = msgid; 1775 } 1776 1777 static inline void format_lan_msg(struct ipmi_smi_msg *smi_msg, 1778 struct kernel_ipmi_msg *msg, 1779 struct ipmi_lan_addr *lan_addr, 1780 long msgid, 1781 unsigned char ipmb_seq, 1782 unsigned char source_lun) 1783 { 1784 /* Format the IPMB header data. */ 1785 smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); 1786 smi_msg->data[1] = IPMI_SEND_MSG_CMD; 1787 smi_msg->data[2] = lan_addr->channel; 1788 smi_msg->data[3] = lan_addr->session_handle; 1789 smi_msg->data[4] = lan_addr->remote_SWID; 1790 smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3); 1791 smi_msg->data[6] = ipmb_checksum(&smi_msg->data[4], 2); 1792 smi_msg->data[7] = lan_addr->local_SWID; 1793 smi_msg->data[8] = (ipmb_seq << 2) | source_lun; 1794 smi_msg->data[9] = msg->cmd; 1795 1796 /* Now tack on the data to the message. */ 1797 if (msg->data_len > 0) 1798 memcpy(&smi_msg->data[10], msg->data, msg->data_len); 1799 smi_msg->data_size = msg->data_len + 10; 1800 1801 /* Now calculate the checksum and tack it on. */ 1802 smi_msg->data[smi_msg->data_size] 1803 = ipmb_checksum(&smi_msg->data[7], smi_msg->data_size - 7); 1804 1805 /* 1806 * Add on the checksum size and the offset from the 1807 * broadcast. 1808 */ 1809 smi_msg->data_size += 1; 1810 1811 smi_msg->msgid = msgid; 1812 } 1813 1814 static struct ipmi_smi_msg *smi_add_send_msg(struct ipmi_smi *intf, 1815 struct ipmi_smi_msg *smi_msg, 1816 int priority) 1817 { 1818 if (intf->curr_msg) { 1819 if (priority > 0) 1820 list_add_tail(&smi_msg->link, &intf->hp_xmit_msgs); 1821 else 1822 list_add_tail(&smi_msg->link, &intf->xmit_msgs); 1823 smi_msg = NULL; 1824 } else { 1825 intf->curr_msg = smi_msg; 1826 } 1827 1828 return smi_msg; 1829 } 1830 1831 static void smi_send(struct ipmi_smi *intf, 1832 const struct ipmi_smi_handlers *handlers, 1833 struct ipmi_smi_msg *smi_msg, int priority) 1834 { 1835 int run_to_completion = intf->run_to_completion; 1836 unsigned long flags = 0; 1837 1838 if (!run_to_completion) 1839 spin_lock_irqsave(&intf->xmit_msgs_lock, flags); 1840 smi_msg = smi_add_send_msg(intf, smi_msg, priority); 1841 1842 if (!run_to_completion) 1843 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags); 1844 1845 if (smi_msg) 1846 handlers->sender(intf->send_info, smi_msg); 1847 } 1848 1849 static bool is_maintenance_mode_cmd(struct kernel_ipmi_msg *msg) 1850 { 1851 return (((msg->netfn == IPMI_NETFN_APP_REQUEST) 1852 && ((msg->cmd == IPMI_COLD_RESET_CMD) 1853 || (msg->cmd == IPMI_WARM_RESET_CMD))) 1854 || (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST)); 1855 } 1856 1857 static int i_ipmi_req_sysintf(struct ipmi_smi *intf, 1858 struct ipmi_addr *addr, 1859 long msgid, 1860 struct kernel_ipmi_msg *msg, 1861 struct ipmi_smi_msg *smi_msg, 1862 struct ipmi_recv_msg *recv_msg, 1863 int retries, 1864 unsigned int retry_time_ms) 1865 { 1866 struct ipmi_system_interface_addr *smi_addr; 1867 1868 if (msg->netfn & 1) 1869 /* Responses are not allowed to the SMI. */ 1870 return -EINVAL; 1871 1872 smi_addr = (struct ipmi_system_interface_addr *) addr; 1873 if (smi_addr->lun > 3) { 1874 ipmi_inc_stat(intf, sent_invalid_commands); 1875 return -EINVAL; 1876 } 1877 1878 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr)); 1879 1880 if ((msg->netfn == IPMI_NETFN_APP_REQUEST) 1881 && ((msg->cmd == IPMI_SEND_MSG_CMD) 1882 || (msg->cmd == IPMI_GET_MSG_CMD) 1883 || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD))) { 1884 /* 1885 * We don't let the user do these, since we manage 1886 * the sequence numbers. 1887 */ 1888 ipmi_inc_stat(intf, sent_invalid_commands); 1889 return -EINVAL; 1890 } 1891 1892 if (is_maintenance_mode_cmd(msg)) { 1893 unsigned long flags; 1894 1895 spin_lock_irqsave(&intf->maintenance_mode_lock, flags); 1896 intf->auto_maintenance_timeout 1897 = maintenance_mode_timeout_ms; 1898 if (!intf->maintenance_mode 1899 && !intf->maintenance_mode_enable) { 1900 intf->maintenance_mode_enable = true; 1901 maintenance_mode_update(intf); 1902 } 1903 spin_unlock_irqrestore(&intf->maintenance_mode_lock, 1904 flags); 1905 } 1906 1907 if (msg->data_len + 2 > IPMI_MAX_MSG_LENGTH) { 1908 ipmi_inc_stat(intf, sent_invalid_commands); 1909 return -EMSGSIZE; 1910 } 1911 1912 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3); 1913 smi_msg->data[1] = msg->cmd; 1914 smi_msg->msgid = msgid; 1915 smi_msg->user_data = recv_msg; 1916 if (msg->data_len > 0) 1917 memcpy(&smi_msg->data[2], msg->data, msg->data_len); 1918 smi_msg->data_size = msg->data_len + 2; 1919 ipmi_inc_stat(intf, sent_local_commands); 1920 1921 return 0; 1922 } 1923 1924 static int i_ipmi_req_ipmb(struct ipmi_smi *intf, 1925 struct ipmi_addr *addr, 1926 long msgid, 1927 struct kernel_ipmi_msg *msg, 1928 struct ipmi_smi_msg *smi_msg, 1929 struct ipmi_recv_msg *recv_msg, 1930 unsigned char source_address, 1931 unsigned char source_lun, 1932 int retries, 1933 unsigned int retry_time_ms) 1934 { 1935 struct ipmi_ipmb_addr *ipmb_addr; 1936 unsigned char ipmb_seq; 1937 long seqid; 1938 int broadcast = 0; 1939 struct ipmi_channel *chans; 1940 int rv = 0; 1941 1942 if (addr->channel >= IPMI_MAX_CHANNELS) { 1943 ipmi_inc_stat(intf, sent_invalid_commands); 1944 return -EINVAL; 1945 } 1946 1947 chans = READ_ONCE(intf->channel_list)->c; 1948 1949 if (chans[addr->channel].medium != IPMI_CHANNEL_MEDIUM_IPMB) { 1950 ipmi_inc_stat(intf, sent_invalid_commands); 1951 return -EINVAL; 1952 } 1953 1954 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) { 1955 /* 1956 * Broadcasts add a zero at the beginning of the 1957 * message, but otherwise is the same as an IPMB 1958 * address. 1959 */ 1960 addr->addr_type = IPMI_IPMB_ADDR_TYPE; 1961 broadcast = 1; 1962 retries = 0; /* Don't retry broadcasts. */ 1963 } 1964 1965 /* 1966 * 9 for the header and 1 for the checksum, plus 1967 * possibly one for the broadcast. 1968 */ 1969 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) { 1970 ipmi_inc_stat(intf, sent_invalid_commands); 1971 return -EMSGSIZE; 1972 } 1973 1974 ipmb_addr = (struct ipmi_ipmb_addr *) addr; 1975 if (ipmb_addr->lun > 3) { 1976 ipmi_inc_stat(intf, sent_invalid_commands); 1977 return -EINVAL; 1978 } 1979 1980 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr)); 1981 1982 if (recv_msg->msg.netfn & 0x1) { 1983 /* 1984 * It's a response, so use the user's sequence 1985 * from msgid. 1986 */ 1987 ipmi_inc_stat(intf, sent_ipmb_responses); 1988 format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid, 1989 msgid, broadcast, 1990 source_address, source_lun); 1991 1992 /* 1993 * Save the receive message so we can use it 1994 * to deliver the response. 1995 */ 1996 smi_msg->user_data = recv_msg; 1997 } else { 1998 /* It's a command, so get a sequence for it. */ 1999 unsigned long flags; 2000 2001 spin_lock_irqsave(&intf->seq_lock, flags); 2002 2003 if (is_maintenance_mode_cmd(msg)) 2004 intf->ipmb_maintenance_mode_timeout = 2005 maintenance_mode_timeout_ms; 2006 2007 if (intf->ipmb_maintenance_mode_timeout && retry_time_ms == 0) 2008 /* Different default in maintenance mode */ 2009 retry_time_ms = default_maintenance_retry_ms; 2010 2011 /* 2012 * Create a sequence number with a 1 second 2013 * timeout and 4 retries. 2014 */ 2015 rv = intf_next_seq(intf, 2016 recv_msg, 2017 retry_time_ms, 2018 retries, 2019 broadcast, 2020 &ipmb_seq, 2021 &seqid); 2022 if (rv) 2023 /* 2024 * We have used up all the sequence numbers, 2025 * probably, so abort. 2026 */ 2027 goto out_err; 2028 2029 ipmi_inc_stat(intf, sent_ipmb_commands); 2030 2031 /* 2032 * Store the sequence number in the message, 2033 * so that when the send message response 2034 * comes back we can start the timer. 2035 */ 2036 format_ipmb_msg(smi_msg, msg, ipmb_addr, 2037 STORE_SEQ_IN_MSGID(ipmb_seq, seqid), 2038 ipmb_seq, broadcast, 2039 source_address, source_lun); 2040 2041 /* 2042 * Copy the message into the recv message data, so we 2043 * can retransmit it later if necessary. 2044 */ 2045 memcpy(recv_msg->msg_data, smi_msg->data, 2046 smi_msg->data_size); 2047 recv_msg->msg.data = recv_msg->msg_data; 2048 recv_msg->msg.data_len = smi_msg->data_size; 2049 2050 /* 2051 * We don't unlock until here, because we need 2052 * to copy the completed message into the 2053 * recv_msg before we release the lock. 2054 * Otherwise, race conditions may bite us. I 2055 * know that's pretty paranoid, but I prefer 2056 * to be correct. 2057 */ 2058 out_err: 2059 spin_unlock_irqrestore(&intf->seq_lock, flags); 2060 } 2061 2062 return rv; 2063 } 2064 2065 static int i_ipmi_req_lan(struct ipmi_smi *intf, 2066 struct ipmi_addr *addr, 2067 long msgid, 2068 struct kernel_ipmi_msg *msg, 2069 struct ipmi_smi_msg *smi_msg, 2070 struct ipmi_recv_msg *recv_msg, 2071 unsigned char source_lun, 2072 int retries, 2073 unsigned int retry_time_ms) 2074 { 2075 struct ipmi_lan_addr *lan_addr; 2076 unsigned char ipmb_seq; 2077 long seqid; 2078 struct ipmi_channel *chans; 2079 int rv = 0; 2080 2081 if (addr->channel >= IPMI_MAX_CHANNELS) { 2082 ipmi_inc_stat(intf, sent_invalid_commands); 2083 return -EINVAL; 2084 } 2085 2086 chans = READ_ONCE(intf->channel_list)->c; 2087 2088 if ((chans[addr->channel].medium 2089 != IPMI_CHANNEL_MEDIUM_8023LAN) 2090 && (chans[addr->channel].medium 2091 != IPMI_CHANNEL_MEDIUM_ASYNC)) { 2092 ipmi_inc_stat(intf, sent_invalid_commands); 2093 return -EINVAL; 2094 } 2095 2096 /* 11 for the header and 1 for the checksum. */ 2097 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) { 2098 ipmi_inc_stat(intf, sent_invalid_commands); 2099 return -EMSGSIZE; 2100 } 2101 2102 lan_addr = (struct ipmi_lan_addr *) addr; 2103 if (lan_addr->lun > 3) { 2104 ipmi_inc_stat(intf, sent_invalid_commands); 2105 return -EINVAL; 2106 } 2107 2108 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr)); 2109 2110 if (recv_msg->msg.netfn & 0x1) { 2111 /* 2112 * It's a response, so use the user's sequence 2113 * from msgid. 2114 */ 2115 ipmi_inc_stat(intf, sent_lan_responses); 2116 format_lan_msg(smi_msg, msg, lan_addr, msgid, 2117 msgid, source_lun); 2118 2119 /* 2120 * Save the receive message so we can use it 2121 * to deliver the response. 2122 */ 2123 smi_msg->user_data = recv_msg; 2124 } else { 2125 /* It's a command, so get a sequence for it. */ 2126 unsigned long flags; 2127 2128 spin_lock_irqsave(&intf->seq_lock, flags); 2129 2130 /* 2131 * Create a sequence number with a 1 second 2132 * timeout and 4 retries. 2133 */ 2134 rv = intf_next_seq(intf, 2135 recv_msg, 2136 retry_time_ms, 2137 retries, 2138 0, 2139 &ipmb_seq, 2140 &seqid); 2141 if (rv) 2142 /* 2143 * We have used up all the sequence numbers, 2144 * probably, so abort. 2145 */ 2146 goto out_err; 2147 2148 ipmi_inc_stat(intf, sent_lan_commands); 2149 2150 /* 2151 * Store the sequence number in the message, 2152 * so that when the send message response 2153 * comes back we can start the timer. 2154 */ 2155 format_lan_msg(smi_msg, msg, lan_addr, 2156 STORE_SEQ_IN_MSGID(ipmb_seq, seqid), 2157 ipmb_seq, source_lun); 2158 2159 /* 2160 * Copy the message into the recv message data, so we 2161 * can retransmit it later if necessary. 2162 */ 2163 memcpy(recv_msg->msg_data, smi_msg->data, 2164 smi_msg->data_size); 2165 recv_msg->msg.data = recv_msg->msg_data; 2166 recv_msg->msg.data_len = smi_msg->data_size; 2167 2168 /* 2169 * We don't unlock until here, because we need 2170 * to copy the completed message into the 2171 * recv_msg before we release the lock. 2172 * Otherwise, race conditions may bite us. I 2173 * know that's pretty paranoid, but I prefer 2174 * to be correct. 2175 */ 2176 out_err: 2177 spin_unlock_irqrestore(&intf->seq_lock, flags); 2178 } 2179 2180 return rv; 2181 } 2182 2183 /* 2184 * Separate from ipmi_request so that the user does not have to be 2185 * supplied in certain circumstances (mainly at panic time). If 2186 * messages are supplied, they will be freed, even if an error 2187 * occurs. 2188 */ 2189 static int i_ipmi_request(struct ipmi_user *user, 2190 struct ipmi_smi *intf, 2191 struct ipmi_addr *addr, 2192 long msgid, 2193 struct kernel_ipmi_msg *msg, 2194 void *user_msg_data, 2195 void *supplied_smi, 2196 struct ipmi_recv_msg *supplied_recv, 2197 int priority, 2198 unsigned char source_address, 2199 unsigned char source_lun, 2200 int retries, 2201 unsigned int retry_time_ms) 2202 { 2203 struct ipmi_smi_msg *smi_msg; 2204 struct ipmi_recv_msg *recv_msg; 2205 int rv = 0; 2206 2207 if (supplied_recv) 2208 recv_msg = supplied_recv; 2209 else { 2210 recv_msg = ipmi_alloc_recv_msg(); 2211 if (recv_msg == NULL) { 2212 rv = -ENOMEM; 2213 goto out; 2214 } 2215 } 2216 recv_msg->user_msg_data = user_msg_data; 2217 2218 if (supplied_smi) 2219 smi_msg = (struct ipmi_smi_msg *) supplied_smi; 2220 else { 2221 smi_msg = ipmi_alloc_smi_msg(); 2222 if (smi_msg == NULL) { 2223 ipmi_free_recv_msg(recv_msg); 2224 rv = -ENOMEM; 2225 goto out; 2226 } 2227 } 2228 2229 rcu_read_lock(); 2230 if (intf->in_shutdown) { 2231 rv = -ENODEV; 2232 goto out_err; 2233 } 2234 2235 recv_msg->user = user; 2236 if (user) 2237 /* The put happens when the message is freed. */ 2238 kref_get(&user->refcount); 2239 recv_msg->msgid = msgid; 2240 /* 2241 * Store the message to send in the receive message so timeout 2242 * responses can get the proper response data. 2243 */ 2244 recv_msg->msg = *msg; 2245 2246 if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) { 2247 rv = i_ipmi_req_sysintf(intf, addr, msgid, msg, smi_msg, 2248 recv_msg, retries, retry_time_ms); 2249 } else if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) { 2250 rv = i_ipmi_req_ipmb(intf, addr, msgid, msg, smi_msg, recv_msg, 2251 source_address, source_lun, 2252 retries, retry_time_ms); 2253 } else if (is_lan_addr(addr)) { 2254 rv = i_ipmi_req_lan(intf, addr, msgid, msg, smi_msg, recv_msg, 2255 source_lun, retries, retry_time_ms); 2256 } else { 2257 /* Unknown address type. */ 2258 ipmi_inc_stat(intf, sent_invalid_commands); 2259 rv = -EINVAL; 2260 } 2261 2262 if (rv) { 2263 out_err: 2264 ipmi_free_smi_msg(smi_msg); 2265 ipmi_free_recv_msg(recv_msg); 2266 } else { 2267 ipmi_debug_msg("Send", smi_msg->data, smi_msg->data_size); 2268 2269 smi_send(intf, intf->handlers, smi_msg, priority); 2270 } 2271 rcu_read_unlock(); 2272 2273 out: 2274 return rv; 2275 } 2276 2277 static int check_addr(struct ipmi_smi *intf, 2278 struct ipmi_addr *addr, 2279 unsigned char *saddr, 2280 unsigned char *lun) 2281 { 2282 if (addr->channel >= IPMI_MAX_CHANNELS) 2283 return -EINVAL; 2284 addr->channel = array_index_nospec(addr->channel, IPMI_MAX_CHANNELS); 2285 *lun = intf->addrinfo[addr->channel].lun; 2286 *saddr = intf->addrinfo[addr->channel].address; 2287 return 0; 2288 } 2289 2290 int ipmi_request_settime(struct ipmi_user *user, 2291 struct ipmi_addr *addr, 2292 long msgid, 2293 struct kernel_ipmi_msg *msg, 2294 void *user_msg_data, 2295 int priority, 2296 int retries, 2297 unsigned int retry_time_ms) 2298 { 2299 unsigned char saddr = 0, lun = 0; 2300 int rv, index; 2301 2302 if (!user) 2303 return -EINVAL; 2304 2305 user = acquire_ipmi_user(user, &index); 2306 if (!user) 2307 return -ENODEV; 2308 2309 rv = check_addr(user->intf, addr, &saddr, &lun); 2310 if (!rv) 2311 rv = i_ipmi_request(user, 2312 user->intf, 2313 addr, 2314 msgid, 2315 msg, 2316 user_msg_data, 2317 NULL, NULL, 2318 priority, 2319 saddr, 2320 lun, 2321 retries, 2322 retry_time_ms); 2323 2324 release_ipmi_user(user, index); 2325 return rv; 2326 } 2327 EXPORT_SYMBOL(ipmi_request_settime); 2328 2329 int ipmi_request_supply_msgs(struct ipmi_user *user, 2330 struct ipmi_addr *addr, 2331 long msgid, 2332 struct kernel_ipmi_msg *msg, 2333 void *user_msg_data, 2334 void *supplied_smi, 2335 struct ipmi_recv_msg *supplied_recv, 2336 int priority) 2337 { 2338 unsigned char saddr = 0, lun = 0; 2339 int rv, index; 2340 2341 if (!user) 2342 return -EINVAL; 2343 2344 user = acquire_ipmi_user(user, &index); 2345 if (!user) 2346 return -ENODEV; 2347 2348 rv = check_addr(user->intf, addr, &saddr, &lun); 2349 if (!rv) 2350 rv = i_ipmi_request(user, 2351 user->intf, 2352 addr, 2353 msgid, 2354 msg, 2355 user_msg_data, 2356 supplied_smi, 2357 supplied_recv, 2358 priority, 2359 saddr, 2360 lun, 2361 -1, 0); 2362 2363 release_ipmi_user(user, index); 2364 return rv; 2365 } 2366 EXPORT_SYMBOL(ipmi_request_supply_msgs); 2367 2368 static void bmc_device_id_handler(struct ipmi_smi *intf, 2369 struct ipmi_recv_msg *msg) 2370 { 2371 int rv; 2372 2373 if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 2374 || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE) 2375 || (msg->msg.cmd != IPMI_GET_DEVICE_ID_CMD)) { 2376 dev_warn(intf->si_dev, 2377 "invalid device_id msg: addr_type=%d netfn=%x cmd=%x\n", 2378 msg->addr.addr_type, msg->msg.netfn, msg->msg.cmd); 2379 return; 2380 } 2381 2382 rv = ipmi_demangle_device_id(msg->msg.netfn, msg->msg.cmd, 2383 msg->msg.data, msg->msg.data_len, &intf->bmc->fetch_id); 2384 if (rv) { 2385 dev_warn(intf->si_dev, "device id demangle failed: %d\n", rv); 2386 intf->bmc->dyn_id_set = 0; 2387 } else { 2388 /* 2389 * Make sure the id data is available before setting 2390 * dyn_id_set. 2391 */ 2392 smp_wmb(); 2393 intf->bmc->dyn_id_set = 1; 2394 } 2395 2396 wake_up(&intf->waitq); 2397 } 2398 2399 static int 2400 send_get_device_id_cmd(struct ipmi_smi *intf) 2401 { 2402 struct ipmi_system_interface_addr si; 2403 struct kernel_ipmi_msg msg; 2404 2405 si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 2406 si.channel = IPMI_BMC_CHANNEL; 2407 si.lun = 0; 2408 2409 msg.netfn = IPMI_NETFN_APP_REQUEST; 2410 msg.cmd = IPMI_GET_DEVICE_ID_CMD; 2411 msg.data = NULL; 2412 msg.data_len = 0; 2413 2414 return i_ipmi_request(NULL, 2415 intf, 2416 (struct ipmi_addr *) &si, 2417 0, 2418 &msg, 2419 intf, 2420 NULL, 2421 NULL, 2422 0, 2423 intf->addrinfo[0].address, 2424 intf->addrinfo[0].lun, 2425 -1, 0); 2426 } 2427 2428 static int __get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc) 2429 { 2430 int rv; 2431 2432 bmc->dyn_id_set = 2; 2433 2434 intf->null_user_handler = bmc_device_id_handler; 2435 2436 rv = send_get_device_id_cmd(intf); 2437 if (rv) 2438 return rv; 2439 2440 wait_event(intf->waitq, bmc->dyn_id_set != 2); 2441 2442 if (!bmc->dyn_id_set) 2443 rv = -EIO; /* Something went wrong in the fetch. */ 2444 2445 /* dyn_id_set makes the id data available. */ 2446 smp_rmb(); 2447 2448 intf->null_user_handler = NULL; 2449 2450 return rv; 2451 } 2452 2453 /* 2454 * Fetch the device id for the bmc/interface. You must pass in either 2455 * bmc or intf, this code will get the other one. If the data has 2456 * been recently fetched, this will just use the cached data. Otherwise 2457 * it will run a new fetch. 2458 * 2459 * Except for the first time this is called (in ipmi_register_smi()), 2460 * this will always return good data; 2461 */ 2462 static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, 2463 struct ipmi_device_id *id, 2464 bool *guid_set, guid_t *guid, int intf_num) 2465 { 2466 int rv = 0; 2467 int prev_dyn_id_set, prev_guid_set; 2468 bool intf_set = intf != NULL; 2469 2470 if (!intf) { 2471 mutex_lock(&bmc->dyn_mutex); 2472 retry_bmc_lock: 2473 if (list_empty(&bmc->intfs)) { 2474 mutex_unlock(&bmc->dyn_mutex); 2475 return -ENOENT; 2476 } 2477 intf = list_first_entry(&bmc->intfs, struct ipmi_smi, 2478 bmc_link); 2479 kref_get(&intf->refcount); 2480 mutex_unlock(&bmc->dyn_mutex); 2481 mutex_lock(&intf->bmc_reg_mutex); 2482 mutex_lock(&bmc->dyn_mutex); 2483 if (intf != list_first_entry(&bmc->intfs, struct ipmi_smi, 2484 bmc_link)) { 2485 mutex_unlock(&intf->bmc_reg_mutex); 2486 kref_put(&intf->refcount, intf_free); 2487 goto retry_bmc_lock; 2488 } 2489 } else { 2490 mutex_lock(&intf->bmc_reg_mutex); 2491 bmc = intf->bmc; 2492 mutex_lock(&bmc->dyn_mutex); 2493 kref_get(&intf->refcount); 2494 } 2495 2496 /* If we have a valid and current ID, just return that. */ 2497 if (intf->in_bmc_register || 2498 (bmc->dyn_id_set && time_is_after_jiffies(bmc->dyn_id_expiry))) 2499 goto out_noprocessing; 2500 2501 prev_guid_set = bmc->dyn_guid_set; 2502 __get_guid(intf); 2503 2504 prev_dyn_id_set = bmc->dyn_id_set; 2505 rv = __get_device_id(intf, bmc); 2506 if (rv) 2507 goto out; 2508 2509 /* 2510 * The guid, device id, manufacturer id, and product id should 2511 * not change on a BMC. If it does we have to do some dancing. 2512 */ 2513 if (!intf->bmc_registered 2514 || (!prev_guid_set && bmc->dyn_guid_set) 2515 || (!prev_dyn_id_set && bmc->dyn_id_set) 2516 || (prev_guid_set && bmc->dyn_guid_set 2517 && !guid_equal(&bmc->guid, &bmc->fetch_guid)) 2518 || bmc->id.device_id != bmc->fetch_id.device_id 2519 || bmc->id.manufacturer_id != bmc->fetch_id.manufacturer_id 2520 || bmc->id.product_id != bmc->fetch_id.product_id) { 2521 struct ipmi_device_id id = bmc->fetch_id; 2522 int guid_set = bmc->dyn_guid_set; 2523 guid_t guid; 2524 2525 guid = bmc->fetch_guid; 2526 mutex_unlock(&bmc->dyn_mutex); 2527 2528 __ipmi_bmc_unregister(intf); 2529 /* Fill in the temporary BMC for good measure. */ 2530 intf->bmc->id = id; 2531 intf->bmc->dyn_guid_set = guid_set; 2532 intf->bmc->guid = guid; 2533 if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num)) 2534 need_waiter(intf); /* Retry later on an error. */ 2535 else 2536 __scan_channels(intf, &id); 2537 2538 2539 if (!intf_set) { 2540 /* 2541 * We weren't given the interface on the 2542 * command line, so restart the operation on 2543 * the next interface for the BMC. 2544 */ 2545 mutex_unlock(&intf->bmc_reg_mutex); 2546 mutex_lock(&bmc->dyn_mutex); 2547 goto retry_bmc_lock; 2548 } 2549 2550 /* We have a new BMC, set it up. */ 2551 bmc = intf->bmc; 2552 mutex_lock(&bmc->dyn_mutex); 2553 goto out_noprocessing; 2554 } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id))) 2555 /* Version info changes, scan the channels again. */ 2556 __scan_channels(intf, &bmc->fetch_id); 2557 2558 bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY; 2559 2560 out: 2561 if (rv && prev_dyn_id_set) { 2562 rv = 0; /* Ignore failures if we have previous data. */ 2563 bmc->dyn_id_set = prev_dyn_id_set; 2564 } 2565 if (!rv) { 2566 bmc->id = bmc->fetch_id; 2567 if (bmc->dyn_guid_set) 2568 bmc->guid = bmc->fetch_guid; 2569 else if (prev_guid_set) 2570 /* 2571 * The guid used to be valid and it failed to fetch, 2572 * just use the cached value. 2573 */ 2574 bmc->dyn_guid_set = prev_guid_set; 2575 } 2576 out_noprocessing: 2577 if (!rv) { 2578 if (id) 2579 *id = bmc->id; 2580 2581 if (guid_set) 2582 *guid_set = bmc->dyn_guid_set; 2583 2584 if (guid && bmc->dyn_guid_set) 2585 *guid = bmc->guid; 2586 } 2587 2588 mutex_unlock(&bmc->dyn_mutex); 2589 mutex_unlock(&intf->bmc_reg_mutex); 2590 2591 kref_put(&intf->refcount, intf_free); 2592 return rv; 2593 } 2594 2595 static int bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, 2596 struct ipmi_device_id *id, 2597 bool *guid_set, guid_t *guid) 2598 { 2599 return __bmc_get_device_id(intf, bmc, id, guid_set, guid, -1); 2600 } 2601 2602 static ssize_t device_id_show(struct device *dev, 2603 struct device_attribute *attr, 2604 char *buf) 2605 { 2606 struct bmc_device *bmc = to_bmc_device(dev); 2607 struct ipmi_device_id id; 2608 int rv; 2609 2610 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2611 if (rv) 2612 return rv; 2613 2614 return snprintf(buf, 10, "%u\n", id.device_id); 2615 } 2616 static DEVICE_ATTR_RO(device_id); 2617 2618 static ssize_t provides_device_sdrs_show(struct device *dev, 2619 struct device_attribute *attr, 2620 char *buf) 2621 { 2622 struct bmc_device *bmc = to_bmc_device(dev); 2623 struct ipmi_device_id id; 2624 int rv; 2625 2626 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2627 if (rv) 2628 return rv; 2629 2630 return snprintf(buf, 10, "%u\n", (id.device_revision & 0x80) >> 7); 2631 } 2632 static DEVICE_ATTR_RO(provides_device_sdrs); 2633 2634 static ssize_t revision_show(struct device *dev, struct device_attribute *attr, 2635 char *buf) 2636 { 2637 struct bmc_device *bmc = to_bmc_device(dev); 2638 struct ipmi_device_id id; 2639 int rv; 2640 2641 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2642 if (rv) 2643 return rv; 2644 2645 return snprintf(buf, 20, "%u\n", id.device_revision & 0x0F); 2646 } 2647 static DEVICE_ATTR_RO(revision); 2648 2649 static ssize_t firmware_revision_show(struct device *dev, 2650 struct device_attribute *attr, 2651 char *buf) 2652 { 2653 struct bmc_device *bmc = to_bmc_device(dev); 2654 struct ipmi_device_id id; 2655 int rv; 2656 2657 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2658 if (rv) 2659 return rv; 2660 2661 return snprintf(buf, 20, "%u.%x\n", id.firmware_revision_1, 2662 id.firmware_revision_2); 2663 } 2664 static DEVICE_ATTR_RO(firmware_revision); 2665 2666 static ssize_t ipmi_version_show(struct device *dev, 2667 struct device_attribute *attr, 2668 char *buf) 2669 { 2670 struct bmc_device *bmc = to_bmc_device(dev); 2671 struct ipmi_device_id id; 2672 int rv; 2673 2674 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2675 if (rv) 2676 return rv; 2677 2678 return snprintf(buf, 20, "%u.%u\n", 2679 ipmi_version_major(&id), 2680 ipmi_version_minor(&id)); 2681 } 2682 static DEVICE_ATTR_RO(ipmi_version); 2683 2684 static ssize_t add_dev_support_show(struct device *dev, 2685 struct device_attribute *attr, 2686 char *buf) 2687 { 2688 struct bmc_device *bmc = to_bmc_device(dev); 2689 struct ipmi_device_id id; 2690 int rv; 2691 2692 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2693 if (rv) 2694 return rv; 2695 2696 return snprintf(buf, 10, "0x%02x\n", id.additional_device_support); 2697 } 2698 static DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show, 2699 NULL); 2700 2701 static ssize_t manufacturer_id_show(struct device *dev, 2702 struct device_attribute *attr, 2703 char *buf) 2704 { 2705 struct bmc_device *bmc = to_bmc_device(dev); 2706 struct ipmi_device_id id; 2707 int rv; 2708 2709 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2710 if (rv) 2711 return rv; 2712 2713 return snprintf(buf, 20, "0x%6.6x\n", id.manufacturer_id); 2714 } 2715 static DEVICE_ATTR_RO(manufacturer_id); 2716 2717 static ssize_t product_id_show(struct device *dev, 2718 struct device_attribute *attr, 2719 char *buf) 2720 { 2721 struct bmc_device *bmc = to_bmc_device(dev); 2722 struct ipmi_device_id id; 2723 int rv; 2724 2725 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2726 if (rv) 2727 return rv; 2728 2729 return snprintf(buf, 10, "0x%4.4x\n", id.product_id); 2730 } 2731 static DEVICE_ATTR_RO(product_id); 2732 2733 static ssize_t aux_firmware_rev_show(struct device *dev, 2734 struct device_attribute *attr, 2735 char *buf) 2736 { 2737 struct bmc_device *bmc = to_bmc_device(dev); 2738 struct ipmi_device_id id; 2739 int rv; 2740 2741 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2742 if (rv) 2743 return rv; 2744 2745 return snprintf(buf, 21, "0x%02x 0x%02x 0x%02x 0x%02x\n", 2746 id.aux_firmware_revision[3], 2747 id.aux_firmware_revision[2], 2748 id.aux_firmware_revision[1], 2749 id.aux_firmware_revision[0]); 2750 } 2751 static DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL); 2752 2753 static ssize_t guid_show(struct device *dev, struct device_attribute *attr, 2754 char *buf) 2755 { 2756 struct bmc_device *bmc = to_bmc_device(dev); 2757 bool guid_set; 2758 guid_t guid; 2759 int rv; 2760 2761 rv = bmc_get_device_id(NULL, bmc, NULL, &guid_set, &guid); 2762 if (rv) 2763 return rv; 2764 if (!guid_set) 2765 return -ENOENT; 2766 2767 return snprintf(buf, UUID_STRING_LEN + 1 + 1, "%pUl\n", &guid); 2768 } 2769 static DEVICE_ATTR_RO(guid); 2770 2771 static struct attribute *bmc_dev_attrs[] = { 2772 &dev_attr_device_id.attr, 2773 &dev_attr_provides_device_sdrs.attr, 2774 &dev_attr_revision.attr, 2775 &dev_attr_firmware_revision.attr, 2776 &dev_attr_ipmi_version.attr, 2777 &dev_attr_additional_device_support.attr, 2778 &dev_attr_manufacturer_id.attr, 2779 &dev_attr_product_id.attr, 2780 &dev_attr_aux_firmware_revision.attr, 2781 &dev_attr_guid.attr, 2782 NULL 2783 }; 2784 2785 static umode_t bmc_dev_attr_is_visible(struct kobject *kobj, 2786 struct attribute *attr, int idx) 2787 { 2788 struct device *dev = kobj_to_dev(kobj); 2789 struct bmc_device *bmc = to_bmc_device(dev); 2790 umode_t mode = attr->mode; 2791 int rv; 2792 2793 if (attr == &dev_attr_aux_firmware_revision.attr) { 2794 struct ipmi_device_id id; 2795 2796 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2797 return (!rv && id.aux_firmware_revision_set) ? mode : 0; 2798 } 2799 if (attr == &dev_attr_guid.attr) { 2800 bool guid_set; 2801 2802 rv = bmc_get_device_id(NULL, bmc, NULL, &guid_set, NULL); 2803 return (!rv && guid_set) ? mode : 0; 2804 } 2805 return mode; 2806 } 2807 2808 static const struct attribute_group bmc_dev_attr_group = { 2809 .attrs = bmc_dev_attrs, 2810 .is_visible = bmc_dev_attr_is_visible, 2811 }; 2812 2813 static const struct attribute_group *bmc_dev_attr_groups[] = { 2814 &bmc_dev_attr_group, 2815 NULL 2816 }; 2817 2818 static const struct device_type bmc_device_type = { 2819 .groups = bmc_dev_attr_groups, 2820 }; 2821 2822 static int __find_bmc_guid(struct device *dev, void *data) 2823 { 2824 guid_t *guid = data; 2825 struct bmc_device *bmc; 2826 int rv; 2827 2828 if (dev->type != &bmc_device_type) 2829 return 0; 2830 2831 bmc = to_bmc_device(dev); 2832 rv = bmc->dyn_guid_set && guid_equal(&bmc->guid, guid); 2833 if (rv) 2834 rv = kref_get_unless_zero(&bmc->usecount); 2835 return rv; 2836 } 2837 2838 /* 2839 * Returns with the bmc's usecount incremented, if it is non-NULL. 2840 */ 2841 static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv, 2842 guid_t *guid) 2843 { 2844 struct device *dev; 2845 struct bmc_device *bmc = NULL; 2846 2847 dev = driver_find_device(drv, NULL, guid, __find_bmc_guid); 2848 if (dev) { 2849 bmc = to_bmc_device(dev); 2850 put_device(dev); 2851 } 2852 return bmc; 2853 } 2854 2855 struct prod_dev_id { 2856 unsigned int product_id; 2857 unsigned char device_id; 2858 }; 2859 2860 static int __find_bmc_prod_dev_id(struct device *dev, void *data) 2861 { 2862 struct prod_dev_id *cid = data; 2863 struct bmc_device *bmc; 2864 int rv; 2865 2866 if (dev->type != &bmc_device_type) 2867 return 0; 2868 2869 bmc = to_bmc_device(dev); 2870 rv = (bmc->id.product_id == cid->product_id 2871 && bmc->id.device_id == cid->device_id); 2872 if (rv) 2873 rv = kref_get_unless_zero(&bmc->usecount); 2874 return rv; 2875 } 2876 2877 /* 2878 * Returns with the bmc's usecount incremented, if it is non-NULL. 2879 */ 2880 static struct bmc_device *ipmi_find_bmc_prod_dev_id( 2881 struct device_driver *drv, 2882 unsigned int product_id, unsigned char device_id) 2883 { 2884 struct prod_dev_id id = { 2885 .product_id = product_id, 2886 .device_id = device_id, 2887 }; 2888 struct device *dev; 2889 struct bmc_device *bmc = NULL; 2890 2891 dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id); 2892 if (dev) { 2893 bmc = to_bmc_device(dev); 2894 put_device(dev); 2895 } 2896 return bmc; 2897 } 2898 2899 static DEFINE_IDA(ipmi_bmc_ida); 2900 2901 static void 2902 release_bmc_device(struct device *dev) 2903 { 2904 kfree(to_bmc_device(dev)); 2905 } 2906 2907 static void cleanup_bmc_work(struct work_struct *work) 2908 { 2909 struct bmc_device *bmc = container_of(work, struct bmc_device, 2910 remove_work); 2911 int id = bmc->pdev.id; /* Unregister overwrites id */ 2912 2913 platform_device_unregister(&bmc->pdev); 2914 ida_simple_remove(&ipmi_bmc_ida, id); 2915 } 2916 2917 static void 2918 cleanup_bmc_device(struct kref *ref) 2919 { 2920 struct bmc_device *bmc = container_of(ref, struct bmc_device, usecount); 2921 2922 /* 2923 * Remove the platform device in a work queue to avoid issues 2924 * with removing the device attributes while reading a device 2925 * attribute. 2926 */ 2927 schedule_work(&bmc->remove_work); 2928 } 2929 2930 /* 2931 * Must be called with intf->bmc_reg_mutex held. 2932 */ 2933 static void __ipmi_bmc_unregister(struct ipmi_smi *intf) 2934 { 2935 struct bmc_device *bmc = intf->bmc; 2936 2937 if (!intf->bmc_registered) 2938 return; 2939 2940 sysfs_remove_link(&intf->si_dev->kobj, "bmc"); 2941 sysfs_remove_link(&bmc->pdev.dev.kobj, intf->my_dev_name); 2942 kfree(intf->my_dev_name); 2943 intf->my_dev_name = NULL; 2944 2945 mutex_lock(&bmc->dyn_mutex); 2946 list_del(&intf->bmc_link); 2947 mutex_unlock(&bmc->dyn_mutex); 2948 intf->bmc = &intf->tmp_bmc; 2949 kref_put(&bmc->usecount, cleanup_bmc_device); 2950 intf->bmc_registered = false; 2951 } 2952 2953 static void ipmi_bmc_unregister(struct ipmi_smi *intf) 2954 { 2955 mutex_lock(&intf->bmc_reg_mutex); 2956 __ipmi_bmc_unregister(intf); 2957 mutex_unlock(&intf->bmc_reg_mutex); 2958 } 2959 2960 /* 2961 * Must be called with intf->bmc_reg_mutex held. 2962 */ 2963 static int __ipmi_bmc_register(struct ipmi_smi *intf, 2964 struct ipmi_device_id *id, 2965 bool guid_set, guid_t *guid, int intf_num) 2966 { 2967 int rv; 2968 struct bmc_device *bmc; 2969 struct bmc_device *old_bmc; 2970 2971 /* 2972 * platform_device_register() can cause bmc_reg_mutex to 2973 * be claimed because of the is_visible functions of 2974 * the attributes. Eliminate possible recursion and 2975 * release the lock. 2976 */ 2977 intf->in_bmc_register = true; 2978 mutex_unlock(&intf->bmc_reg_mutex); 2979 2980 /* 2981 * Try to find if there is an bmc_device struct 2982 * representing the interfaced BMC already 2983 */ 2984 mutex_lock(&ipmidriver_mutex); 2985 if (guid_set) 2986 old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, guid); 2987 else 2988 old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver, 2989 id->product_id, 2990 id->device_id); 2991 2992 /* 2993 * If there is already an bmc_device, free the new one, 2994 * otherwise register the new BMC device 2995 */ 2996 if (old_bmc) { 2997 bmc = old_bmc; 2998 /* 2999 * Note: old_bmc already has usecount incremented by 3000 * the BMC find functions. 3001 */ 3002 intf->bmc = old_bmc; 3003 mutex_lock(&bmc->dyn_mutex); 3004 list_add_tail(&intf->bmc_link, &bmc->intfs); 3005 mutex_unlock(&bmc->dyn_mutex); 3006 3007 dev_info(intf->si_dev, 3008 "interfacing existing BMC (man_id: 0x%6.6x, prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n", 3009 bmc->id.manufacturer_id, 3010 bmc->id.product_id, 3011 bmc->id.device_id); 3012 } else { 3013 bmc = kzalloc(sizeof(*bmc), GFP_KERNEL); 3014 if (!bmc) { 3015 rv = -ENOMEM; 3016 goto out; 3017 } 3018 INIT_LIST_HEAD(&bmc->intfs); 3019 mutex_init(&bmc->dyn_mutex); 3020 INIT_WORK(&bmc->remove_work, cleanup_bmc_work); 3021 3022 bmc->id = *id; 3023 bmc->dyn_id_set = 1; 3024 bmc->dyn_guid_set = guid_set; 3025 bmc->guid = *guid; 3026 bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY; 3027 3028 bmc->pdev.name = "ipmi_bmc"; 3029 3030 rv = ida_simple_get(&ipmi_bmc_ida, 0, 0, GFP_KERNEL); 3031 if (rv < 0) 3032 goto out; 3033 bmc->pdev.dev.driver = &ipmidriver.driver; 3034 bmc->pdev.id = rv; 3035 bmc->pdev.dev.release = release_bmc_device; 3036 bmc->pdev.dev.type = &bmc_device_type; 3037 kref_init(&bmc->usecount); 3038 3039 intf->bmc = bmc; 3040 mutex_lock(&bmc->dyn_mutex); 3041 list_add_tail(&intf->bmc_link, &bmc->intfs); 3042 mutex_unlock(&bmc->dyn_mutex); 3043 3044 rv = platform_device_register(&bmc->pdev); 3045 if (rv) { 3046 dev_err(intf->si_dev, 3047 "Unable to register bmc device: %d\n", 3048 rv); 3049 goto out_list_del; 3050 } 3051 3052 dev_info(intf->si_dev, 3053 "Found new BMC (man_id: 0x%6.6x, prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n", 3054 bmc->id.manufacturer_id, 3055 bmc->id.product_id, 3056 bmc->id.device_id); 3057 } 3058 3059 /* 3060 * create symlink from system interface device to bmc device 3061 * and back. 3062 */ 3063 rv = sysfs_create_link(&intf->si_dev->kobj, &bmc->pdev.dev.kobj, "bmc"); 3064 if (rv) { 3065 dev_err(intf->si_dev, "Unable to create bmc symlink: %d\n", rv); 3066 goto out_put_bmc; 3067 } 3068 3069 if (intf_num == -1) 3070 intf_num = intf->intf_num; 3071 intf->my_dev_name = kasprintf(GFP_KERNEL, "ipmi%d", intf_num); 3072 if (!intf->my_dev_name) { 3073 rv = -ENOMEM; 3074 dev_err(intf->si_dev, "Unable to allocate link from BMC: %d\n", 3075 rv); 3076 goto out_unlink1; 3077 } 3078 3079 rv = sysfs_create_link(&bmc->pdev.dev.kobj, &intf->si_dev->kobj, 3080 intf->my_dev_name); 3081 if (rv) { 3082 kfree(intf->my_dev_name); 3083 intf->my_dev_name = NULL; 3084 dev_err(intf->si_dev, "Unable to create symlink to bmc: %d\n", 3085 rv); 3086 goto out_free_my_dev_name; 3087 } 3088 3089 intf->bmc_registered = true; 3090 3091 out: 3092 mutex_unlock(&ipmidriver_mutex); 3093 mutex_lock(&intf->bmc_reg_mutex); 3094 intf->in_bmc_register = false; 3095 return rv; 3096 3097 3098 out_free_my_dev_name: 3099 kfree(intf->my_dev_name); 3100 intf->my_dev_name = NULL; 3101 3102 out_unlink1: 3103 sysfs_remove_link(&intf->si_dev->kobj, "bmc"); 3104 3105 out_put_bmc: 3106 mutex_lock(&bmc->dyn_mutex); 3107 list_del(&intf->bmc_link); 3108 mutex_unlock(&bmc->dyn_mutex); 3109 intf->bmc = &intf->tmp_bmc; 3110 kref_put(&bmc->usecount, cleanup_bmc_device); 3111 goto out; 3112 3113 out_list_del: 3114 mutex_lock(&bmc->dyn_mutex); 3115 list_del(&intf->bmc_link); 3116 mutex_unlock(&bmc->dyn_mutex); 3117 intf->bmc = &intf->tmp_bmc; 3118 put_device(&bmc->pdev.dev); 3119 goto out; 3120 } 3121 3122 static int 3123 send_guid_cmd(struct ipmi_smi *intf, int chan) 3124 { 3125 struct kernel_ipmi_msg msg; 3126 struct ipmi_system_interface_addr si; 3127 3128 si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 3129 si.channel = IPMI_BMC_CHANNEL; 3130 si.lun = 0; 3131 3132 msg.netfn = IPMI_NETFN_APP_REQUEST; 3133 msg.cmd = IPMI_GET_DEVICE_GUID_CMD; 3134 msg.data = NULL; 3135 msg.data_len = 0; 3136 return i_ipmi_request(NULL, 3137 intf, 3138 (struct ipmi_addr *) &si, 3139 0, 3140 &msg, 3141 intf, 3142 NULL, 3143 NULL, 3144 0, 3145 intf->addrinfo[0].address, 3146 intf->addrinfo[0].lun, 3147 -1, 0); 3148 } 3149 3150 static void guid_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) 3151 { 3152 struct bmc_device *bmc = intf->bmc; 3153 3154 if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 3155 || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE) 3156 || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD)) 3157 /* Not for me */ 3158 return; 3159 3160 if (msg->msg.data[0] != 0) { 3161 /* Error from getting the GUID, the BMC doesn't have one. */ 3162 bmc->dyn_guid_set = 0; 3163 goto out; 3164 } 3165 3166 if (msg->msg.data_len < UUID_SIZE + 1) { 3167 bmc->dyn_guid_set = 0; 3168 dev_warn(intf->si_dev, 3169 "The GUID response from the BMC was too short, it was %d but should have been %d. Assuming GUID is not available.\n", 3170 msg->msg.data_len, UUID_SIZE + 1); 3171 goto out; 3172 } 3173 3174 guid_copy(&bmc->fetch_guid, (guid_t *)(msg->msg.data + 1)); 3175 /* 3176 * Make sure the guid data is available before setting 3177 * dyn_guid_set. 3178 */ 3179 smp_wmb(); 3180 bmc->dyn_guid_set = 1; 3181 out: 3182 wake_up(&intf->waitq); 3183 } 3184 3185 static void __get_guid(struct ipmi_smi *intf) 3186 { 3187 int rv; 3188 struct bmc_device *bmc = intf->bmc; 3189 3190 bmc->dyn_guid_set = 2; 3191 intf->null_user_handler = guid_handler; 3192 rv = send_guid_cmd(intf, 0); 3193 if (rv) 3194 /* Send failed, no GUID available. */ 3195 bmc->dyn_guid_set = 0; 3196 3197 wait_event(intf->waitq, bmc->dyn_guid_set != 2); 3198 3199 /* dyn_guid_set makes the guid data available. */ 3200 smp_rmb(); 3201 3202 intf->null_user_handler = NULL; 3203 } 3204 3205 static int 3206 send_channel_info_cmd(struct ipmi_smi *intf, int chan) 3207 { 3208 struct kernel_ipmi_msg msg; 3209 unsigned char data[1]; 3210 struct ipmi_system_interface_addr si; 3211 3212 si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 3213 si.channel = IPMI_BMC_CHANNEL; 3214 si.lun = 0; 3215 3216 msg.netfn = IPMI_NETFN_APP_REQUEST; 3217 msg.cmd = IPMI_GET_CHANNEL_INFO_CMD; 3218 msg.data = data; 3219 msg.data_len = 1; 3220 data[0] = chan; 3221 return i_ipmi_request(NULL, 3222 intf, 3223 (struct ipmi_addr *) &si, 3224 0, 3225 &msg, 3226 intf, 3227 NULL, 3228 NULL, 3229 0, 3230 intf->addrinfo[0].address, 3231 intf->addrinfo[0].lun, 3232 -1, 0); 3233 } 3234 3235 static void 3236 channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) 3237 { 3238 int rv = 0; 3239 int ch; 3240 unsigned int set = intf->curr_working_cset; 3241 struct ipmi_channel *chans; 3242 3243 if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 3244 && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE) 3245 && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD)) { 3246 /* It's the one we want */ 3247 if (msg->msg.data[0] != 0) { 3248 /* Got an error from the channel, just go on. */ 3249 3250 if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) { 3251 /* 3252 * If the MC does not support this 3253 * command, that is legal. We just 3254 * assume it has one IPMB at channel 3255 * zero. 3256 */ 3257 intf->wchannels[set].c[0].medium 3258 = IPMI_CHANNEL_MEDIUM_IPMB; 3259 intf->wchannels[set].c[0].protocol 3260 = IPMI_CHANNEL_PROTOCOL_IPMB; 3261 3262 intf->channel_list = intf->wchannels + set; 3263 intf->channels_ready = true; 3264 wake_up(&intf->waitq); 3265 goto out; 3266 } 3267 goto next_channel; 3268 } 3269 if (msg->msg.data_len < 4) { 3270 /* Message not big enough, just go on. */ 3271 goto next_channel; 3272 } 3273 ch = intf->curr_channel; 3274 chans = intf->wchannels[set].c; 3275 chans[ch].medium = msg->msg.data[2] & 0x7f; 3276 chans[ch].protocol = msg->msg.data[3] & 0x1f; 3277 3278 next_channel: 3279 intf->curr_channel++; 3280 if (intf->curr_channel >= IPMI_MAX_CHANNELS) { 3281 intf->channel_list = intf->wchannels + set; 3282 intf->channels_ready = true; 3283 wake_up(&intf->waitq); 3284 } else { 3285 intf->channel_list = intf->wchannels + set; 3286 intf->channels_ready = true; 3287 rv = send_channel_info_cmd(intf, intf->curr_channel); 3288 } 3289 3290 if (rv) { 3291 /* Got an error somehow, just give up. */ 3292 dev_warn(intf->si_dev, 3293 "Error sending channel information for channel %d: %d\n", 3294 intf->curr_channel, rv); 3295 3296 intf->channel_list = intf->wchannels + set; 3297 intf->channels_ready = true; 3298 wake_up(&intf->waitq); 3299 } 3300 } 3301 out: 3302 return; 3303 } 3304 3305 /* 3306 * Must be holding intf->bmc_reg_mutex to call this. 3307 */ 3308 static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id) 3309 { 3310 int rv; 3311 3312 if (ipmi_version_major(id) > 1 3313 || (ipmi_version_major(id) == 1 3314 && ipmi_version_minor(id) >= 5)) { 3315 unsigned int set; 3316 3317 /* 3318 * Start scanning the channels to see what is 3319 * available. 3320 */ 3321 set = !intf->curr_working_cset; 3322 intf->curr_working_cset = set; 3323 memset(&intf->wchannels[set], 0, 3324 sizeof(struct ipmi_channel_set)); 3325 3326 intf->null_user_handler = channel_handler; 3327 intf->curr_channel = 0; 3328 rv = send_channel_info_cmd(intf, 0); 3329 if (rv) { 3330 dev_warn(intf->si_dev, 3331 "Error sending channel information for channel 0, %d\n", 3332 rv); 3333 return -EIO; 3334 } 3335 3336 /* Wait for the channel info to be read. */ 3337 wait_event(intf->waitq, intf->channels_ready); 3338 intf->null_user_handler = NULL; 3339 } else { 3340 unsigned int set = intf->curr_working_cset; 3341 3342 /* Assume a single IPMB channel at zero. */ 3343 intf->wchannels[set].c[0].medium = IPMI_CHANNEL_MEDIUM_IPMB; 3344 intf->wchannels[set].c[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB; 3345 intf->channel_list = intf->wchannels + set; 3346 intf->channels_ready = true; 3347 } 3348 3349 return 0; 3350 } 3351 3352 static void ipmi_poll(struct ipmi_smi *intf) 3353 { 3354 if (intf->handlers->poll) 3355 intf->handlers->poll(intf->send_info); 3356 /* In case something came in */ 3357 handle_new_recv_msgs(intf); 3358 } 3359 3360 void ipmi_poll_interface(struct ipmi_user *user) 3361 { 3362 ipmi_poll(user->intf); 3363 } 3364 EXPORT_SYMBOL(ipmi_poll_interface); 3365 3366 static void redo_bmc_reg(struct work_struct *work) 3367 { 3368 struct ipmi_smi *intf = container_of(work, struct ipmi_smi, 3369 bmc_reg_work); 3370 3371 if (!intf->in_shutdown) 3372 bmc_get_device_id(intf, NULL, NULL, NULL, NULL); 3373 3374 kref_put(&intf->refcount, intf_free); 3375 } 3376 3377 int ipmi_register_smi(const struct ipmi_smi_handlers *handlers, 3378 void *send_info, 3379 struct device *si_dev, 3380 unsigned char slave_addr) 3381 { 3382 int i, j; 3383 int rv; 3384 struct ipmi_smi *intf, *tintf; 3385 struct list_head *link; 3386 struct ipmi_device_id id; 3387 3388 /* 3389 * Make sure the driver is actually initialized, this handles 3390 * problems with initialization order. 3391 */ 3392 rv = ipmi_init_msghandler(); 3393 if (rv) 3394 return rv; 3395 3396 intf = kzalloc(sizeof(*intf), GFP_KERNEL); 3397 if (!intf) 3398 return -ENOMEM; 3399 3400 rv = init_srcu_struct(&intf->users_srcu); 3401 if (rv) { 3402 kfree(intf); 3403 return rv; 3404 } 3405 3406 3407 intf->bmc = &intf->tmp_bmc; 3408 INIT_LIST_HEAD(&intf->bmc->intfs); 3409 mutex_init(&intf->bmc->dyn_mutex); 3410 INIT_LIST_HEAD(&intf->bmc_link); 3411 mutex_init(&intf->bmc_reg_mutex); 3412 intf->intf_num = -1; /* Mark it invalid for now. */ 3413 kref_init(&intf->refcount); 3414 INIT_WORK(&intf->bmc_reg_work, redo_bmc_reg); 3415 intf->si_dev = si_dev; 3416 for (j = 0; j < IPMI_MAX_CHANNELS; j++) { 3417 intf->addrinfo[j].address = IPMI_BMC_SLAVE_ADDR; 3418 intf->addrinfo[j].lun = 2; 3419 } 3420 if (slave_addr != 0) 3421 intf->addrinfo[0].address = slave_addr; 3422 INIT_LIST_HEAD(&intf->users); 3423 intf->handlers = handlers; 3424 intf->send_info = send_info; 3425 spin_lock_init(&intf->seq_lock); 3426 for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) { 3427 intf->seq_table[j].inuse = 0; 3428 intf->seq_table[j].seqid = 0; 3429 } 3430 intf->curr_seq = 0; 3431 spin_lock_init(&intf->waiting_rcv_msgs_lock); 3432 INIT_LIST_HEAD(&intf->waiting_rcv_msgs); 3433 tasklet_init(&intf->recv_tasklet, 3434 smi_recv_tasklet, 3435 (unsigned long) intf); 3436 atomic_set(&intf->watchdog_pretimeouts_to_deliver, 0); 3437 spin_lock_init(&intf->xmit_msgs_lock); 3438 INIT_LIST_HEAD(&intf->xmit_msgs); 3439 INIT_LIST_HEAD(&intf->hp_xmit_msgs); 3440 spin_lock_init(&intf->events_lock); 3441 spin_lock_init(&intf->watch_lock); 3442 atomic_set(&intf->event_waiters, 0); 3443 intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME; 3444 INIT_LIST_HEAD(&intf->waiting_events); 3445 intf->waiting_events_count = 0; 3446 mutex_init(&intf->cmd_rcvrs_mutex); 3447 spin_lock_init(&intf->maintenance_mode_lock); 3448 INIT_LIST_HEAD(&intf->cmd_rcvrs); 3449 init_waitqueue_head(&intf->waitq); 3450 for (i = 0; i < IPMI_NUM_STATS; i++) 3451 atomic_set(&intf->stats[i], 0); 3452 3453 mutex_lock(&ipmi_interfaces_mutex); 3454 /* Look for a hole in the numbers. */ 3455 i = 0; 3456 link = &ipmi_interfaces; 3457 list_for_each_entry_rcu(tintf, &ipmi_interfaces, link) { 3458 if (tintf->intf_num != i) { 3459 link = &tintf->link; 3460 break; 3461 } 3462 i++; 3463 } 3464 /* Add the new interface in numeric order. */ 3465 if (i == 0) 3466 list_add_rcu(&intf->link, &ipmi_interfaces); 3467 else 3468 list_add_tail_rcu(&intf->link, link); 3469 3470 rv = handlers->start_processing(send_info, intf); 3471 if (rv) 3472 goto out_err; 3473 3474 rv = __bmc_get_device_id(intf, NULL, &id, NULL, NULL, i); 3475 if (rv) { 3476 dev_err(si_dev, "Unable to get the device id: %d\n", rv); 3477 goto out_err_started; 3478 } 3479 3480 mutex_lock(&intf->bmc_reg_mutex); 3481 rv = __scan_channels(intf, &id); 3482 mutex_unlock(&intf->bmc_reg_mutex); 3483 if (rv) 3484 goto out_err_bmc_reg; 3485 3486 /* 3487 * Keep memory order straight for RCU readers. Make 3488 * sure everything else is committed to memory before 3489 * setting intf_num to mark the interface valid. 3490 */ 3491 smp_wmb(); 3492 intf->intf_num = i; 3493 mutex_unlock(&ipmi_interfaces_mutex); 3494 3495 /* After this point the interface is legal to use. */ 3496 call_smi_watchers(i, intf->si_dev); 3497 3498 return 0; 3499 3500 out_err_bmc_reg: 3501 ipmi_bmc_unregister(intf); 3502 out_err_started: 3503 if (intf->handlers->shutdown) 3504 intf->handlers->shutdown(intf->send_info); 3505 out_err: 3506 list_del_rcu(&intf->link); 3507 mutex_unlock(&ipmi_interfaces_mutex); 3508 synchronize_srcu(&ipmi_interfaces_srcu); 3509 cleanup_srcu_struct(&intf->users_srcu); 3510 kref_put(&intf->refcount, intf_free); 3511 3512 return rv; 3513 } 3514 EXPORT_SYMBOL(ipmi_register_smi); 3515 3516 static void deliver_smi_err_response(struct ipmi_smi *intf, 3517 struct ipmi_smi_msg *msg, 3518 unsigned char err) 3519 { 3520 msg->rsp[0] = msg->data[0] | 4; 3521 msg->rsp[1] = msg->data[1]; 3522 msg->rsp[2] = err; 3523 msg->rsp_size = 3; 3524 /* It's an error, so it will never requeue, no need to check return. */ 3525 handle_one_recv_msg(intf, msg); 3526 } 3527 3528 static void cleanup_smi_msgs(struct ipmi_smi *intf) 3529 { 3530 int i; 3531 struct seq_table *ent; 3532 struct ipmi_smi_msg *msg; 3533 struct list_head *entry; 3534 struct list_head tmplist; 3535 3536 /* Clear out our transmit queues and hold the messages. */ 3537 INIT_LIST_HEAD(&tmplist); 3538 list_splice_tail(&intf->hp_xmit_msgs, &tmplist); 3539 list_splice_tail(&intf->xmit_msgs, &tmplist); 3540 3541 /* Current message first, to preserve order */ 3542 while (intf->curr_msg && !list_empty(&intf->waiting_rcv_msgs)) { 3543 /* Wait for the message to clear out. */ 3544 schedule_timeout(1); 3545 } 3546 3547 /* No need for locks, the interface is down. */ 3548 3549 /* 3550 * Return errors for all pending messages in queue and in the 3551 * tables waiting for remote responses. 3552 */ 3553 while (!list_empty(&tmplist)) { 3554 entry = tmplist.next; 3555 list_del(entry); 3556 msg = list_entry(entry, struct ipmi_smi_msg, link); 3557 deliver_smi_err_response(intf, msg, IPMI_ERR_UNSPECIFIED); 3558 } 3559 3560 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) { 3561 ent = &intf->seq_table[i]; 3562 if (!ent->inuse) 3563 continue; 3564 deliver_err_response(intf, ent->recv_msg, IPMI_ERR_UNSPECIFIED); 3565 } 3566 } 3567 3568 void ipmi_unregister_smi(struct ipmi_smi *intf) 3569 { 3570 struct ipmi_smi_watcher *w; 3571 int intf_num = intf->intf_num, index; 3572 3573 mutex_lock(&ipmi_interfaces_mutex); 3574 intf->intf_num = -1; 3575 intf->in_shutdown = true; 3576 list_del_rcu(&intf->link); 3577 mutex_unlock(&ipmi_interfaces_mutex); 3578 synchronize_srcu(&ipmi_interfaces_srcu); 3579 3580 /* At this point no users can be added to the interface. */ 3581 3582 /* 3583 * Call all the watcher interfaces to tell them that 3584 * an interface is going away. 3585 */ 3586 mutex_lock(&smi_watchers_mutex); 3587 list_for_each_entry(w, &smi_watchers, link) 3588 w->smi_gone(intf_num); 3589 mutex_unlock(&smi_watchers_mutex); 3590 3591 index = srcu_read_lock(&intf->users_srcu); 3592 while (!list_empty(&intf->users)) { 3593 struct ipmi_user *user = 3594 container_of(list_next_rcu(&intf->users), 3595 struct ipmi_user, link); 3596 3597 _ipmi_destroy_user(user); 3598 } 3599 srcu_read_unlock(&intf->users_srcu, index); 3600 3601 if (intf->handlers->shutdown) 3602 intf->handlers->shutdown(intf->send_info); 3603 3604 cleanup_smi_msgs(intf); 3605 3606 ipmi_bmc_unregister(intf); 3607 3608 cleanup_srcu_struct(&intf->users_srcu); 3609 kref_put(&intf->refcount, intf_free); 3610 } 3611 EXPORT_SYMBOL(ipmi_unregister_smi); 3612 3613 static int handle_ipmb_get_msg_rsp(struct ipmi_smi *intf, 3614 struct ipmi_smi_msg *msg) 3615 { 3616 struct ipmi_ipmb_addr ipmb_addr; 3617 struct ipmi_recv_msg *recv_msg; 3618 3619 /* 3620 * This is 11, not 10, because the response must contain a 3621 * completion code. 3622 */ 3623 if (msg->rsp_size < 11) { 3624 /* Message not big enough, just ignore it. */ 3625 ipmi_inc_stat(intf, invalid_ipmb_responses); 3626 return 0; 3627 } 3628 3629 if (msg->rsp[2] != 0) { 3630 /* An error getting the response, just ignore it. */ 3631 return 0; 3632 } 3633 3634 ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE; 3635 ipmb_addr.slave_addr = msg->rsp[6]; 3636 ipmb_addr.channel = msg->rsp[3] & 0x0f; 3637 ipmb_addr.lun = msg->rsp[7] & 3; 3638 3639 /* 3640 * It's a response from a remote entity. Look up the sequence 3641 * number and handle the response. 3642 */ 3643 if (intf_find_seq(intf, 3644 msg->rsp[7] >> 2, 3645 msg->rsp[3] & 0x0f, 3646 msg->rsp[8], 3647 (msg->rsp[4] >> 2) & (~1), 3648 (struct ipmi_addr *) &ipmb_addr, 3649 &recv_msg)) { 3650 /* 3651 * We were unable to find the sequence number, 3652 * so just nuke the message. 3653 */ 3654 ipmi_inc_stat(intf, unhandled_ipmb_responses); 3655 return 0; 3656 } 3657 3658 memcpy(recv_msg->msg_data, &msg->rsp[9], msg->rsp_size - 9); 3659 /* 3660 * The other fields matched, so no need to set them, except 3661 * for netfn, which needs to be the response that was 3662 * returned, not the request value. 3663 */ 3664 recv_msg->msg.netfn = msg->rsp[4] >> 2; 3665 recv_msg->msg.data = recv_msg->msg_data; 3666 recv_msg->msg.data_len = msg->rsp_size - 10; 3667 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 3668 if (deliver_response(intf, recv_msg)) 3669 ipmi_inc_stat(intf, unhandled_ipmb_responses); 3670 else 3671 ipmi_inc_stat(intf, handled_ipmb_responses); 3672 3673 return 0; 3674 } 3675 3676 static int handle_ipmb_get_msg_cmd(struct ipmi_smi *intf, 3677 struct ipmi_smi_msg *msg) 3678 { 3679 struct cmd_rcvr *rcvr; 3680 int rv = 0; 3681 unsigned char netfn; 3682 unsigned char cmd; 3683 unsigned char chan; 3684 struct ipmi_user *user = NULL; 3685 struct ipmi_ipmb_addr *ipmb_addr; 3686 struct ipmi_recv_msg *recv_msg; 3687 3688 if (msg->rsp_size < 10) { 3689 /* Message not big enough, just ignore it. */ 3690 ipmi_inc_stat(intf, invalid_commands); 3691 return 0; 3692 } 3693 3694 if (msg->rsp[2] != 0) { 3695 /* An error getting the response, just ignore it. */ 3696 return 0; 3697 } 3698 3699 netfn = msg->rsp[4] >> 2; 3700 cmd = msg->rsp[8]; 3701 chan = msg->rsp[3] & 0xf; 3702 3703 rcu_read_lock(); 3704 rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); 3705 if (rcvr) { 3706 user = rcvr->user; 3707 kref_get(&user->refcount); 3708 } else 3709 user = NULL; 3710 rcu_read_unlock(); 3711 3712 if (user == NULL) { 3713 /* We didn't find a user, deliver an error response. */ 3714 ipmi_inc_stat(intf, unhandled_commands); 3715 3716 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); 3717 msg->data[1] = IPMI_SEND_MSG_CMD; 3718 msg->data[2] = msg->rsp[3]; 3719 msg->data[3] = msg->rsp[6]; 3720 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3); 3721 msg->data[5] = ipmb_checksum(&msg->data[3], 2); 3722 msg->data[6] = intf->addrinfo[msg->rsp[3] & 0xf].address; 3723 /* rqseq/lun */ 3724 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3); 3725 msg->data[8] = msg->rsp[8]; /* cmd */ 3726 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE; 3727 msg->data[10] = ipmb_checksum(&msg->data[6], 4); 3728 msg->data_size = 11; 3729 3730 ipmi_debug_msg("Invalid command:", msg->data, msg->data_size); 3731 3732 rcu_read_lock(); 3733 if (!intf->in_shutdown) { 3734 smi_send(intf, intf->handlers, msg, 0); 3735 /* 3736 * We used the message, so return the value 3737 * that causes it to not be freed or 3738 * queued. 3739 */ 3740 rv = -1; 3741 } 3742 rcu_read_unlock(); 3743 } else { 3744 recv_msg = ipmi_alloc_recv_msg(); 3745 if (!recv_msg) { 3746 /* 3747 * We couldn't allocate memory for the 3748 * message, so requeue it for handling 3749 * later. 3750 */ 3751 rv = 1; 3752 kref_put(&user->refcount, free_user); 3753 } else { 3754 /* Extract the source address from the data. */ 3755 ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr; 3756 ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE; 3757 ipmb_addr->slave_addr = msg->rsp[6]; 3758 ipmb_addr->lun = msg->rsp[7] & 3; 3759 ipmb_addr->channel = msg->rsp[3] & 0xf; 3760 3761 /* 3762 * Extract the rest of the message information 3763 * from the IPMB header. 3764 */ 3765 recv_msg->user = user; 3766 recv_msg->recv_type = IPMI_CMD_RECV_TYPE; 3767 recv_msg->msgid = msg->rsp[7] >> 2; 3768 recv_msg->msg.netfn = msg->rsp[4] >> 2; 3769 recv_msg->msg.cmd = msg->rsp[8]; 3770 recv_msg->msg.data = recv_msg->msg_data; 3771 3772 /* 3773 * We chop off 10, not 9 bytes because the checksum 3774 * at the end also needs to be removed. 3775 */ 3776 recv_msg->msg.data_len = msg->rsp_size - 10; 3777 memcpy(recv_msg->msg_data, &msg->rsp[9], 3778 msg->rsp_size - 10); 3779 if (deliver_response(intf, recv_msg)) 3780 ipmi_inc_stat(intf, unhandled_commands); 3781 else 3782 ipmi_inc_stat(intf, handled_commands); 3783 } 3784 } 3785 3786 return rv; 3787 } 3788 3789 static int handle_lan_get_msg_rsp(struct ipmi_smi *intf, 3790 struct ipmi_smi_msg *msg) 3791 { 3792 struct ipmi_lan_addr lan_addr; 3793 struct ipmi_recv_msg *recv_msg; 3794 3795 3796 /* 3797 * This is 13, not 12, because the response must contain a 3798 * completion code. 3799 */ 3800 if (msg->rsp_size < 13) { 3801 /* Message not big enough, just ignore it. */ 3802 ipmi_inc_stat(intf, invalid_lan_responses); 3803 return 0; 3804 } 3805 3806 if (msg->rsp[2] != 0) { 3807 /* An error getting the response, just ignore it. */ 3808 return 0; 3809 } 3810 3811 lan_addr.addr_type = IPMI_LAN_ADDR_TYPE; 3812 lan_addr.session_handle = msg->rsp[4]; 3813 lan_addr.remote_SWID = msg->rsp[8]; 3814 lan_addr.local_SWID = msg->rsp[5]; 3815 lan_addr.channel = msg->rsp[3] & 0x0f; 3816 lan_addr.privilege = msg->rsp[3] >> 4; 3817 lan_addr.lun = msg->rsp[9] & 3; 3818 3819 /* 3820 * It's a response from a remote entity. Look up the sequence 3821 * number and handle the response. 3822 */ 3823 if (intf_find_seq(intf, 3824 msg->rsp[9] >> 2, 3825 msg->rsp[3] & 0x0f, 3826 msg->rsp[10], 3827 (msg->rsp[6] >> 2) & (~1), 3828 (struct ipmi_addr *) &lan_addr, 3829 &recv_msg)) { 3830 /* 3831 * We were unable to find the sequence number, 3832 * so just nuke the message. 3833 */ 3834 ipmi_inc_stat(intf, unhandled_lan_responses); 3835 return 0; 3836 } 3837 3838 memcpy(recv_msg->msg_data, &msg->rsp[11], msg->rsp_size - 11); 3839 /* 3840 * The other fields matched, so no need to set them, except 3841 * for netfn, which needs to be the response that was 3842 * returned, not the request value. 3843 */ 3844 recv_msg->msg.netfn = msg->rsp[6] >> 2; 3845 recv_msg->msg.data = recv_msg->msg_data; 3846 recv_msg->msg.data_len = msg->rsp_size - 12; 3847 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 3848 if (deliver_response(intf, recv_msg)) 3849 ipmi_inc_stat(intf, unhandled_lan_responses); 3850 else 3851 ipmi_inc_stat(intf, handled_lan_responses); 3852 3853 return 0; 3854 } 3855 3856 static int handle_lan_get_msg_cmd(struct ipmi_smi *intf, 3857 struct ipmi_smi_msg *msg) 3858 { 3859 struct cmd_rcvr *rcvr; 3860 int rv = 0; 3861 unsigned char netfn; 3862 unsigned char cmd; 3863 unsigned char chan; 3864 struct ipmi_user *user = NULL; 3865 struct ipmi_lan_addr *lan_addr; 3866 struct ipmi_recv_msg *recv_msg; 3867 3868 if (msg->rsp_size < 12) { 3869 /* Message not big enough, just ignore it. */ 3870 ipmi_inc_stat(intf, invalid_commands); 3871 return 0; 3872 } 3873 3874 if (msg->rsp[2] != 0) { 3875 /* An error getting the response, just ignore it. */ 3876 return 0; 3877 } 3878 3879 netfn = msg->rsp[6] >> 2; 3880 cmd = msg->rsp[10]; 3881 chan = msg->rsp[3] & 0xf; 3882 3883 rcu_read_lock(); 3884 rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); 3885 if (rcvr) { 3886 user = rcvr->user; 3887 kref_get(&user->refcount); 3888 } else 3889 user = NULL; 3890 rcu_read_unlock(); 3891 3892 if (user == NULL) { 3893 /* We didn't find a user, just give up. */ 3894 ipmi_inc_stat(intf, unhandled_commands); 3895 3896 /* 3897 * Don't do anything with these messages, just allow 3898 * them to be freed. 3899 */ 3900 rv = 0; 3901 } else { 3902 recv_msg = ipmi_alloc_recv_msg(); 3903 if (!recv_msg) { 3904 /* 3905 * We couldn't allocate memory for the 3906 * message, so requeue it for handling later. 3907 */ 3908 rv = 1; 3909 kref_put(&user->refcount, free_user); 3910 } else { 3911 /* Extract the source address from the data. */ 3912 lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr; 3913 lan_addr->addr_type = IPMI_LAN_ADDR_TYPE; 3914 lan_addr->session_handle = msg->rsp[4]; 3915 lan_addr->remote_SWID = msg->rsp[8]; 3916 lan_addr->local_SWID = msg->rsp[5]; 3917 lan_addr->lun = msg->rsp[9] & 3; 3918 lan_addr->channel = msg->rsp[3] & 0xf; 3919 lan_addr->privilege = msg->rsp[3] >> 4; 3920 3921 /* 3922 * Extract the rest of the message information 3923 * from the IPMB header. 3924 */ 3925 recv_msg->user = user; 3926 recv_msg->recv_type = IPMI_CMD_RECV_TYPE; 3927 recv_msg->msgid = msg->rsp[9] >> 2; 3928 recv_msg->msg.netfn = msg->rsp[6] >> 2; 3929 recv_msg->msg.cmd = msg->rsp[10]; 3930 recv_msg->msg.data = recv_msg->msg_data; 3931 3932 /* 3933 * We chop off 12, not 11 bytes because the checksum 3934 * at the end also needs to be removed. 3935 */ 3936 recv_msg->msg.data_len = msg->rsp_size - 12; 3937 memcpy(recv_msg->msg_data, &msg->rsp[11], 3938 msg->rsp_size - 12); 3939 if (deliver_response(intf, recv_msg)) 3940 ipmi_inc_stat(intf, unhandled_commands); 3941 else 3942 ipmi_inc_stat(intf, handled_commands); 3943 } 3944 } 3945 3946 return rv; 3947 } 3948 3949 /* 3950 * This routine will handle "Get Message" command responses with 3951 * channels that use an OEM Medium. The message format belongs to 3952 * the OEM. See IPMI 2.0 specification, Chapter 6 and 3953 * Chapter 22, sections 22.6 and 22.24 for more details. 3954 */ 3955 static int handle_oem_get_msg_cmd(struct ipmi_smi *intf, 3956 struct ipmi_smi_msg *msg) 3957 { 3958 struct cmd_rcvr *rcvr; 3959 int rv = 0; 3960 unsigned char netfn; 3961 unsigned char cmd; 3962 unsigned char chan; 3963 struct ipmi_user *user = NULL; 3964 struct ipmi_system_interface_addr *smi_addr; 3965 struct ipmi_recv_msg *recv_msg; 3966 3967 /* 3968 * We expect the OEM SW to perform error checking 3969 * so we just do some basic sanity checks 3970 */ 3971 if (msg->rsp_size < 4) { 3972 /* Message not big enough, just ignore it. */ 3973 ipmi_inc_stat(intf, invalid_commands); 3974 return 0; 3975 } 3976 3977 if (msg->rsp[2] != 0) { 3978 /* An error getting the response, just ignore it. */ 3979 return 0; 3980 } 3981 3982 /* 3983 * This is an OEM Message so the OEM needs to know how 3984 * handle the message. We do no interpretation. 3985 */ 3986 netfn = msg->rsp[0] >> 2; 3987 cmd = msg->rsp[1]; 3988 chan = msg->rsp[3] & 0xf; 3989 3990 rcu_read_lock(); 3991 rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); 3992 if (rcvr) { 3993 user = rcvr->user; 3994 kref_get(&user->refcount); 3995 } else 3996 user = NULL; 3997 rcu_read_unlock(); 3998 3999 if (user == NULL) { 4000 /* We didn't find a user, just give up. */ 4001 ipmi_inc_stat(intf, unhandled_commands); 4002 4003 /* 4004 * Don't do anything with these messages, just allow 4005 * them to be freed. 4006 */ 4007 4008 rv = 0; 4009 } else { 4010 recv_msg = ipmi_alloc_recv_msg(); 4011 if (!recv_msg) { 4012 /* 4013 * We couldn't allocate memory for the 4014 * message, so requeue it for handling 4015 * later. 4016 */ 4017 rv = 1; 4018 kref_put(&user->refcount, free_user); 4019 } else { 4020 /* 4021 * OEM Messages are expected to be delivered via 4022 * the system interface to SMS software. We might 4023 * need to visit this again depending on OEM 4024 * requirements 4025 */ 4026 smi_addr = ((struct ipmi_system_interface_addr *) 4027 &recv_msg->addr); 4028 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 4029 smi_addr->channel = IPMI_BMC_CHANNEL; 4030 smi_addr->lun = msg->rsp[0] & 3; 4031 4032 recv_msg->user = user; 4033 recv_msg->user_msg_data = NULL; 4034 recv_msg->recv_type = IPMI_OEM_RECV_TYPE; 4035 recv_msg->msg.netfn = msg->rsp[0] >> 2; 4036 recv_msg->msg.cmd = msg->rsp[1]; 4037 recv_msg->msg.data = recv_msg->msg_data; 4038 4039 /* 4040 * The message starts at byte 4 which follows the 4041 * the Channel Byte in the "GET MESSAGE" command 4042 */ 4043 recv_msg->msg.data_len = msg->rsp_size - 4; 4044 memcpy(recv_msg->msg_data, &msg->rsp[4], 4045 msg->rsp_size - 4); 4046 if (deliver_response(intf, recv_msg)) 4047 ipmi_inc_stat(intf, unhandled_commands); 4048 else 4049 ipmi_inc_stat(intf, handled_commands); 4050 } 4051 } 4052 4053 return rv; 4054 } 4055 4056 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg, 4057 struct ipmi_smi_msg *msg) 4058 { 4059 struct ipmi_system_interface_addr *smi_addr; 4060 4061 recv_msg->msgid = 0; 4062 smi_addr = (struct ipmi_system_interface_addr *) &recv_msg->addr; 4063 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 4064 smi_addr->channel = IPMI_BMC_CHANNEL; 4065 smi_addr->lun = msg->rsp[0] & 3; 4066 recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE; 4067 recv_msg->msg.netfn = msg->rsp[0] >> 2; 4068 recv_msg->msg.cmd = msg->rsp[1]; 4069 memcpy(recv_msg->msg_data, &msg->rsp[3], msg->rsp_size - 3); 4070 recv_msg->msg.data = recv_msg->msg_data; 4071 recv_msg->msg.data_len = msg->rsp_size - 3; 4072 } 4073 4074 static int handle_read_event_rsp(struct ipmi_smi *intf, 4075 struct ipmi_smi_msg *msg) 4076 { 4077 struct ipmi_recv_msg *recv_msg, *recv_msg2; 4078 struct list_head msgs; 4079 struct ipmi_user *user; 4080 int rv = 0, deliver_count = 0, index; 4081 unsigned long flags; 4082 4083 if (msg->rsp_size < 19) { 4084 /* Message is too small to be an IPMB event. */ 4085 ipmi_inc_stat(intf, invalid_events); 4086 return 0; 4087 } 4088 4089 if (msg->rsp[2] != 0) { 4090 /* An error getting the event, just ignore it. */ 4091 return 0; 4092 } 4093 4094 INIT_LIST_HEAD(&msgs); 4095 4096 spin_lock_irqsave(&intf->events_lock, flags); 4097 4098 ipmi_inc_stat(intf, events); 4099 4100 /* 4101 * Allocate and fill in one message for every user that is 4102 * getting events. 4103 */ 4104 index = srcu_read_lock(&intf->users_srcu); 4105 list_for_each_entry_rcu(user, &intf->users, link) { 4106 if (!user->gets_events) 4107 continue; 4108 4109 recv_msg = ipmi_alloc_recv_msg(); 4110 if (!recv_msg) { 4111 rcu_read_unlock(); 4112 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, 4113 link) { 4114 list_del(&recv_msg->link); 4115 ipmi_free_recv_msg(recv_msg); 4116 } 4117 /* 4118 * We couldn't allocate memory for the 4119 * message, so requeue it for handling 4120 * later. 4121 */ 4122 rv = 1; 4123 goto out; 4124 } 4125 4126 deliver_count++; 4127 4128 copy_event_into_recv_msg(recv_msg, msg); 4129 recv_msg->user = user; 4130 kref_get(&user->refcount); 4131 list_add_tail(&recv_msg->link, &msgs); 4132 } 4133 srcu_read_unlock(&intf->users_srcu, index); 4134 4135 if (deliver_count) { 4136 /* Now deliver all the messages. */ 4137 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) { 4138 list_del(&recv_msg->link); 4139 deliver_local_response(intf, recv_msg); 4140 } 4141 } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) { 4142 /* 4143 * No one to receive the message, put it in queue if there's 4144 * not already too many things in the queue. 4145 */ 4146 recv_msg = ipmi_alloc_recv_msg(); 4147 if (!recv_msg) { 4148 /* 4149 * We couldn't allocate memory for the 4150 * message, so requeue it for handling 4151 * later. 4152 */ 4153 rv = 1; 4154 goto out; 4155 } 4156 4157 copy_event_into_recv_msg(recv_msg, msg); 4158 list_add_tail(&recv_msg->link, &intf->waiting_events); 4159 intf->waiting_events_count++; 4160 } else if (!intf->event_msg_printed) { 4161 /* 4162 * There's too many things in the queue, discard this 4163 * message. 4164 */ 4165 dev_warn(intf->si_dev, 4166 "Event queue full, discarding incoming events\n"); 4167 intf->event_msg_printed = 1; 4168 } 4169 4170 out: 4171 spin_unlock_irqrestore(&intf->events_lock, flags); 4172 4173 return rv; 4174 } 4175 4176 static int handle_bmc_rsp(struct ipmi_smi *intf, 4177 struct ipmi_smi_msg *msg) 4178 { 4179 struct ipmi_recv_msg *recv_msg; 4180 struct ipmi_system_interface_addr *smi_addr; 4181 4182 recv_msg = (struct ipmi_recv_msg *) msg->user_data; 4183 if (recv_msg == NULL) { 4184 dev_warn(intf->si_dev, 4185 "IPMI message received with no owner. This could be because of a malformed message, or because of a hardware error. Contact your hardware vendor for assistance.\n"); 4186 return 0; 4187 } 4188 4189 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 4190 recv_msg->msgid = msg->msgid; 4191 smi_addr = ((struct ipmi_system_interface_addr *) 4192 &recv_msg->addr); 4193 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 4194 smi_addr->channel = IPMI_BMC_CHANNEL; 4195 smi_addr->lun = msg->rsp[0] & 3; 4196 recv_msg->msg.netfn = msg->rsp[0] >> 2; 4197 recv_msg->msg.cmd = msg->rsp[1]; 4198 memcpy(recv_msg->msg_data, &msg->rsp[2], msg->rsp_size - 2); 4199 recv_msg->msg.data = recv_msg->msg_data; 4200 recv_msg->msg.data_len = msg->rsp_size - 2; 4201 deliver_local_response(intf, recv_msg); 4202 4203 return 0; 4204 } 4205 4206 /* 4207 * Handle a received message. Return 1 if the message should be requeued, 4208 * 0 if the message should be freed, or -1 if the message should not 4209 * be freed or requeued. 4210 */ 4211 static int handle_one_recv_msg(struct ipmi_smi *intf, 4212 struct ipmi_smi_msg *msg) 4213 { 4214 int requeue; 4215 int chan; 4216 4217 ipmi_debug_msg("Recv:", msg->rsp, msg->rsp_size); 4218 if (msg->rsp_size < 2) { 4219 /* Message is too small to be correct. */ 4220 dev_warn(intf->si_dev, 4221 "BMC returned too small a message for netfn %x cmd %x, got %d bytes\n", 4222 (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size); 4223 4224 /* Generate an error response for the message. */ 4225 msg->rsp[0] = msg->data[0] | (1 << 2); 4226 msg->rsp[1] = msg->data[1]; 4227 msg->rsp[2] = IPMI_ERR_UNSPECIFIED; 4228 msg->rsp_size = 3; 4229 } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1)) 4230 || (msg->rsp[1] != msg->data[1])) { 4231 /* 4232 * The NetFN and Command in the response is not even 4233 * marginally correct. 4234 */ 4235 dev_warn(intf->si_dev, 4236 "BMC returned incorrect response, expected netfn %x cmd %x, got netfn %x cmd %x\n", 4237 (msg->data[0] >> 2) | 1, msg->data[1], 4238 msg->rsp[0] >> 2, msg->rsp[1]); 4239 4240 /* Generate an error response for the message. */ 4241 msg->rsp[0] = msg->data[0] | (1 << 2); 4242 msg->rsp[1] = msg->data[1]; 4243 msg->rsp[2] = IPMI_ERR_UNSPECIFIED; 4244 msg->rsp_size = 3; 4245 } 4246 4247 if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2)) 4248 && (msg->rsp[1] == IPMI_SEND_MSG_CMD) 4249 && (msg->user_data != NULL)) { 4250 /* 4251 * It's a response to a response we sent. For this we 4252 * deliver a send message response to the user. 4253 */ 4254 struct ipmi_recv_msg *recv_msg = msg->user_data; 4255 4256 requeue = 0; 4257 if (msg->rsp_size < 2) 4258 /* Message is too small to be correct. */ 4259 goto out; 4260 4261 chan = msg->data[2] & 0x0f; 4262 if (chan >= IPMI_MAX_CHANNELS) 4263 /* Invalid channel number */ 4264 goto out; 4265 4266 if (!recv_msg) 4267 goto out; 4268 4269 recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE; 4270 recv_msg->msg.data = recv_msg->msg_data; 4271 recv_msg->msg.data_len = 1; 4272 recv_msg->msg_data[0] = msg->rsp[2]; 4273 deliver_local_response(intf, recv_msg); 4274 } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2)) 4275 && (msg->rsp[1] == IPMI_GET_MSG_CMD)) { 4276 struct ipmi_channel *chans; 4277 4278 /* It's from the receive queue. */ 4279 chan = msg->rsp[3] & 0xf; 4280 if (chan >= IPMI_MAX_CHANNELS) { 4281 /* Invalid channel number */ 4282 requeue = 0; 4283 goto out; 4284 } 4285 4286 /* 4287 * We need to make sure the channels have been initialized. 4288 * The channel_handler routine will set the "curr_channel" 4289 * equal to or greater than IPMI_MAX_CHANNELS when all the 4290 * channels for this interface have been initialized. 4291 */ 4292 if (!intf->channels_ready) { 4293 requeue = 0; /* Throw the message away */ 4294 goto out; 4295 } 4296 4297 chans = READ_ONCE(intf->channel_list)->c; 4298 4299 switch (chans[chan].medium) { 4300 case IPMI_CHANNEL_MEDIUM_IPMB: 4301 if (msg->rsp[4] & 0x04) { 4302 /* 4303 * It's a response, so find the 4304 * requesting message and send it up. 4305 */ 4306 requeue = handle_ipmb_get_msg_rsp(intf, msg); 4307 } else { 4308 /* 4309 * It's a command to the SMS from some other 4310 * entity. Handle that. 4311 */ 4312 requeue = handle_ipmb_get_msg_cmd(intf, msg); 4313 } 4314 break; 4315 4316 case IPMI_CHANNEL_MEDIUM_8023LAN: 4317 case IPMI_CHANNEL_MEDIUM_ASYNC: 4318 if (msg->rsp[6] & 0x04) { 4319 /* 4320 * It's a response, so find the 4321 * requesting message and send it up. 4322 */ 4323 requeue = handle_lan_get_msg_rsp(intf, msg); 4324 } else { 4325 /* 4326 * It's a command to the SMS from some other 4327 * entity. Handle that. 4328 */ 4329 requeue = handle_lan_get_msg_cmd(intf, msg); 4330 } 4331 break; 4332 4333 default: 4334 /* Check for OEM Channels. Clients had better 4335 register for these commands. */ 4336 if ((chans[chan].medium >= IPMI_CHANNEL_MEDIUM_OEM_MIN) 4337 && (chans[chan].medium 4338 <= IPMI_CHANNEL_MEDIUM_OEM_MAX)) { 4339 requeue = handle_oem_get_msg_cmd(intf, msg); 4340 } else { 4341 /* 4342 * We don't handle the channel type, so just 4343 * free the message. 4344 */ 4345 requeue = 0; 4346 } 4347 } 4348 4349 } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2)) 4350 && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD)) { 4351 /* It's an asynchronous event. */ 4352 requeue = handle_read_event_rsp(intf, msg); 4353 } else { 4354 /* It's a response from the local BMC. */ 4355 requeue = handle_bmc_rsp(intf, msg); 4356 } 4357 4358 out: 4359 return requeue; 4360 } 4361 4362 /* 4363 * If there are messages in the queue or pretimeouts, handle them. 4364 */ 4365 static void handle_new_recv_msgs(struct ipmi_smi *intf) 4366 { 4367 struct ipmi_smi_msg *smi_msg; 4368 unsigned long flags = 0; 4369 int rv; 4370 int run_to_completion = intf->run_to_completion; 4371 4372 /* See if any waiting messages need to be processed. */ 4373 if (!run_to_completion) 4374 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags); 4375 while (!list_empty(&intf->waiting_rcv_msgs)) { 4376 smi_msg = list_entry(intf->waiting_rcv_msgs.next, 4377 struct ipmi_smi_msg, link); 4378 list_del(&smi_msg->link); 4379 if (!run_to_completion) 4380 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, 4381 flags); 4382 rv = handle_one_recv_msg(intf, smi_msg); 4383 if (!run_to_completion) 4384 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags); 4385 if (rv > 0) { 4386 /* 4387 * To preserve message order, quit if we 4388 * can't handle a message. Add the message 4389 * back at the head, this is safe because this 4390 * tasklet is the only thing that pulls the 4391 * messages. 4392 */ 4393 list_add(&smi_msg->link, &intf->waiting_rcv_msgs); 4394 break; 4395 } else { 4396 if (rv == 0) 4397 /* Message handled */ 4398 ipmi_free_smi_msg(smi_msg); 4399 /* If rv < 0, fatal error, del but don't free. */ 4400 } 4401 } 4402 if (!run_to_completion) 4403 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, flags); 4404 4405 /* 4406 * If the pretimout count is non-zero, decrement one from it and 4407 * deliver pretimeouts to all the users. 4408 */ 4409 if (atomic_add_unless(&intf->watchdog_pretimeouts_to_deliver, -1, 0)) { 4410 struct ipmi_user *user; 4411 int index; 4412 4413 index = srcu_read_lock(&intf->users_srcu); 4414 list_for_each_entry_rcu(user, &intf->users, link) { 4415 if (user->handler->ipmi_watchdog_pretimeout) 4416 user->handler->ipmi_watchdog_pretimeout( 4417 user->handler_data); 4418 } 4419 srcu_read_unlock(&intf->users_srcu, index); 4420 } 4421 } 4422 4423 static void smi_recv_tasklet(unsigned long val) 4424 { 4425 unsigned long flags = 0; /* keep us warning-free. */ 4426 struct ipmi_smi *intf = (struct ipmi_smi *) val; 4427 int run_to_completion = intf->run_to_completion; 4428 struct ipmi_smi_msg *newmsg = NULL; 4429 4430 /* 4431 * Start the next message if available. 4432 * 4433 * Do this here, not in the actual receiver, because we may deadlock 4434 * because the lower layer is allowed to hold locks while calling 4435 * message delivery. 4436 */ 4437 4438 rcu_read_lock(); 4439 4440 if (!run_to_completion) 4441 spin_lock_irqsave(&intf->xmit_msgs_lock, flags); 4442 if (intf->curr_msg == NULL && !intf->in_shutdown) { 4443 struct list_head *entry = NULL; 4444 4445 /* Pick the high priority queue first. */ 4446 if (!list_empty(&intf->hp_xmit_msgs)) 4447 entry = intf->hp_xmit_msgs.next; 4448 else if (!list_empty(&intf->xmit_msgs)) 4449 entry = intf->xmit_msgs.next; 4450 4451 if (entry) { 4452 list_del(entry); 4453 newmsg = list_entry(entry, struct ipmi_smi_msg, link); 4454 intf->curr_msg = newmsg; 4455 } 4456 } 4457 4458 if (!run_to_completion) 4459 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags); 4460 if (newmsg) 4461 intf->handlers->sender(intf->send_info, newmsg); 4462 4463 rcu_read_unlock(); 4464 4465 handle_new_recv_msgs(intf); 4466 } 4467 4468 /* Handle a new message from the lower layer. */ 4469 void ipmi_smi_msg_received(struct ipmi_smi *intf, 4470 struct ipmi_smi_msg *msg) 4471 { 4472 unsigned long flags = 0; /* keep us warning-free. */ 4473 int run_to_completion = intf->run_to_completion; 4474 4475 if ((msg->data_size >= 2) 4476 && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2)) 4477 && (msg->data[1] == IPMI_SEND_MSG_CMD) 4478 && (msg->user_data == NULL)) { 4479 4480 if (intf->in_shutdown) 4481 goto free_msg; 4482 4483 /* 4484 * This is the local response to a command send, start 4485 * the timer for these. The user_data will not be 4486 * NULL if this is a response send, and we will let 4487 * response sends just go through. 4488 */ 4489 4490 /* 4491 * Check for errors, if we get certain errors (ones 4492 * that mean basically we can try again later), we 4493 * ignore them and start the timer. Otherwise we 4494 * report the error immediately. 4495 */ 4496 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0) 4497 && (msg->rsp[2] != IPMI_NODE_BUSY_ERR) 4498 && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR) 4499 && (msg->rsp[2] != IPMI_BUS_ERR) 4500 && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) { 4501 int ch = msg->rsp[3] & 0xf; 4502 struct ipmi_channel *chans; 4503 4504 /* Got an error sending the message, handle it. */ 4505 4506 chans = READ_ONCE(intf->channel_list)->c; 4507 if ((chans[ch].medium == IPMI_CHANNEL_MEDIUM_8023LAN) 4508 || (chans[ch].medium == IPMI_CHANNEL_MEDIUM_ASYNC)) 4509 ipmi_inc_stat(intf, sent_lan_command_errs); 4510 else 4511 ipmi_inc_stat(intf, sent_ipmb_command_errs); 4512 intf_err_seq(intf, msg->msgid, msg->rsp[2]); 4513 } else 4514 /* The message was sent, start the timer. */ 4515 intf_start_seq_timer(intf, msg->msgid); 4516 4517 free_msg: 4518 ipmi_free_smi_msg(msg); 4519 } else { 4520 /* 4521 * To preserve message order, we keep a queue and deliver from 4522 * a tasklet. 4523 */ 4524 if (!run_to_completion) 4525 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags); 4526 list_add_tail(&msg->link, &intf->waiting_rcv_msgs); 4527 if (!run_to_completion) 4528 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, 4529 flags); 4530 } 4531 4532 if (!run_to_completion) 4533 spin_lock_irqsave(&intf->xmit_msgs_lock, flags); 4534 /* 4535 * We can get an asynchronous event or receive message in addition 4536 * to commands we send. 4537 */ 4538 if (msg == intf->curr_msg) 4539 intf->curr_msg = NULL; 4540 if (!run_to_completion) 4541 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags); 4542 4543 if (run_to_completion) 4544 smi_recv_tasklet((unsigned long) intf); 4545 else 4546 tasklet_schedule(&intf->recv_tasklet); 4547 } 4548 EXPORT_SYMBOL(ipmi_smi_msg_received); 4549 4550 void ipmi_smi_watchdog_pretimeout(struct ipmi_smi *intf) 4551 { 4552 if (intf->in_shutdown) 4553 return; 4554 4555 atomic_set(&intf->watchdog_pretimeouts_to_deliver, 1); 4556 tasklet_schedule(&intf->recv_tasklet); 4557 } 4558 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout); 4559 4560 static struct ipmi_smi_msg * 4561 smi_from_recv_msg(struct ipmi_smi *intf, struct ipmi_recv_msg *recv_msg, 4562 unsigned char seq, long seqid) 4563 { 4564 struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg(); 4565 if (!smi_msg) 4566 /* 4567 * If we can't allocate the message, then just return, we 4568 * get 4 retries, so this should be ok. 4569 */ 4570 return NULL; 4571 4572 memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len); 4573 smi_msg->data_size = recv_msg->msg.data_len; 4574 smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid); 4575 4576 ipmi_debug_msg("Resend: ", smi_msg->data, smi_msg->data_size); 4577 4578 return smi_msg; 4579 } 4580 4581 static void check_msg_timeout(struct ipmi_smi *intf, struct seq_table *ent, 4582 struct list_head *timeouts, 4583 unsigned long timeout_period, 4584 int slot, unsigned long *flags, 4585 bool *need_timer) 4586 { 4587 struct ipmi_recv_msg *msg; 4588 4589 if (intf->in_shutdown) 4590 return; 4591 4592 if (!ent->inuse) 4593 return; 4594 4595 if (timeout_period < ent->timeout) { 4596 ent->timeout -= timeout_period; 4597 *need_timer = true; 4598 return; 4599 } 4600 4601 if (ent->retries_left == 0) { 4602 /* The message has used all its retries. */ 4603 ent->inuse = 0; 4604 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 4605 msg = ent->recv_msg; 4606 list_add_tail(&msg->link, timeouts); 4607 if (ent->broadcast) 4608 ipmi_inc_stat(intf, timed_out_ipmb_broadcasts); 4609 else if (is_lan_addr(&ent->recv_msg->addr)) 4610 ipmi_inc_stat(intf, timed_out_lan_commands); 4611 else 4612 ipmi_inc_stat(intf, timed_out_ipmb_commands); 4613 } else { 4614 struct ipmi_smi_msg *smi_msg; 4615 /* More retries, send again. */ 4616 4617 *need_timer = true; 4618 4619 /* 4620 * Start with the max timer, set to normal timer after 4621 * the message is sent. 4622 */ 4623 ent->timeout = MAX_MSG_TIMEOUT; 4624 ent->retries_left--; 4625 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot, 4626 ent->seqid); 4627 if (!smi_msg) { 4628 if (is_lan_addr(&ent->recv_msg->addr)) 4629 ipmi_inc_stat(intf, 4630 dropped_rexmit_lan_commands); 4631 else 4632 ipmi_inc_stat(intf, 4633 dropped_rexmit_ipmb_commands); 4634 return; 4635 } 4636 4637 spin_unlock_irqrestore(&intf->seq_lock, *flags); 4638 4639 /* 4640 * Send the new message. We send with a zero 4641 * priority. It timed out, I doubt time is that 4642 * critical now, and high priority messages are really 4643 * only for messages to the local MC, which don't get 4644 * resent. 4645 */ 4646 if (intf->handlers) { 4647 if (is_lan_addr(&ent->recv_msg->addr)) 4648 ipmi_inc_stat(intf, 4649 retransmitted_lan_commands); 4650 else 4651 ipmi_inc_stat(intf, 4652 retransmitted_ipmb_commands); 4653 4654 smi_send(intf, intf->handlers, smi_msg, 0); 4655 } else 4656 ipmi_free_smi_msg(smi_msg); 4657 4658 spin_lock_irqsave(&intf->seq_lock, *flags); 4659 } 4660 } 4661 4662 static bool ipmi_timeout_handler(struct ipmi_smi *intf, 4663 unsigned long timeout_period) 4664 { 4665 struct list_head timeouts; 4666 struct ipmi_recv_msg *msg, *msg2; 4667 unsigned long flags; 4668 int i; 4669 bool need_timer = false; 4670 4671 if (!intf->bmc_registered) { 4672 kref_get(&intf->refcount); 4673 if (!schedule_work(&intf->bmc_reg_work)) { 4674 kref_put(&intf->refcount, intf_free); 4675 need_timer = true; 4676 } 4677 } 4678 4679 /* 4680 * Go through the seq table and find any messages that 4681 * have timed out, putting them in the timeouts 4682 * list. 4683 */ 4684 INIT_LIST_HEAD(&timeouts); 4685 spin_lock_irqsave(&intf->seq_lock, flags); 4686 if (intf->ipmb_maintenance_mode_timeout) { 4687 if (intf->ipmb_maintenance_mode_timeout <= timeout_period) 4688 intf->ipmb_maintenance_mode_timeout = 0; 4689 else 4690 intf->ipmb_maintenance_mode_timeout -= timeout_period; 4691 } 4692 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) 4693 check_msg_timeout(intf, &intf->seq_table[i], 4694 &timeouts, timeout_period, i, 4695 &flags, &need_timer); 4696 spin_unlock_irqrestore(&intf->seq_lock, flags); 4697 4698 list_for_each_entry_safe(msg, msg2, &timeouts, link) 4699 deliver_err_response(intf, msg, IPMI_TIMEOUT_COMPLETION_CODE); 4700 4701 /* 4702 * Maintenance mode handling. Check the timeout 4703 * optimistically before we claim the lock. It may 4704 * mean a timeout gets missed occasionally, but that 4705 * only means the timeout gets extended by one period 4706 * in that case. No big deal, and it avoids the lock 4707 * most of the time. 4708 */ 4709 if (intf->auto_maintenance_timeout > 0) { 4710 spin_lock_irqsave(&intf->maintenance_mode_lock, flags); 4711 if (intf->auto_maintenance_timeout > 0) { 4712 intf->auto_maintenance_timeout 4713 -= timeout_period; 4714 if (!intf->maintenance_mode 4715 && (intf->auto_maintenance_timeout <= 0)) { 4716 intf->maintenance_mode_enable = false; 4717 maintenance_mode_update(intf); 4718 } 4719 } 4720 spin_unlock_irqrestore(&intf->maintenance_mode_lock, 4721 flags); 4722 } 4723 4724 tasklet_schedule(&intf->recv_tasklet); 4725 4726 return need_timer; 4727 } 4728 4729 static void ipmi_request_event(struct ipmi_smi *intf) 4730 { 4731 /* No event requests when in maintenance mode. */ 4732 if (intf->maintenance_mode_enable) 4733 return; 4734 4735 if (!intf->in_shutdown) 4736 intf->handlers->request_events(intf->send_info); 4737 } 4738 4739 static struct timer_list ipmi_timer; 4740 4741 static atomic_t stop_operation; 4742 4743 static void ipmi_timeout(struct timer_list *unused) 4744 { 4745 struct ipmi_smi *intf; 4746 bool need_timer = false; 4747 int index; 4748 4749 if (atomic_read(&stop_operation)) 4750 return; 4751 4752 index = srcu_read_lock(&ipmi_interfaces_srcu); 4753 list_for_each_entry_rcu(intf, &ipmi_interfaces, link) { 4754 if (atomic_read(&intf->event_waiters)) { 4755 intf->ticks_to_req_ev--; 4756 if (intf->ticks_to_req_ev == 0) { 4757 ipmi_request_event(intf); 4758 intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME; 4759 } 4760 need_timer = true; 4761 } 4762 4763 need_timer |= ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME); 4764 } 4765 srcu_read_unlock(&ipmi_interfaces_srcu, index); 4766 4767 if (need_timer) 4768 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); 4769 } 4770 4771 static void need_waiter(struct ipmi_smi *intf) 4772 { 4773 /* Racy, but worst case we start the timer twice. */ 4774 if (!timer_pending(&ipmi_timer)) 4775 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); 4776 } 4777 4778 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0); 4779 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0); 4780 4781 static void free_smi_msg(struct ipmi_smi_msg *msg) 4782 { 4783 atomic_dec(&smi_msg_inuse_count); 4784 kfree(msg); 4785 } 4786 4787 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void) 4788 { 4789 struct ipmi_smi_msg *rv; 4790 rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC); 4791 if (rv) { 4792 rv->done = free_smi_msg; 4793 rv->user_data = NULL; 4794 atomic_inc(&smi_msg_inuse_count); 4795 } 4796 return rv; 4797 } 4798 EXPORT_SYMBOL(ipmi_alloc_smi_msg); 4799 4800 static void free_recv_msg(struct ipmi_recv_msg *msg) 4801 { 4802 atomic_dec(&recv_msg_inuse_count); 4803 kfree(msg); 4804 } 4805 4806 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void) 4807 { 4808 struct ipmi_recv_msg *rv; 4809 4810 rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC); 4811 if (rv) { 4812 rv->user = NULL; 4813 rv->done = free_recv_msg; 4814 atomic_inc(&recv_msg_inuse_count); 4815 } 4816 return rv; 4817 } 4818 4819 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg) 4820 { 4821 if (msg->user) 4822 kref_put(&msg->user->refcount, free_user); 4823 msg->done(msg); 4824 } 4825 EXPORT_SYMBOL(ipmi_free_recv_msg); 4826 4827 static atomic_t panic_done_count = ATOMIC_INIT(0); 4828 4829 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg) 4830 { 4831 atomic_dec(&panic_done_count); 4832 } 4833 4834 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg) 4835 { 4836 atomic_dec(&panic_done_count); 4837 } 4838 4839 /* 4840 * Inside a panic, send a message and wait for a response. 4841 */ 4842 static void ipmi_panic_request_and_wait(struct ipmi_smi *intf, 4843 struct ipmi_addr *addr, 4844 struct kernel_ipmi_msg *msg) 4845 { 4846 struct ipmi_smi_msg smi_msg; 4847 struct ipmi_recv_msg recv_msg; 4848 int rv; 4849 4850 smi_msg.done = dummy_smi_done_handler; 4851 recv_msg.done = dummy_recv_done_handler; 4852 atomic_add(2, &panic_done_count); 4853 rv = i_ipmi_request(NULL, 4854 intf, 4855 addr, 4856 0, 4857 msg, 4858 intf, 4859 &smi_msg, 4860 &recv_msg, 4861 0, 4862 intf->addrinfo[0].address, 4863 intf->addrinfo[0].lun, 4864 0, 1); /* Don't retry, and don't wait. */ 4865 if (rv) 4866 atomic_sub(2, &panic_done_count); 4867 else if (intf->handlers->flush_messages) 4868 intf->handlers->flush_messages(intf->send_info); 4869 4870 while (atomic_read(&panic_done_count) != 0) 4871 ipmi_poll(intf); 4872 } 4873 4874 static void event_receiver_fetcher(struct ipmi_smi *intf, 4875 struct ipmi_recv_msg *msg) 4876 { 4877 if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 4878 && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE) 4879 && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD) 4880 && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) { 4881 /* A get event receiver command, save it. */ 4882 intf->event_receiver = msg->msg.data[1]; 4883 intf->event_receiver_lun = msg->msg.data[2] & 0x3; 4884 } 4885 } 4886 4887 static void device_id_fetcher(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) 4888 { 4889 if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 4890 && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE) 4891 && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD) 4892 && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) { 4893 /* 4894 * A get device id command, save if we are an event 4895 * receiver or generator. 4896 */ 4897 intf->local_sel_device = (msg->msg.data[6] >> 2) & 1; 4898 intf->local_event_generator = (msg->msg.data[6] >> 5) & 1; 4899 } 4900 } 4901 4902 static void send_panic_events(struct ipmi_smi *intf, char *str) 4903 { 4904 struct kernel_ipmi_msg msg; 4905 unsigned char data[16]; 4906 struct ipmi_system_interface_addr *si; 4907 struct ipmi_addr addr; 4908 char *p = str; 4909 struct ipmi_ipmb_addr *ipmb; 4910 int j; 4911 4912 if (ipmi_send_panic_event == IPMI_SEND_PANIC_EVENT_NONE) 4913 return; 4914 4915 si = (struct ipmi_system_interface_addr *) &addr; 4916 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 4917 si->channel = IPMI_BMC_CHANNEL; 4918 si->lun = 0; 4919 4920 /* Fill in an event telling that we have failed. */ 4921 msg.netfn = 0x04; /* Sensor or Event. */ 4922 msg.cmd = 2; /* Platform event command. */ 4923 msg.data = data; 4924 msg.data_len = 8; 4925 data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */ 4926 data[1] = 0x03; /* This is for IPMI 1.0. */ 4927 data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */ 4928 data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */ 4929 data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */ 4930 4931 /* 4932 * Put a few breadcrumbs in. Hopefully later we can add more things 4933 * to make the panic events more useful. 4934 */ 4935 if (str) { 4936 data[3] = str[0]; 4937 data[6] = str[1]; 4938 data[7] = str[2]; 4939 } 4940 4941 /* Send the event announcing the panic. */ 4942 ipmi_panic_request_and_wait(intf, &addr, &msg); 4943 4944 /* 4945 * On every interface, dump a bunch of OEM event holding the 4946 * string. 4947 */ 4948 if (ipmi_send_panic_event != IPMI_SEND_PANIC_EVENT_STRING || !str) 4949 return; 4950 4951 /* 4952 * intf_num is used as an marker to tell if the 4953 * interface is valid. Thus we need a read barrier to 4954 * make sure data fetched before checking intf_num 4955 * won't be used. 4956 */ 4957 smp_rmb(); 4958 4959 /* 4960 * First job here is to figure out where to send the 4961 * OEM events. There's no way in IPMI to send OEM 4962 * events using an event send command, so we have to 4963 * find the SEL to put them in and stick them in 4964 * there. 4965 */ 4966 4967 /* Get capabilities from the get device id. */ 4968 intf->local_sel_device = 0; 4969 intf->local_event_generator = 0; 4970 intf->event_receiver = 0; 4971 4972 /* Request the device info from the local MC. */ 4973 msg.netfn = IPMI_NETFN_APP_REQUEST; 4974 msg.cmd = IPMI_GET_DEVICE_ID_CMD; 4975 msg.data = NULL; 4976 msg.data_len = 0; 4977 intf->null_user_handler = device_id_fetcher; 4978 ipmi_panic_request_and_wait(intf, &addr, &msg); 4979 4980 if (intf->local_event_generator) { 4981 /* Request the event receiver from the local MC. */ 4982 msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST; 4983 msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD; 4984 msg.data = NULL; 4985 msg.data_len = 0; 4986 intf->null_user_handler = event_receiver_fetcher; 4987 ipmi_panic_request_and_wait(intf, &addr, &msg); 4988 } 4989 intf->null_user_handler = NULL; 4990 4991 /* 4992 * Validate the event receiver. The low bit must not 4993 * be 1 (it must be a valid IPMB address), it cannot 4994 * be zero, and it must not be my address. 4995 */ 4996 if (((intf->event_receiver & 1) == 0) 4997 && (intf->event_receiver != 0) 4998 && (intf->event_receiver != intf->addrinfo[0].address)) { 4999 /* 5000 * The event receiver is valid, send an IPMB 5001 * message. 5002 */ 5003 ipmb = (struct ipmi_ipmb_addr *) &addr; 5004 ipmb->addr_type = IPMI_IPMB_ADDR_TYPE; 5005 ipmb->channel = 0; /* FIXME - is this right? */ 5006 ipmb->lun = intf->event_receiver_lun; 5007 ipmb->slave_addr = intf->event_receiver; 5008 } else if (intf->local_sel_device) { 5009 /* 5010 * The event receiver was not valid (or was 5011 * me), but I am an SEL device, just dump it 5012 * in my SEL. 5013 */ 5014 si = (struct ipmi_system_interface_addr *) &addr; 5015 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 5016 si->channel = IPMI_BMC_CHANNEL; 5017 si->lun = 0; 5018 } else 5019 return; /* No where to send the event. */ 5020 5021 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */ 5022 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD; 5023 msg.data = data; 5024 msg.data_len = 16; 5025 5026 j = 0; 5027 while (*p) { 5028 int size = strlen(p); 5029 5030 if (size > 11) 5031 size = 11; 5032 data[0] = 0; 5033 data[1] = 0; 5034 data[2] = 0xf0; /* OEM event without timestamp. */ 5035 data[3] = intf->addrinfo[0].address; 5036 data[4] = j++; /* sequence # */ 5037 /* 5038 * Always give 11 bytes, so strncpy will fill 5039 * it with zeroes for me. 5040 */ 5041 strncpy(data+5, p, 11); 5042 p += size; 5043 5044 ipmi_panic_request_and_wait(intf, &addr, &msg); 5045 } 5046 } 5047 5048 static int has_panicked; 5049 5050 static int panic_event(struct notifier_block *this, 5051 unsigned long event, 5052 void *ptr) 5053 { 5054 struct ipmi_smi *intf; 5055 struct ipmi_user *user; 5056 5057 if (has_panicked) 5058 return NOTIFY_DONE; 5059 has_panicked = 1; 5060 5061 /* For every registered interface, set it to run to completion. */ 5062 list_for_each_entry_rcu(intf, &ipmi_interfaces, link) { 5063 if (!intf->handlers || intf->intf_num == -1) 5064 /* Interface is not ready. */ 5065 continue; 5066 5067 if (!intf->handlers->poll) 5068 continue; 5069 5070 /* 5071 * If we were interrupted while locking xmit_msgs_lock or 5072 * waiting_rcv_msgs_lock, the corresponding list may be 5073 * corrupted. In this case, drop items on the list for 5074 * the safety. 5075 */ 5076 if (!spin_trylock(&intf->xmit_msgs_lock)) { 5077 INIT_LIST_HEAD(&intf->xmit_msgs); 5078 INIT_LIST_HEAD(&intf->hp_xmit_msgs); 5079 } else 5080 spin_unlock(&intf->xmit_msgs_lock); 5081 5082 if (!spin_trylock(&intf->waiting_rcv_msgs_lock)) 5083 INIT_LIST_HEAD(&intf->waiting_rcv_msgs); 5084 else 5085 spin_unlock(&intf->waiting_rcv_msgs_lock); 5086 5087 intf->run_to_completion = 1; 5088 if (intf->handlers->set_run_to_completion) 5089 intf->handlers->set_run_to_completion(intf->send_info, 5090 1); 5091 5092 list_for_each_entry_rcu(user, &intf->users, link) { 5093 if (user->handler->ipmi_panic_handler) 5094 user->handler->ipmi_panic_handler( 5095 user->handler_data); 5096 } 5097 5098 send_panic_events(intf, ptr); 5099 } 5100 5101 return NOTIFY_DONE; 5102 } 5103 5104 /* Must be called with ipmi_interfaces_mutex held. */ 5105 static int ipmi_register_driver(void) 5106 { 5107 int rv; 5108 5109 if (drvregistered) 5110 return 0; 5111 5112 rv = driver_register(&ipmidriver.driver); 5113 if (rv) 5114 pr_err("Could not register IPMI driver\n"); 5115 else 5116 drvregistered = true; 5117 return rv; 5118 } 5119 5120 static struct notifier_block panic_block = { 5121 .notifier_call = panic_event, 5122 .next = NULL, 5123 .priority = 200 /* priority: INT_MAX >= x >= 0 */ 5124 }; 5125 5126 static int ipmi_init_msghandler(void) 5127 { 5128 int rv; 5129 5130 mutex_lock(&ipmi_interfaces_mutex); 5131 rv = ipmi_register_driver(); 5132 if (rv) 5133 goto out; 5134 if (initialized) 5135 goto out; 5136 5137 init_srcu_struct(&ipmi_interfaces_srcu); 5138 5139 timer_setup(&ipmi_timer, ipmi_timeout, 0); 5140 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); 5141 5142 atomic_notifier_chain_register(&panic_notifier_list, &panic_block); 5143 5144 initialized = true; 5145 5146 out: 5147 mutex_unlock(&ipmi_interfaces_mutex); 5148 return rv; 5149 } 5150 5151 static int __init ipmi_init_msghandler_mod(void) 5152 { 5153 int rv; 5154 5155 pr_info("version " IPMI_DRIVER_VERSION "\n"); 5156 5157 mutex_lock(&ipmi_interfaces_mutex); 5158 rv = ipmi_register_driver(); 5159 mutex_unlock(&ipmi_interfaces_mutex); 5160 5161 return rv; 5162 } 5163 5164 static void __exit cleanup_ipmi(void) 5165 { 5166 int count; 5167 5168 if (initialized) { 5169 atomic_notifier_chain_unregister(&panic_notifier_list, 5170 &panic_block); 5171 5172 /* 5173 * This can't be called if any interfaces exist, so no worry 5174 * about shutting down the interfaces. 5175 */ 5176 5177 /* 5178 * Tell the timer to stop, then wait for it to stop. This 5179 * avoids problems with race conditions removing the timer 5180 * here. 5181 */ 5182 atomic_set(&stop_operation, 1); 5183 del_timer_sync(&ipmi_timer); 5184 5185 initialized = false; 5186 5187 /* Check for buffer leaks. */ 5188 count = atomic_read(&smi_msg_inuse_count); 5189 if (count != 0) 5190 pr_warn("SMI message count %d at exit\n", count); 5191 count = atomic_read(&recv_msg_inuse_count); 5192 if (count != 0) 5193 pr_warn("recv message count %d at exit\n", count); 5194 5195 cleanup_srcu_struct(&ipmi_interfaces_srcu); 5196 } 5197 if (drvregistered) 5198 driver_unregister(&ipmidriver.driver); 5199 } 5200 module_exit(cleanup_ipmi); 5201 5202 module_init(ipmi_init_msghandler_mod); 5203 MODULE_LICENSE("GPL"); 5204 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>"); 5205 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI" 5206 " interface."); 5207 MODULE_VERSION(IPMI_DRIVER_VERSION); 5208 MODULE_SOFTDEP("post: ipmi_devintf"); 5209