1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * ipmi_msghandler.c 4 * 5 * Incoming and outgoing message routing for an IPMI interface. 6 * 7 * Author: MontaVista Software, Inc. 8 * Corey Minyard <minyard@mvista.com> 9 * source@mvista.com 10 * 11 * Copyright 2002 MontaVista Software Inc. 12 */ 13 14 #define pr_fmt(fmt) "IPMI message handler: " fmt 15 #define dev_fmt(fmt) pr_fmt(fmt) 16 17 #include <linux/module.h> 18 #include <linux/errno.h> 19 #include <linux/panic_notifier.h> 20 #include <linux/poll.h> 21 #include <linux/sched.h> 22 #include <linux/seq_file.h> 23 #include <linux/spinlock.h> 24 #include <linux/mutex.h> 25 #include <linux/slab.h> 26 #include <linux/ipmi.h> 27 #include <linux/ipmi_smi.h> 28 #include <linux/notifier.h> 29 #include <linux/init.h> 30 #include <linux/proc_fs.h> 31 #include <linux/rcupdate.h> 32 #include <linux/interrupt.h> 33 #include <linux/moduleparam.h> 34 #include <linux/workqueue.h> 35 #include <linux/uuid.h> 36 #include <linux/nospec.h> 37 #include <linux/vmalloc.h> 38 #include <linux/delay.h> 39 40 #define IPMI_DRIVER_VERSION "39.2" 41 42 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void); 43 static int ipmi_init_msghandler(void); 44 static void smi_recv_tasklet(struct tasklet_struct *t); 45 static void handle_new_recv_msgs(struct ipmi_smi *intf); 46 static void need_waiter(struct ipmi_smi *intf); 47 static int handle_one_recv_msg(struct ipmi_smi *intf, 48 struct ipmi_smi_msg *msg); 49 50 static bool initialized; 51 static bool drvregistered; 52 53 /* Numbers in this enumerator should be mapped to ipmi_panic_event_str */ 54 enum ipmi_panic_event_op { 55 IPMI_SEND_PANIC_EVENT_NONE, 56 IPMI_SEND_PANIC_EVENT, 57 IPMI_SEND_PANIC_EVENT_STRING, 58 IPMI_SEND_PANIC_EVENT_MAX 59 }; 60 61 /* Indices in this array should be mapped to enum ipmi_panic_event_op */ 62 static const char *const ipmi_panic_event_str[] = { "none", "event", "string", NULL }; 63 64 #ifdef CONFIG_IPMI_PANIC_STRING 65 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT_STRING 66 #elif defined(CONFIG_IPMI_PANIC_EVENT) 67 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT 68 #else 69 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT_NONE 70 #endif 71 72 static enum ipmi_panic_event_op ipmi_send_panic_event = IPMI_PANIC_DEFAULT; 73 74 static int panic_op_write_handler(const char *val, 75 const struct kernel_param *kp) 76 { 77 char valcp[16]; 78 int e; 79 80 strscpy(valcp, val, sizeof(valcp)); 81 e = match_string(ipmi_panic_event_str, -1, strstrip(valcp)); 82 if (e < 0) 83 return e; 84 85 ipmi_send_panic_event = e; 86 return 0; 87 } 88 89 static int panic_op_read_handler(char *buffer, const struct kernel_param *kp) 90 { 91 const char *event_str; 92 93 if (ipmi_send_panic_event >= IPMI_SEND_PANIC_EVENT_MAX) 94 event_str = "???"; 95 else 96 event_str = ipmi_panic_event_str[ipmi_send_panic_event]; 97 98 return sprintf(buffer, "%s\n", event_str); 99 } 100 101 static const struct kernel_param_ops panic_op_ops = { 102 .set = panic_op_write_handler, 103 .get = panic_op_read_handler 104 }; 105 module_param_cb(panic_op, &panic_op_ops, NULL, 0600); 106 MODULE_PARM_DESC(panic_op, "Sets if the IPMI driver will attempt to store panic information in the event log in the event of a panic. Set to 'none' for no, 'event' for a single event, or 'string' for a generic event and the panic string in IPMI OEM events."); 107 108 109 #define MAX_EVENTS_IN_QUEUE 25 110 111 /* Remain in auto-maintenance mode for this amount of time (in ms). */ 112 static unsigned long maintenance_mode_timeout_ms = 30000; 113 module_param(maintenance_mode_timeout_ms, ulong, 0644); 114 MODULE_PARM_DESC(maintenance_mode_timeout_ms, 115 "The time (milliseconds) after the last maintenance message that the connection stays in maintenance mode."); 116 117 /* 118 * Don't let a message sit in a queue forever, always time it with at lest 119 * the max message timer. This is in milliseconds. 120 */ 121 #define MAX_MSG_TIMEOUT 60000 122 123 /* 124 * Timeout times below are in milliseconds, and are done off a 1 125 * second timer. So setting the value to 1000 would mean anything 126 * between 0 and 1000ms. So really the only reasonable minimum 127 * setting it 2000ms, which is between 1 and 2 seconds. 128 */ 129 130 /* The default timeout for message retries. */ 131 static unsigned long default_retry_ms = 2000; 132 module_param(default_retry_ms, ulong, 0644); 133 MODULE_PARM_DESC(default_retry_ms, 134 "The time (milliseconds) between retry sends"); 135 136 /* The default timeout for maintenance mode message retries. */ 137 static unsigned long default_maintenance_retry_ms = 3000; 138 module_param(default_maintenance_retry_ms, ulong, 0644); 139 MODULE_PARM_DESC(default_maintenance_retry_ms, 140 "The time (milliseconds) between retry sends in maintenance mode"); 141 142 /* The default maximum number of retries */ 143 static unsigned int default_max_retries = 4; 144 module_param(default_max_retries, uint, 0644); 145 MODULE_PARM_DESC(default_max_retries, 146 "The time (milliseconds) between retry sends in maintenance mode"); 147 148 /* The default maximum number of users that may register. */ 149 static unsigned int max_users = 30; 150 module_param(max_users, uint, 0644); 151 MODULE_PARM_DESC(max_users, 152 "The most users that may use the IPMI stack at one time."); 153 154 /* The default maximum number of message a user may have outstanding. */ 155 static unsigned int max_msgs_per_user = 100; 156 module_param(max_msgs_per_user, uint, 0644); 157 MODULE_PARM_DESC(max_msgs_per_user, 158 "The most message a user may have outstanding."); 159 160 /* Call every ~1000 ms. */ 161 #define IPMI_TIMEOUT_TIME 1000 162 163 /* How many jiffies does it take to get to the timeout time. */ 164 #define IPMI_TIMEOUT_JIFFIES ((IPMI_TIMEOUT_TIME * HZ) / 1000) 165 166 /* 167 * Request events from the queue every second (this is the number of 168 * IPMI_TIMEOUT_TIMES between event requests). Hopefully, in the 169 * future, IPMI will add a way to know immediately if an event is in 170 * the queue and this silliness can go away. 171 */ 172 #define IPMI_REQUEST_EV_TIME (1000 / (IPMI_TIMEOUT_TIME)) 173 174 /* How long should we cache dynamic device IDs? */ 175 #define IPMI_DYN_DEV_ID_EXPIRY (10 * HZ) 176 177 /* 178 * The main "user" data structure. 179 */ 180 struct ipmi_user { 181 struct list_head link; 182 183 /* 184 * Set to NULL when the user is destroyed, a pointer to myself 185 * so srcu_dereference can be used on it. 186 */ 187 struct ipmi_user *self; 188 struct srcu_struct release_barrier; 189 190 struct kref refcount; 191 192 /* The upper layer that handles receive messages. */ 193 const struct ipmi_user_hndl *handler; 194 void *handler_data; 195 196 /* The interface this user is bound to. */ 197 struct ipmi_smi *intf; 198 199 /* Does this interface receive IPMI events? */ 200 bool gets_events; 201 202 atomic_t nr_msgs; 203 204 /* Free must run in process context for RCU cleanup. */ 205 struct work_struct remove_work; 206 }; 207 208 static struct workqueue_struct *remove_work_wq; 209 210 static struct ipmi_user *acquire_ipmi_user(struct ipmi_user *user, int *index) 211 __acquires(user->release_barrier) 212 { 213 struct ipmi_user *ruser; 214 215 *index = srcu_read_lock(&user->release_barrier); 216 ruser = srcu_dereference(user->self, &user->release_barrier); 217 if (!ruser) 218 srcu_read_unlock(&user->release_barrier, *index); 219 return ruser; 220 } 221 222 static void release_ipmi_user(struct ipmi_user *user, int index) 223 { 224 srcu_read_unlock(&user->release_barrier, index); 225 } 226 227 struct cmd_rcvr { 228 struct list_head link; 229 230 struct ipmi_user *user; 231 unsigned char netfn; 232 unsigned char cmd; 233 unsigned int chans; 234 235 /* 236 * This is used to form a linked lised during mass deletion. 237 * Since this is in an RCU list, we cannot use the link above 238 * or change any data until the RCU period completes. So we 239 * use this next variable during mass deletion so we can have 240 * a list and don't have to wait and restart the search on 241 * every individual deletion of a command. 242 */ 243 struct cmd_rcvr *next; 244 }; 245 246 struct seq_table { 247 unsigned int inuse : 1; 248 unsigned int broadcast : 1; 249 250 unsigned long timeout; 251 unsigned long orig_timeout; 252 unsigned int retries_left; 253 254 /* 255 * To verify on an incoming send message response that this is 256 * the message that the response is for, we keep a sequence id 257 * and increment it every time we send a message. 258 */ 259 long seqid; 260 261 /* 262 * This is held so we can properly respond to the message on a 263 * timeout, and it is used to hold the temporary data for 264 * retransmission, too. 265 */ 266 struct ipmi_recv_msg *recv_msg; 267 }; 268 269 /* 270 * Store the information in a msgid (long) to allow us to find a 271 * sequence table entry from the msgid. 272 */ 273 #define STORE_SEQ_IN_MSGID(seq, seqid) \ 274 ((((seq) & 0x3f) << 26) | ((seqid) & 0x3ffffff)) 275 276 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \ 277 do { \ 278 seq = (((msgid) >> 26) & 0x3f); \ 279 seqid = ((msgid) & 0x3ffffff); \ 280 } while (0) 281 282 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3ffffff) 283 284 #define IPMI_MAX_CHANNELS 16 285 struct ipmi_channel { 286 unsigned char medium; 287 unsigned char protocol; 288 }; 289 290 struct ipmi_channel_set { 291 struct ipmi_channel c[IPMI_MAX_CHANNELS]; 292 }; 293 294 struct ipmi_my_addrinfo { 295 /* 296 * My slave address. This is initialized to IPMI_BMC_SLAVE_ADDR, 297 * but may be changed by the user. 298 */ 299 unsigned char address; 300 301 /* 302 * My LUN. This should generally stay the SMS LUN, but just in 303 * case... 304 */ 305 unsigned char lun; 306 }; 307 308 /* 309 * Note that the product id, manufacturer id, guid, and device id are 310 * immutable in this structure, so dyn_mutex is not required for 311 * accessing those. If those change on a BMC, a new BMC is allocated. 312 */ 313 struct bmc_device { 314 struct platform_device pdev; 315 struct list_head intfs; /* Interfaces on this BMC. */ 316 struct ipmi_device_id id; 317 struct ipmi_device_id fetch_id; 318 int dyn_id_set; 319 unsigned long dyn_id_expiry; 320 struct mutex dyn_mutex; /* Protects id, intfs, & dyn* */ 321 guid_t guid; 322 guid_t fetch_guid; 323 int dyn_guid_set; 324 struct kref usecount; 325 struct work_struct remove_work; 326 unsigned char cc; /* completion code */ 327 }; 328 #define to_bmc_device(x) container_of((x), struct bmc_device, pdev.dev) 329 330 static int bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, 331 struct ipmi_device_id *id, 332 bool *guid_set, guid_t *guid); 333 334 /* 335 * Various statistics for IPMI, these index stats[] in the ipmi_smi 336 * structure. 337 */ 338 enum ipmi_stat_indexes { 339 /* Commands we got from the user that were invalid. */ 340 IPMI_STAT_sent_invalid_commands = 0, 341 342 /* Commands we sent to the MC. */ 343 IPMI_STAT_sent_local_commands, 344 345 /* Responses from the MC that were delivered to a user. */ 346 IPMI_STAT_handled_local_responses, 347 348 /* Responses from the MC that were not delivered to a user. */ 349 IPMI_STAT_unhandled_local_responses, 350 351 /* Commands we sent out to the IPMB bus. */ 352 IPMI_STAT_sent_ipmb_commands, 353 354 /* Commands sent on the IPMB that had errors on the SEND CMD */ 355 IPMI_STAT_sent_ipmb_command_errs, 356 357 /* Each retransmit increments this count. */ 358 IPMI_STAT_retransmitted_ipmb_commands, 359 360 /* 361 * When a message times out (runs out of retransmits) this is 362 * incremented. 363 */ 364 IPMI_STAT_timed_out_ipmb_commands, 365 366 /* 367 * This is like above, but for broadcasts. Broadcasts are 368 * *not* included in the above count (they are expected to 369 * time out). 370 */ 371 IPMI_STAT_timed_out_ipmb_broadcasts, 372 373 /* Responses I have sent to the IPMB bus. */ 374 IPMI_STAT_sent_ipmb_responses, 375 376 /* The response was delivered to the user. */ 377 IPMI_STAT_handled_ipmb_responses, 378 379 /* The response had invalid data in it. */ 380 IPMI_STAT_invalid_ipmb_responses, 381 382 /* The response didn't have anyone waiting for it. */ 383 IPMI_STAT_unhandled_ipmb_responses, 384 385 /* Commands we sent out to the IPMB bus. */ 386 IPMI_STAT_sent_lan_commands, 387 388 /* Commands sent on the IPMB that had errors on the SEND CMD */ 389 IPMI_STAT_sent_lan_command_errs, 390 391 /* Each retransmit increments this count. */ 392 IPMI_STAT_retransmitted_lan_commands, 393 394 /* 395 * When a message times out (runs out of retransmits) this is 396 * incremented. 397 */ 398 IPMI_STAT_timed_out_lan_commands, 399 400 /* Responses I have sent to the IPMB bus. */ 401 IPMI_STAT_sent_lan_responses, 402 403 /* The response was delivered to the user. */ 404 IPMI_STAT_handled_lan_responses, 405 406 /* The response had invalid data in it. */ 407 IPMI_STAT_invalid_lan_responses, 408 409 /* The response didn't have anyone waiting for it. */ 410 IPMI_STAT_unhandled_lan_responses, 411 412 /* The command was delivered to the user. */ 413 IPMI_STAT_handled_commands, 414 415 /* The command had invalid data in it. */ 416 IPMI_STAT_invalid_commands, 417 418 /* The command didn't have anyone waiting for it. */ 419 IPMI_STAT_unhandled_commands, 420 421 /* Invalid data in an event. */ 422 IPMI_STAT_invalid_events, 423 424 /* Events that were received with the proper format. */ 425 IPMI_STAT_events, 426 427 /* Retransmissions on IPMB that failed. */ 428 IPMI_STAT_dropped_rexmit_ipmb_commands, 429 430 /* Retransmissions on LAN that failed. */ 431 IPMI_STAT_dropped_rexmit_lan_commands, 432 433 /* This *must* remain last, add new values above this. */ 434 IPMI_NUM_STATS 435 }; 436 437 438 #define IPMI_IPMB_NUM_SEQ 64 439 struct ipmi_smi { 440 struct module *owner; 441 442 /* What interface number are we? */ 443 int intf_num; 444 445 struct kref refcount; 446 447 /* Set when the interface is being unregistered. */ 448 bool in_shutdown; 449 450 /* Used for a list of interfaces. */ 451 struct list_head link; 452 453 /* 454 * The list of upper layers that are using me. seq_lock write 455 * protects this. Read protection is with srcu. 456 */ 457 struct list_head users; 458 struct srcu_struct users_srcu; 459 atomic_t nr_users; 460 struct device_attribute nr_users_devattr; 461 struct device_attribute nr_msgs_devattr; 462 463 464 /* Used for wake ups at startup. */ 465 wait_queue_head_t waitq; 466 467 /* 468 * Prevents the interface from being unregistered when the 469 * interface is used by being looked up through the BMC 470 * structure. 471 */ 472 struct mutex bmc_reg_mutex; 473 474 struct bmc_device tmp_bmc; 475 struct bmc_device *bmc; 476 bool bmc_registered; 477 struct list_head bmc_link; 478 char *my_dev_name; 479 bool in_bmc_register; /* Handle recursive situations. Yuck. */ 480 struct work_struct bmc_reg_work; 481 482 const struct ipmi_smi_handlers *handlers; 483 void *send_info; 484 485 /* Driver-model device for the system interface. */ 486 struct device *si_dev; 487 488 /* 489 * A table of sequence numbers for this interface. We use the 490 * sequence numbers for IPMB messages that go out of the 491 * interface to match them up with their responses. A routine 492 * is called periodically to time the items in this list. 493 */ 494 spinlock_t seq_lock; 495 struct seq_table seq_table[IPMI_IPMB_NUM_SEQ]; 496 int curr_seq; 497 498 /* 499 * Messages queued for delivery. If delivery fails (out of memory 500 * for instance), They will stay in here to be processed later in a 501 * periodic timer interrupt. The tasklet is for handling received 502 * messages directly from the handler. 503 */ 504 spinlock_t waiting_rcv_msgs_lock; 505 struct list_head waiting_rcv_msgs; 506 atomic_t watchdog_pretimeouts_to_deliver; 507 struct tasklet_struct recv_tasklet; 508 509 spinlock_t xmit_msgs_lock; 510 struct list_head xmit_msgs; 511 struct ipmi_smi_msg *curr_msg; 512 struct list_head hp_xmit_msgs; 513 514 /* 515 * The list of command receivers that are registered for commands 516 * on this interface. 517 */ 518 struct mutex cmd_rcvrs_mutex; 519 struct list_head cmd_rcvrs; 520 521 /* 522 * Events that were queues because no one was there to receive 523 * them. 524 */ 525 spinlock_t events_lock; /* For dealing with event stuff. */ 526 struct list_head waiting_events; 527 unsigned int waiting_events_count; /* How many events in queue? */ 528 char delivering_events; 529 char event_msg_printed; 530 531 /* How many users are waiting for events? */ 532 atomic_t event_waiters; 533 unsigned int ticks_to_req_ev; 534 535 spinlock_t watch_lock; /* For dealing with watch stuff below. */ 536 537 /* How many users are waiting for commands? */ 538 unsigned int command_waiters; 539 540 /* How many users are waiting for watchdogs? */ 541 unsigned int watchdog_waiters; 542 543 /* How many users are waiting for message responses? */ 544 unsigned int response_waiters; 545 546 /* 547 * Tells what the lower layer has last been asked to watch for, 548 * messages and/or watchdogs. Protected by watch_lock. 549 */ 550 unsigned int last_watch_mask; 551 552 /* 553 * The event receiver for my BMC, only really used at panic 554 * shutdown as a place to store this. 555 */ 556 unsigned char event_receiver; 557 unsigned char event_receiver_lun; 558 unsigned char local_sel_device; 559 unsigned char local_event_generator; 560 561 /* For handling of maintenance mode. */ 562 int maintenance_mode; 563 bool maintenance_mode_enable; 564 int auto_maintenance_timeout; 565 spinlock_t maintenance_mode_lock; /* Used in a timer... */ 566 567 /* 568 * If we are doing maintenance on something on IPMB, extend 569 * the timeout time to avoid timeouts writing firmware and 570 * such. 571 */ 572 int ipmb_maintenance_mode_timeout; 573 574 /* 575 * A cheap hack, if this is non-null and a message to an 576 * interface comes in with a NULL user, call this routine with 577 * it. Note that the message will still be freed by the 578 * caller. This only works on the system interface. 579 * 580 * Protected by bmc_reg_mutex. 581 */ 582 void (*null_user_handler)(struct ipmi_smi *intf, 583 struct ipmi_recv_msg *msg); 584 585 /* 586 * When we are scanning the channels for an SMI, this will 587 * tell which channel we are scanning. 588 */ 589 int curr_channel; 590 591 /* Channel information */ 592 struct ipmi_channel_set *channel_list; 593 unsigned int curr_working_cset; /* First index into the following. */ 594 struct ipmi_channel_set wchannels[2]; 595 struct ipmi_my_addrinfo addrinfo[IPMI_MAX_CHANNELS]; 596 bool channels_ready; 597 598 atomic_t stats[IPMI_NUM_STATS]; 599 600 /* 601 * run_to_completion duplicate of smb_info, smi_info 602 * and ipmi_serial_info structures. Used to decrease numbers of 603 * parameters passed by "low" level IPMI code. 604 */ 605 int run_to_completion; 606 }; 607 #define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev) 608 609 static void __get_guid(struct ipmi_smi *intf); 610 static void __ipmi_bmc_unregister(struct ipmi_smi *intf); 611 static int __ipmi_bmc_register(struct ipmi_smi *intf, 612 struct ipmi_device_id *id, 613 bool guid_set, guid_t *guid, int intf_num); 614 static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id); 615 616 617 /** 618 * The driver model view of the IPMI messaging driver. 619 */ 620 static struct platform_driver ipmidriver = { 621 .driver = { 622 .name = "ipmi", 623 .bus = &platform_bus_type 624 } 625 }; 626 /* 627 * This mutex keeps us from adding the same BMC twice. 628 */ 629 static DEFINE_MUTEX(ipmidriver_mutex); 630 631 static LIST_HEAD(ipmi_interfaces); 632 static DEFINE_MUTEX(ipmi_interfaces_mutex); 633 #define ipmi_interfaces_mutex_held() \ 634 lockdep_is_held(&ipmi_interfaces_mutex) 635 static struct srcu_struct ipmi_interfaces_srcu; 636 637 /* 638 * List of watchers that want to know when smi's are added and deleted. 639 */ 640 static LIST_HEAD(smi_watchers); 641 static DEFINE_MUTEX(smi_watchers_mutex); 642 643 #define ipmi_inc_stat(intf, stat) \ 644 atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat]) 645 #define ipmi_get_stat(intf, stat) \ 646 ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat])) 647 648 static const char * const addr_src_to_str[] = { 649 "invalid", "hotmod", "hardcoded", "SPMI", "ACPI", "SMBIOS", "PCI", 650 "device-tree", "platform" 651 }; 652 653 const char *ipmi_addr_src_to_str(enum ipmi_addr_src src) 654 { 655 if (src >= SI_LAST) 656 src = 0; /* Invalid */ 657 return addr_src_to_str[src]; 658 } 659 EXPORT_SYMBOL(ipmi_addr_src_to_str); 660 661 static int is_lan_addr(struct ipmi_addr *addr) 662 { 663 return addr->addr_type == IPMI_LAN_ADDR_TYPE; 664 } 665 666 static int is_ipmb_addr(struct ipmi_addr *addr) 667 { 668 return addr->addr_type == IPMI_IPMB_ADDR_TYPE; 669 } 670 671 static int is_ipmb_bcast_addr(struct ipmi_addr *addr) 672 { 673 return addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE; 674 } 675 676 static int is_ipmb_direct_addr(struct ipmi_addr *addr) 677 { 678 return addr->addr_type == IPMI_IPMB_DIRECT_ADDR_TYPE; 679 } 680 681 static void free_recv_msg_list(struct list_head *q) 682 { 683 struct ipmi_recv_msg *msg, *msg2; 684 685 list_for_each_entry_safe(msg, msg2, q, link) { 686 list_del(&msg->link); 687 ipmi_free_recv_msg(msg); 688 } 689 } 690 691 static void free_smi_msg_list(struct list_head *q) 692 { 693 struct ipmi_smi_msg *msg, *msg2; 694 695 list_for_each_entry_safe(msg, msg2, q, link) { 696 list_del(&msg->link); 697 ipmi_free_smi_msg(msg); 698 } 699 } 700 701 static void clean_up_interface_data(struct ipmi_smi *intf) 702 { 703 int i; 704 struct cmd_rcvr *rcvr, *rcvr2; 705 struct list_head list; 706 707 tasklet_kill(&intf->recv_tasklet); 708 709 free_smi_msg_list(&intf->waiting_rcv_msgs); 710 free_recv_msg_list(&intf->waiting_events); 711 712 /* 713 * Wholesale remove all the entries from the list in the 714 * interface and wait for RCU to know that none are in use. 715 */ 716 mutex_lock(&intf->cmd_rcvrs_mutex); 717 INIT_LIST_HEAD(&list); 718 list_splice_init_rcu(&intf->cmd_rcvrs, &list, synchronize_rcu); 719 mutex_unlock(&intf->cmd_rcvrs_mutex); 720 721 list_for_each_entry_safe(rcvr, rcvr2, &list, link) 722 kfree(rcvr); 723 724 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) { 725 if ((intf->seq_table[i].inuse) 726 && (intf->seq_table[i].recv_msg)) 727 ipmi_free_recv_msg(intf->seq_table[i].recv_msg); 728 } 729 } 730 731 static void intf_free(struct kref *ref) 732 { 733 struct ipmi_smi *intf = container_of(ref, struct ipmi_smi, refcount); 734 735 clean_up_interface_data(intf); 736 kfree(intf); 737 } 738 739 struct watcher_entry { 740 int intf_num; 741 struct ipmi_smi *intf; 742 struct list_head link; 743 }; 744 745 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher) 746 { 747 struct ipmi_smi *intf; 748 int index, rv; 749 750 /* 751 * Make sure the driver is actually initialized, this handles 752 * problems with initialization order. 753 */ 754 rv = ipmi_init_msghandler(); 755 if (rv) 756 return rv; 757 758 mutex_lock(&smi_watchers_mutex); 759 760 list_add(&watcher->link, &smi_watchers); 761 762 index = srcu_read_lock(&ipmi_interfaces_srcu); 763 list_for_each_entry_rcu(intf, &ipmi_interfaces, link, 764 lockdep_is_held(&smi_watchers_mutex)) { 765 int intf_num = READ_ONCE(intf->intf_num); 766 767 if (intf_num == -1) 768 continue; 769 watcher->new_smi(intf_num, intf->si_dev); 770 } 771 srcu_read_unlock(&ipmi_interfaces_srcu, index); 772 773 mutex_unlock(&smi_watchers_mutex); 774 775 return 0; 776 } 777 EXPORT_SYMBOL(ipmi_smi_watcher_register); 778 779 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher) 780 { 781 mutex_lock(&smi_watchers_mutex); 782 list_del(&watcher->link); 783 mutex_unlock(&smi_watchers_mutex); 784 return 0; 785 } 786 EXPORT_SYMBOL(ipmi_smi_watcher_unregister); 787 788 /* 789 * Must be called with smi_watchers_mutex held. 790 */ 791 static void 792 call_smi_watchers(int i, struct device *dev) 793 { 794 struct ipmi_smi_watcher *w; 795 796 mutex_lock(&smi_watchers_mutex); 797 list_for_each_entry(w, &smi_watchers, link) { 798 if (try_module_get(w->owner)) { 799 w->new_smi(i, dev); 800 module_put(w->owner); 801 } 802 } 803 mutex_unlock(&smi_watchers_mutex); 804 } 805 806 static int 807 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2) 808 { 809 if (addr1->addr_type != addr2->addr_type) 810 return 0; 811 812 if (addr1->channel != addr2->channel) 813 return 0; 814 815 if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) { 816 struct ipmi_system_interface_addr *smi_addr1 817 = (struct ipmi_system_interface_addr *) addr1; 818 struct ipmi_system_interface_addr *smi_addr2 819 = (struct ipmi_system_interface_addr *) addr2; 820 return (smi_addr1->lun == smi_addr2->lun); 821 } 822 823 if (is_ipmb_addr(addr1) || is_ipmb_bcast_addr(addr1)) { 824 struct ipmi_ipmb_addr *ipmb_addr1 825 = (struct ipmi_ipmb_addr *) addr1; 826 struct ipmi_ipmb_addr *ipmb_addr2 827 = (struct ipmi_ipmb_addr *) addr2; 828 829 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr) 830 && (ipmb_addr1->lun == ipmb_addr2->lun)); 831 } 832 833 if (is_ipmb_direct_addr(addr1)) { 834 struct ipmi_ipmb_direct_addr *daddr1 835 = (struct ipmi_ipmb_direct_addr *) addr1; 836 struct ipmi_ipmb_direct_addr *daddr2 837 = (struct ipmi_ipmb_direct_addr *) addr2; 838 839 return daddr1->slave_addr == daddr2->slave_addr && 840 daddr1->rq_lun == daddr2->rq_lun && 841 daddr1->rs_lun == daddr2->rs_lun; 842 } 843 844 if (is_lan_addr(addr1)) { 845 struct ipmi_lan_addr *lan_addr1 846 = (struct ipmi_lan_addr *) addr1; 847 struct ipmi_lan_addr *lan_addr2 848 = (struct ipmi_lan_addr *) addr2; 849 850 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID) 851 && (lan_addr1->local_SWID == lan_addr2->local_SWID) 852 && (lan_addr1->session_handle 853 == lan_addr2->session_handle) 854 && (lan_addr1->lun == lan_addr2->lun)); 855 } 856 857 return 1; 858 } 859 860 int ipmi_validate_addr(struct ipmi_addr *addr, int len) 861 { 862 if (len < sizeof(struct ipmi_system_interface_addr)) 863 return -EINVAL; 864 865 if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) { 866 if (addr->channel != IPMI_BMC_CHANNEL) 867 return -EINVAL; 868 return 0; 869 } 870 871 if ((addr->channel == IPMI_BMC_CHANNEL) 872 || (addr->channel >= IPMI_MAX_CHANNELS) 873 || (addr->channel < 0)) 874 return -EINVAL; 875 876 if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) { 877 if (len < sizeof(struct ipmi_ipmb_addr)) 878 return -EINVAL; 879 return 0; 880 } 881 882 if (is_ipmb_direct_addr(addr)) { 883 struct ipmi_ipmb_direct_addr *daddr = (void *) addr; 884 885 if (addr->channel != 0) 886 return -EINVAL; 887 if (len < sizeof(struct ipmi_ipmb_direct_addr)) 888 return -EINVAL; 889 890 if (daddr->slave_addr & 0x01) 891 return -EINVAL; 892 if (daddr->rq_lun >= 4) 893 return -EINVAL; 894 if (daddr->rs_lun >= 4) 895 return -EINVAL; 896 return 0; 897 } 898 899 if (is_lan_addr(addr)) { 900 if (len < sizeof(struct ipmi_lan_addr)) 901 return -EINVAL; 902 return 0; 903 } 904 905 return -EINVAL; 906 } 907 EXPORT_SYMBOL(ipmi_validate_addr); 908 909 unsigned int ipmi_addr_length(int addr_type) 910 { 911 if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 912 return sizeof(struct ipmi_system_interface_addr); 913 914 if ((addr_type == IPMI_IPMB_ADDR_TYPE) 915 || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)) 916 return sizeof(struct ipmi_ipmb_addr); 917 918 if (addr_type == IPMI_IPMB_DIRECT_ADDR_TYPE) 919 return sizeof(struct ipmi_ipmb_direct_addr); 920 921 if (addr_type == IPMI_LAN_ADDR_TYPE) 922 return sizeof(struct ipmi_lan_addr); 923 924 return 0; 925 } 926 EXPORT_SYMBOL(ipmi_addr_length); 927 928 static int deliver_response(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) 929 { 930 int rv = 0; 931 932 if (!msg->user) { 933 /* Special handling for NULL users. */ 934 if (intf->null_user_handler) { 935 intf->null_user_handler(intf, msg); 936 } else { 937 /* No handler, so give up. */ 938 rv = -EINVAL; 939 } 940 ipmi_free_recv_msg(msg); 941 } else if (oops_in_progress) { 942 /* 943 * If we are running in the panic context, calling the 944 * receive handler doesn't much meaning and has a deadlock 945 * risk. At this moment, simply skip it in that case. 946 */ 947 ipmi_free_recv_msg(msg); 948 atomic_dec(&msg->user->nr_msgs); 949 } else { 950 int index; 951 struct ipmi_user *user = acquire_ipmi_user(msg->user, &index); 952 953 if (user) { 954 atomic_dec(&user->nr_msgs); 955 user->handler->ipmi_recv_hndl(msg, user->handler_data); 956 release_ipmi_user(user, index); 957 } else { 958 /* User went away, give up. */ 959 ipmi_free_recv_msg(msg); 960 rv = -EINVAL; 961 } 962 } 963 964 return rv; 965 } 966 967 static void deliver_local_response(struct ipmi_smi *intf, 968 struct ipmi_recv_msg *msg) 969 { 970 if (deliver_response(intf, msg)) 971 ipmi_inc_stat(intf, unhandled_local_responses); 972 else 973 ipmi_inc_stat(intf, handled_local_responses); 974 } 975 976 static void deliver_err_response(struct ipmi_smi *intf, 977 struct ipmi_recv_msg *msg, int err) 978 { 979 msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 980 msg->msg_data[0] = err; 981 msg->msg.netfn |= 1; /* Convert to a response. */ 982 msg->msg.data_len = 1; 983 msg->msg.data = msg->msg_data; 984 deliver_local_response(intf, msg); 985 } 986 987 static void smi_add_watch(struct ipmi_smi *intf, unsigned int flags) 988 { 989 unsigned long iflags; 990 991 if (!intf->handlers->set_need_watch) 992 return; 993 994 spin_lock_irqsave(&intf->watch_lock, iflags); 995 if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES) 996 intf->response_waiters++; 997 998 if (flags & IPMI_WATCH_MASK_CHECK_WATCHDOG) 999 intf->watchdog_waiters++; 1000 1001 if (flags & IPMI_WATCH_MASK_CHECK_COMMANDS) 1002 intf->command_waiters++; 1003 1004 if ((intf->last_watch_mask & flags) != flags) { 1005 intf->last_watch_mask |= flags; 1006 intf->handlers->set_need_watch(intf->send_info, 1007 intf->last_watch_mask); 1008 } 1009 spin_unlock_irqrestore(&intf->watch_lock, iflags); 1010 } 1011 1012 static void smi_remove_watch(struct ipmi_smi *intf, unsigned int flags) 1013 { 1014 unsigned long iflags; 1015 1016 if (!intf->handlers->set_need_watch) 1017 return; 1018 1019 spin_lock_irqsave(&intf->watch_lock, iflags); 1020 if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES) 1021 intf->response_waiters--; 1022 1023 if (flags & IPMI_WATCH_MASK_CHECK_WATCHDOG) 1024 intf->watchdog_waiters--; 1025 1026 if (flags & IPMI_WATCH_MASK_CHECK_COMMANDS) 1027 intf->command_waiters--; 1028 1029 flags = 0; 1030 if (intf->response_waiters) 1031 flags |= IPMI_WATCH_MASK_CHECK_MESSAGES; 1032 if (intf->watchdog_waiters) 1033 flags |= IPMI_WATCH_MASK_CHECK_WATCHDOG; 1034 if (intf->command_waiters) 1035 flags |= IPMI_WATCH_MASK_CHECK_COMMANDS; 1036 1037 if (intf->last_watch_mask != flags) { 1038 intf->last_watch_mask = flags; 1039 intf->handlers->set_need_watch(intf->send_info, 1040 intf->last_watch_mask); 1041 } 1042 spin_unlock_irqrestore(&intf->watch_lock, iflags); 1043 } 1044 1045 /* 1046 * Find the next sequence number not being used and add the given 1047 * message with the given timeout to the sequence table. This must be 1048 * called with the interface's seq_lock held. 1049 */ 1050 static int intf_next_seq(struct ipmi_smi *intf, 1051 struct ipmi_recv_msg *recv_msg, 1052 unsigned long timeout, 1053 int retries, 1054 int broadcast, 1055 unsigned char *seq, 1056 long *seqid) 1057 { 1058 int rv = 0; 1059 unsigned int i; 1060 1061 if (timeout == 0) 1062 timeout = default_retry_ms; 1063 if (retries < 0) 1064 retries = default_max_retries; 1065 1066 for (i = intf->curr_seq; (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq; 1067 i = (i+1)%IPMI_IPMB_NUM_SEQ) { 1068 if (!intf->seq_table[i].inuse) 1069 break; 1070 } 1071 1072 if (!intf->seq_table[i].inuse) { 1073 intf->seq_table[i].recv_msg = recv_msg; 1074 1075 /* 1076 * Start with the maximum timeout, when the send response 1077 * comes in we will start the real timer. 1078 */ 1079 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT; 1080 intf->seq_table[i].orig_timeout = timeout; 1081 intf->seq_table[i].retries_left = retries; 1082 intf->seq_table[i].broadcast = broadcast; 1083 intf->seq_table[i].inuse = 1; 1084 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid); 1085 *seq = i; 1086 *seqid = intf->seq_table[i].seqid; 1087 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ; 1088 smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 1089 need_waiter(intf); 1090 } else { 1091 rv = -EAGAIN; 1092 } 1093 1094 return rv; 1095 } 1096 1097 /* 1098 * Return the receive message for the given sequence number and 1099 * release the sequence number so it can be reused. Some other data 1100 * is passed in to be sure the message matches up correctly (to help 1101 * guard against message coming in after their timeout and the 1102 * sequence number being reused). 1103 */ 1104 static int intf_find_seq(struct ipmi_smi *intf, 1105 unsigned char seq, 1106 short channel, 1107 unsigned char cmd, 1108 unsigned char netfn, 1109 struct ipmi_addr *addr, 1110 struct ipmi_recv_msg **recv_msg) 1111 { 1112 int rv = -ENODEV; 1113 unsigned long flags; 1114 1115 if (seq >= IPMI_IPMB_NUM_SEQ) 1116 return -EINVAL; 1117 1118 spin_lock_irqsave(&intf->seq_lock, flags); 1119 if (intf->seq_table[seq].inuse) { 1120 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg; 1121 1122 if ((msg->addr.channel == channel) && (msg->msg.cmd == cmd) 1123 && (msg->msg.netfn == netfn) 1124 && (ipmi_addr_equal(addr, &msg->addr))) { 1125 *recv_msg = msg; 1126 intf->seq_table[seq].inuse = 0; 1127 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 1128 rv = 0; 1129 } 1130 } 1131 spin_unlock_irqrestore(&intf->seq_lock, flags); 1132 1133 return rv; 1134 } 1135 1136 1137 /* Start the timer for a specific sequence table entry. */ 1138 static int intf_start_seq_timer(struct ipmi_smi *intf, 1139 long msgid) 1140 { 1141 int rv = -ENODEV; 1142 unsigned long flags; 1143 unsigned char seq; 1144 unsigned long seqid; 1145 1146 1147 GET_SEQ_FROM_MSGID(msgid, seq, seqid); 1148 1149 spin_lock_irqsave(&intf->seq_lock, flags); 1150 /* 1151 * We do this verification because the user can be deleted 1152 * while a message is outstanding. 1153 */ 1154 if ((intf->seq_table[seq].inuse) 1155 && (intf->seq_table[seq].seqid == seqid)) { 1156 struct seq_table *ent = &intf->seq_table[seq]; 1157 ent->timeout = ent->orig_timeout; 1158 rv = 0; 1159 } 1160 spin_unlock_irqrestore(&intf->seq_lock, flags); 1161 1162 return rv; 1163 } 1164 1165 /* Got an error for the send message for a specific sequence number. */ 1166 static int intf_err_seq(struct ipmi_smi *intf, 1167 long msgid, 1168 unsigned int err) 1169 { 1170 int rv = -ENODEV; 1171 unsigned long flags; 1172 unsigned char seq; 1173 unsigned long seqid; 1174 struct ipmi_recv_msg *msg = NULL; 1175 1176 1177 GET_SEQ_FROM_MSGID(msgid, seq, seqid); 1178 1179 spin_lock_irqsave(&intf->seq_lock, flags); 1180 /* 1181 * We do this verification because the user can be deleted 1182 * while a message is outstanding. 1183 */ 1184 if ((intf->seq_table[seq].inuse) 1185 && (intf->seq_table[seq].seqid == seqid)) { 1186 struct seq_table *ent = &intf->seq_table[seq]; 1187 1188 ent->inuse = 0; 1189 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 1190 msg = ent->recv_msg; 1191 rv = 0; 1192 } 1193 spin_unlock_irqrestore(&intf->seq_lock, flags); 1194 1195 if (msg) 1196 deliver_err_response(intf, msg, err); 1197 1198 return rv; 1199 } 1200 1201 static void free_user_work(struct work_struct *work) 1202 { 1203 struct ipmi_user *user = container_of(work, struct ipmi_user, 1204 remove_work); 1205 1206 cleanup_srcu_struct(&user->release_barrier); 1207 vfree(user); 1208 } 1209 1210 int ipmi_create_user(unsigned int if_num, 1211 const struct ipmi_user_hndl *handler, 1212 void *handler_data, 1213 struct ipmi_user **user) 1214 { 1215 unsigned long flags; 1216 struct ipmi_user *new_user; 1217 int rv, index; 1218 struct ipmi_smi *intf; 1219 1220 /* 1221 * There is no module usecount here, because it's not 1222 * required. Since this can only be used by and called from 1223 * other modules, they will implicitly use this module, and 1224 * thus this can't be removed unless the other modules are 1225 * removed. 1226 */ 1227 1228 if (handler == NULL) 1229 return -EINVAL; 1230 1231 /* 1232 * Make sure the driver is actually initialized, this handles 1233 * problems with initialization order. 1234 */ 1235 rv = ipmi_init_msghandler(); 1236 if (rv) 1237 return rv; 1238 1239 new_user = vzalloc(sizeof(*new_user)); 1240 if (!new_user) 1241 return -ENOMEM; 1242 1243 index = srcu_read_lock(&ipmi_interfaces_srcu); 1244 list_for_each_entry_rcu(intf, &ipmi_interfaces, link) { 1245 if (intf->intf_num == if_num) 1246 goto found; 1247 } 1248 /* Not found, return an error */ 1249 rv = -EINVAL; 1250 goto out_kfree; 1251 1252 found: 1253 if (atomic_add_return(1, &intf->nr_users) > max_users) { 1254 rv = -EBUSY; 1255 goto out_kfree; 1256 } 1257 1258 INIT_WORK(&new_user->remove_work, free_user_work); 1259 1260 rv = init_srcu_struct(&new_user->release_barrier); 1261 if (rv) 1262 goto out_kfree; 1263 1264 if (!try_module_get(intf->owner)) { 1265 rv = -ENODEV; 1266 goto out_kfree; 1267 } 1268 1269 /* Note that each existing user holds a refcount to the interface. */ 1270 kref_get(&intf->refcount); 1271 1272 atomic_set(&new_user->nr_msgs, 0); 1273 kref_init(&new_user->refcount); 1274 new_user->handler = handler; 1275 new_user->handler_data = handler_data; 1276 new_user->intf = intf; 1277 new_user->gets_events = false; 1278 1279 rcu_assign_pointer(new_user->self, new_user); 1280 spin_lock_irqsave(&intf->seq_lock, flags); 1281 list_add_rcu(&new_user->link, &intf->users); 1282 spin_unlock_irqrestore(&intf->seq_lock, flags); 1283 if (handler->ipmi_watchdog_pretimeout) 1284 /* User wants pretimeouts, so make sure to watch for them. */ 1285 smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG); 1286 srcu_read_unlock(&ipmi_interfaces_srcu, index); 1287 *user = new_user; 1288 return 0; 1289 1290 out_kfree: 1291 atomic_dec(&intf->nr_users); 1292 srcu_read_unlock(&ipmi_interfaces_srcu, index); 1293 vfree(new_user); 1294 return rv; 1295 } 1296 EXPORT_SYMBOL(ipmi_create_user); 1297 1298 int ipmi_get_smi_info(int if_num, struct ipmi_smi_info *data) 1299 { 1300 int rv, index; 1301 struct ipmi_smi *intf; 1302 1303 index = srcu_read_lock(&ipmi_interfaces_srcu); 1304 list_for_each_entry_rcu(intf, &ipmi_interfaces, link) { 1305 if (intf->intf_num == if_num) 1306 goto found; 1307 } 1308 srcu_read_unlock(&ipmi_interfaces_srcu, index); 1309 1310 /* Not found, return an error */ 1311 return -EINVAL; 1312 1313 found: 1314 if (!intf->handlers->get_smi_info) 1315 rv = -ENOTTY; 1316 else 1317 rv = intf->handlers->get_smi_info(intf->send_info, data); 1318 srcu_read_unlock(&ipmi_interfaces_srcu, index); 1319 1320 return rv; 1321 } 1322 EXPORT_SYMBOL(ipmi_get_smi_info); 1323 1324 static void free_user(struct kref *ref) 1325 { 1326 struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount); 1327 1328 /* SRCU cleanup must happen in task context. */ 1329 queue_work(remove_work_wq, &user->remove_work); 1330 } 1331 1332 static void _ipmi_destroy_user(struct ipmi_user *user) 1333 { 1334 struct ipmi_smi *intf = user->intf; 1335 int i; 1336 unsigned long flags; 1337 struct cmd_rcvr *rcvr; 1338 struct cmd_rcvr *rcvrs = NULL; 1339 1340 if (!acquire_ipmi_user(user, &i)) { 1341 /* 1342 * The user has already been cleaned up, just make sure 1343 * nothing is using it and return. 1344 */ 1345 synchronize_srcu(&user->release_barrier); 1346 return; 1347 } 1348 1349 rcu_assign_pointer(user->self, NULL); 1350 release_ipmi_user(user, i); 1351 1352 synchronize_srcu(&user->release_barrier); 1353 1354 if (user->handler->shutdown) 1355 user->handler->shutdown(user->handler_data); 1356 1357 if (user->handler->ipmi_watchdog_pretimeout) 1358 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG); 1359 1360 if (user->gets_events) 1361 atomic_dec(&intf->event_waiters); 1362 1363 /* Remove the user from the interface's sequence table. */ 1364 spin_lock_irqsave(&intf->seq_lock, flags); 1365 list_del_rcu(&user->link); 1366 atomic_dec(&intf->nr_users); 1367 1368 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) { 1369 if (intf->seq_table[i].inuse 1370 && (intf->seq_table[i].recv_msg->user == user)) { 1371 intf->seq_table[i].inuse = 0; 1372 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 1373 ipmi_free_recv_msg(intf->seq_table[i].recv_msg); 1374 } 1375 } 1376 spin_unlock_irqrestore(&intf->seq_lock, flags); 1377 1378 /* 1379 * Remove the user from the command receiver's table. First 1380 * we build a list of everything (not using the standard link, 1381 * since other things may be using it till we do 1382 * synchronize_srcu()) then free everything in that list. 1383 */ 1384 mutex_lock(&intf->cmd_rcvrs_mutex); 1385 list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link, 1386 lockdep_is_held(&intf->cmd_rcvrs_mutex)) { 1387 if (rcvr->user == user) { 1388 list_del_rcu(&rcvr->link); 1389 rcvr->next = rcvrs; 1390 rcvrs = rcvr; 1391 } 1392 } 1393 mutex_unlock(&intf->cmd_rcvrs_mutex); 1394 synchronize_rcu(); 1395 while (rcvrs) { 1396 rcvr = rcvrs; 1397 rcvrs = rcvr->next; 1398 kfree(rcvr); 1399 } 1400 1401 kref_put(&intf->refcount, intf_free); 1402 module_put(intf->owner); 1403 } 1404 1405 int ipmi_destroy_user(struct ipmi_user *user) 1406 { 1407 _ipmi_destroy_user(user); 1408 1409 kref_put(&user->refcount, free_user); 1410 1411 return 0; 1412 } 1413 EXPORT_SYMBOL(ipmi_destroy_user); 1414 1415 int ipmi_get_version(struct ipmi_user *user, 1416 unsigned char *major, 1417 unsigned char *minor) 1418 { 1419 struct ipmi_device_id id; 1420 int rv, index; 1421 1422 user = acquire_ipmi_user(user, &index); 1423 if (!user) 1424 return -ENODEV; 1425 1426 rv = bmc_get_device_id(user->intf, NULL, &id, NULL, NULL); 1427 if (!rv) { 1428 *major = ipmi_version_major(&id); 1429 *minor = ipmi_version_minor(&id); 1430 } 1431 release_ipmi_user(user, index); 1432 1433 return rv; 1434 } 1435 EXPORT_SYMBOL(ipmi_get_version); 1436 1437 int ipmi_set_my_address(struct ipmi_user *user, 1438 unsigned int channel, 1439 unsigned char address) 1440 { 1441 int index, rv = 0; 1442 1443 user = acquire_ipmi_user(user, &index); 1444 if (!user) 1445 return -ENODEV; 1446 1447 if (channel >= IPMI_MAX_CHANNELS) { 1448 rv = -EINVAL; 1449 } else { 1450 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS); 1451 user->intf->addrinfo[channel].address = address; 1452 } 1453 release_ipmi_user(user, index); 1454 1455 return rv; 1456 } 1457 EXPORT_SYMBOL(ipmi_set_my_address); 1458 1459 int ipmi_get_my_address(struct ipmi_user *user, 1460 unsigned int channel, 1461 unsigned char *address) 1462 { 1463 int index, rv = 0; 1464 1465 user = acquire_ipmi_user(user, &index); 1466 if (!user) 1467 return -ENODEV; 1468 1469 if (channel >= IPMI_MAX_CHANNELS) { 1470 rv = -EINVAL; 1471 } else { 1472 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS); 1473 *address = user->intf->addrinfo[channel].address; 1474 } 1475 release_ipmi_user(user, index); 1476 1477 return rv; 1478 } 1479 EXPORT_SYMBOL(ipmi_get_my_address); 1480 1481 int ipmi_set_my_LUN(struct ipmi_user *user, 1482 unsigned int channel, 1483 unsigned char LUN) 1484 { 1485 int index, rv = 0; 1486 1487 user = acquire_ipmi_user(user, &index); 1488 if (!user) 1489 return -ENODEV; 1490 1491 if (channel >= IPMI_MAX_CHANNELS) { 1492 rv = -EINVAL; 1493 } else { 1494 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS); 1495 user->intf->addrinfo[channel].lun = LUN & 0x3; 1496 } 1497 release_ipmi_user(user, index); 1498 1499 return rv; 1500 } 1501 EXPORT_SYMBOL(ipmi_set_my_LUN); 1502 1503 int ipmi_get_my_LUN(struct ipmi_user *user, 1504 unsigned int channel, 1505 unsigned char *address) 1506 { 1507 int index, rv = 0; 1508 1509 user = acquire_ipmi_user(user, &index); 1510 if (!user) 1511 return -ENODEV; 1512 1513 if (channel >= IPMI_MAX_CHANNELS) { 1514 rv = -EINVAL; 1515 } else { 1516 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS); 1517 *address = user->intf->addrinfo[channel].lun; 1518 } 1519 release_ipmi_user(user, index); 1520 1521 return rv; 1522 } 1523 EXPORT_SYMBOL(ipmi_get_my_LUN); 1524 1525 int ipmi_get_maintenance_mode(struct ipmi_user *user) 1526 { 1527 int mode, index; 1528 unsigned long flags; 1529 1530 user = acquire_ipmi_user(user, &index); 1531 if (!user) 1532 return -ENODEV; 1533 1534 spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags); 1535 mode = user->intf->maintenance_mode; 1536 spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags); 1537 release_ipmi_user(user, index); 1538 1539 return mode; 1540 } 1541 EXPORT_SYMBOL(ipmi_get_maintenance_mode); 1542 1543 static void maintenance_mode_update(struct ipmi_smi *intf) 1544 { 1545 if (intf->handlers->set_maintenance_mode) 1546 intf->handlers->set_maintenance_mode( 1547 intf->send_info, intf->maintenance_mode_enable); 1548 } 1549 1550 int ipmi_set_maintenance_mode(struct ipmi_user *user, int mode) 1551 { 1552 int rv = 0, index; 1553 unsigned long flags; 1554 struct ipmi_smi *intf = user->intf; 1555 1556 user = acquire_ipmi_user(user, &index); 1557 if (!user) 1558 return -ENODEV; 1559 1560 spin_lock_irqsave(&intf->maintenance_mode_lock, flags); 1561 if (intf->maintenance_mode != mode) { 1562 switch (mode) { 1563 case IPMI_MAINTENANCE_MODE_AUTO: 1564 intf->maintenance_mode_enable 1565 = (intf->auto_maintenance_timeout > 0); 1566 break; 1567 1568 case IPMI_MAINTENANCE_MODE_OFF: 1569 intf->maintenance_mode_enable = false; 1570 break; 1571 1572 case IPMI_MAINTENANCE_MODE_ON: 1573 intf->maintenance_mode_enable = true; 1574 break; 1575 1576 default: 1577 rv = -EINVAL; 1578 goto out_unlock; 1579 } 1580 intf->maintenance_mode = mode; 1581 1582 maintenance_mode_update(intf); 1583 } 1584 out_unlock: 1585 spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags); 1586 release_ipmi_user(user, index); 1587 1588 return rv; 1589 } 1590 EXPORT_SYMBOL(ipmi_set_maintenance_mode); 1591 1592 int ipmi_set_gets_events(struct ipmi_user *user, bool val) 1593 { 1594 unsigned long flags; 1595 struct ipmi_smi *intf = user->intf; 1596 struct ipmi_recv_msg *msg, *msg2; 1597 struct list_head msgs; 1598 int index; 1599 1600 user = acquire_ipmi_user(user, &index); 1601 if (!user) 1602 return -ENODEV; 1603 1604 INIT_LIST_HEAD(&msgs); 1605 1606 spin_lock_irqsave(&intf->events_lock, flags); 1607 if (user->gets_events == val) 1608 goto out; 1609 1610 user->gets_events = val; 1611 1612 if (val) { 1613 if (atomic_inc_return(&intf->event_waiters) == 1) 1614 need_waiter(intf); 1615 } else { 1616 atomic_dec(&intf->event_waiters); 1617 } 1618 1619 if (intf->delivering_events) 1620 /* 1621 * Another thread is delivering events for this, so 1622 * let it handle any new events. 1623 */ 1624 goto out; 1625 1626 /* Deliver any queued events. */ 1627 while (user->gets_events && !list_empty(&intf->waiting_events)) { 1628 list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link) 1629 list_move_tail(&msg->link, &msgs); 1630 intf->waiting_events_count = 0; 1631 if (intf->event_msg_printed) { 1632 dev_warn(intf->si_dev, "Event queue no longer full\n"); 1633 intf->event_msg_printed = 0; 1634 } 1635 1636 intf->delivering_events = 1; 1637 spin_unlock_irqrestore(&intf->events_lock, flags); 1638 1639 list_for_each_entry_safe(msg, msg2, &msgs, link) { 1640 msg->user = user; 1641 kref_get(&user->refcount); 1642 deliver_local_response(intf, msg); 1643 } 1644 1645 spin_lock_irqsave(&intf->events_lock, flags); 1646 intf->delivering_events = 0; 1647 } 1648 1649 out: 1650 spin_unlock_irqrestore(&intf->events_lock, flags); 1651 release_ipmi_user(user, index); 1652 1653 return 0; 1654 } 1655 EXPORT_SYMBOL(ipmi_set_gets_events); 1656 1657 static struct cmd_rcvr *find_cmd_rcvr(struct ipmi_smi *intf, 1658 unsigned char netfn, 1659 unsigned char cmd, 1660 unsigned char chan) 1661 { 1662 struct cmd_rcvr *rcvr; 1663 1664 list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link, 1665 lockdep_is_held(&intf->cmd_rcvrs_mutex)) { 1666 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd) 1667 && (rcvr->chans & (1 << chan))) 1668 return rcvr; 1669 } 1670 return NULL; 1671 } 1672 1673 static int is_cmd_rcvr_exclusive(struct ipmi_smi *intf, 1674 unsigned char netfn, 1675 unsigned char cmd, 1676 unsigned int chans) 1677 { 1678 struct cmd_rcvr *rcvr; 1679 1680 list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link, 1681 lockdep_is_held(&intf->cmd_rcvrs_mutex)) { 1682 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd) 1683 && (rcvr->chans & chans)) 1684 return 0; 1685 } 1686 return 1; 1687 } 1688 1689 int ipmi_register_for_cmd(struct ipmi_user *user, 1690 unsigned char netfn, 1691 unsigned char cmd, 1692 unsigned int chans) 1693 { 1694 struct ipmi_smi *intf = user->intf; 1695 struct cmd_rcvr *rcvr; 1696 int rv = 0, index; 1697 1698 user = acquire_ipmi_user(user, &index); 1699 if (!user) 1700 return -ENODEV; 1701 1702 rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL); 1703 if (!rcvr) { 1704 rv = -ENOMEM; 1705 goto out_release; 1706 } 1707 rcvr->cmd = cmd; 1708 rcvr->netfn = netfn; 1709 rcvr->chans = chans; 1710 rcvr->user = user; 1711 1712 mutex_lock(&intf->cmd_rcvrs_mutex); 1713 /* Make sure the command/netfn is not already registered. */ 1714 if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) { 1715 rv = -EBUSY; 1716 goto out_unlock; 1717 } 1718 1719 smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS); 1720 1721 list_add_rcu(&rcvr->link, &intf->cmd_rcvrs); 1722 1723 out_unlock: 1724 mutex_unlock(&intf->cmd_rcvrs_mutex); 1725 if (rv) 1726 kfree(rcvr); 1727 out_release: 1728 release_ipmi_user(user, index); 1729 1730 return rv; 1731 } 1732 EXPORT_SYMBOL(ipmi_register_for_cmd); 1733 1734 int ipmi_unregister_for_cmd(struct ipmi_user *user, 1735 unsigned char netfn, 1736 unsigned char cmd, 1737 unsigned int chans) 1738 { 1739 struct ipmi_smi *intf = user->intf; 1740 struct cmd_rcvr *rcvr; 1741 struct cmd_rcvr *rcvrs = NULL; 1742 int i, rv = -ENOENT, index; 1743 1744 user = acquire_ipmi_user(user, &index); 1745 if (!user) 1746 return -ENODEV; 1747 1748 mutex_lock(&intf->cmd_rcvrs_mutex); 1749 for (i = 0; i < IPMI_NUM_CHANNELS; i++) { 1750 if (((1 << i) & chans) == 0) 1751 continue; 1752 rcvr = find_cmd_rcvr(intf, netfn, cmd, i); 1753 if (rcvr == NULL) 1754 continue; 1755 if (rcvr->user == user) { 1756 rv = 0; 1757 rcvr->chans &= ~chans; 1758 if (rcvr->chans == 0) { 1759 list_del_rcu(&rcvr->link); 1760 rcvr->next = rcvrs; 1761 rcvrs = rcvr; 1762 } 1763 } 1764 } 1765 mutex_unlock(&intf->cmd_rcvrs_mutex); 1766 synchronize_rcu(); 1767 release_ipmi_user(user, index); 1768 while (rcvrs) { 1769 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS); 1770 rcvr = rcvrs; 1771 rcvrs = rcvr->next; 1772 kfree(rcvr); 1773 } 1774 1775 return rv; 1776 } 1777 EXPORT_SYMBOL(ipmi_unregister_for_cmd); 1778 1779 unsigned char 1780 ipmb_checksum(unsigned char *data, int size) 1781 { 1782 unsigned char csum = 0; 1783 1784 for (; size > 0; size--, data++) 1785 csum += *data; 1786 1787 return -csum; 1788 } 1789 EXPORT_SYMBOL(ipmb_checksum); 1790 1791 static inline void format_ipmb_msg(struct ipmi_smi_msg *smi_msg, 1792 struct kernel_ipmi_msg *msg, 1793 struct ipmi_ipmb_addr *ipmb_addr, 1794 long msgid, 1795 unsigned char ipmb_seq, 1796 int broadcast, 1797 unsigned char source_address, 1798 unsigned char source_lun) 1799 { 1800 int i = broadcast; 1801 1802 /* Format the IPMB header data. */ 1803 smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); 1804 smi_msg->data[1] = IPMI_SEND_MSG_CMD; 1805 smi_msg->data[2] = ipmb_addr->channel; 1806 if (broadcast) 1807 smi_msg->data[3] = 0; 1808 smi_msg->data[i+3] = ipmb_addr->slave_addr; 1809 smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3); 1810 smi_msg->data[i+5] = ipmb_checksum(&smi_msg->data[i + 3], 2); 1811 smi_msg->data[i+6] = source_address; 1812 smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun; 1813 smi_msg->data[i+8] = msg->cmd; 1814 1815 /* Now tack on the data to the message. */ 1816 if (msg->data_len > 0) 1817 memcpy(&smi_msg->data[i + 9], msg->data, msg->data_len); 1818 smi_msg->data_size = msg->data_len + 9; 1819 1820 /* Now calculate the checksum and tack it on. */ 1821 smi_msg->data[i+smi_msg->data_size] 1822 = ipmb_checksum(&smi_msg->data[i + 6], smi_msg->data_size - 6); 1823 1824 /* 1825 * Add on the checksum size and the offset from the 1826 * broadcast. 1827 */ 1828 smi_msg->data_size += 1 + i; 1829 1830 smi_msg->msgid = msgid; 1831 } 1832 1833 static inline void format_lan_msg(struct ipmi_smi_msg *smi_msg, 1834 struct kernel_ipmi_msg *msg, 1835 struct ipmi_lan_addr *lan_addr, 1836 long msgid, 1837 unsigned char ipmb_seq, 1838 unsigned char source_lun) 1839 { 1840 /* Format the IPMB header data. */ 1841 smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); 1842 smi_msg->data[1] = IPMI_SEND_MSG_CMD; 1843 smi_msg->data[2] = lan_addr->channel; 1844 smi_msg->data[3] = lan_addr->session_handle; 1845 smi_msg->data[4] = lan_addr->remote_SWID; 1846 smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3); 1847 smi_msg->data[6] = ipmb_checksum(&smi_msg->data[4], 2); 1848 smi_msg->data[7] = lan_addr->local_SWID; 1849 smi_msg->data[8] = (ipmb_seq << 2) | source_lun; 1850 smi_msg->data[9] = msg->cmd; 1851 1852 /* Now tack on the data to the message. */ 1853 if (msg->data_len > 0) 1854 memcpy(&smi_msg->data[10], msg->data, msg->data_len); 1855 smi_msg->data_size = msg->data_len + 10; 1856 1857 /* Now calculate the checksum and tack it on. */ 1858 smi_msg->data[smi_msg->data_size] 1859 = ipmb_checksum(&smi_msg->data[7], smi_msg->data_size - 7); 1860 1861 /* 1862 * Add on the checksum size and the offset from the 1863 * broadcast. 1864 */ 1865 smi_msg->data_size += 1; 1866 1867 smi_msg->msgid = msgid; 1868 } 1869 1870 static struct ipmi_smi_msg *smi_add_send_msg(struct ipmi_smi *intf, 1871 struct ipmi_smi_msg *smi_msg, 1872 int priority) 1873 { 1874 if (intf->curr_msg) { 1875 if (priority > 0) 1876 list_add_tail(&smi_msg->link, &intf->hp_xmit_msgs); 1877 else 1878 list_add_tail(&smi_msg->link, &intf->xmit_msgs); 1879 smi_msg = NULL; 1880 } else { 1881 intf->curr_msg = smi_msg; 1882 } 1883 1884 return smi_msg; 1885 } 1886 1887 static void smi_send(struct ipmi_smi *intf, 1888 const struct ipmi_smi_handlers *handlers, 1889 struct ipmi_smi_msg *smi_msg, int priority) 1890 { 1891 int run_to_completion = intf->run_to_completion; 1892 unsigned long flags = 0; 1893 1894 if (!run_to_completion) 1895 spin_lock_irqsave(&intf->xmit_msgs_lock, flags); 1896 smi_msg = smi_add_send_msg(intf, smi_msg, priority); 1897 1898 if (!run_to_completion) 1899 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags); 1900 1901 if (smi_msg) 1902 handlers->sender(intf->send_info, smi_msg); 1903 } 1904 1905 static bool is_maintenance_mode_cmd(struct kernel_ipmi_msg *msg) 1906 { 1907 return (((msg->netfn == IPMI_NETFN_APP_REQUEST) 1908 && ((msg->cmd == IPMI_COLD_RESET_CMD) 1909 || (msg->cmd == IPMI_WARM_RESET_CMD))) 1910 || (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST)); 1911 } 1912 1913 static int i_ipmi_req_sysintf(struct ipmi_smi *intf, 1914 struct ipmi_addr *addr, 1915 long msgid, 1916 struct kernel_ipmi_msg *msg, 1917 struct ipmi_smi_msg *smi_msg, 1918 struct ipmi_recv_msg *recv_msg, 1919 int retries, 1920 unsigned int retry_time_ms) 1921 { 1922 struct ipmi_system_interface_addr *smi_addr; 1923 1924 if (msg->netfn & 1) 1925 /* Responses are not allowed to the SMI. */ 1926 return -EINVAL; 1927 1928 smi_addr = (struct ipmi_system_interface_addr *) addr; 1929 if (smi_addr->lun > 3) { 1930 ipmi_inc_stat(intf, sent_invalid_commands); 1931 return -EINVAL; 1932 } 1933 1934 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr)); 1935 1936 if ((msg->netfn == IPMI_NETFN_APP_REQUEST) 1937 && ((msg->cmd == IPMI_SEND_MSG_CMD) 1938 || (msg->cmd == IPMI_GET_MSG_CMD) 1939 || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD))) { 1940 /* 1941 * We don't let the user do these, since we manage 1942 * the sequence numbers. 1943 */ 1944 ipmi_inc_stat(intf, sent_invalid_commands); 1945 return -EINVAL; 1946 } 1947 1948 if (is_maintenance_mode_cmd(msg)) { 1949 unsigned long flags; 1950 1951 spin_lock_irqsave(&intf->maintenance_mode_lock, flags); 1952 intf->auto_maintenance_timeout 1953 = maintenance_mode_timeout_ms; 1954 if (!intf->maintenance_mode 1955 && !intf->maintenance_mode_enable) { 1956 intf->maintenance_mode_enable = true; 1957 maintenance_mode_update(intf); 1958 } 1959 spin_unlock_irqrestore(&intf->maintenance_mode_lock, 1960 flags); 1961 } 1962 1963 if (msg->data_len + 2 > IPMI_MAX_MSG_LENGTH) { 1964 ipmi_inc_stat(intf, sent_invalid_commands); 1965 return -EMSGSIZE; 1966 } 1967 1968 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3); 1969 smi_msg->data[1] = msg->cmd; 1970 smi_msg->msgid = msgid; 1971 smi_msg->user_data = recv_msg; 1972 if (msg->data_len > 0) 1973 memcpy(&smi_msg->data[2], msg->data, msg->data_len); 1974 smi_msg->data_size = msg->data_len + 2; 1975 ipmi_inc_stat(intf, sent_local_commands); 1976 1977 return 0; 1978 } 1979 1980 static int i_ipmi_req_ipmb(struct ipmi_smi *intf, 1981 struct ipmi_addr *addr, 1982 long msgid, 1983 struct kernel_ipmi_msg *msg, 1984 struct ipmi_smi_msg *smi_msg, 1985 struct ipmi_recv_msg *recv_msg, 1986 unsigned char source_address, 1987 unsigned char source_lun, 1988 int retries, 1989 unsigned int retry_time_ms) 1990 { 1991 struct ipmi_ipmb_addr *ipmb_addr; 1992 unsigned char ipmb_seq; 1993 long seqid; 1994 int broadcast = 0; 1995 struct ipmi_channel *chans; 1996 int rv = 0; 1997 1998 if (addr->channel >= IPMI_MAX_CHANNELS) { 1999 ipmi_inc_stat(intf, sent_invalid_commands); 2000 return -EINVAL; 2001 } 2002 2003 chans = READ_ONCE(intf->channel_list)->c; 2004 2005 if (chans[addr->channel].medium != IPMI_CHANNEL_MEDIUM_IPMB) { 2006 ipmi_inc_stat(intf, sent_invalid_commands); 2007 return -EINVAL; 2008 } 2009 2010 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) { 2011 /* 2012 * Broadcasts add a zero at the beginning of the 2013 * message, but otherwise is the same as an IPMB 2014 * address. 2015 */ 2016 addr->addr_type = IPMI_IPMB_ADDR_TYPE; 2017 broadcast = 1; 2018 retries = 0; /* Don't retry broadcasts. */ 2019 } 2020 2021 /* 2022 * 9 for the header and 1 for the checksum, plus 2023 * possibly one for the broadcast. 2024 */ 2025 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) { 2026 ipmi_inc_stat(intf, sent_invalid_commands); 2027 return -EMSGSIZE; 2028 } 2029 2030 ipmb_addr = (struct ipmi_ipmb_addr *) addr; 2031 if (ipmb_addr->lun > 3) { 2032 ipmi_inc_stat(intf, sent_invalid_commands); 2033 return -EINVAL; 2034 } 2035 2036 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr)); 2037 2038 if (recv_msg->msg.netfn & 0x1) { 2039 /* 2040 * It's a response, so use the user's sequence 2041 * from msgid. 2042 */ 2043 ipmi_inc_stat(intf, sent_ipmb_responses); 2044 format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid, 2045 msgid, broadcast, 2046 source_address, source_lun); 2047 2048 /* 2049 * Save the receive message so we can use it 2050 * to deliver the response. 2051 */ 2052 smi_msg->user_data = recv_msg; 2053 } else { 2054 /* It's a command, so get a sequence for it. */ 2055 unsigned long flags; 2056 2057 spin_lock_irqsave(&intf->seq_lock, flags); 2058 2059 if (is_maintenance_mode_cmd(msg)) 2060 intf->ipmb_maintenance_mode_timeout = 2061 maintenance_mode_timeout_ms; 2062 2063 if (intf->ipmb_maintenance_mode_timeout && retry_time_ms == 0) 2064 /* Different default in maintenance mode */ 2065 retry_time_ms = default_maintenance_retry_ms; 2066 2067 /* 2068 * Create a sequence number with a 1 second 2069 * timeout and 4 retries. 2070 */ 2071 rv = intf_next_seq(intf, 2072 recv_msg, 2073 retry_time_ms, 2074 retries, 2075 broadcast, 2076 &ipmb_seq, 2077 &seqid); 2078 if (rv) 2079 /* 2080 * We have used up all the sequence numbers, 2081 * probably, so abort. 2082 */ 2083 goto out_err; 2084 2085 ipmi_inc_stat(intf, sent_ipmb_commands); 2086 2087 /* 2088 * Store the sequence number in the message, 2089 * so that when the send message response 2090 * comes back we can start the timer. 2091 */ 2092 format_ipmb_msg(smi_msg, msg, ipmb_addr, 2093 STORE_SEQ_IN_MSGID(ipmb_seq, seqid), 2094 ipmb_seq, broadcast, 2095 source_address, source_lun); 2096 2097 /* 2098 * Copy the message into the recv message data, so we 2099 * can retransmit it later if necessary. 2100 */ 2101 memcpy(recv_msg->msg_data, smi_msg->data, 2102 smi_msg->data_size); 2103 recv_msg->msg.data = recv_msg->msg_data; 2104 recv_msg->msg.data_len = smi_msg->data_size; 2105 2106 /* 2107 * We don't unlock until here, because we need 2108 * to copy the completed message into the 2109 * recv_msg before we release the lock. 2110 * Otherwise, race conditions may bite us. I 2111 * know that's pretty paranoid, but I prefer 2112 * to be correct. 2113 */ 2114 out_err: 2115 spin_unlock_irqrestore(&intf->seq_lock, flags); 2116 } 2117 2118 return rv; 2119 } 2120 2121 static int i_ipmi_req_ipmb_direct(struct ipmi_smi *intf, 2122 struct ipmi_addr *addr, 2123 long msgid, 2124 struct kernel_ipmi_msg *msg, 2125 struct ipmi_smi_msg *smi_msg, 2126 struct ipmi_recv_msg *recv_msg, 2127 unsigned char source_lun) 2128 { 2129 struct ipmi_ipmb_direct_addr *daddr; 2130 bool is_cmd = !(recv_msg->msg.netfn & 0x1); 2131 2132 if (!(intf->handlers->flags & IPMI_SMI_CAN_HANDLE_IPMB_DIRECT)) 2133 return -EAFNOSUPPORT; 2134 2135 /* Responses must have a completion code. */ 2136 if (!is_cmd && msg->data_len < 1) { 2137 ipmi_inc_stat(intf, sent_invalid_commands); 2138 return -EINVAL; 2139 } 2140 2141 if ((msg->data_len + 4) > IPMI_MAX_MSG_LENGTH) { 2142 ipmi_inc_stat(intf, sent_invalid_commands); 2143 return -EMSGSIZE; 2144 } 2145 2146 daddr = (struct ipmi_ipmb_direct_addr *) addr; 2147 if (daddr->rq_lun > 3 || daddr->rs_lun > 3) { 2148 ipmi_inc_stat(intf, sent_invalid_commands); 2149 return -EINVAL; 2150 } 2151 2152 smi_msg->type = IPMI_SMI_MSG_TYPE_IPMB_DIRECT; 2153 smi_msg->msgid = msgid; 2154 2155 if (is_cmd) { 2156 smi_msg->data[0] = msg->netfn << 2 | daddr->rs_lun; 2157 smi_msg->data[2] = recv_msg->msgid << 2 | daddr->rq_lun; 2158 } else { 2159 smi_msg->data[0] = msg->netfn << 2 | daddr->rq_lun; 2160 smi_msg->data[2] = recv_msg->msgid << 2 | daddr->rs_lun; 2161 } 2162 smi_msg->data[1] = daddr->slave_addr; 2163 smi_msg->data[3] = msg->cmd; 2164 2165 memcpy(smi_msg->data + 4, msg->data, msg->data_len); 2166 smi_msg->data_size = msg->data_len + 4; 2167 2168 smi_msg->user_data = recv_msg; 2169 2170 return 0; 2171 } 2172 2173 static int i_ipmi_req_lan(struct ipmi_smi *intf, 2174 struct ipmi_addr *addr, 2175 long msgid, 2176 struct kernel_ipmi_msg *msg, 2177 struct ipmi_smi_msg *smi_msg, 2178 struct ipmi_recv_msg *recv_msg, 2179 unsigned char source_lun, 2180 int retries, 2181 unsigned int retry_time_ms) 2182 { 2183 struct ipmi_lan_addr *lan_addr; 2184 unsigned char ipmb_seq; 2185 long seqid; 2186 struct ipmi_channel *chans; 2187 int rv = 0; 2188 2189 if (addr->channel >= IPMI_MAX_CHANNELS) { 2190 ipmi_inc_stat(intf, sent_invalid_commands); 2191 return -EINVAL; 2192 } 2193 2194 chans = READ_ONCE(intf->channel_list)->c; 2195 2196 if ((chans[addr->channel].medium 2197 != IPMI_CHANNEL_MEDIUM_8023LAN) 2198 && (chans[addr->channel].medium 2199 != IPMI_CHANNEL_MEDIUM_ASYNC)) { 2200 ipmi_inc_stat(intf, sent_invalid_commands); 2201 return -EINVAL; 2202 } 2203 2204 /* 11 for the header and 1 for the checksum. */ 2205 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) { 2206 ipmi_inc_stat(intf, sent_invalid_commands); 2207 return -EMSGSIZE; 2208 } 2209 2210 lan_addr = (struct ipmi_lan_addr *) addr; 2211 if (lan_addr->lun > 3) { 2212 ipmi_inc_stat(intf, sent_invalid_commands); 2213 return -EINVAL; 2214 } 2215 2216 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr)); 2217 2218 if (recv_msg->msg.netfn & 0x1) { 2219 /* 2220 * It's a response, so use the user's sequence 2221 * from msgid. 2222 */ 2223 ipmi_inc_stat(intf, sent_lan_responses); 2224 format_lan_msg(smi_msg, msg, lan_addr, msgid, 2225 msgid, source_lun); 2226 2227 /* 2228 * Save the receive message so we can use it 2229 * to deliver the response. 2230 */ 2231 smi_msg->user_data = recv_msg; 2232 } else { 2233 /* It's a command, so get a sequence for it. */ 2234 unsigned long flags; 2235 2236 spin_lock_irqsave(&intf->seq_lock, flags); 2237 2238 /* 2239 * Create a sequence number with a 1 second 2240 * timeout and 4 retries. 2241 */ 2242 rv = intf_next_seq(intf, 2243 recv_msg, 2244 retry_time_ms, 2245 retries, 2246 0, 2247 &ipmb_seq, 2248 &seqid); 2249 if (rv) 2250 /* 2251 * We have used up all the sequence numbers, 2252 * probably, so abort. 2253 */ 2254 goto out_err; 2255 2256 ipmi_inc_stat(intf, sent_lan_commands); 2257 2258 /* 2259 * Store the sequence number in the message, 2260 * so that when the send message response 2261 * comes back we can start the timer. 2262 */ 2263 format_lan_msg(smi_msg, msg, lan_addr, 2264 STORE_SEQ_IN_MSGID(ipmb_seq, seqid), 2265 ipmb_seq, source_lun); 2266 2267 /* 2268 * Copy the message into the recv message data, so we 2269 * can retransmit it later if necessary. 2270 */ 2271 memcpy(recv_msg->msg_data, smi_msg->data, 2272 smi_msg->data_size); 2273 recv_msg->msg.data = recv_msg->msg_data; 2274 recv_msg->msg.data_len = smi_msg->data_size; 2275 2276 /* 2277 * We don't unlock until here, because we need 2278 * to copy the completed message into the 2279 * recv_msg before we release the lock. 2280 * Otherwise, race conditions may bite us. I 2281 * know that's pretty paranoid, but I prefer 2282 * to be correct. 2283 */ 2284 out_err: 2285 spin_unlock_irqrestore(&intf->seq_lock, flags); 2286 } 2287 2288 return rv; 2289 } 2290 2291 /* 2292 * Separate from ipmi_request so that the user does not have to be 2293 * supplied in certain circumstances (mainly at panic time). If 2294 * messages are supplied, they will be freed, even if an error 2295 * occurs. 2296 */ 2297 static int i_ipmi_request(struct ipmi_user *user, 2298 struct ipmi_smi *intf, 2299 struct ipmi_addr *addr, 2300 long msgid, 2301 struct kernel_ipmi_msg *msg, 2302 void *user_msg_data, 2303 void *supplied_smi, 2304 struct ipmi_recv_msg *supplied_recv, 2305 int priority, 2306 unsigned char source_address, 2307 unsigned char source_lun, 2308 int retries, 2309 unsigned int retry_time_ms) 2310 { 2311 struct ipmi_smi_msg *smi_msg; 2312 struct ipmi_recv_msg *recv_msg; 2313 int rv = 0; 2314 2315 if (user) { 2316 if (atomic_add_return(1, &user->nr_msgs) > max_msgs_per_user) { 2317 /* Decrement will happen at the end of the routine. */ 2318 rv = -EBUSY; 2319 goto out; 2320 } 2321 } 2322 2323 if (supplied_recv) 2324 recv_msg = supplied_recv; 2325 else { 2326 recv_msg = ipmi_alloc_recv_msg(); 2327 if (recv_msg == NULL) { 2328 rv = -ENOMEM; 2329 goto out; 2330 } 2331 } 2332 recv_msg->user_msg_data = user_msg_data; 2333 2334 if (supplied_smi) 2335 smi_msg = supplied_smi; 2336 else { 2337 smi_msg = ipmi_alloc_smi_msg(); 2338 if (smi_msg == NULL) { 2339 if (!supplied_recv) 2340 ipmi_free_recv_msg(recv_msg); 2341 rv = -ENOMEM; 2342 goto out; 2343 } 2344 } 2345 2346 rcu_read_lock(); 2347 if (intf->in_shutdown) { 2348 rv = -ENODEV; 2349 goto out_err; 2350 } 2351 2352 recv_msg->user = user; 2353 if (user) 2354 /* The put happens when the message is freed. */ 2355 kref_get(&user->refcount); 2356 recv_msg->msgid = msgid; 2357 /* 2358 * Store the message to send in the receive message so timeout 2359 * responses can get the proper response data. 2360 */ 2361 recv_msg->msg = *msg; 2362 2363 if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) { 2364 rv = i_ipmi_req_sysintf(intf, addr, msgid, msg, smi_msg, 2365 recv_msg, retries, retry_time_ms); 2366 } else if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) { 2367 rv = i_ipmi_req_ipmb(intf, addr, msgid, msg, smi_msg, recv_msg, 2368 source_address, source_lun, 2369 retries, retry_time_ms); 2370 } else if (is_ipmb_direct_addr(addr)) { 2371 rv = i_ipmi_req_ipmb_direct(intf, addr, msgid, msg, smi_msg, 2372 recv_msg, source_lun); 2373 } else if (is_lan_addr(addr)) { 2374 rv = i_ipmi_req_lan(intf, addr, msgid, msg, smi_msg, recv_msg, 2375 source_lun, retries, retry_time_ms); 2376 } else { 2377 /* Unknown address type. */ 2378 ipmi_inc_stat(intf, sent_invalid_commands); 2379 rv = -EINVAL; 2380 } 2381 2382 if (rv) { 2383 out_err: 2384 ipmi_free_smi_msg(smi_msg); 2385 ipmi_free_recv_msg(recv_msg); 2386 } else { 2387 dev_dbg(intf->si_dev, "Send: %*ph\n", 2388 smi_msg->data_size, smi_msg->data); 2389 2390 smi_send(intf, intf->handlers, smi_msg, priority); 2391 } 2392 rcu_read_unlock(); 2393 2394 out: 2395 if (rv && user) 2396 atomic_dec(&user->nr_msgs); 2397 return rv; 2398 } 2399 2400 static int check_addr(struct ipmi_smi *intf, 2401 struct ipmi_addr *addr, 2402 unsigned char *saddr, 2403 unsigned char *lun) 2404 { 2405 if (addr->channel >= IPMI_MAX_CHANNELS) 2406 return -EINVAL; 2407 addr->channel = array_index_nospec(addr->channel, IPMI_MAX_CHANNELS); 2408 *lun = intf->addrinfo[addr->channel].lun; 2409 *saddr = intf->addrinfo[addr->channel].address; 2410 return 0; 2411 } 2412 2413 int ipmi_request_settime(struct ipmi_user *user, 2414 struct ipmi_addr *addr, 2415 long msgid, 2416 struct kernel_ipmi_msg *msg, 2417 void *user_msg_data, 2418 int priority, 2419 int retries, 2420 unsigned int retry_time_ms) 2421 { 2422 unsigned char saddr = 0, lun = 0; 2423 int rv, index; 2424 2425 if (!user) 2426 return -EINVAL; 2427 2428 user = acquire_ipmi_user(user, &index); 2429 if (!user) 2430 return -ENODEV; 2431 2432 rv = check_addr(user->intf, addr, &saddr, &lun); 2433 if (!rv) 2434 rv = i_ipmi_request(user, 2435 user->intf, 2436 addr, 2437 msgid, 2438 msg, 2439 user_msg_data, 2440 NULL, NULL, 2441 priority, 2442 saddr, 2443 lun, 2444 retries, 2445 retry_time_ms); 2446 2447 release_ipmi_user(user, index); 2448 return rv; 2449 } 2450 EXPORT_SYMBOL(ipmi_request_settime); 2451 2452 int ipmi_request_supply_msgs(struct ipmi_user *user, 2453 struct ipmi_addr *addr, 2454 long msgid, 2455 struct kernel_ipmi_msg *msg, 2456 void *user_msg_data, 2457 void *supplied_smi, 2458 struct ipmi_recv_msg *supplied_recv, 2459 int priority) 2460 { 2461 unsigned char saddr = 0, lun = 0; 2462 int rv, index; 2463 2464 if (!user) 2465 return -EINVAL; 2466 2467 user = acquire_ipmi_user(user, &index); 2468 if (!user) 2469 return -ENODEV; 2470 2471 rv = check_addr(user->intf, addr, &saddr, &lun); 2472 if (!rv) 2473 rv = i_ipmi_request(user, 2474 user->intf, 2475 addr, 2476 msgid, 2477 msg, 2478 user_msg_data, 2479 supplied_smi, 2480 supplied_recv, 2481 priority, 2482 saddr, 2483 lun, 2484 -1, 0); 2485 2486 release_ipmi_user(user, index); 2487 return rv; 2488 } 2489 EXPORT_SYMBOL(ipmi_request_supply_msgs); 2490 2491 static void bmc_device_id_handler(struct ipmi_smi *intf, 2492 struct ipmi_recv_msg *msg) 2493 { 2494 int rv; 2495 2496 if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 2497 || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE) 2498 || (msg->msg.cmd != IPMI_GET_DEVICE_ID_CMD)) { 2499 dev_warn(intf->si_dev, 2500 "invalid device_id msg: addr_type=%d netfn=%x cmd=%x\n", 2501 msg->addr.addr_type, msg->msg.netfn, msg->msg.cmd); 2502 return; 2503 } 2504 2505 if (msg->msg.data[0]) { 2506 dev_warn(intf->si_dev, "device id fetch failed: 0x%2.2x\n", 2507 msg->msg.data[0]); 2508 intf->bmc->dyn_id_set = 0; 2509 goto out; 2510 } 2511 2512 rv = ipmi_demangle_device_id(msg->msg.netfn, msg->msg.cmd, 2513 msg->msg.data, msg->msg.data_len, &intf->bmc->fetch_id); 2514 if (rv) { 2515 dev_warn(intf->si_dev, "device id demangle failed: %d\n", rv); 2516 /* record completion code when error */ 2517 intf->bmc->cc = msg->msg.data[0]; 2518 intf->bmc->dyn_id_set = 0; 2519 } else { 2520 /* 2521 * Make sure the id data is available before setting 2522 * dyn_id_set. 2523 */ 2524 smp_wmb(); 2525 intf->bmc->dyn_id_set = 1; 2526 } 2527 out: 2528 wake_up(&intf->waitq); 2529 } 2530 2531 static int 2532 send_get_device_id_cmd(struct ipmi_smi *intf) 2533 { 2534 struct ipmi_system_interface_addr si; 2535 struct kernel_ipmi_msg msg; 2536 2537 si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 2538 si.channel = IPMI_BMC_CHANNEL; 2539 si.lun = 0; 2540 2541 msg.netfn = IPMI_NETFN_APP_REQUEST; 2542 msg.cmd = IPMI_GET_DEVICE_ID_CMD; 2543 msg.data = NULL; 2544 msg.data_len = 0; 2545 2546 return i_ipmi_request(NULL, 2547 intf, 2548 (struct ipmi_addr *) &si, 2549 0, 2550 &msg, 2551 intf, 2552 NULL, 2553 NULL, 2554 0, 2555 intf->addrinfo[0].address, 2556 intf->addrinfo[0].lun, 2557 -1, 0); 2558 } 2559 2560 static int __get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc) 2561 { 2562 int rv; 2563 unsigned int retry_count = 0; 2564 2565 intf->null_user_handler = bmc_device_id_handler; 2566 2567 retry: 2568 bmc->cc = 0; 2569 bmc->dyn_id_set = 2; 2570 2571 rv = send_get_device_id_cmd(intf); 2572 if (rv) 2573 goto out_reset_handler; 2574 2575 wait_event(intf->waitq, bmc->dyn_id_set != 2); 2576 2577 if (!bmc->dyn_id_set) { 2578 if (bmc->cc != IPMI_CC_NO_ERROR && 2579 ++retry_count <= GET_DEVICE_ID_MAX_RETRY) { 2580 msleep(500); 2581 dev_warn(intf->si_dev, 2582 "BMC returned 0x%2.2x, retry get bmc device id\n", 2583 bmc->cc); 2584 goto retry; 2585 } 2586 2587 rv = -EIO; /* Something went wrong in the fetch. */ 2588 } 2589 2590 /* dyn_id_set makes the id data available. */ 2591 smp_rmb(); 2592 2593 out_reset_handler: 2594 intf->null_user_handler = NULL; 2595 2596 return rv; 2597 } 2598 2599 /* 2600 * Fetch the device id for the bmc/interface. You must pass in either 2601 * bmc or intf, this code will get the other one. If the data has 2602 * been recently fetched, this will just use the cached data. Otherwise 2603 * it will run a new fetch. 2604 * 2605 * Except for the first time this is called (in ipmi_add_smi()), 2606 * this will always return good data; 2607 */ 2608 static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, 2609 struct ipmi_device_id *id, 2610 bool *guid_set, guid_t *guid, int intf_num) 2611 { 2612 int rv = 0; 2613 int prev_dyn_id_set, prev_guid_set; 2614 bool intf_set = intf != NULL; 2615 2616 if (!intf) { 2617 mutex_lock(&bmc->dyn_mutex); 2618 retry_bmc_lock: 2619 if (list_empty(&bmc->intfs)) { 2620 mutex_unlock(&bmc->dyn_mutex); 2621 return -ENOENT; 2622 } 2623 intf = list_first_entry(&bmc->intfs, struct ipmi_smi, 2624 bmc_link); 2625 kref_get(&intf->refcount); 2626 mutex_unlock(&bmc->dyn_mutex); 2627 mutex_lock(&intf->bmc_reg_mutex); 2628 mutex_lock(&bmc->dyn_mutex); 2629 if (intf != list_first_entry(&bmc->intfs, struct ipmi_smi, 2630 bmc_link)) { 2631 mutex_unlock(&intf->bmc_reg_mutex); 2632 kref_put(&intf->refcount, intf_free); 2633 goto retry_bmc_lock; 2634 } 2635 } else { 2636 mutex_lock(&intf->bmc_reg_mutex); 2637 bmc = intf->bmc; 2638 mutex_lock(&bmc->dyn_mutex); 2639 kref_get(&intf->refcount); 2640 } 2641 2642 /* If we have a valid and current ID, just return that. */ 2643 if (intf->in_bmc_register || 2644 (bmc->dyn_id_set && time_is_after_jiffies(bmc->dyn_id_expiry))) 2645 goto out_noprocessing; 2646 2647 prev_guid_set = bmc->dyn_guid_set; 2648 __get_guid(intf); 2649 2650 prev_dyn_id_set = bmc->dyn_id_set; 2651 rv = __get_device_id(intf, bmc); 2652 if (rv) 2653 goto out; 2654 2655 /* 2656 * The guid, device id, manufacturer id, and product id should 2657 * not change on a BMC. If it does we have to do some dancing. 2658 */ 2659 if (!intf->bmc_registered 2660 || (!prev_guid_set && bmc->dyn_guid_set) 2661 || (!prev_dyn_id_set && bmc->dyn_id_set) 2662 || (prev_guid_set && bmc->dyn_guid_set 2663 && !guid_equal(&bmc->guid, &bmc->fetch_guid)) 2664 || bmc->id.device_id != bmc->fetch_id.device_id 2665 || bmc->id.manufacturer_id != bmc->fetch_id.manufacturer_id 2666 || bmc->id.product_id != bmc->fetch_id.product_id) { 2667 struct ipmi_device_id id = bmc->fetch_id; 2668 int guid_set = bmc->dyn_guid_set; 2669 guid_t guid; 2670 2671 guid = bmc->fetch_guid; 2672 mutex_unlock(&bmc->dyn_mutex); 2673 2674 __ipmi_bmc_unregister(intf); 2675 /* Fill in the temporary BMC for good measure. */ 2676 intf->bmc->id = id; 2677 intf->bmc->dyn_guid_set = guid_set; 2678 intf->bmc->guid = guid; 2679 if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num)) 2680 need_waiter(intf); /* Retry later on an error. */ 2681 else 2682 __scan_channels(intf, &id); 2683 2684 2685 if (!intf_set) { 2686 /* 2687 * We weren't given the interface on the 2688 * command line, so restart the operation on 2689 * the next interface for the BMC. 2690 */ 2691 mutex_unlock(&intf->bmc_reg_mutex); 2692 mutex_lock(&bmc->dyn_mutex); 2693 goto retry_bmc_lock; 2694 } 2695 2696 /* We have a new BMC, set it up. */ 2697 bmc = intf->bmc; 2698 mutex_lock(&bmc->dyn_mutex); 2699 goto out_noprocessing; 2700 } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id))) 2701 /* Version info changes, scan the channels again. */ 2702 __scan_channels(intf, &bmc->fetch_id); 2703 2704 bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY; 2705 2706 out: 2707 if (rv && prev_dyn_id_set) { 2708 rv = 0; /* Ignore failures if we have previous data. */ 2709 bmc->dyn_id_set = prev_dyn_id_set; 2710 } 2711 if (!rv) { 2712 bmc->id = bmc->fetch_id; 2713 if (bmc->dyn_guid_set) 2714 bmc->guid = bmc->fetch_guid; 2715 else if (prev_guid_set) 2716 /* 2717 * The guid used to be valid and it failed to fetch, 2718 * just use the cached value. 2719 */ 2720 bmc->dyn_guid_set = prev_guid_set; 2721 } 2722 out_noprocessing: 2723 if (!rv) { 2724 if (id) 2725 *id = bmc->id; 2726 2727 if (guid_set) 2728 *guid_set = bmc->dyn_guid_set; 2729 2730 if (guid && bmc->dyn_guid_set) 2731 *guid = bmc->guid; 2732 } 2733 2734 mutex_unlock(&bmc->dyn_mutex); 2735 mutex_unlock(&intf->bmc_reg_mutex); 2736 2737 kref_put(&intf->refcount, intf_free); 2738 return rv; 2739 } 2740 2741 static int bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, 2742 struct ipmi_device_id *id, 2743 bool *guid_set, guid_t *guid) 2744 { 2745 return __bmc_get_device_id(intf, bmc, id, guid_set, guid, -1); 2746 } 2747 2748 static ssize_t device_id_show(struct device *dev, 2749 struct device_attribute *attr, 2750 char *buf) 2751 { 2752 struct bmc_device *bmc = to_bmc_device(dev); 2753 struct ipmi_device_id id; 2754 int rv; 2755 2756 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2757 if (rv) 2758 return rv; 2759 2760 return sysfs_emit(buf, "%u\n", id.device_id); 2761 } 2762 static DEVICE_ATTR_RO(device_id); 2763 2764 static ssize_t provides_device_sdrs_show(struct device *dev, 2765 struct device_attribute *attr, 2766 char *buf) 2767 { 2768 struct bmc_device *bmc = to_bmc_device(dev); 2769 struct ipmi_device_id id; 2770 int rv; 2771 2772 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2773 if (rv) 2774 return rv; 2775 2776 return sysfs_emit(buf, "%u\n", (id.device_revision & 0x80) >> 7); 2777 } 2778 static DEVICE_ATTR_RO(provides_device_sdrs); 2779 2780 static ssize_t revision_show(struct device *dev, struct device_attribute *attr, 2781 char *buf) 2782 { 2783 struct bmc_device *bmc = to_bmc_device(dev); 2784 struct ipmi_device_id id; 2785 int rv; 2786 2787 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2788 if (rv) 2789 return rv; 2790 2791 return sysfs_emit(buf, "%u\n", id.device_revision & 0x0F); 2792 } 2793 static DEVICE_ATTR_RO(revision); 2794 2795 static ssize_t firmware_revision_show(struct device *dev, 2796 struct device_attribute *attr, 2797 char *buf) 2798 { 2799 struct bmc_device *bmc = to_bmc_device(dev); 2800 struct ipmi_device_id id; 2801 int rv; 2802 2803 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2804 if (rv) 2805 return rv; 2806 2807 return sysfs_emit(buf, "%u.%x\n", id.firmware_revision_1, 2808 id.firmware_revision_2); 2809 } 2810 static DEVICE_ATTR_RO(firmware_revision); 2811 2812 static ssize_t ipmi_version_show(struct device *dev, 2813 struct device_attribute *attr, 2814 char *buf) 2815 { 2816 struct bmc_device *bmc = to_bmc_device(dev); 2817 struct ipmi_device_id id; 2818 int rv; 2819 2820 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2821 if (rv) 2822 return rv; 2823 2824 return sysfs_emit(buf, "%u.%u\n", 2825 ipmi_version_major(&id), 2826 ipmi_version_minor(&id)); 2827 } 2828 static DEVICE_ATTR_RO(ipmi_version); 2829 2830 static ssize_t add_dev_support_show(struct device *dev, 2831 struct device_attribute *attr, 2832 char *buf) 2833 { 2834 struct bmc_device *bmc = to_bmc_device(dev); 2835 struct ipmi_device_id id; 2836 int rv; 2837 2838 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2839 if (rv) 2840 return rv; 2841 2842 return sysfs_emit(buf, "0x%02x\n", id.additional_device_support); 2843 } 2844 static DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show, 2845 NULL); 2846 2847 static ssize_t manufacturer_id_show(struct device *dev, 2848 struct device_attribute *attr, 2849 char *buf) 2850 { 2851 struct bmc_device *bmc = to_bmc_device(dev); 2852 struct ipmi_device_id id; 2853 int rv; 2854 2855 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2856 if (rv) 2857 return rv; 2858 2859 return sysfs_emit(buf, "0x%6.6x\n", id.manufacturer_id); 2860 } 2861 static DEVICE_ATTR_RO(manufacturer_id); 2862 2863 static ssize_t product_id_show(struct device *dev, 2864 struct device_attribute *attr, 2865 char *buf) 2866 { 2867 struct bmc_device *bmc = to_bmc_device(dev); 2868 struct ipmi_device_id id; 2869 int rv; 2870 2871 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2872 if (rv) 2873 return rv; 2874 2875 return sysfs_emit(buf, "0x%4.4x\n", id.product_id); 2876 } 2877 static DEVICE_ATTR_RO(product_id); 2878 2879 static ssize_t aux_firmware_rev_show(struct device *dev, 2880 struct device_attribute *attr, 2881 char *buf) 2882 { 2883 struct bmc_device *bmc = to_bmc_device(dev); 2884 struct ipmi_device_id id; 2885 int rv; 2886 2887 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2888 if (rv) 2889 return rv; 2890 2891 return sysfs_emit(buf, "0x%02x 0x%02x 0x%02x 0x%02x\n", 2892 id.aux_firmware_revision[3], 2893 id.aux_firmware_revision[2], 2894 id.aux_firmware_revision[1], 2895 id.aux_firmware_revision[0]); 2896 } 2897 static DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL); 2898 2899 static ssize_t guid_show(struct device *dev, struct device_attribute *attr, 2900 char *buf) 2901 { 2902 struct bmc_device *bmc = to_bmc_device(dev); 2903 bool guid_set; 2904 guid_t guid; 2905 int rv; 2906 2907 rv = bmc_get_device_id(NULL, bmc, NULL, &guid_set, &guid); 2908 if (rv) 2909 return rv; 2910 if (!guid_set) 2911 return -ENOENT; 2912 2913 return sysfs_emit(buf, "%pUl\n", &guid); 2914 } 2915 static DEVICE_ATTR_RO(guid); 2916 2917 static struct attribute *bmc_dev_attrs[] = { 2918 &dev_attr_device_id.attr, 2919 &dev_attr_provides_device_sdrs.attr, 2920 &dev_attr_revision.attr, 2921 &dev_attr_firmware_revision.attr, 2922 &dev_attr_ipmi_version.attr, 2923 &dev_attr_additional_device_support.attr, 2924 &dev_attr_manufacturer_id.attr, 2925 &dev_attr_product_id.attr, 2926 &dev_attr_aux_firmware_revision.attr, 2927 &dev_attr_guid.attr, 2928 NULL 2929 }; 2930 2931 static umode_t bmc_dev_attr_is_visible(struct kobject *kobj, 2932 struct attribute *attr, int idx) 2933 { 2934 struct device *dev = kobj_to_dev(kobj); 2935 struct bmc_device *bmc = to_bmc_device(dev); 2936 umode_t mode = attr->mode; 2937 int rv; 2938 2939 if (attr == &dev_attr_aux_firmware_revision.attr) { 2940 struct ipmi_device_id id; 2941 2942 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2943 return (!rv && id.aux_firmware_revision_set) ? mode : 0; 2944 } 2945 if (attr == &dev_attr_guid.attr) { 2946 bool guid_set; 2947 2948 rv = bmc_get_device_id(NULL, bmc, NULL, &guid_set, NULL); 2949 return (!rv && guid_set) ? mode : 0; 2950 } 2951 return mode; 2952 } 2953 2954 static const struct attribute_group bmc_dev_attr_group = { 2955 .attrs = bmc_dev_attrs, 2956 .is_visible = bmc_dev_attr_is_visible, 2957 }; 2958 2959 static const struct attribute_group *bmc_dev_attr_groups[] = { 2960 &bmc_dev_attr_group, 2961 NULL 2962 }; 2963 2964 static const struct device_type bmc_device_type = { 2965 .groups = bmc_dev_attr_groups, 2966 }; 2967 2968 static int __find_bmc_guid(struct device *dev, const void *data) 2969 { 2970 const guid_t *guid = data; 2971 struct bmc_device *bmc; 2972 int rv; 2973 2974 if (dev->type != &bmc_device_type) 2975 return 0; 2976 2977 bmc = to_bmc_device(dev); 2978 rv = bmc->dyn_guid_set && guid_equal(&bmc->guid, guid); 2979 if (rv) 2980 rv = kref_get_unless_zero(&bmc->usecount); 2981 return rv; 2982 } 2983 2984 /* 2985 * Returns with the bmc's usecount incremented, if it is non-NULL. 2986 */ 2987 static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv, 2988 guid_t *guid) 2989 { 2990 struct device *dev; 2991 struct bmc_device *bmc = NULL; 2992 2993 dev = driver_find_device(drv, NULL, guid, __find_bmc_guid); 2994 if (dev) { 2995 bmc = to_bmc_device(dev); 2996 put_device(dev); 2997 } 2998 return bmc; 2999 } 3000 3001 struct prod_dev_id { 3002 unsigned int product_id; 3003 unsigned char device_id; 3004 }; 3005 3006 static int __find_bmc_prod_dev_id(struct device *dev, const void *data) 3007 { 3008 const struct prod_dev_id *cid = data; 3009 struct bmc_device *bmc; 3010 int rv; 3011 3012 if (dev->type != &bmc_device_type) 3013 return 0; 3014 3015 bmc = to_bmc_device(dev); 3016 rv = (bmc->id.product_id == cid->product_id 3017 && bmc->id.device_id == cid->device_id); 3018 if (rv) 3019 rv = kref_get_unless_zero(&bmc->usecount); 3020 return rv; 3021 } 3022 3023 /* 3024 * Returns with the bmc's usecount incremented, if it is non-NULL. 3025 */ 3026 static struct bmc_device *ipmi_find_bmc_prod_dev_id( 3027 struct device_driver *drv, 3028 unsigned int product_id, unsigned char device_id) 3029 { 3030 struct prod_dev_id id = { 3031 .product_id = product_id, 3032 .device_id = device_id, 3033 }; 3034 struct device *dev; 3035 struct bmc_device *bmc = NULL; 3036 3037 dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id); 3038 if (dev) { 3039 bmc = to_bmc_device(dev); 3040 put_device(dev); 3041 } 3042 return bmc; 3043 } 3044 3045 static DEFINE_IDA(ipmi_bmc_ida); 3046 3047 static void 3048 release_bmc_device(struct device *dev) 3049 { 3050 kfree(to_bmc_device(dev)); 3051 } 3052 3053 static void cleanup_bmc_work(struct work_struct *work) 3054 { 3055 struct bmc_device *bmc = container_of(work, struct bmc_device, 3056 remove_work); 3057 int id = bmc->pdev.id; /* Unregister overwrites id */ 3058 3059 platform_device_unregister(&bmc->pdev); 3060 ida_simple_remove(&ipmi_bmc_ida, id); 3061 } 3062 3063 static void 3064 cleanup_bmc_device(struct kref *ref) 3065 { 3066 struct bmc_device *bmc = container_of(ref, struct bmc_device, usecount); 3067 3068 /* 3069 * Remove the platform device in a work queue to avoid issues 3070 * with removing the device attributes while reading a device 3071 * attribute. 3072 */ 3073 queue_work(remove_work_wq, &bmc->remove_work); 3074 } 3075 3076 /* 3077 * Must be called with intf->bmc_reg_mutex held. 3078 */ 3079 static void __ipmi_bmc_unregister(struct ipmi_smi *intf) 3080 { 3081 struct bmc_device *bmc = intf->bmc; 3082 3083 if (!intf->bmc_registered) 3084 return; 3085 3086 sysfs_remove_link(&intf->si_dev->kobj, "bmc"); 3087 sysfs_remove_link(&bmc->pdev.dev.kobj, intf->my_dev_name); 3088 kfree(intf->my_dev_name); 3089 intf->my_dev_name = NULL; 3090 3091 mutex_lock(&bmc->dyn_mutex); 3092 list_del(&intf->bmc_link); 3093 mutex_unlock(&bmc->dyn_mutex); 3094 intf->bmc = &intf->tmp_bmc; 3095 kref_put(&bmc->usecount, cleanup_bmc_device); 3096 intf->bmc_registered = false; 3097 } 3098 3099 static void ipmi_bmc_unregister(struct ipmi_smi *intf) 3100 { 3101 mutex_lock(&intf->bmc_reg_mutex); 3102 __ipmi_bmc_unregister(intf); 3103 mutex_unlock(&intf->bmc_reg_mutex); 3104 } 3105 3106 /* 3107 * Must be called with intf->bmc_reg_mutex held. 3108 */ 3109 static int __ipmi_bmc_register(struct ipmi_smi *intf, 3110 struct ipmi_device_id *id, 3111 bool guid_set, guid_t *guid, int intf_num) 3112 { 3113 int rv; 3114 struct bmc_device *bmc; 3115 struct bmc_device *old_bmc; 3116 3117 /* 3118 * platform_device_register() can cause bmc_reg_mutex to 3119 * be claimed because of the is_visible functions of 3120 * the attributes. Eliminate possible recursion and 3121 * release the lock. 3122 */ 3123 intf->in_bmc_register = true; 3124 mutex_unlock(&intf->bmc_reg_mutex); 3125 3126 /* 3127 * Try to find if there is an bmc_device struct 3128 * representing the interfaced BMC already 3129 */ 3130 mutex_lock(&ipmidriver_mutex); 3131 if (guid_set) 3132 old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, guid); 3133 else 3134 old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver, 3135 id->product_id, 3136 id->device_id); 3137 3138 /* 3139 * If there is already an bmc_device, free the new one, 3140 * otherwise register the new BMC device 3141 */ 3142 if (old_bmc) { 3143 bmc = old_bmc; 3144 /* 3145 * Note: old_bmc already has usecount incremented by 3146 * the BMC find functions. 3147 */ 3148 intf->bmc = old_bmc; 3149 mutex_lock(&bmc->dyn_mutex); 3150 list_add_tail(&intf->bmc_link, &bmc->intfs); 3151 mutex_unlock(&bmc->dyn_mutex); 3152 3153 dev_info(intf->si_dev, 3154 "interfacing existing BMC (man_id: 0x%6.6x, prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n", 3155 bmc->id.manufacturer_id, 3156 bmc->id.product_id, 3157 bmc->id.device_id); 3158 } else { 3159 bmc = kzalloc(sizeof(*bmc), GFP_KERNEL); 3160 if (!bmc) { 3161 rv = -ENOMEM; 3162 goto out; 3163 } 3164 INIT_LIST_HEAD(&bmc->intfs); 3165 mutex_init(&bmc->dyn_mutex); 3166 INIT_WORK(&bmc->remove_work, cleanup_bmc_work); 3167 3168 bmc->id = *id; 3169 bmc->dyn_id_set = 1; 3170 bmc->dyn_guid_set = guid_set; 3171 bmc->guid = *guid; 3172 bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY; 3173 3174 bmc->pdev.name = "ipmi_bmc"; 3175 3176 rv = ida_simple_get(&ipmi_bmc_ida, 0, 0, GFP_KERNEL); 3177 if (rv < 0) { 3178 kfree(bmc); 3179 goto out; 3180 } 3181 3182 bmc->pdev.dev.driver = &ipmidriver.driver; 3183 bmc->pdev.id = rv; 3184 bmc->pdev.dev.release = release_bmc_device; 3185 bmc->pdev.dev.type = &bmc_device_type; 3186 kref_init(&bmc->usecount); 3187 3188 intf->bmc = bmc; 3189 mutex_lock(&bmc->dyn_mutex); 3190 list_add_tail(&intf->bmc_link, &bmc->intfs); 3191 mutex_unlock(&bmc->dyn_mutex); 3192 3193 rv = platform_device_register(&bmc->pdev); 3194 if (rv) { 3195 dev_err(intf->si_dev, 3196 "Unable to register bmc device: %d\n", 3197 rv); 3198 goto out_list_del; 3199 } 3200 3201 dev_info(intf->si_dev, 3202 "Found new BMC (man_id: 0x%6.6x, prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n", 3203 bmc->id.manufacturer_id, 3204 bmc->id.product_id, 3205 bmc->id.device_id); 3206 } 3207 3208 /* 3209 * create symlink from system interface device to bmc device 3210 * and back. 3211 */ 3212 rv = sysfs_create_link(&intf->si_dev->kobj, &bmc->pdev.dev.kobj, "bmc"); 3213 if (rv) { 3214 dev_err(intf->si_dev, "Unable to create bmc symlink: %d\n", rv); 3215 goto out_put_bmc; 3216 } 3217 3218 if (intf_num == -1) 3219 intf_num = intf->intf_num; 3220 intf->my_dev_name = kasprintf(GFP_KERNEL, "ipmi%d", intf_num); 3221 if (!intf->my_dev_name) { 3222 rv = -ENOMEM; 3223 dev_err(intf->si_dev, "Unable to allocate link from BMC: %d\n", 3224 rv); 3225 goto out_unlink1; 3226 } 3227 3228 rv = sysfs_create_link(&bmc->pdev.dev.kobj, &intf->si_dev->kobj, 3229 intf->my_dev_name); 3230 if (rv) { 3231 dev_err(intf->si_dev, "Unable to create symlink to bmc: %d\n", 3232 rv); 3233 goto out_free_my_dev_name; 3234 } 3235 3236 intf->bmc_registered = true; 3237 3238 out: 3239 mutex_unlock(&ipmidriver_mutex); 3240 mutex_lock(&intf->bmc_reg_mutex); 3241 intf->in_bmc_register = false; 3242 return rv; 3243 3244 3245 out_free_my_dev_name: 3246 kfree(intf->my_dev_name); 3247 intf->my_dev_name = NULL; 3248 3249 out_unlink1: 3250 sysfs_remove_link(&intf->si_dev->kobj, "bmc"); 3251 3252 out_put_bmc: 3253 mutex_lock(&bmc->dyn_mutex); 3254 list_del(&intf->bmc_link); 3255 mutex_unlock(&bmc->dyn_mutex); 3256 intf->bmc = &intf->tmp_bmc; 3257 kref_put(&bmc->usecount, cleanup_bmc_device); 3258 goto out; 3259 3260 out_list_del: 3261 mutex_lock(&bmc->dyn_mutex); 3262 list_del(&intf->bmc_link); 3263 mutex_unlock(&bmc->dyn_mutex); 3264 intf->bmc = &intf->tmp_bmc; 3265 put_device(&bmc->pdev.dev); 3266 goto out; 3267 } 3268 3269 static int 3270 send_guid_cmd(struct ipmi_smi *intf, int chan) 3271 { 3272 struct kernel_ipmi_msg msg; 3273 struct ipmi_system_interface_addr si; 3274 3275 si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 3276 si.channel = IPMI_BMC_CHANNEL; 3277 si.lun = 0; 3278 3279 msg.netfn = IPMI_NETFN_APP_REQUEST; 3280 msg.cmd = IPMI_GET_DEVICE_GUID_CMD; 3281 msg.data = NULL; 3282 msg.data_len = 0; 3283 return i_ipmi_request(NULL, 3284 intf, 3285 (struct ipmi_addr *) &si, 3286 0, 3287 &msg, 3288 intf, 3289 NULL, 3290 NULL, 3291 0, 3292 intf->addrinfo[0].address, 3293 intf->addrinfo[0].lun, 3294 -1, 0); 3295 } 3296 3297 static void guid_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) 3298 { 3299 struct bmc_device *bmc = intf->bmc; 3300 3301 if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 3302 || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE) 3303 || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD)) 3304 /* Not for me */ 3305 return; 3306 3307 if (msg->msg.data[0] != 0) { 3308 /* Error from getting the GUID, the BMC doesn't have one. */ 3309 bmc->dyn_guid_set = 0; 3310 goto out; 3311 } 3312 3313 if (msg->msg.data_len < UUID_SIZE + 1) { 3314 bmc->dyn_guid_set = 0; 3315 dev_warn(intf->si_dev, 3316 "The GUID response from the BMC was too short, it was %d but should have been %d. Assuming GUID is not available.\n", 3317 msg->msg.data_len, UUID_SIZE + 1); 3318 goto out; 3319 } 3320 3321 import_guid(&bmc->fetch_guid, msg->msg.data + 1); 3322 /* 3323 * Make sure the guid data is available before setting 3324 * dyn_guid_set. 3325 */ 3326 smp_wmb(); 3327 bmc->dyn_guid_set = 1; 3328 out: 3329 wake_up(&intf->waitq); 3330 } 3331 3332 static void __get_guid(struct ipmi_smi *intf) 3333 { 3334 int rv; 3335 struct bmc_device *bmc = intf->bmc; 3336 3337 bmc->dyn_guid_set = 2; 3338 intf->null_user_handler = guid_handler; 3339 rv = send_guid_cmd(intf, 0); 3340 if (rv) 3341 /* Send failed, no GUID available. */ 3342 bmc->dyn_guid_set = 0; 3343 else 3344 wait_event(intf->waitq, bmc->dyn_guid_set != 2); 3345 3346 /* dyn_guid_set makes the guid data available. */ 3347 smp_rmb(); 3348 3349 intf->null_user_handler = NULL; 3350 } 3351 3352 static int 3353 send_channel_info_cmd(struct ipmi_smi *intf, int chan) 3354 { 3355 struct kernel_ipmi_msg msg; 3356 unsigned char data[1]; 3357 struct ipmi_system_interface_addr si; 3358 3359 si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 3360 si.channel = IPMI_BMC_CHANNEL; 3361 si.lun = 0; 3362 3363 msg.netfn = IPMI_NETFN_APP_REQUEST; 3364 msg.cmd = IPMI_GET_CHANNEL_INFO_CMD; 3365 msg.data = data; 3366 msg.data_len = 1; 3367 data[0] = chan; 3368 return i_ipmi_request(NULL, 3369 intf, 3370 (struct ipmi_addr *) &si, 3371 0, 3372 &msg, 3373 intf, 3374 NULL, 3375 NULL, 3376 0, 3377 intf->addrinfo[0].address, 3378 intf->addrinfo[0].lun, 3379 -1, 0); 3380 } 3381 3382 static void 3383 channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) 3384 { 3385 int rv = 0; 3386 int ch; 3387 unsigned int set = intf->curr_working_cset; 3388 struct ipmi_channel *chans; 3389 3390 if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 3391 && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE) 3392 && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD)) { 3393 /* It's the one we want */ 3394 if (msg->msg.data[0] != 0) { 3395 /* Got an error from the channel, just go on. */ 3396 if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) { 3397 /* 3398 * If the MC does not support this 3399 * command, that is legal. We just 3400 * assume it has one IPMB at channel 3401 * zero. 3402 */ 3403 intf->wchannels[set].c[0].medium 3404 = IPMI_CHANNEL_MEDIUM_IPMB; 3405 intf->wchannels[set].c[0].protocol 3406 = IPMI_CHANNEL_PROTOCOL_IPMB; 3407 3408 intf->channel_list = intf->wchannels + set; 3409 intf->channels_ready = true; 3410 wake_up(&intf->waitq); 3411 goto out; 3412 } 3413 goto next_channel; 3414 } 3415 if (msg->msg.data_len < 4) { 3416 /* Message not big enough, just go on. */ 3417 goto next_channel; 3418 } 3419 ch = intf->curr_channel; 3420 chans = intf->wchannels[set].c; 3421 chans[ch].medium = msg->msg.data[2] & 0x7f; 3422 chans[ch].protocol = msg->msg.data[3] & 0x1f; 3423 3424 next_channel: 3425 intf->curr_channel++; 3426 if (intf->curr_channel >= IPMI_MAX_CHANNELS) { 3427 intf->channel_list = intf->wchannels + set; 3428 intf->channels_ready = true; 3429 wake_up(&intf->waitq); 3430 } else { 3431 intf->channel_list = intf->wchannels + set; 3432 intf->channels_ready = true; 3433 rv = send_channel_info_cmd(intf, intf->curr_channel); 3434 } 3435 3436 if (rv) { 3437 /* Got an error somehow, just give up. */ 3438 dev_warn(intf->si_dev, 3439 "Error sending channel information for channel %d: %d\n", 3440 intf->curr_channel, rv); 3441 3442 intf->channel_list = intf->wchannels + set; 3443 intf->channels_ready = true; 3444 wake_up(&intf->waitq); 3445 } 3446 } 3447 out: 3448 return; 3449 } 3450 3451 /* 3452 * Must be holding intf->bmc_reg_mutex to call this. 3453 */ 3454 static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id) 3455 { 3456 int rv; 3457 3458 if (ipmi_version_major(id) > 1 3459 || (ipmi_version_major(id) == 1 3460 && ipmi_version_minor(id) >= 5)) { 3461 unsigned int set; 3462 3463 /* 3464 * Start scanning the channels to see what is 3465 * available. 3466 */ 3467 set = !intf->curr_working_cset; 3468 intf->curr_working_cset = set; 3469 memset(&intf->wchannels[set], 0, 3470 sizeof(struct ipmi_channel_set)); 3471 3472 intf->null_user_handler = channel_handler; 3473 intf->curr_channel = 0; 3474 rv = send_channel_info_cmd(intf, 0); 3475 if (rv) { 3476 dev_warn(intf->si_dev, 3477 "Error sending channel information for channel 0, %d\n", 3478 rv); 3479 intf->null_user_handler = NULL; 3480 return -EIO; 3481 } 3482 3483 /* Wait for the channel info to be read. */ 3484 wait_event(intf->waitq, intf->channels_ready); 3485 intf->null_user_handler = NULL; 3486 } else { 3487 unsigned int set = intf->curr_working_cset; 3488 3489 /* Assume a single IPMB channel at zero. */ 3490 intf->wchannels[set].c[0].medium = IPMI_CHANNEL_MEDIUM_IPMB; 3491 intf->wchannels[set].c[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB; 3492 intf->channel_list = intf->wchannels + set; 3493 intf->channels_ready = true; 3494 } 3495 3496 return 0; 3497 } 3498 3499 static void ipmi_poll(struct ipmi_smi *intf) 3500 { 3501 if (intf->handlers->poll) 3502 intf->handlers->poll(intf->send_info); 3503 /* In case something came in */ 3504 handle_new_recv_msgs(intf); 3505 } 3506 3507 void ipmi_poll_interface(struct ipmi_user *user) 3508 { 3509 ipmi_poll(user->intf); 3510 } 3511 EXPORT_SYMBOL(ipmi_poll_interface); 3512 3513 static ssize_t nr_users_show(struct device *dev, 3514 struct device_attribute *attr, 3515 char *buf) 3516 { 3517 struct ipmi_smi *intf = container_of(attr, 3518 struct ipmi_smi, nr_users_devattr); 3519 3520 return sysfs_emit(buf, "%d\n", atomic_read(&intf->nr_users)); 3521 } 3522 static DEVICE_ATTR_RO(nr_users); 3523 3524 static ssize_t nr_msgs_show(struct device *dev, 3525 struct device_attribute *attr, 3526 char *buf) 3527 { 3528 struct ipmi_smi *intf = container_of(attr, 3529 struct ipmi_smi, nr_msgs_devattr); 3530 struct ipmi_user *user; 3531 int index; 3532 unsigned int count = 0; 3533 3534 index = srcu_read_lock(&intf->users_srcu); 3535 list_for_each_entry_rcu(user, &intf->users, link) 3536 count += atomic_read(&user->nr_msgs); 3537 srcu_read_unlock(&intf->users_srcu, index); 3538 3539 return sysfs_emit(buf, "%u\n", count); 3540 } 3541 static DEVICE_ATTR_RO(nr_msgs); 3542 3543 static void redo_bmc_reg(struct work_struct *work) 3544 { 3545 struct ipmi_smi *intf = container_of(work, struct ipmi_smi, 3546 bmc_reg_work); 3547 3548 if (!intf->in_shutdown) 3549 bmc_get_device_id(intf, NULL, NULL, NULL, NULL); 3550 3551 kref_put(&intf->refcount, intf_free); 3552 } 3553 3554 int ipmi_add_smi(struct module *owner, 3555 const struct ipmi_smi_handlers *handlers, 3556 void *send_info, 3557 struct device *si_dev, 3558 unsigned char slave_addr) 3559 { 3560 int i, j; 3561 int rv; 3562 struct ipmi_smi *intf, *tintf; 3563 struct list_head *link; 3564 struct ipmi_device_id id; 3565 3566 /* 3567 * Make sure the driver is actually initialized, this handles 3568 * problems with initialization order. 3569 */ 3570 rv = ipmi_init_msghandler(); 3571 if (rv) 3572 return rv; 3573 3574 intf = kzalloc(sizeof(*intf), GFP_KERNEL); 3575 if (!intf) 3576 return -ENOMEM; 3577 3578 rv = init_srcu_struct(&intf->users_srcu); 3579 if (rv) { 3580 kfree(intf); 3581 return rv; 3582 } 3583 3584 intf->owner = owner; 3585 intf->bmc = &intf->tmp_bmc; 3586 INIT_LIST_HEAD(&intf->bmc->intfs); 3587 mutex_init(&intf->bmc->dyn_mutex); 3588 INIT_LIST_HEAD(&intf->bmc_link); 3589 mutex_init(&intf->bmc_reg_mutex); 3590 intf->intf_num = -1; /* Mark it invalid for now. */ 3591 kref_init(&intf->refcount); 3592 INIT_WORK(&intf->bmc_reg_work, redo_bmc_reg); 3593 intf->si_dev = si_dev; 3594 for (j = 0; j < IPMI_MAX_CHANNELS; j++) { 3595 intf->addrinfo[j].address = IPMI_BMC_SLAVE_ADDR; 3596 intf->addrinfo[j].lun = 2; 3597 } 3598 if (slave_addr != 0) 3599 intf->addrinfo[0].address = slave_addr; 3600 INIT_LIST_HEAD(&intf->users); 3601 atomic_set(&intf->nr_users, 0); 3602 intf->handlers = handlers; 3603 intf->send_info = send_info; 3604 spin_lock_init(&intf->seq_lock); 3605 for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) { 3606 intf->seq_table[j].inuse = 0; 3607 intf->seq_table[j].seqid = 0; 3608 } 3609 intf->curr_seq = 0; 3610 spin_lock_init(&intf->waiting_rcv_msgs_lock); 3611 INIT_LIST_HEAD(&intf->waiting_rcv_msgs); 3612 tasklet_setup(&intf->recv_tasklet, 3613 smi_recv_tasklet); 3614 atomic_set(&intf->watchdog_pretimeouts_to_deliver, 0); 3615 spin_lock_init(&intf->xmit_msgs_lock); 3616 INIT_LIST_HEAD(&intf->xmit_msgs); 3617 INIT_LIST_HEAD(&intf->hp_xmit_msgs); 3618 spin_lock_init(&intf->events_lock); 3619 spin_lock_init(&intf->watch_lock); 3620 atomic_set(&intf->event_waiters, 0); 3621 intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME; 3622 INIT_LIST_HEAD(&intf->waiting_events); 3623 intf->waiting_events_count = 0; 3624 mutex_init(&intf->cmd_rcvrs_mutex); 3625 spin_lock_init(&intf->maintenance_mode_lock); 3626 INIT_LIST_HEAD(&intf->cmd_rcvrs); 3627 init_waitqueue_head(&intf->waitq); 3628 for (i = 0; i < IPMI_NUM_STATS; i++) 3629 atomic_set(&intf->stats[i], 0); 3630 3631 mutex_lock(&ipmi_interfaces_mutex); 3632 /* Look for a hole in the numbers. */ 3633 i = 0; 3634 link = &ipmi_interfaces; 3635 list_for_each_entry_rcu(tintf, &ipmi_interfaces, link, 3636 ipmi_interfaces_mutex_held()) { 3637 if (tintf->intf_num != i) { 3638 link = &tintf->link; 3639 break; 3640 } 3641 i++; 3642 } 3643 /* Add the new interface in numeric order. */ 3644 if (i == 0) 3645 list_add_rcu(&intf->link, &ipmi_interfaces); 3646 else 3647 list_add_tail_rcu(&intf->link, link); 3648 3649 rv = handlers->start_processing(send_info, intf); 3650 if (rv) 3651 goto out_err; 3652 3653 rv = __bmc_get_device_id(intf, NULL, &id, NULL, NULL, i); 3654 if (rv) { 3655 dev_err(si_dev, "Unable to get the device id: %d\n", rv); 3656 goto out_err_started; 3657 } 3658 3659 mutex_lock(&intf->bmc_reg_mutex); 3660 rv = __scan_channels(intf, &id); 3661 mutex_unlock(&intf->bmc_reg_mutex); 3662 if (rv) 3663 goto out_err_bmc_reg; 3664 3665 intf->nr_users_devattr = dev_attr_nr_users; 3666 sysfs_attr_init(&intf->nr_users_devattr.attr); 3667 rv = device_create_file(intf->si_dev, &intf->nr_users_devattr); 3668 if (rv) 3669 goto out_err_bmc_reg; 3670 3671 intf->nr_msgs_devattr = dev_attr_nr_msgs; 3672 sysfs_attr_init(&intf->nr_msgs_devattr.attr); 3673 rv = device_create_file(intf->si_dev, &intf->nr_msgs_devattr); 3674 if (rv) { 3675 device_remove_file(intf->si_dev, &intf->nr_users_devattr); 3676 goto out_err_bmc_reg; 3677 } 3678 3679 /* 3680 * Keep memory order straight for RCU readers. Make 3681 * sure everything else is committed to memory before 3682 * setting intf_num to mark the interface valid. 3683 */ 3684 smp_wmb(); 3685 intf->intf_num = i; 3686 mutex_unlock(&ipmi_interfaces_mutex); 3687 3688 /* After this point the interface is legal to use. */ 3689 call_smi_watchers(i, intf->si_dev); 3690 3691 return 0; 3692 3693 out_err_bmc_reg: 3694 ipmi_bmc_unregister(intf); 3695 out_err_started: 3696 if (intf->handlers->shutdown) 3697 intf->handlers->shutdown(intf->send_info); 3698 out_err: 3699 list_del_rcu(&intf->link); 3700 mutex_unlock(&ipmi_interfaces_mutex); 3701 synchronize_srcu(&ipmi_interfaces_srcu); 3702 cleanup_srcu_struct(&intf->users_srcu); 3703 kref_put(&intf->refcount, intf_free); 3704 3705 return rv; 3706 } 3707 EXPORT_SYMBOL(ipmi_add_smi); 3708 3709 static void deliver_smi_err_response(struct ipmi_smi *intf, 3710 struct ipmi_smi_msg *msg, 3711 unsigned char err) 3712 { 3713 msg->rsp[0] = msg->data[0] | 4; 3714 msg->rsp[1] = msg->data[1]; 3715 msg->rsp[2] = err; 3716 msg->rsp_size = 3; 3717 /* It's an error, so it will never requeue, no need to check return. */ 3718 handle_one_recv_msg(intf, msg); 3719 } 3720 3721 static void cleanup_smi_msgs(struct ipmi_smi *intf) 3722 { 3723 int i; 3724 struct seq_table *ent; 3725 struct ipmi_smi_msg *msg; 3726 struct list_head *entry; 3727 struct list_head tmplist; 3728 3729 /* Clear out our transmit queues and hold the messages. */ 3730 INIT_LIST_HEAD(&tmplist); 3731 list_splice_tail(&intf->hp_xmit_msgs, &tmplist); 3732 list_splice_tail(&intf->xmit_msgs, &tmplist); 3733 3734 /* Current message first, to preserve order */ 3735 while (intf->curr_msg && !list_empty(&intf->waiting_rcv_msgs)) { 3736 /* Wait for the message to clear out. */ 3737 schedule_timeout(1); 3738 } 3739 3740 /* No need for locks, the interface is down. */ 3741 3742 /* 3743 * Return errors for all pending messages in queue and in the 3744 * tables waiting for remote responses. 3745 */ 3746 while (!list_empty(&tmplist)) { 3747 entry = tmplist.next; 3748 list_del(entry); 3749 msg = list_entry(entry, struct ipmi_smi_msg, link); 3750 deliver_smi_err_response(intf, msg, IPMI_ERR_UNSPECIFIED); 3751 } 3752 3753 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) { 3754 ent = &intf->seq_table[i]; 3755 if (!ent->inuse) 3756 continue; 3757 deliver_err_response(intf, ent->recv_msg, IPMI_ERR_UNSPECIFIED); 3758 } 3759 } 3760 3761 void ipmi_unregister_smi(struct ipmi_smi *intf) 3762 { 3763 struct ipmi_smi_watcher *w; 3764 int intf_num, index; 3765 3766 if (!intf) 3767 return; 3768 intf_num = intf->intf_num; 3769 mutex_lock(&ipmi_interfaces_mutex); 3770 intf->intf_num = -1; 3771 intf->in_shutdown = true; 3772 list_del_rcu(&intf->link); 3773 mutex_unlock(&ipmi_interfaces_mutex); 3774 synchronize_srcu(&ipmi_interfaces_srcu); 3775 3776 /* At this point no users can be added to the interface. */ 3777 3778 device_remove_file(intf->si_dev, &intf->nr_msgs_devattr); 3779 device_remove_file(intf->si_dev, &intf->nr_users_devattr); 3780 3781 /* 3782 * Call all the watcher interfaces to tell them that 3783 * an interface is going away. 3784 */ 3785 mutex_lock(&smi_watchers_mutex); 3786 list_for_each_entry(w, &smi_watchers, link) 3787 w->smi_gone(intf_num); 3788 mutex_unlock(&smi_watchers_mutex); 3789 3790 index = srcu_read_lock(&intf->users_srcu); 3791 while (!list_empty(&intf->users)) { 3792 struct ipmi_user *user = 3793 container_of(list_next_rcu(&intf->users), 3794 struct ipmi_user, link); 3795 3796 _ipmi_destroy_user(user); 3797 } 3798 srcu_read_unlock(&intf->users_srcu, index); 3799 3800 if (intf->handlers->shutdown) 3801 intf->handlers->shutdown(intf->send_info); 3802 3803 cleanup_smi_msgs(intf); 3804 3805 ipmi_bmc_unregister(intf); 3806 3807 cleanup_srcu_struct(&intf->users_srcu); 3808 kref_put(&intf->refcount, intf_free); 3809 } 3810 EXPORT_SYMBOL(ipmi_unregister_smi); 3811 3812 static int handle_ipmb_get_msg_rsp(struct ipmi_smi *intf, 3813 struct ipmi_smi_msg *msg) 3814 { 3815 struct ipmi_ipmb_addr ipmb_addr; 3816 struct ipmi_recv_msg *recv_msg; 3817 3818 /* 3819 * This is 11, not 10, because the response must contain a 3820 * completion code. 3821 */ 3822 if (msg->rsp_size < 11) { 3823 /* Message not big enough, just ignore it. */ 3824 ipmi_inc_stat(intf, invalid_ipmb_responses); 3825 return 0; 3826 } 3827 3828 if (msg->rsp[2] != 0) { 3829 /* An error getting the response, just ignore it. */ 3830 return 0; 3831 } 3832 3833 ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE; 3834 ipmb_addr.slave_addr = msg->rsp[6]; 3835 ipmb_addr.channel = msg->rsp[3] & 0x0f; 3836 ipmb_addr.lun = msg->rsp[7] & 3; 3837 3838 /* 3839 * It's a response from a remote entity. Look up the sequence 3840 * number and handle the response. 3841 */ 3842 if (intf_find_seq(intf, 3843 msg->rsp[7] >> 2, 3844 msg->rsp[3] & 0x0f, 3845 msg->rsp[8], 3846 (msg->rsp[4] >> 2) & (~1), 3847 (struct ipmi_addr *) &ipmb_addr, 3848 &recv_msg)) { 3849 /* 3850 * We were unable to find the sequence number, 3851 * so just nuke the message. 3852 */ 3853 ipmi_inc_stat(intf, unhandled_ipmb_responses); 3854 return 0; 3855 } 3856 3857 memcpy(recv_msg->msg_data, &msg->rsp[9], msg->rsp_size - 9); 3858 /* 3859 * The other fields matched, so no need to set them, except 3860 * for netfn, which needs to be the response that was 3861 * returned, not the request value. 3862 */ 3863 recv_msg->msg.netfn = msg->rsp[4] >> 2; 3864 recv_msg->msg.data = recv_msg->msg_data; 3865 recv_msg->msg.data_len = msg->rsp_size - 10; 3866 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 3867 if (deliver_response(intf, recv_msg)) 3868 ipmi_inc_stat(intf, unhandled_ipmb_responses); 3869 else 3870 ipmi_inc_stat(intf, handled_ipmb_responses); 3871 3872 return 0; 3873 } 3874 3875 static int handle_ipmb_get_msg_cmd(struct ipmi_smi *intf, 3876 struct ipmi_smi_msg *msg) 3877 { 3878 struct cmd_rcvr *rcvr; 3879 int rv = 0; 3880 unsigned char netfn; 3881 unsigned char cmd; 3882 unsigned char chan; 3883 struct ipmi_user *user = NULL; 3884 struct ipmi_ipmb_addr *ipmb_addr; 3885 struct ipmi_recv_msg *recv_msg; 3886 3887 if (msg->rsp_size < 10) { 3888 /* Message not big enough, just ignore it. */ 3889 ipmi_inc_stat(intf, invalid_commands); 3890 return 0; 3891 } 3892 3893 if (msg->rsp[2] != 0) { 3894 /* An error getting the response, just ignore it. */ 3895 return 0; 3896 } 3897 3898 netfn = msg->rsp[4] >> 2; 3899 cmd = msg->rsp[8]; 3900 chan = msg->rsp[3] & 0xf; 3901 3902 rcu_read_lock(); 3903 rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); 3904 if (rcvr) { 3905 user = rcvr->user; 3906 kref_get(&user->refcount); 3907 } else 3908 user = NULL; 3909 rcu_read_unlock(); 3910 3911 if (user == NULL) { 3912 /* We didn't find a user, deliver an error response. */ 3913 ipmi_inc_stat(intf, unhandled_commands); 3914 3915 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); 3916 msg->data[1] = IPMI_SEND_MSG_CMD; 3917 msg->data[2] = msg->rsp[3]; 3918 msg->data[3] = msg->rsp[6]; 3919 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3); 3920 msg->data[5] = ipmb_checksum(&msg->data[3], 2); 3921 msg->data[6] = intf->addrinfo[msg->rsp[3] & 0xf].address; 3922 /* rqseq/lun */ 3923 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3); 3924 msg->data[8] = msg->rsp[8]; /* cmd */ 3925 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE; 3926 msg->data[10] = ipmb_checksum(&msg->data[6], 4); 3927 msg->data_size = 11; 3928 3929 dev_dbg(intf->si_dev, "Invalid command: %*ph\n", 3930 msg->data_size, msg->data); 3931 3932 rcu_read_lock(); 3933 if (!intf->in_shutdown) { 3934 smi_send(intf, intf->handlers, msg, 0); 3935 /* 3936 * We used the message, so return the value 3937 * that causes it to not be freed or 3938 * queued. 3939 */ 3940 rv = -1; 3941 } 3942 rcu_read_unlock(); 3943 } else { 3944 recv_msg = ipmi_alloc_recv_msg(); 3945 if (!recv_msg) { 3946 /* 3947 * We couldn't allocate memory for the 3948 * message, so requeue it for handling 3949 * later. 3950 */ 3951 rv = 1; 3952 kref_put(&user->refcount, free_user); 3953 } else { 3954 /* Extract the source address from the data. */ 3955 ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr; 3956 ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE; 3957 ipmb_addr->slave_addr = msg->rsp[6]; 3958 ipmb_addr->lun = msg->rsp[7] & 3; 3959 ipmb_addr->channel = msg->rsp[3] & 0xf; 3960 3961 /* 3962 * Extract the rest of the message information 3963 * from the IPMB header. 3964 */ 3965 recv_msg->user = user; 3966 recv_msg->recv_type = IPMI_CMD_RECV_TYPE; 3967 recv_msg->msgid = msg->rsp[7] >> 2; 3968 recv_msg->msg.netfn = msg->rsp[4] >> 2; 3969 recv_msg->msg.cmd = msg->rsp[8]; 3970 recv_msg->msg.data = recv_msg->msg_data; 3971 3972 /* 3973 * We chop off 10, not 9 bytes because the checksum 3974 * at the end also needs to be removed. 3975 */ 3976 recv_msg->msg.data_len = msg->rsp_size - 10; 3977 memcpy(recv_msg->msg_data, &msg->rsp[9], 3978 msg->rsp_size - 10); 3979 if (deliver_response(intf, recv_msg)) 3980 ipmi_inc_stat(intf, unhandled_commands); 3981 else 3982 ipmi_inc_stat(intf, handled_commands); 3983 } 3984 } 3985 3986 return rv; 3987 } 3988 3989 static int handle_ipmb_direct_rcv_cmd(struct ipmi_smi *intf, 3990 struct ipmi_smi_msg *msg) 3991 { 3992 struct cmd_rcvr *rcvr; 3993 int rv = 0; 3994 struct ipmi_user *user = NULL; 3995 struct ipmi_ipmb_direct_addr *daddr; 3996 struct ipmi_recv_msg *recv_msg; 3997 unsigned char netfn = msg->rsp[0] >> 2; 3998 unsigned char cmd = msg->rsp[3]; 3999 4000 rcu_read_lock(); 4001 /* We always use channel 0 for direct messages. */ 4002 rcvr = find_cmd_rcvr(intf, netfn, cmd, 0); 4003 if (rcvr) { 4004 user = rcvr->user; 4005 kref_get(&user->refcount); 4006 } else 4007 user = NULL; 4008 rcu_read_unlock(); 4009 4010 if (user == NULL) { 4011 /* We didn't find a user, deliver an error response. */ 4012 ipmi_inc_stat(intf, unhandled_commands); 4013 4014 msg->data[0] = (netfn + 1) << 2; 4015 msg->data[0] |= msg->rsp[2] & 0x3; /* rqLUN */ 4016 msg->data[1] = msg->rsp[1]; /* Addr */ 4017 msg->data[2] = msg->rsp[2] & ~0x3; /* rqSeq */ 4018 msg->data[2] |= msg->rsp[0] & 0x3; /* rsLUN */ 4019 msg->data[3] = cmd; 4020 msg->data[4] = IPMI_INVALID_CMD_COMPLETION_CODE; 4021 msg->data_size = 5; 4022 4023 rcu_read_lock(); 4024 if (!intf->in_shutdown) { 4025 smi_send(intf, intf->handlers, msg, 0); 4026 /* 4027 * We used the message, so return the value 4028 * that causes it to not be freed or 4029 * queued. 4030 */ 4031 rv = -1; 4032 } 4033 rcu_read_unlock(); 4034 } else { 4035 recv_msg = ipmi_alloc_recv_msg(); 4036 if (!recv_msg) { 4037 /* 4038 * We couldn't allocate memory for the 4039 * message, so requeue it for handling 4040 * later. 4041 */ 4042 rv = 1; 4043 kref_put(&user->refcount, free_user); 4044 } else { 4045 /* Extract the source address from the data. */ 4046 daddr = (struct ipmi_ipmb_direct_addr *)&recv_msg->addr; 4047 daddr->addr_type = IPMI_IPMB_DIRECT_ADDR_TYPE; 4048 daddr->channel = 0; 4049 daddr->slave_addr = msg->rsp[1]; 4050 daddr->rs_lun = msg->rsp[0] & 3; 4051 daddr->rq_lun = msg->rsp[2] & 3; 4052 4053 /* 4054 * Extract the rest of the message information 4055 * from the IPMB header. 4056 */ 4057 recv_msg->user = user; 4058 recv_msg->recv_type = IPMI_CMD_RECV_TYPE; 4059 recv_msg->msgid = (msg->rsp[2] >> 2); 4060 recv_msg->msg.netfn = msg->rsp[0] >> 2; 4061 recv_msg->msg.cmd = msg->rsp[3]; 4062 recv_msg->msg.data = recv_msg->msg_data; 4063 4064 recv_msg->msg.data_len = msg->rsp_size - 4; 4065 memcpy(recv_msg->msg_data, msg->rsp + 4, 4066 msg->rsp_size - 4); 4067 if (deliver_response(intf, recv_msg)) 4068 ipmi_inc_stat(intf, unhandled_commands); 4069 else 4070 ipmi_inc_stat(intf, handled_commands); 4071 } 4072 } 4073 4074 return rv; 4075 } 4076 4077 static int handle_ipmb_direct_rcv_rsp(struct ipmi_smi *intf, 4078 struct ipmi_smi_msg *msg) 4079 { 4080 struct ipmi_recv_msg *recv_msg; 4081 struct ipmi_ipmb_direct_addr *daddr; 4082 4083 recv_msg = msg->user_data; 4084 if (recv_msg == NULL) { 4085 dev_warn(intf->si_dev, 4086 "IPMI direct message received with no owner. This could be because of a malformed message, or because of a hardware error. Contact your hardware vendor for assistance.\n"); 4087 return 0; 4088 } 4089 4090 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 4091 recv_msg->msgid = msg->msgid; 4092 daddr = (struct ipmi_ipmb_direct_addr *) &recv_msg->addr; 4093 daddr->addr_type = IPMI_IPMB_DIRECT_ADDR_TYPE; 4094 daddr->channel = 0; 4095 daddr->slave_addr = msg->rsp[1]; 4096 daddr->rq_lun = msg->rsp[0] & 3; 4097 daddr->rs_lun = msg->rsp[2] & 3; 4098 recv_msg->msg.netfn = msg->rsp[0] >> 2; 4099 recv_msg->msg.cmd = msg->rsp[3]; 4100 memcpy(recv_msg->msg_data, &msg->rsp[4], msg->rsp_size - 4); 4101 recv_msg->msg.data = recv_msg->msg_data; 4102 recv_msg->msg.data_len = msg->rsp_size - 4; 4103 deliver_local_response(intf, recv_msg); 4104 4105 return 0; 4106 } 4107 4108 static int handle_lan_get_msg_rsp(struct ipmi_smi *intf, 4109 struct ipmi_smi_msg *msg) 4110 { 4111 struct ipmi_lan_addr lan_addr; 4112 struct ipmi_recv_msg *recv_msg; 4113 4114 4115 /* 4116 * This is 13, not 12, because the response must contain a 4117 * completion code. 4118 */ 4119 if (msg->rsp_size < 13) { 4120 /* Message not big enough, just ignore it. */ 4121 ipmi_inc_stat(intf, invalid_lan_responses); 4122 return 0; 4123 } 4124 4125 if (msg->rsp[2] != 0) { 4126 /* An error getting the response, just ignore it. */ 4127 return 0; 4128 } 4129 4130 lan_addr.addr_type = IPMI_LAN_ADDR_TYPE; 4131 lan_addr.session_handle = msg->rsp[4]; 4132 lan_addr.remote_SWID = msg->rsp[8]; 4133 lan_addr.local_SWID = msg->rsp[5]; 4134 lan_addr.channel = msg->rsp[3] & 0x0f; 4135 lan_addr.privilege = msg->rsp[3] >> 4; 4136 lan_addr.lun = msg->rsp[9] & 3; 4137 4138 /* 4139 * It's a response from a remote entity. Look up the sequence 4140 * number and handle the response. 4141 */ 4142 if (intf_find_seq(intf, 4143 msg->rsp[9] >> 2, 4144 msg->rsp[3] & 0x0f, 4145 msg->rsp[10], 4146 (msg->rsp[6] >> 2) & (~1), 4147 (struct ipmi_addr *) &lan_addr, 4148 &recv_msg)) { 4149 /* 4150 * We were unable to find the sequence number, 4151 * so just nuke the message. 4152 */ 4153 ipmi_inc_stat(intf, unhandled_lan_responses); 4154 return 0; 4155 } 4156 4157 memcpy(recv_msg->msg_data, &msg->rsp[11], msg->rsp_size - 11); 4158 /* 4159 * The other fields matched, so no need to set them, except 4160 * for netfn, which needs to be the response that was 4161 * returned, not the request value. 4162 */ 4163 recv_msg->msg.netfn = msg->rsp[6] >> 2; 4164 recv_msg->msg.data = recv_msg->msg_data; 4165 recv_msg->msg.data_len = msg->rsp_size - 12; 4166 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 4167 if (deliver_response(intf, recv_msg)) 4168 ipmi_inc_stat(intf, unhandled_lan_responses); 4169 else 4170 ipmi_inc_stat(intf, handled_lan_responses); 4171 4172 return 0; 4173 } 4174 4175 static int handle_lan_get_msg_cmd(struct ipmi_smi *intf, 4176 struct ipmi_smi_msg *msg) 4177 { 4178 struct cmd_rcvr *rcvr; 4179 int rv = 0; 4180 unsigned char netfn; 4181 unsigned char cmd; 4182 unsigned char chan; 4183 struct ipmi_user *user = NULL; 4184 struct ipmi_lan_addr *lan_addr; 4185 struct ipmi_recv_msg *recv_msg; 4186 4187 if (msg->rsp_size < 12) { 4188 /* Message not big enough, just ignore it. */ 4189 ipmi_inc_stat(intf, invalid_commands); 4190 return 0; 4191 } 4192 4193 if (msg->rsp[2] != 0) { 4194 /* An error getting the response, just ignore it. */ 4195 return 0; 4196 } 4197 4198 netfn = msg->rsp[6] >> 2; 4199 cmd = msg->rsp[10]; 4200 chan = msg->rsp[3] & 0xf; 4201 4202 rcu_read_lock(); 4203 rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); 4204 if (rcvr) { 4205 user = rcvr->user; 4206 kref_get(&user->refcount); 4207 } else 4208 user = NULL; 4209 rcu_read_unlock(); 4210 4211 if (user == NULL) { 4212 /* We didn't find a user, just give up. */ 4213 ipmi_inc_stat(intf, unhandled_commands); 4214 4215 /* 4216 * Don't do anything with these messages, just allow 4217 * them to be freed. 4218 */ 4219 rv = 0; 4220 } else { 4221 recv_msg = ipmi_alloc_recv_msg(); 4222 if (!recv_msg) { 4223 /* 4224 * We couldn't allocate memory for the 4225 * message, so requeue it for handling later. 4226 */ 4227 rv = 1; 4228 kref_put(&user->refcount, free_user); 4229 } else { 4230 /* Extract the source address from the data. */ 4231 lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr; 4232 lan_addr->addr_type = IPMI_LAN_ADDR_TYPE; 4233 lan_addr->session_handle = msg->rsp[4]; 4234 lan_addr->remote_SWID = msg->rsp[8]; 4235 lan_addr->local_SWID = msg->rsp[5]; 4236 lan_addr->lun = msg->rsp[9] & 3; 4237 lan_addr->channel = msg->rsp[3] & 0xf; 4238 lan_addr->privilege = msg->rsp[3] >> 4; 4239 4240 /* 4241 * Extract the rest of the message information 4242 * from the IPMB header. 4243 */ 4244 recv_msg->user = user; 4245 recv_msg->recv_type = IPMI_CMD_RECV_TYPE; 4246 recv_msg->msgid = msg->rsp[9] >> 2; 4247 recv_msg->msg.netfn = msg->rsp[6] >> 2; 4248 recv_msg->msg.cmd = msg->rsp[10]; 4249 recv_msg->msg.data = recv_msg->msg_data; 4250 4251 /* 4252 * We chop off 12, not 11 bytes because the checksum 4253 * at the end also needs to be removed. 4254 */ 4255 recv_msg->msg.data_len = msg->rsp_size - 12; 4256 memcpy(recv_msg->msg_data, &msg->rsp[11], 4257 msg->rsp_size - 12); 4258 if (deliver_response(intf, recv_msg)) 4259 ipmi_inc_stat(intf, unhandled_commands); 4260 else 4261 ipmi_inc_stat(intf, handled_commands); 4262 } 4263 } 4264 4265 return rv; 4266 } 4267 4268 /* 4269 * This routine will handle "Get Message" command responses with 4270 * channels that use an OEM Medium. The message format belongs to 4271 * the OEM. See IPMI 2.0 specification, Chapter 6 and 4272 * Chapter 22, sections 22.6 and 22.24 for more details. 4273 */ 4274 static int handle_oem_get_msg_cmd(struct ipmi_smi *intf, 4275 struct ipmi_smi_msg *msg) 4276 { 4277 struct cmd_rcvr *rcvr; 4278 int rv = 0; 4279 unsigned char netfn; 4280 unsigned char cmd; 4281 unsigned char chan; 4282 struct ipmi_user *user = NULL; 4283 struct ipmi_system_interface_addr *smi_addr; 4284 struct ipmi_recv_msg *recv_msg; 4285 4286 /* 4287 * We expect the OEM SW to perform error checking 4288 * so we just do some basic sanity checks 4289 */ 4290 if (msg->rsp_size < 4) { 4291 /* Message not big enough, just ignore it. */ 4292 ipmi_inc_stat(intf, invalid_commands); 4293 return 0; 4294 } 4295 4296 if (msg->rsp[2] != 0) { 4297 /* An error getting the response, just ignore it. */ 4298 return 0; 4299 } 4300 4301 /* 4302 * This is an OEM Message so the OEM needs to know how 4303 * handle the message. We do no interpretation. 4304 */ 4305 netfn = msg->rsp[0] >> 2; 4306 cmd = msg->rsp[1]; 4307 chan = msg->rsp[3] & 0xf; 4308 4309 rcu_read_lock(); 4310 rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); 4311 if (rcvr) { 4312 user = rcvr->user; 4313 kref_get(&user->refcount); 4314 } else 4315 user = NULL; 4316 rcu_read_unlock(); 4317 4318 if (user == NULL) { 4319 /* We didn't find a user, just give up. */ 4320 ipmi_inc_stat(intf, unhandled_commands); 4321 4322 /* 4323 * Don't do anything with these messages, just allow 4324 * them to be freed. 4325 */ 4326 4327 rv = 0; 4328 } else { 4329 recv_msg = ipmi_alloc_recv_msg(); 4330 if (!recv_msg) { 4331 /* 4332 * We couldn't allocate memory for the 4333 * message, so requeue it for handling 4334 * later. 4335 */ 4336 rv = 1; 4337 kref_put(&user->refcount, free_user); 4338 } else { 4339 /* 4340 * OEM Messages are expected to be delivered via 4341 * the system interface to SMS software. We might 4342 * need to visit this again depending on OEM 4343 * requirements 4344 */ 4345 smi_addr = ((struct ipmi_system_interface_addr *) 4346 &recv_msg->addr); 4347 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 4348 smi_addr->channel = IPMI_BMC_CHANNEL; 4349 smi_addr->lun = msg->rsp[0] & 3; 4350 4351 recv_msg->user = user; 4352 recv_msg->user_msg_data = NULL; 4353 recv_msg->recv_type = IPMI_OEM_RECV_TYPE; 4354 recv_msg->msg.netfn = msg->rsp[0] >> 2; 4355 recv_msg->msg.cmd = msg->rsp[1]; 4356 recv_msg->msg.data = recv_msg->msg_data; 4357 4358 /* 4359 * The message starts at byte 4 which follows the 4360 * the Channel Byte in the "GET MESSAGE" command 4361 */ 4362 recv_msg->msg.data_len = msg->rsp_size - 4; 4363 memcpy(recv_msg->msg_data, &msg->rsp[4], 4364 msg->rsp_size - 4); 4365 if (deliver_response(intf, recv_msg)) 4366 ipmi_inc_stat(intf, unhandled_commands); 4367 else 4368 ipmi_inc_stat(intf, handled_commands); 4369 } 4370 } 4371 4372 return rv; 4373 } 4374 4375 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg, 4376 struct ipmi_smi_msg *msg) 4377 { 4378 struct ipmi_system_interface_addr *smi_addr; 4379 4380 recv_msg->msgid = 0; 4381 smi_addr = (struct ipmi_system_interface_addr *) &recv_msg->addr; 4382 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 4383 smi_addr->channel = IPMI_BMC_CHANNEL; 4384 smi_addr->lun = msg->rsp[0] & 3; 4385 recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE; 4386 recv_msg->msg.netfn = msg->rsp[0] >> 2; 4387 recv_msg->msg.cmd = msg->rsp[1]; 4388 memcpy(recv_msg->msg_data, &msg->rsp[3], msg->rsp_size - 3); 4389 recv_msg->msg.data = recv_msg->msg_data; 4390 recv_msg->msg.data_len = msg->rsp_size - 3; 4391 } 4392 4393 static int handle_read_event_rsp(struct ipmi_smi *intf, 4394 struct ipmi_smi_msg *msg) 4395 { 4396 struct ipmi_recv_msg *recv_msg, *recv_msg2; 4397 struct list_head msgs; 4398 struct ipmi_user *user; 4399 int rv = 0, deliver_count = 0, index; 4400 unsigned long flags; 4401 4402 if (msg->rsp_size < 19) { 4403 /* Message is too small to be an IPMB event. */ 4404 ipmi_inc_stat(intf, invalid_events); 4405 return 0; 4406 } 4407 4408 if (msg->rsp[2] != 0) { 4409 /* An error getting the event, just ignore it. */ 4410 return 0; 4411 } 4412 4413 INIT_LIST_HEAD(&msgs); 4414 4415 spin_lock_irqsave(&intf->events_lock, flags); 4416 4417 ipmi_inc_stat(intf, events); 4418 4419 /* 4420 * Allocate and fill in one message for every user that is 4421 * getting events. 4422 */ 4423 index = srcu_read_lock(&intf->users_srcu); 4424 list_for_each_entry_rcu(user, &intf->users, link) { 4425 if (!user->gets_events) 4426 continue; 4427 4428 recv_msg = ipmi_alloc_recv_msg(); 4429 if (!recv_msg) { 4430 rcu_read_unlock(); 4431 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, 4432 link) { 4433 list_del(&recv_msg->link); 4434 ipmi_free_recv_msg(recv_msg); 4435 } 4436 /* 4437 * We couldn't allocate memory for the 4438 * message, so requeue it for handling 4439 * later. 4440 */ 4441 rv = 1; 4442 goto out; 4443 } 4444 4445 deliver_count++; 4446 4447 copy_event_into_recv_msg(recv_msg, msg); 4448 recv_msg->user = user; 4449 kref_get(&user->refcount); 4450 list_add_tail(&recv_msg->link, &msgs); 4451 } 4452 srcu_read_unlock(&intf->users_srcu, index); 4453 4454 if (deliver_count) { 4455 /* Now deliver all the messages. */ 4456 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) { 4457 list_del(&recv_msg->link); 4458 deliver_local_response(intf, recv_msg); 4459 } 4460 } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) { 4461 /* 4462 * No one to receive the message, put it in queue if there's 4463 * not already too many things in the queue. 4464 */ 4465 recv_msg = ipmi_alloc_recv_msg(); 4466 if (!recv_msg) { 4467 /* 4468 * We couldn't allocate memory for the 4469 * message, so requeue it for handling 4470 * later. 4471 */ 4472 rv = 1; 4473 goto out; 4474 } 4475 4476 copy_event_into_recv_msg(recv_msg, msg); 4477 list_add_tail(&recv_msg->link, &intf->waiting_events); 4478 intf->waiting_events_count++; 4479 } else if (!intf->event_msg_printed) { 4480 /* 4481 * There's too many things in the queue, discard this 4482 * message. 4483 */ 4484 dev_warn(intf->si_dev, 4485 "Event queue full, discarding incoming events\n"); 4486 intf->event_msg_printed = 1; 4487 } 4488 4489 out: 4490 spin_unlock_irqrestore(&intf->events_lock, flags); 4491 4492 return rv; 4493 } 4494 4495 static int handle_bmc_rsp(struct ipmi_smi *intf, 4496 struct ipmi_smi_msg *msg) 4497 { 4498 struct ipmi_recv_msg *recv_msg; 4499 struct ipmi_system_interface_addr *smi_addr; 4500 4501 recv_msg = msg->user_data; 4502 if (recv_msg == NULL) { 4503 dev_warn(intf->si_dev, 4504 "IPMI SMI message received with no owner. This could be because of a malformed message, or because of a hardware error. Contact your hardware vendor for assistance.\n"); 4505 return 0; 4506 } 4507 4508 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 4509 recv_msg->msgid = msg->msgid; 4510 smi_addr = ((struct ipmi_system_interface_addr *) 4511 &recv_msg->addr); 4512 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 4513 smi_addr->channel = IPMI_BMC_CHANNEL; 4514 smi_addr->lun = msg->rsp[0] & 3; 4515 recv_msg->msg.netfn = msg->rsp[0] >> 2; 4516 recv_msg->msg.cmd = msg->rsp[1]; 4517 memcpy(recv_msg->msg_data, &msg->rsp[2], msg->rsp_size - 2); 4518 recv_msg->msg.data = recv_msg->msg_data; 4519 recv_msg->msg.data_len = msg->rsp_size - 2; 4520 deliver_local_response(intf, recv_msg); 4521 4522 return 0; 4523 } 4524 4525 /* 4526 * Handle a received message. Return 1 if the message should be requeued, 4527 * 0 if the message should be freed, or -1 if the message should not 4528 * be freed or requeued. 4529 */ 4530 static int handle_one_recv_msg(struct ipmi_smi *intf, 4531 struct ipmi_smi_msg *msg) 4532 { 4533 int requeue = 0; 4534 int chan; 4535 unsigned char cc; 4536 bool is_cmd = !((msg->rsp[0] >> 2) & 1); 4537 4538 dev_dbg(intf->si_dev, "Recv: %*ph\n", msg->rsp_size, msg->rsp); 4539 4540 if (msg->rsp_size < 2) { 4541 /* Message is too small to be correct. */ 4542 dev_warn(intf->si_dev, 4543 "BMC returned too small a message for netfn %x cmd %x, got %d bytes\n", 4544 (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size); 4545 4546 return_unspecified: 4547 /* Generate an error response for the message. */ 4548 msg->rsp[0] = msg->data[0] | (1 << 2); 4549 msg->rsp[1] = msg->data[1]; 4550 msg->rsp[2] = IPMI_ERR_UNSPECIFIED; 4551 msg->rsp_size = 3; 4552 } else if (msg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) { 4553 /* commands must have at least 4 bytes, responses 5. */ 4554 if (is_cmd && (msg->rsp_size < 4)) { 4555 ipmi_inc_stat(intf, invalid_commands); 4556 goto out; 4557 } 4558 if (!is_cmd && (msg->rsp_size < 5)) { 4559 ipmi_inc_stat(intf, invalid_ipmb_responses); 4560 /* Construct a valid error response. */ 4561 msg->rsp[0] = msg->data[0] & 0xfc; /* NetFN */ 4562 msg->rsp[0] |= (1 << 2); /* Make it a response */ 4563 msg->rsp[0] |= msg->data[2] & 3; /* rqLUN */ 4564 msg->rsp[1] = msg->data[1]; /* Addr */ 4565 msg->rsp[2] = msg->data[2] & 0xfc; /* rqSeq */ 4566 msg->rsp[2] |= msg->data[0] & 0x3; /* rsLUN */ 4567 msg->rsp[3] = msg->data[3]; /* Cmd */ 4568 msg->rsp[4] = IPMI_ERR_UNSPECIFIED; 4569 msg->rsp_size = 5; 4570 } 4571 } else if ((msg->data_size >= 2) 4572 && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2)) 4573 && (msg->data[1] == IPMI_SEND_MSG_CMD) 4574 && (msg->user_data == NULL)) { 4575 4576 if (intf->in_shutdown) 4577 goto out; 4578 4579 /* 4580 * This is the local response to a command send, start 4581 * the timer for these. The user_data will not be 4582 * NULL if this is a response send, and we will let 4583 * response sends just go through. 4584 */ 4585 4586 /* 4587 * Check for errors, if we get certain errors (ones 4588 * that mean basically we can try again later), we 4589 * ignore them and start the timer. Otherwise we 4590 * report the error immediately. 4591 */ 4592 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0) 4593 && (msg->rsp[2] != IPMI_NODE_BUSY_ERR) 4594 && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR) 4595 && (msg->rsp[2] != IPMI_BUS_ERR) 4596 && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) { 4597 int ch = msg->rsp[3] & 0xf; 4598 struct ipmi_channel *chans; 4599 4600 /* Got an error sending the message, handle it. */ 4601 4602 chans = READ_ONCE(intf->channel_list)->c; 4603 if ((chans[ch].medium == IPMI_CHANNEL_MEDIUM_8023LAN) 4604 || (chans[ch].medium == IPMI_CHANNEL_MEDIUM_ASYNC)) 4605 ipmi_inc_stat(intf, sent_lan_command_errs); 4606 else 4607 ipmi_inc_stat(intf, sent_ipmb_command_errs); 4608 intf_err_seq(intf, msg->msgid, msg->rsp[2]); 4609 } else 4610 /* The message was sent, start the timer. */ 4611 intf_start_seq_timer(intf, msg->msgid); 4612 requeue = 0; 4613 goto out; 4614 } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1)) 4615 || (msg->rsp[1] != msg->data[1])) { 4616 /* 4617 * The NetFN and Command in the response is not even 4618 * marginally correct. 4619 */ 4620 dev_warn(intf->si_dev, 4621 "BMC returned incorrect response, expected netfn %x cmd %x, got netfn %x cmd %x\n", 4622 (msg->data[0] >> 2) | 1, msg->data[1], 4623 msg->rsp[0] >> 2, msg->rsp[1]); 4624 4625 goto return_unspecified; 4626 } 4627 4628 if (msg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) { 4629 if ((msg->data[0] >> 2) & 1) { 4630 /* It's a response to a sent response. */ 4631 chan = 0; 4632 cc = msg->rsp[4]; 4633 goto process_response_response; 4634 } 4635 if (is_cmd) 4636 requeue = handle_ipmb_direct_rcv_cmd(intf, msg); 4637 else 4638 requeue = handle_ipmb_direct_rcv_rsp(intf, msg); 4639 } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2)) 4640 && (msg->rsp[1] == IPMI_SEND_MSG_CMD) 4641 && (msg->user_data != NULL)) { 4642 /* 4643 * It's a response to a response we sent. For this we 4644 * deliver a send message response to the user. 4645 */ 4646 struct ipmi_recv_msg *recv_msg; 4647 4648 chan = msg->data[2] & 0x0f; 4649 if (chan >= IPMI_MAX_CHANNELS) 4650 /* Invalid channel number */ 4651 goto out; 4652 cc = msg->rsp[2]; 4653 4654 process_response_response: 4655 recv_msg = msg->user_data; 4656 4657 requeue = 0; 4658 if (!recv_msg) 4659 goto out; 4660 4661 recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE; 4662 recv_msg->msg.data = recv_msg->msg_data; 4663 recv_msg->msg_data[0] = cc; 4664 recv_msg->msg.data_len = 1; 4665 deliver_local_response(intf, recv_msg); 4666 } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2)) 4667 && (msg->rsp[1] == IPMI_GET_MSG_CMD)) { 4668 struct ipmi_channel *chans; 4669 4670 /* It's from the receive queue. */ 4671 chan = msg->rsp[3] & 0xf; 4672 if (chan >= IPMI_MAX_CHANNELS) { 4673 /* Invalid channel number */ 4674 requeue = 0; 4675 goto out; 4676 } 4677 4678 /* 4679 * We need to make sure the channels have been initialized. 4680 * The channel_handler routine will set the "curr_channel" 4681 * equal to or greater than IPMI_MAX_CHANNELS when all the 4682 * channels for this interface have been initialized. 4683 */ 4684 if (!intf->channels_ready) { 4685 requeue = 0; /* Throw the message away */ 4686 goto out; 4687 } 4688 4689 chans = READ_ONCE(intf->channel_list)->c; 4690 4691 switch (chans[chan].medium) { 4692 case IPMI_CHANNEL_MEDIUM_IPMB: 4693 if (msg->rsp[4] & 0x04) { 4694 /* 4695 * It's a response, so find the 4696 * requesting message and send it up. 4697 */ 4698 requeue = handle_ipmb_get_msg_rsp(intf, msg); 4699 } else { 4700 /* 4701 * It's a command to the SMS from some other 4702 * entity. Handle that. 4703 */ 4704 requeue = handle_ipmb_get_msg_cmd(intf, msg); 4705 } 4706 break; 4707 4708 case IPMI_CHANNEL_MEDIUM_8023LAN: 4709 case IPMI_CHANNEL_MEDIUM_ASYNC: 4710 if (msg->rsp[6] & 0x04) { 4711 /* 4712 * It's a response, so find the 4713 * requesting message and send it up. 4714 */ 4715 requeue = handle_lan_get_msg_rsp(intf, msg); 4716 } else { 4717 /* 4718 * It's a command to the SMS from some other 4719 * entity. Handle that. 4720 */ 4721 requeue = handle_lan_get_msg_cmd(intf, msg); 4722 } 4723 break; 4724 4725 default: 4726 /* Check for OEM Channels. Clients had better 4727 register for these commands. */ 4728 if ((chans[chan].medium >= IPMI_CHANNEL_MEDIUM_OEM_MIN) 4729 && (chans[chan].medium 4730 <= IPMI_CHANNEL_MEDIUM_OEM_MAX)) { 4731 requeue = handle_oem_get_msg_cmd(intf, msg); 4732 } else { 4733 /* 4734 * We don't handle the channel type, so just 4735 * free the message. 4736 */ 4737 requeue = 0; 4738 } 4739 } 4740 4741 } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2)) 4742 && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD)) { 4743 /* It's an asynchronous event. */ 4744 requeue = handle_read_event_rsp(intf, msg); 4745 } else { 4746 /* It's a response from the local BMC. */ 4747 requeue = handle_bmc_rsp(intf, msg); 4748 } 4749 4750 out: 4751 return requeue; 4752 } 4753 4754 /* 4755 * If there are messages in the queue or pretimeouts, handle them. 4756 */ 4757 static void handle_new_recv_msgs(struct ipmi_smi *intf) 4758 { 4759 struct ipmi_smi_msg *smi_msg; 4760 unsigned long flags = 0; 4761 int rv; 4762 int run_to_completion = intf->run_to_completion; 4763 4764 /* See if any waiting messages need to be processed. */ 4765 if (!run_to_completion) 4766 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags); 4767 while (!list_empty(&intf->waiting_rcv_msgs)) { 4768 smi_msg = list_entry(intf->waiting_rcv_msgs.next, 4769 struct ipmi_smi_msg, link); 4770 list_del(&smi_msg->link); 4771 if (!run_to_completion) 4772 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, 4773 flags); 4774 rv = handle_one_recv_msg(intf, smi_msg); 4775 if (!run_to_completion) 4776 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags); 4777 if (rv > 0) { 4778 /* 4779 * To preserve message order, quit if we 4780 * can't handle a message. Add the message 4781 * back at the head, this is safe because this 4782 * tasklet is the only thing that pulls the 4783 * messages. 4784 */ 4785 list_add(&smi_msg->link, &intf->waiting_rcv_msgs); 4786 break; 4787 } else { 4788 if (rv == 0) 4789 /* Message handled */ 4790 ipmi_free_smi_msg(smi_msg); 4791 /* If rv < 0, fatal error, del but don't free. */ 4792 } 4793 } 4794 if (!run_to_completion) 4795 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, flags); 4796 4797 /* 4798 * If the pretimout count is non-zero, decrement one from it and 4799 * deliver pretimeouts to all the users. 4800 */ 4801 if (atomic_add_unless(&intf->watchdog_pretimeouts_to_deliver, -1, 0)) { 4802 struct ipmi_user *user; 4803 int index; 4804 4805 index = srcu_read_lock(&intf->users_srcu); 4806 list_for_each_entry_rcu(user, &intf->users, link) { 4807 if (user->handler->ipmi_watchdog_pretimeout) 4808 user->handler->ipmi_watchdog_pretimeout( 4809 user->handler_data); 4810 } 4811 srcu_read_unlock(&intf->users_srcu, index); 4812 } 4813 } 4814 4815 static void smi_recv_tasklet(struct tasklet_struct *t) 4816 { 4817 unsigned long flags = 0; /* keep us warning-free. */ 4818 struct ipmi_smi *intf = from_tasklet(intf, t, recv_tasklet); 4819 int run_to_completion = intf->run_to_completion; 4820 struct ipmi_smi_msg *newmsg = NULL; 4821 4822 /* 4823 * Start the next message if available. 4824 * 4825 * Do this here, not in the actual receiver, because we may deadlock 4826 * because the lower layer is allowed to hold locks while calling 4827 * message delivery. 4828 */ 4829 4830 rcu_read_lock(); 4831 4832 if (!run_to_completion) 4833 spin_lock_irqsave(&intf->xmit_msgs_lock, flags); 4834 if (intf->curr_msg == NULL && !intf->in_shutdown) { 4835 struct list_head *entry = NULL; 4836 4837 /* Pick the high priority queue first. */ 4838 if (!list_empty(&intf->hp_xmit_msgs)) 4839 entry = intf->hp_xmit_msgs.next; 4840 else if (!list_empty(&intf->xmit_msgs)) 4841 entry = intf->xmit_msgs.next; 4842 4843 if (entry) { 4844 list_del(entry); 4845 newmsg = list_entry(entry, struct ipmi_smi_msg, link); 4846 intf->curr_msg = newmsg; 4847 } 4848 } 4849 4850 if (!run_to_completion) 4851 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags); 4852 if (newmsg) 4853 intf->handlers->sender(intf->send_info, newmsg); 4854 4855 rcu_read_unlock(); 4856 4857 handle_new_recv_msgs(intf); 4858 } 4859 4860 /* Handle a new message from the lower layer. */ 4861 void ipmi_smi_msg_received(struct ipmi_smi *intf, 4862 struct ipmi_smi_msg *msg) 4863 { 4864 unsigned long flags = 0; /* keep us warning-free. */ 4865 int run_to_completion = intf->run_to_completion; 4866 4867 /* 4868 * To preserve message order, we keep a queue and deliver from 4869 * a tasklet. 4870 */ 4871 if (!run_to_completion) 4872 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags); 4873 list_add_tail(&msg->link, &intf->waiting_rcv_msgs); 4874 if (!run_to_completion) 4875 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, 4876 flags); 4877 4878 if (!run_to_completion) 4879 spin_lock_irqsave(&intf->xmit_msgs_lock, flags); 4880 /* 4881 * We can get an asynchronous event or receive message in addition 4882 * to commands we send. 4883 */ 4884 if (msg == intf->curr_msg) 4885 intf->curr_msg = NULL; 4886 if (!run_to_completion) 4887 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags); 4888 4889 if (run_to_completion) 4890 smi_recv_tasklet(&intf->recv_tasklet); 4891 else 4892 tasklet_schedule(&intf->recv_tasklet); 4893 } 4894 EXPORT_SYMBOL(ipmi_smi_msg_received); 4895 4896 void ipmi_smi_watchdog_pretimeout(struct ipmi_smi *intf) 4897 { 4898 if (intf->in_shutdown) 4899 return; 4900 4901 atomic_set(&intf->watchdog_pretimeouts_to_deliver, 1); 4902 tasklet_schedule(&intf->recv_tasklet); 4903 } 4904 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout); 4905 4906 static struct ipmi_smi_msg * 4907 smi_from_recv_msg(struct ipmi_smi *intf, struct ipmi_recv_msg *recv_msg, 4908 unsigned char seq, long seqid) 4909 { 4910 struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg(); 4911 if (!smi_msg) 4912 /* 4913 * If we can't allocate the message, then just return, we 4914 * get 4 retries, so this should be ok. 4915 */ 4916 return NULL; 4917 4918 memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len); 4919 smi_msg->data_size = recv_msg->msg.data_len; 4920 smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid); 4921 4922 dev_dbg(intf->si_dev, "Resend: %*ph\n", 4923 smi_msg->data_size, smi_msg->data); 4924 4925 return smi_msg; 4926 } 4927 4928 static void check_msg_timeout(struct ipmi_smi *intf, struct seq_table *ent, 4929 struct list_head *timeouts, 4930 unsigned long timeout_period, 4931 int slot, unsigned long *flags, 4932 bool *need_timer) 4933 { 4934 struct ipmi_recv_msg *msg; 4935 4936 if (intf->in_shutdown) 4937 return; 4938 4939 if (!ent->inuse) 4940 return; 4941 4942 if (timeout_period < ent->timeout) { 4943 ent->timeout -= timeout_period; 4944 *need_timer = true; 4945 return; 4946 } 4947 4948 if (ent->retries_left == 0) { 4949 /* The message has used all its retries. */ 4950 ent->inuse = 0; 4951 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 4952 msg = ent->recv_msg; 4953 list_add_tail(&msg->link, timeouts); 4954 if (ent->broadcast) 4955 ipmi_inc_stat(intf, timed_out_ipmb_broadcasts); 4956 else if (is_lan_addr(&ent->recv_msg->addr)) 4957 ipmi_inc_stat(intf, timed_out_lan_commands); 4958 else 4959 ipmi_inc_stat(intf, timed_out_ipmb_commands); 4960 } else { 4961 struct ipmi_smi_msg *smi_msg; 4962 /* More retries, send again. */ 4963 4964 *need_timer = true; 4965 4966 /* 4967 * Start with the max timer, set to normal timer after 4968 * the message is sent. 4969 */ 4970 ent->timeout = MAX_MSG_TIMEOUT; 4971 ent->retries_left--; 4972 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot, 4973 ent->seqid); 4974 if (!smi_msg) { 4975 if (is_lan_addr(&ent->recv_msg->addr)) 4976 ipmi_inc_stat(intf, 4977 dropped_rexmit_lan_commands); 4978 else 4979 ipmi_inc_stat(intf, 4980 dropped_rexmit_ipmb_commands); 4981 return; 4982 } 4983 4984 spin_unlock_irqrestore(&intf->seq_lock, *flags); 4985 4986 /* 4987 * Send the new message. We send with a zero 4988 * priority. It timed out, I doubt time is that 4989 * critical now, and high priority messages are really 4990 * only for messages to the local MC, which don't get 4991 * resent. 4992 */ 4993 if (intf->handlers) { 4994 if (is_lan_addr(&ent->recv_msg->addr)) 4995 ipmi_inc_stat(intf, 4996 retransmitted_lan_commands); 4997 else 4998 ipmi_inc_stat(intf, 4999 retransmitted_ipmb_commands); 5000 5001 smi_send(intf, intf->handlers, smi_msg, 0); 5002 } else 5003 ipmi_free_smi_msg(smi_msg); 5004 5005 spin_lock_irqsave(&intf->seq_lock, *flags); 5006 } 5007 } 5008 5009 static bool ipmi_timeout_handler(struct ipmi_smi *intf, 5010 unsigned long timeout_period) 5011 { 5012 struct list_head timeouts; 5013 struct ipmi_recv_msg *msg, *msg2; 5014 unsigned long flags; 5015 int i; 5016 bool need_timer = false; 5017 5018 if (!intf->bmc_registered) { 5019 kref_get(&intf->refcount); 5020 if (!schedule_work(&intf->bmc_reg_work)) { 5021 kref_put(&intf->refcount, intf_free); 5022 need_timer = true; 5023 } 5024 } 5025 5026 /* 5027 * Go through the seq table and find any messages that 5028 * have timed out, putting them in the timeouts 5029 * list. 5030 */ 5031 INIT_LIST_HEAD(&timeouts); 5032 spin_lock_irqsave(&intf->seq_lock, flags); 5033 if (intf->ipmb_maintenance_mode_timeout) { 5034 if (intf->ipmb_maintenance_mode_timeout <= timeout_period) 5035 intf->ipmb_maintenance_mode_timeout = 0; 5036 else 5037 intf->ipmb_maintenance_mode_timeout -= timeout_period; 5038 } 5039 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) 5040 check_msg_timeout(intf, &intf->seq_table[i], 5041 &timeouts, timeout_period, i, 5042 &flags, &need_timer); 5043 spin_unlock_irqrestore(&intf->seq_lock, flags); 5044 5045 list_for_each_entry_safe(msg, msg2, &timeouts, link) 5046 deliver_err_response(intf, msg, IPMI_TIMEOUT_COMPLETION_CODE); 5047 5048 /* 5049 * Maintenance mode handling. Check the timeout 5050 * optimistically before we claim the lock. It may 5051 * mean a timeout gets missed occasionally, but that 5052 * only means the timeout gets extended by one period 5053 * in that case. No big deal, and it avoids the lock 5054 * most of the time. 5055 */ 5056 if (intf->auto_maintenance_timeout > 0) { 5057 spin_lock_irqsave(&intf->maintenance_mode_lock, flags); 5058 if (intf->auto_maintenance_timeout > 0) { 5059 intf->auto_maintenance_timeout 5060 -= timeout_period; 5061 if (!intf->maintenance_mode 5062 && (intf->auto_maintenance_timeout <= 0)) { 5063 intf->maintenance_mode_enable = false; 5064 maintenance_mode_update(intf); 5065 } 5066 } 5067 spin_unlock_irqrestore(&intf->maintenance_mode_lock, 5068 flags); 5069 } 5070 5071 tasklet_schedule(&intf->recv_tasklet); 5072 5073 return need_timer; 5074 } 5075 5076 static void ipmi_request_event(struct ipmi_smi *intf) 5077 { 5078 /* No event requests when in maintenance mode. */ 5079 if (intf->maintenance_mode_enable) 5080 return; 5081 5082 if (!intf->in_shutdown) 5083 intf->handlers->request_events(intf->send_info); 5084 } 5085 5086 static struct timer_list ipmi_timer; 5087 5088 static atomic_t stop_operation; 5089 5090 static void ipmi_timeout(struct timer_list *unused) 5091 { 5092 struct ipmi_smi *intf; 5093 bool need_timer = false; 5094 int index; 5095 5096 if (atomic_read(&stop_operation)) 5097 return; 5098 5099 index = srcu_read_lock(&ipmi_interfaces_srcu); 5100 list_for_each_entry_rcu(intf, &ipmi_interfaces, link) { 5101 if (atomic_read(&intf->event_waiters)) { 5102 intf->ticks_to_req_ev--; 5103 if (intf->ticks_to_req_ev == 0) { 5104 ipmi_request_event(intf); 5105 intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME; 5106 } 5107 need_timer = true; 5108 } 5109 5110 need_timer |= ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME); 5111 } 5112 srcu_read_unlock(&ipmi_interfaces_srcu, index); 5113 5114 if (need_timer) 5115 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); 5116 } 5117 5118 static void need_waiter(struct ipmi_smi *intf) 5119 { 5120 /* Racy, but worst case we start the timer twice. */ 5121 if (!timer_pending(&ipmi_timer)) 5122 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); 5123 } 5124 5125 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0); 5126 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0); 5127 5128 static void free_smi_msg(struct ipmi_smi_msg *msg) 5129 { 5130 atomic_dec(&smi_msg_inuse_count); 5131 /* Try to keep as much stuff out of the panic path as possible. */ 5132 if (!oops_in_progress) 5133 kfree(msg); 5134 } 5135 5136 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void) 5137 { 5138 struct ipmi_smi_msg *rv; 5139 rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC); 5140 if (rv) { 5141 rv->done = free_smi_msg; 5142 rv->user_data = NULL; 5143 rv->type = IPMI_SMI_MSG_TYPE_NORMAL; 5144 atomic_inc(&smi_msg_inuse_count); 5145 } 5146 return rv; 5147 } 5148 EXPORT_SYMBOL(ipmi_alloc_smi_msg); 5149 5150 static void free_recv_msg(struct ipmi_recv_msg *msg) 5151 { 5152 atomic_dec(&recv_msg_inuse_count); 5153 /* Try to keep as much stuff out of the panic path as possible. */ 5154 if (!oops_in_progress) 5155 kfree(msg); 5156 } 5157 5158 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void) 5159 { 5160 struct ipmi_recv_msg *rv; 5161 5162 rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC); 5163 if (rv) { 5164 rv->user = NULL; 5165 rv->done = free_recv_msg; 5166 atomic_inc(&recv_msg_inuse_count); 5167 } 5168 return rv; 5169 } 5170 5171 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg) 5172 { 5173 if (msg->user && !oops_in_progress) 5174 kref_put(&msg->user->refcount, free_user); 5175 msg->done(msg); 5176 } 5177 EXPORT_SYMBOL(ipmi_free_recv_msg); 5178 5179 static atomic_t panic_done_count = ATOMIC_INIT(0); 5180 5181 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg) 5182 { 5183 atomic_dec(&panic_done_count); 5184 } 5185 5186 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg) 5187 { 5188 atomic_dec(&panic_done_count); 5189 } 5190 5191 /* 5192 * Inside a panic, send a message and wait for a response. 5193 */ 5194 static void ipmi_panic_request_and_wait(struct ipmi_smi *intf, 5195 struct ipmi_addr *addr, 5196 struct kernel_ipmi_msg *msg) 5197 { 5198 struct ipmi_smi_msg smi_msg; 5199 struct ipmi_recv_msg recv_msg; 5200 int rv; 5201 5202 smi_msg.done = dummy_smi_done_handler; 5203 recv_msg.done = dummy_recv_done_handler; 5204 atomic_add(2, &panic_done_count); 5205 rv = i_ipmi_request(NULL, 5206 intf, 5207 addr, 5208 0, 5209 msg, 5210 intf, 5211 &smi_msg, 5212 &recv_msg, 5213 0, 5214 intf->addrinfo[0].address, 5215 intf->addrinfo[0].lun, 5216 0, 1); /* Don't retry, and don't wait. */ 5217 if (rv) 5218 atomic_sub(2, &panic_done_count); 5219 else if (intf->handlers->flush_messages) 5220 intf->handlers->flush_messages(intf->send_info); 5221 5222 while (atomic_read(&panic_done_count) != 0) 5223 ipmi_poll(intf); 5224 } 5225 5226 static void event_receiver_fetcher(struct ipmi_smi *intf, 5227 struct ipmi_recv_msg *msg) 5228 { 5229 if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 5230 && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE) 5231 && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD) 5232 && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) { 5233 /* A get event receiver command, save it. */ 5234 intf->event_receiver = msg->msg.data[1]; 5235 intf->event_receiver_lun = msg->msg.data[2] & 0x3; 5236 } 5237 } 5238 5239 static void device_id_fetcher(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) 5240 { 5241 if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 5242 && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE) 5243 && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD) 5244 && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) { 5245 /* 5246 * A get device id command, save if we are an event 5247 * receiver or generator. 5248 */ 5249 intf->local_sel_device = (msg->msg.data[6] >> 2) & 1; 5250 intf->local_event_generator = (msg->msg.data[6] >> 5) & 1; 5251 } 5252 } 5253 5254 static void send_panic_events(struct ipmi_smi *intf, char *str) 5255 { 5256 struct kernel_ipmi_msg msg; 5257 unsigned char data[16]; 5258 struct ipmi_system_interface_addr *si; 5259 struct ipmi_addr addr; 5260 char *p = str; 5261 struct ipmi_ipmb_addr *ipmb; 5262 int j; 5263 5264 if (ipmi_send_panic_event == IPMI_SEND_PANIC_EVENT_NONE) 5265 return; 5266 5267 si = (struct ipmi_system_interface_addr *) &addr; 5268 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 5269 si->channel = IPMI_BMC_CHANNEL; 5270 si->lun = 0; 5271 5272 /* Fill in an event telling that we have failed. */ 5273 msg.netfn = 0x04; /* Sensor or Event. */ 5274 msg.cmd = 2; /* Platform event command. */ 5275 msg.data = data; 5276 msg.data_len = 8; 5277 data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */ 5278 data[1] = 0x03; /* This is for IPMI 1.0. */ 5279 data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */ 5280 data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */ 5281 data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */ 5282 5283 /* 5284 * Put a few breadcrumbs in. Hopefully later we can add more things 5285 * to make the panic events more useful. 5286 */ 5287 if (str) { 5288 data[3] = str[0]; 5289 data[6] = str[1]; 5290 data[7] = str[2]; 5291 } 5292 5293 /* Send the event announcing the panic. */ 5294 ipmi_panic_request_and_wait(intf, &addr, &msg); 5295 5296 /* 5297 * On every interface, dump a bunch of OEM event holding the 5298 * string. 5299 */ 5300 if (ipmi_send_panic_event != IPMI_SEND_PANIC_EVENT_STRING || !str) 5301 return; 5302 5303 /* 5304 * intf_num is used as an marker to tell if the 5305 * interface is valid. Thus we need a read barrier to 5306 * make sure data fetched before checking intf_num 5307 * won't be used. 5308 */ 5309 smp_rmb(); 5310 5311 /* 5312 * First job here is to figure out where to send the 5313 * OEM events. There's no way in IPMI to send OEM 5314 * events using an event send command, so we have to 5315 * find the SEL to put them in and stick them in 5316 * there. 5317 */ 5318 5319 /* Get capabilities from the get device id. */ 5320 intf->local_sel_device = 0; 5321 intf->local_event_generator = 0; 5322 intf->event_receiver = 0; 5323 5324 /* Request the device info from the local MC. */ 5325 msg.netfn = IPMI_NETFN_APP_REQUEST; 5326 msg.cmd = IPMI_GET_DEVICE_ID_CMD; 5327 msg.data = NULL; 5328 msg.data_len = 0; 5329 intf->null_user_handler = device_id_fetcher; 5330 ipmi_panic_request_and_wait(intf, &addr, &msg); 5331 5332 if (intf->local_event_generator) { 5333 /* Request the event receiver from the local MC. */ 5334 msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST; 5335 msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD; 5336 msg.data = NULL; 5337 msg.data_len = 0; 5338 intf->null_user_handler = event_receiver_fetcher; 5339 ipmi_panic_request_and_wait(intf, &addr, &msg); 5340 } 5341 intf->null_user_handler = NULL; 5342 5343 /* 5344 * Validate the event receiver. The low bit must not 5345 * be 1 (it must be a valid IPMB address), it cannot 5346 * be zero, and it must not be my address. 5347 */ 5348 if (((intf->event_receiver & 1) == 0) 5349 && (intf->event_receiver != 0) 5350 && (intf->event_receiver != intf->addrinfo[0].address)) { 5351 /* 5352 * The event receiver is valid, send an IPMB 5353 * message. 5354 */ 5355 ipmb = (struct ipmi_ipmb_addr *) &addr; 5356 ipmb->addr_type = IPMI_IPMB_ADDR_TYPE; 5357 ipmb->channel = 0; /* FIXME - is this right? */ 5358 ipmb->lun = intf->event_receiver_lun; 5359 ipmb->slave_addr = intf->event_receiver; 5360 } else if (intf->local_sel_device) { 5361 /* 5362 * The event receiver was not valid (or was 5363 * me), but I am an SEL device, just dump it 5364 * in my SEL. 5365 */ 5366 si = (struct ipmi_system_interface_addr *) &addr; 5367 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 5368 si->channel = IPMI_BMC_CHANNEL; 5369 si->lun = 0; 5370 } else 5371 return; /* No where to send the event. */ 5372 5373 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */ 5374 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD; 5375 msg.data = data; 5376 msg.data_len = 16; 5377 5378 j = 0; 5379 while (*p) { 5380 int size = strlen(p); 5381 5382 if (size > 11) 5383 size = 11; 5384 data[0] = 0; 5385 data[1] = 0; 5386 data[2] = 0xf0; /* OEM event without timestamp. */ 5387 data[3] = intf->addrinfo[0].address; 5388 data[4] = j++; /* sequence # */ 5389 /* 5390 * Always give 11 bytes, so strncpy will fill 5391 * it with zeroes for me. 5392 */ 5393 strncpy(data+5, p, 11); 5394 p += size; 5395 5396 ipmi_panic_request_and_wait(intf, &addr, &msg); 5397 } 5398 } 5399 5400 static int has_panicked; 5401 5402 static int panic_event(struct notifier_block *this, 5403 unsigned long event, 5404 void *ptr) 5405 { 5406 struct ipmi_smi *intf; 5407 struct ipmi_user *user; 5408 5409 if (has_panicked) 5410 return NOTIFY_DONE; 5411 has_panicked = 1; 5412 5413 /* For every registered interface, set it to run to completion. */ 5414 list_for_each_entry_rcu(intf, &ipmi_interfaces, link) { 5415 if (!intf->handlers || intf->intf_num == -1) 5416 /* Interface is not ready. */ 5417 continue; 5418 5419 if (!intf->handlers->poll) 5420 continue; 5421 5422 /* 5423 * If we were interrupted while locking xmit_msgs_lock or 5424 * waiting_rcv_msgs_lock, the corresponding list may be 5425 * corrupted. In this case, drop items on the list for 5426 * the safety. 5427 */ 5428 if (!spin_trylock(&intf->xmit_msgs_lock)) { 5429 INIT_LIST_HEAD(&intf->xmit_msgs); 5430 INIT_LIST_HEAD(&intf->hp_xmit_msgs); 5431 } else 5432 spin_unlock(&intf->xmit_msgs_lock); 5433 5434 if (!spin_trylock(&intf->waiting_rcv_msgs_lock)) 5435 INIT_LIST_HEAD(&intf->waiting_rcv_msgs); 5436 else 5437 spin_unlock(&intf->waiting_rcv_msgs_lock); 5438 5439 intf->run_to_completion = 1; 5440 if (intf->handlers->set_run_to_completion) 5441 intf->handlers->set_run_to_completion(intf->send_info, 5442 1); 5443 5444 list_for_each_entry_rcu(user, &intf->users, link) { 5445 if (user->handler->ipmi_panic_handler) 5446 user->handler->ipmi_panic_handler( 5447 user->handler_data); 5448 } 5449 5450 send_panic_events(intf, ptr); 5451 } 5452 5453 return NOTIFY_DONE; 5454 } 5455 5456 /* Must be called with ipmi_interfaces_mutex held. */ 5457 static int ipmi_register_driver(void) 5458 { 5459 int rv; 5460 5461 if (drvregistered) 5462 return 0; 5463 5464 rv = driver_register(&ipmidriver.driver); 5465 if (rv) 5466 pr_err("Could not register IPMI driver\n"); 5467 else 5468 drvregistered = true; 5469 return rv; 5470 } 5471 5472 static struct notifier_block panic_block = { 5473 .notifier_call = panic_event, 5474 .next = NULL, 5475 .priority = 200 /* priority: INT_MAX >= x >= 0 */ 5476 }; 5477 5478 static int ipmi_init_msghandler(void) 5479 { 5480 int rv; 5481 5482 mutex_lock(&ipmi_interfaces_mutex); 5483 rv = ipmi_register_driver(); 5484 if (rv) 5485 goto out; 5486 if (initialized) 5487 goto out; 5488 5489 rv = init_srcu_struct(&ipmi_interfaces_srcu); 5490 if (rv) 5491 goto out; 5492 5493 remove_work_wq = create_singlethread_workqueue("ipmi-msghandler-remove-wq"); 5494 if (!remove_work_wq) { 5495 pr_err("unable to create ipmi-msghandler-remove-wq workqueue"); 5496 rv = -ENOMEM; 5497 goto out_wq; 5498 } 5499 5500 timer_setup(&ipmi_timer, ipmi_timeout, 0); 5501 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); 5502 5503 atomic_notifier_chain_register(&panic_notifier_list, &panic_block); 5504 5505 initialized = true; 5506 5507 out_wq: 5508 if (rv) 5509 cleanup_srcu_struct(&ipmi_interfaces_srcu); 5510 out: 5511 mutex_unlock(&ipmi_interfaces_mutex); 5512 return rv; 5513 } 5514 5515 static int __init ipmi_init_msghandler_mod(void) 5516 { 5517 int rv; 5518 5519 pr_info("version " IPMI_DRIVER_VERSION "\n"); 5520 5521 mutex_lock(&ipmi_interfaces_mutex); 5522 rv = ipmi_register_driver(); 5523 mutex_unlock(&ipmi_interfaces_mutex); 5524 5525 return rv; 5526 } 5527 5528 static void __exit cleanup_ipmi(void) 5529 { 5530 int count; 5531 5532 if (initialized) { 5533 destroy_workqueue(remove_work_wq); 5534 5535 atomic_notifier_chain_unregister(&panic_notifier_list, 5536 &panic_block); 5537 5538 /* 5539 * This can't be called if any interfaces exist, so no worry 5540 * about shutting down the interfaces. 5541 */ 5542 5543 /* 5544 * Tell the timer to stop, then wait for it to stop. This 5545 * avoids problems with race conditions removing the timer 5546 * here. 5547 */ 5548 atomic_set(&stop_operation, 1); 5549 del_timer_sync(&ipmi_timer); 5550 5551 initialized = false; 5552 5553 /* Check for buffer leaks. */ 5554 count = atomic_read(&smi_msg_inuse_count); 5555 if (count != 0) 5556 pr_warn("SMI message count %d at exit\n", count); 5557 count = atomic_read(&recv_msg_inuse_count); 5558 if (count != 0) 5559 pr_warn("recv message count %d at exit\n", count); 5560 5561 cleanup_srcu_struct(&ipmi_interfaces_srcu); 5562 } 5563 if (drvregistered) 5564 driver_unregister(&ipmidriver.driver); 5565 } 5566 module_exit(cleanup_ipmi); 5567 5568 module_init(ipmi_init_msghandler_mod); 5569 MODULE_LICENSE("GPL"); 5570 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>"); 5571 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI interface."); 5572 MODULE_VERSION(IPMI_DRIVER_VERSION); 5573 MODULE_SOFTDEP("post: ipmi_devintf"); 5574