1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * ipmi_msghandler.c 4 * 5 * Incoming and outgoing message routing for an IPMI interface. 6 * 7 * Author: MontaVista Software, Inc. 8 * Corey Minyard <minyard@mvista.com> 9 * source@mvista.com 10 * 11 * Copyright 2002 MontaVista Software Inc. 12 */ 13 14 #define pr_fmt(fmt) "%s" fmt, "IPMI message handler: " 15 #define dev_fmt pr_fmt 16 17 #include <linux/module.h> 18 #include <linux/errno.h> 19 #include <linux/poll.h> 20 #include <linux/sched.h> 21 #include <linux/seq_file.h> 22 #include <linux/spinlock.h> 23 #include <linux/mutex.h> 24 #include <linux/slab.h> 25 #include <linux/ipmi.h> 26 #include <linux/ipmi_smi.h> 27 #include <linux/notifier.h> 28 #include <linux/init.h> 29 #include <linux/proc_fs.h> 30 #include <linux/rcupdate.h> 31 #include <linux/interrupt.h> 32 #include <linux/moduleparam.h> 33 #include <linux/workqueue.h> 34 #include <linux/uuid.h> 35 #include <linux/nospec.h> 36 #include <linux/vmalloc.h> 37 38 #define IPMI_DRIVER_VERSION "39.2" 39 40 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void); 41 static int ipmi_init_msghandler(void); 42 static void smi_recv_tasklet(unsigned long); 43 static void handle_new_recv_msgs(struct ipmi_smi *intf); 44 static void need_waiter(struct ipmi_smi *intf); 45 static int handle_one_recv_msg(struct ipmi_smi *intf, 46 struct ipmi_smi_msg *msg); 47 48 static bool initialized; 49 static bool drvregistered; 50 51 enum ipmi_panic_event_op { 52 IPMI_SEND_PANIC_EVENT_NONE, 53 IPMI_SEND_PANIC_EVENT, 54 IPMI_SEND_PANIC_EVENT_STRING 55 }; 56 #ifdef CONFIG_IPMI_PANIC_STRING 57 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT_STRING 58 #elif defined(CONFIG_IPMI_PANIC_EVENT) 59 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT 60 #else 61 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT_NONE 62 #endif 63 static enum ipmi_panic_event_op ipmi_send_panic_event = IPMI_PANIC_DEFAULT; 64 65 static int panic_op_write_handler(const char *val, 66 const struct kernel_param *kp) 67 { 68 char valcp[16]; 69 char *s; 70 71 strncpy(valcp, val, 15); 72 valcp[15] = '\0'; 73 74 s = strstrip(valcp); 75 76 if (strcmp(s, "none") == 0) 77 ipmi_send_panic_event = IPMI_SEND_PANIC_EVENT_NONE; 78 else if (strcmp(s, "event") == 0) 79 ipmi_send_panic_event = IPMI_SEND_PANIC_EVENT; 80 else if (strcmp(s, "string") == 0) 81 ipmi_send_panic_event = IPMI_SEND_PANIC_EVENT_STRING; 82 else 83 return -EINVAL; 84 85 return 0; 86 } 87 88 static int panic_op_read_handler(char *buffer, const struct kernel_param *kp) 89 { 90 switch (ipmi_send_panic_event) { 91 case IPMI_SEND_PANIC_EVENT_NONE: 92 strcpy(buffer, "none"); 93 break; 94 95 case IPMI_SEND_PANIC_EVENT: 96 strcpy(buffer, "event"); 97 break; 98 99 case IPMI_SEND_PANIC_EVENT_STRING: 100 strcpy(buffer, "string"); 101 break; 102 103 default: 104 strcpy(buffer, "???"); 105 break; 106 } 107 108 return strlen(buffer); 109 } 110 111 static const struct kernel_param_ops panic_op_ops = { 112 .set = panic_op_write_handler, 113 .get = panic_op_read_handler 114 }; 115 module_param_cb(panic_op, &panic_op_ops, NULL, 0600); 116 MODULE_PARM_DESC(panic_op, "Sets if the IPMI driver will attempt to store panic information in the event log in the event of a panic. Set to 'none' for no, 'event' for a single event, or 'string' for a generic event and the panic string in IPMI OEM events."); 117 118 119 #define MAX_EVENTS_IN_QUEUE 25 120 121 /* Remain in auto-maintenance mode for this amount of time (in ms). */ 122 static unsigned long maintenance_mode_timeout_ms = 30000; 123 module_param(maintenance_mode_timeout_ms, ulong, 0644); 124 MODULE_PARM_DESC(maintenance_mode_timeout_ms, 125 "The time (milliseconds) after the last maintenance message that the connection stays in maintenance mode."); 126 127 /* 128 * Don't let a message sit in a queue forever, always time it with at lest 129 * the max message timer. This is in milliseconds. 130 */ 131 #define MAX_MSG_TIMEOUT 60000 132 133 /* 134 * Timeout times below are in milliseconds, and are done off a 1 135 * second timer. So setting the value to 1000 would mean anything 136 * between 0 and 1000ms. So really the only reasonable minimum 137 * setting it 2000ms, which is between 1 and 2 seconds. 138 */ 139 140 /* The default timeout for message retries. */ 141 static unsigned long default_retry_ms = 2000; 142 module_param(default_retry_ms, ulong, 0644); 143 MODULE_PARM_DESC(default_retry_ms, 144 "The time (milliseconds) between retry sends"); 145 146 /* The default timeout for maintenance mode message retries. */ 147 static unsigned long default_maintenance_retry_ms = 3000; 148 module_param(default_maintenance_retry_ms, ulong, 0644); 149 MODULE_PARM_DESC(default_maintenance_retry_ms, 150 "The time (milliseconds) between retry sends in maintenance mode"); 151 152 /* The default maximum number of retries */ 153 static unsigned int default_max_retries = 4; 154 module_param(default_max_retries, uint, 0644); 155 MODULE_PARM_DESC(default_max_retries, 156 "The time (milliseconds) between retry sends in maintenance mode"); 157 158 /* Call every ~1000 ms. */ 159 #define IPMI_TIMEOUT_TIME 1000 160 161 /* How many jiffies does it take to get to the timeout time. */ 162 #define IPMI_TIMEOUT_JIFFIES ((IPMI_TIMEOUT_TIME * HZ) / 1000) 163 164 /* 165 * Request events from the queue every second (this is the number of 166 * IPMI_TIMEOUT_TIMES between event requests). Hopefully, in the 167 * future, IPMI will add a way to know immediately if an event is in 168 * the queue and this silliness can go away. 169 */ 170 #define IPMI_REQUEST_EV_TIME (1000 / (IPMI_TIMEOUT_TIME)) 171 172 /* How long should we cache dynamic device IDs? */ 173 #define IPMI_DYN_DEV_ID_EXPIRY (10 * HZ) 174 175 /* 176 * The main "user" data structure. 177 */ 178 struct ipmi_user { 179 struct list_head link; 180 181 /* 182 * Set to NULL when the user is destroyed, a pointer to myself 183 * so srcu_dereference can be used on it. 184 */ 185 struct ipmi_user *self; 186 struct srcu_struct release_barrier; 187 188 struct kref refcount; 189 190 /* The upper layer that handles receive messages. */ 191 const struct ipmi_user_hndl *handler; 192 void *handler_data; 193 194 /* The interface this user is bound to. */ 195 struct ipmi_smi *intf; 196 197 /* Does this interface receive IPMI events? */ 198 bool gets_events; 199 200 /* Free must run in process context for RCU cleanup. */ 201 struct work_struct remove_work; 202 }; 203 204 static struct ipmi_user *acquire_ipmi_user(struct ipmi_user *user, int *index) 205 __acquires(user->release_barrier) 206 { 207 struct ipmi_user *ruser; 208 209 *index = srcu_read_lock(&user->release_barrier); 210 ruser = srcu_dereference(user->self, &user->release_barrier); 211 if (!ruser) 212 srcu_read_unlock(&user->release_barrier, *index); 213 return ruser; 214 } 215 216 static void release_ipmi_user(struct ipmi_user *user, int index) 217 { 218 srcu_read_unlock(&user->release_barrier, index); 219 } 220 221 struct cmd_rcvr { 222 struct list_head link; 223 224 struct ipmi_user *user; 225 unsigned char netfn; 226 unsigned char cmd; 227 unsigned int chans; 228 229 /* 230 * This is used to form a linked lised during mass deletion. 231 * Since this is in an RCU list, we cannot use the link above 232 * or change any data until the RCU period completes. So we 233 * use this next variable during mass deletion so we can have 234 * a list and don't have to wait and restart the search on 235 * every individual deletion of a command. 236 */ 237 struct cmd_rcvr *next; 238 }; 239 240 struct seq_table { 241 unsigned int inuse : 1; 242 unsigned int broadcast : 1; 243 244 unsigned long timeout; 245 unsigned long orig_timeout; 246 unsigned int retries_left; 247 248 /* 249 * To verify on an incoming send message response that this is 250 * the message that the response is for, we keep a sequence id 251 * and increment it every time we send a message. 252 */ 253 long seqid; 254 255 /* 256 * This is held so we can properly respond to the message on a 257 * timeout, and it is used to hold the temporary data for 258 * retransmission, too. 259 */ 260 struct ipmi_recv_msg *recv_msg; 261 }; 262 263 /* 264 * Store the information in a msgid (long) to allow us to find a 265 * sequence table entry from the msgid. 266 */ 267 #define STORE_SEQ_IN_MSGID(seq, seqid) \ 268 ((((seq) & 0x3f) << 26) | ((seqid) & 0x3ffffff)) 269 270 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \ 271 do { \ 272 seq = (((msgid) >> 26) & 0x3f); \ 273 seqid = ((msgid) & 0x3ffffff); \ 274 } while (0) 275 276 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3ffffff) 277 278 #define IPMI_MAX_CHANNELS 16 279 struct ipmi_channel { 280 unsigned char medium; 281 unsigned char protocol; 282 }; 283 284 struct ipmi_channel_set { 285 struct ipmi_channel c[IPMI_MAX_CHANNELS]; 286 }; 287 288 struct ipmi_my_addrinfo { 289 /* 290 * My slave address. This is initialized to IPMI_BMC_SLAVE_ADDR, 291 * but may be changed by the user. 292 */ 293 unsigned char address; 294 295 /* 296 * My LUN. This should generally stay the SMS LUN, but just in 297 * case... 298 */ 299 unsigned char lun; 300 }; 301 302 /* 303 * Note that the product id, manufacturer id, guid, and device id are 304 * immutable in this structure, so dyn_mutex is not required for 305 * accessing those. If those change on a BMC, a new BMC is allocated. 306 */ 307 struct bmc_device { 308 struct platform_device pdev; 309 struct list_head intfs; /* Interfaces on this BMC. */ 310 struct ipmi_device_id id; 311 struct ipmi_device_id fetch_id; 312 int dyn_id_set; 313 unsigned long dyn_id_expiry; 314 struct mutex dyn_mutex; /* Protects id, intfs, & dyn* */ 315 guid_t guid; 316 guid_t fetch_guid; 317 int dyn_guid_set; 318 struct kref usecount; 319 struct work_struct remove_work; 320 }; 321 #define to_bmc_device(x) container_of((x), struct bmc_device, pdev.dev) 322 323 static int bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, 324 struct ipmi_device_id *id, 325 bool *guid_set, guid_t *guid); 326 327 /* 328 * Various statistics for IPMI, these index stats[] in the ipmi_smi 329 * structure. 330 */ 331 enum ipmi_stat_indexes { 332 /* Commands we got from the user that were invalid. */ 333 IPMI_STAT_sent_invalid_commands = 0, 334 335 /* Commands we sent to the MC. */ 336 IPMI_STAT_sent_local_commands, 337 338 /* Responses from the MC that were delivered to a user. */ 339 IPMI_STAT_handled_local_responses, 340 341 /* Responses from the MC that were not delivered to a user. */ 342 IPMI_STAT_unhandled_local_responses, 343 344 /* Commands we sent out to the IPMB bus. */ 345 IPMI_STAT_sent_ipmb_commands, 346 347 /* Commands sent on the IPMB that had errors on the SEND CMD */ 348 IPMI_STAT_sent_ipmb_command_errs, 349 350 /* Each retransmit increments this count. */ 351 IPMI_STAT_retransmitted_ipmb_commands, 352 353 /* 354 * When a message times out (runs out of retransmits) this is 355 * incremented. 356 */ 357 IPMI_STAT_timed_out_ipmb_commands, 358 359 /* 360 * This is like above, but for broadcasts. Broadcasts are 361 * *not* included in the above count (they are expected to 362 * time out). 363 */ 364 IPMI_STAT_timed_out_ipmb_broadcasts, 365 366 /* Responses I have sent to the IPMB bus. */ 367 IPMI_STAT_sent_ipmb_responses, 368 369 /* The response was delivered to the user. */ 370 IPMI_STAT_handled_ipmb_responses, 371 372 /* The response had invalid data in it. */ 373 IPMI_STAT_invalid_ipmb_responses, 374 375 /* The response didn't have anyone waiting for it. */ 376 IPMI_STAT_unhandled_ipmb_responses, 377 378 /* Commands we sent out to the IPMB bus. */ 379 IPMI_STAT_sent_lan_commands, 380 381 /* Commands sent on the IPMB that had errors on the SEND CMD */ 382 IPMI_STAT_sent_lan_command_errs, 383 384 /* Each retransmit increments this count. */ 385 IPMI_STAT_retransmitted_lan_commands, 386 387 /* 388 * When a message times out (runs out of retransmits) this is 389 * incremented. 390 */ 391 IPMI_STAT_timed_out_lan_commands, 392 393 /* Responses I have sent to the IPMB bus. */ 394 IPMI_STAT_sent_lan_responses, 395 396 /* The response was delivered to the user. */ 397 IPMI_STAT_handled_lan_responses, 398 399 /* The response had invalid data in it. */ 400 IPMI_STAT_invalid_lan_responses, 401 402 /* The response didn't have anyone waiting for it. */ 403 IPMI_STAT_unhandled_lan_responses, 404 405 /* The command was delivered to the user. */ 406 IPMI_STAT_handled_commands, 407 408 /* The command had invalid data in it. */ 409 IPMI_STAT_invalid_commands, 410 411 /* The command didn't have anyone waiting for it. */ 412 IPMI_STAT_unhandled_commands, 413 414 /* Invalid data in an event. */ 415 IPMI_STAT_invalid_events, 416 417 /* Events that were received with the proper format. */ 418 IPMI_STAT_events, 419 420 /* Retransmissions on IPMB that failed. */ 421 IPMI_STAT_dropped_rexmit_ipmb_commands, 422 423 /* Retransmissions on LAN that failed. */ 424 IPMI_STAT_dropped_rexmit_lan_commands, 425 426 /* This *must* remain last, add new values above this. */ 427 IPMI_NUM_STATS 428 }; 429 430 431 #define IPMI_IPMB_NUM_SEQ 64 432 struct ipmi_smi { 433 struct module *owner; 434 435 /* What interface number are we? */ 436 int intf_num; 437 438 struct kref refcount; 439 440 /* Set when the interface is being unregistered. */ 441 bool in_shutdown; 442 443 /* Used for a list of interfaces. */ 444 struct list_head link; 445 446 /* 447 * The list of upper layers that are using me. seq_lock write 448 * protects this. Read protection is with srcu. 449 */ 450 struct list_head users; 451 struct srcu_struct users_srcu; 452 453 /* Used for wake ups at startup. */ 454 wait_queue_head_t waitq; 455 456 /* 457 * Prevents the interface from being unregistered when the 458 * interface is used by being looked up through the BMC 459 * structure. 460 */ 461 struct mutex bmc_reg_mutex; 462 463 struct bmc_device tmp_bmc; 464 struct bmc_device *bmc; 465 bool bmc_registered; 466 struct list_head bmc_link; 467 char *my_dev_name; 468 bool in_bmc_register; /* Handle recursive situations. Yuck. */ 469 struct work_struct bmc_reg_work; 470 471 const struct ipmi_smi_handlers *handlers; 472 void *send_info; 473 474 /* Driver-model device for the system interface. */ 475 struct device *si_dev; 476 477 /* 478 * A table of sequence numbers for this interface. We use the 479 * sequence numbers for IPMB messages that go out of the 480 * interface to match them up with their responses. A routine 481 * is called periodically to time the items in this list. 482 */ 483 spinlock_t seq_lock; 484 struct seq_table seq_table[IPMI_IPMB_NUM_SEQ]; 485 int curr_seq; 486 487 /* 488 * Messages queued for delivery. If delivery fails (out of memory 489 * for instance), They will stay in here to be processed later in a 490 * periodic timer interrupt. The tasklet is for handling received 491 * messages directly from the handler. 492 */ 493 spinlock_t waiting_rcv_msgs_lock; 494 struct list_head waiting_rcv_msgs; 495 atomic_t watchdog_pretimeouts_to_deliver; 496 struct tasklet_struct recv_tasklet; 497 498 spinlock_t xmit_msgs_lock; 499 struct list_head xmit_msgs; 500 struct ipmi_smi_msg *curr_msg; 501 struct list_head hp_xmit_msgs; 502 503 /* 504 * The list of command receivers that are registered for commands 505 * on this interface. 506 */ 507 struct mutex cmd_rcvrs_mutex; 508 struct list_head cmd_rcvrs; 509 510 /* 511 * Events that were queues because no one was there to receive 512 * them. 513 */ 514 spinlock_t events_lock; /* For dealing with event stuff. */ 515 struct list_head waiting_events; 516 unsigned int waiting_events_count; /* How many events in queue? */ 517 char delivering_events; 518 char event_msg_printed; 519 520 /* How many users are waiting for events? */ 521 atomic_t event_waiters; 522 unsigned int ticks_to_req_ev; 523 524 spinlock_t watch_lock; /* For dealing with watch stuff below. */ 525 526 /* How many users are waiting for commands? */ 527 unsigned int command_waiters; 528 529 /* How many users are waiting for watchdogs? */ 530 unsigned int watchdog_waiters; 531 532 /* How many users are waiting for message responses? */ 533 unsigned int response_waiters; 534 535 /* 536 * Tells what the lower layer has last been asked to watch for, 537 * messages and/or watchdogs. Protected by watch_lock. 538 */ 539 unsigned int last_watch_mask; 540 541 /* 542 * The event receiver for my BMC, only really used at panic 543 * shutdown as a place to store this. 544 */ 545 unsigned char event_receiver; 546 unsigned char event_receiver_lun; 547 unsigned char local_sel_device; 548 unsigned char local_event_generator; 549 550 /* For handling of maintenance mode. */ 551 int maintenance_mode; 552 bool maintenance_mode_enable; 553 int auto_maintenance_timeout; 554 spinlock_t maintenance_mode_lock; /* Used in a timer... */ 555 556 /* 557 * If we are doing maintenance on something on IPMB, extend 558 * the timeout time to avoid timeouts writing firmware and 559 * such. 560 */ 561 int ipmb_maintenance_mode_timeout; 562 563 /* 564 * A cheap hack, if this is non-null and a message to an 565 * interface comes in with a NULL user, call this routine with 566 * it. Note that the message will still be freed by the 567 * caller. This only works on the system interface. 568 * 569 * Protected by bmc_reg_mutex. 570 */ 571 void (*null_user_handler)(struct ipmi_smi *intf, 572 struct ipmi_recv_msg *msg); 573 574 /* 575 * When we are scanning the channels for an SMI, this will 576 * tell which channel we are scanning. 577 */ 578 int curr_channel; 579 580 /* Channel information */ 581 struct ipmi_channel_set *channel_list; 582 unsigned int curr_working_cset; /* First index into the following. */ 583 struct ipmi_channel_set wchannels[2]; 584 struct ipmi_my_addrinfo addrinfo[IPMI_MAX_CHANNELS]; 585 bool channels_ready; 586 587 atomic_t stats[IPMI_NUM_STATS]; 588 589 /* 590 * run_to_completion duplicate of smb_info, smi_info 591 * and ipmi_serial_info structures. Used to decrease numbers of 592 * parameters passed by "low" level IPMI code. 593 */ 594 int run_to_completion; 595 }; 596 #define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev) 597 598 static void __get_guid(struct ipmi_smi *intf); 599 static void __ipmi_bmc_unregister(struct ipmi_smi *intf); 600 static int __ipmi_bmc_register(struct ipmi_smi *intf, 601 struct ipmi_device_id *id, 602 bool guid_set, guid_t *guid, int intf_num); 603 static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id); 604 605 606 /** 607 * The driver model view of the IPMI messaging driver. 608 */ 609 static struct platform_driver ipmidriver = { 610 .driver = { 611 .name = "ipmi", 612 .bus = &platform_bus_type 613 } 614 }; 615 /* 616 * This mutex keeps us from adding the same BMC twice. 617 */ 618 static DEFINE_MUTEX(ipmidriver_mutex); 619 620 static LIST_HEAD(ipmi_interfaces); 621 static DEFINE_MUTEX(ipmi_interfaces_mutex); 622 #define ipmi_interfaces_mutex_held() \ 623 lockdep_is_held(&ipmi_interfaces_mutex) 624 static struct srcu_struct ipmi_interfaces_srcu; 625 626 /* 627 * List of watchers that want to know when smi's are added and deleted. 628 */ 629 static LIST_HEAD(smi_watchers); 630 static DEFINE_MUTEX(smi_watchers_mutex); 631 632 #define ipmi_inc_stat(intf, stat) \ 633 atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat]) 634 #define ipmi_get_stat(intf, stat) \ 635 ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat])) 636 637 static const char * const addr_src_to_str[] = { 638 "invalid", "hotmod", "hardcoded", "SPMI", "ACPI", "SMBIOS", "PCI", 639 "device-tree", "platform" 640 }; 641 642 const char *ipmi_addr_src_to_str(enum ipmi_addr_src src) 643 { 644 if (src >= SI_LAST) 645 src = 0; /* Invalid */ 646 return addr_src_to_str[src]; 647 } 648 EXPORT_SYMBOL(ipmi_addr_src_to_str); 649 650 static int is_lan_addr(struct ipmi_addr *addr) 651 { 652 return addr->addr_type == IPMI_LAN_ADDR_TYPE; 653 } 654 655 static int is_ipmb_addr(struct ipmi_addr *addr) 656 { 657 return addr->addr_type == IPMI_IPMB_ADDR_TYPE; 658 } 659 660 static int is_ipmb_bcast_addr(struct ipmi_addr *addr) 661 { 662 return addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE; 663 } 664 665 static void free_recv_msg_list(struct list_head *q) 666 { 667 struct ipmi_recv_msg *msg, *msg2; 668 669 list_for_each_entry_safe(msg, msg2, q, link) { 670 list_del(&msg->link); 671 ipmi_free_recv_msg(msg); 672 } 673 } 674 675 static void free_smi_msg_list(struct list_head *q) 676 { 677 struct ipmi_smi_msg *msg, *msg2; 678 679 list_for_each_entry_safe(msg, msg2, q, link) { 680 list_del(&msg->link); 681 ipmi_free_smi_msg(msg); 682 } 683 } 684 685 static void clean_up_interface_data(struct ipmi_smi *intf) 686 { 687 int i; 688 struct cmd_rcvr *rcvr, *rcvr2; 689 struct list_head list; 690 691 tasklet_kill(&intf->recv_tasklet); 692 693 free_smi_msg_list(&intf->waiting_rcv_msgs); 694 free_recv_msg_list(&intf->waiting_events); 695 696 /* 697 * Wholesale remove all the entries from the list in the 698 * interface and wait for RCU to know that none are in use. 699 */ 700 mutex_lock(&intf->cmd_rcvrs_mutex); 701 INIT_LIST_HEAD(&list); 702 list_splice_init_rcu(&intf->cmd_rcvrs, &list, synchronize_rcu); 703 mutex_unlock(&intf->cmd_rcvrs_mutex); 704 705 list_for_each_entry_safe(rcvr, rcvr2, &list, link) 706 kfree(rcvr); 707 708 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) { 709 if ((intf->seq_table[i].inuse) 710 && (intf->seq_table[i].recv_msg)) 711 ipmi_free_recv_msg(intf->seq_table[i].recv_msg); 712 } 713 } 714 715 static void intf_free(struct kref *ref) 716 { 717 struct ipmi_smi *intf = container_of(ref, struct ipmi_smi, refcount); 718 719 clean_up_interface_data(intf); 720 kfree(intf); 721 } 722 723 struct watcher_entry { 724 int intf_num; 725 struct ipmi_smi *intf; 726 struct list_head link; 727 }; 728 729 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher) 730 { 731 struct ipmi_smi *intf; 732 int index, rv; 733 734 /* 735 * Make sure the driver is actually initialized, this handles 736 * problems with initialization order. 737 */ 738 rv = ipmi_init_msghandler(); 739 if (rv) 740 return rv; 741 742 mutex_lock(&smi_watchers_mutex); 743 744 list_add(&watcher->link, &smi_watchers); 745 746 index = srcu_read_lock(&ipmi_interfaces_srcu); 747 list_for_each_entry_rcu(intf, &ipmi_interfaces, link) { 748 int intf_num = READ_ONCE(intf->intf_num); 749 750 if (intf_num == -1) 751 continue; 752 watcher->new_smi(intf_num, intf->si_dev); 753 } 754 srcu_read_unlock(&ipmi_interfaces_srcu, index); 755 756 mutex_unlock(&smi_watchers_mutex); 757 758 return 0; 759 } 760 EXPORT_SYMBOL(ipmi_smi_watcher_register); 761 762 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher) 763 { 764 mutex_lock(&smi_watchers_mutex); 765 list_del(&watcher->link); 766 mutex_unlock(&smi_watchers_mutex); 767 return 0; 768 } 769 EXPORT_SYMBOL(ipmi_smi_watcher_unregister); 770 771 /* 772 * Must be called with smi_watchers_mutex held. 773 */ 774 static void 775 call_smi_watchers(int i, struct device *dev) 776 { 777 struct ipmi_smi_watcher *w; 778 779 mutex_lock(&smi_watchers_mutex); 780 list_for_each_entry(w, &smi_watchers, link) { 781 if (try_module_get(w->owner)) { 782 w->new_smi(i, dev); 783 module_put(w->owner); 784 } 785 } 786 mutex_unlock(&smi_watchers_mutex); 787 } 788 789 static int 790 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2) 791 { 792 if (addr1->addr_type != addr2->addr_type) 793 return 0; 794 795 if (addr1->channel != addr2->channel) 796 return 0; 797 798 if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) { 799 struct ipmi_system_interface_addr *smi_addr1 800 = (struct ipmi_system_interface_addr *) addr1; 801 struct ipmi_system_interface_addr *smi_addr2 802 = (struct ipmi_system_interface_addr *) addr2; 803 return (smi_addr1->lun == smi_addr2->lun); 804 } 805 806 if (is_ipmb_addr(addr1) || is_ipmb_bcast_addr(addr1)) { 807 struct ipmi_ipmb_addr *ipmb_addr1 808 = (struct ipmi_ipmb_addr *) addr1; 809 struct ipmi_ipmb_addr *ipmb_addr2 810 = (struct ipmi_ipmb_addr *) addr2; 811 812 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr) 813 && (ipmb_addr1->lun == ipmb_addr2->lun)); 814 } 815 816 if (is_lan_addr(addr1)) { 817 struct ipmi_lan_addr *lan_addr1 818 = (struct ipmi_lan_addr *) addr1; 819 struct ipmi_lan_addr *lan_addr2 820 = (struct ipmi_lan_addr *) addr2; 821 822 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID) 823 && (lan_addr1->local_SWID == lan_addr2->local_SWID) 824 && (lan_addr1->session_handle 825 == lan_addr2->session_handle) 826 && (lan_addr1->lun == lan_addr2->lun)); 827 } 828 829 return 1; 830 } 831 832 int ipmi_validate_addr(struct ipmi_addr *addr, int len) 833 { 834 if (len < sizeof(struct ipmi_system_interface_addr)) 835 return -EINVAL; 836 837 if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) { 838 if (addr->channel != IPMI_BMC_CHANNEL) 839 return -EINVAL; 840 return 0; 841 } 842 843 if ((addr->channel == IPMI_BMC_CHANNEL) 844 || (addr->channel >= IPMI_MAX_CHANNELS) 845 || (addr->channel < 0)) 846 return -EINVAL; 847 848 if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) { 849 if (len < sizeof(struct ipmi_ipmb_addr)) 850 return -EINVAL; 851 return 0; 852 } 853 854 if (is_lan_addr(addr)) { 855 if (len < sizeof(struct ipmi_lan_addr)) 856 return -EINVAL; 857 return 0; 858 } 859 860 return -EINVAL; 861 } 862 EXPORT_SYMBOL(ipmi_validate_addr); 863 864 unsigned int ipmi_addr_length(int addr_type) 865 { 866 if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 867 return sizeof(struct ipmi_system_interface_addr); 868 869 if ((addr_type == IPMI_IPMB_ADDR_TYPE) 870 || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)) 871 return sizeof(struct ipmi_ipmb_addr); 872 873 if (addr_type == IPMI_LAN_ADDR_TYPE) 874 return sizeof(struct ipmi_lan_addr); 875 876 return 0; 877 } 878 EXPORT_SYMBOL(ipmi_addr_length); 879 880 static int deliver_response(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) 881 { 882 int rv = 0; 883 884 if (!msg->user) { 885 /* Special handling for NULL users. */ 886 if (intf->null_user_handler) { 887 intf->null_user_handler(intf, msg); 888 } else { 889 /* No handler, so give up. */ 890 rv = -EINVAL; 891 } 892 ipmi_free_recv_msg(msg); 893 } else if (oops_in_progress) { 894 /* 895 * If we are running in the panic context, calling the 896 * receive handler doesn't much meaning and has a deadlock 897 * risk. At this moment, simply skip it in that case. 898 */ 899 ipmi_free_recv_msg(msg); 900 } else { 901 int index; 902 struct ipmi_user *user = acquire_ipmi_user(msg->user, &index); 903 904 if (user) { 905 user->handler->ipmi_recv_hndl(msg, user->handler_data); 906 release_ipmi_user(user, index); 907 } else { 908 /* User went away, give up. */ 909 ipmi_free_recv_msg(msg); 910 rv = -EINVAL; 911 } 912 } 913 914 return rv; 915 } 916 917 static void deliver_local_response(struct ipmi_smi *intf, 918 struct ipmi_recv_msg *msg) 919 { 920 if (deliver_response(intf, msg)) 921 ipmi_inc_stat(intf, unhandled_local_responses); 922 else 923 ipmi_inc_stat(intf, handled_local_responses); 924 } 925 926 static void deliver_err_response(struct ipmi_smi *intf, 927 struct ipmi_recv_msg *msg, int err) 928 { 929 msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 930 msg->msg_data[0] = err; 931 msg->msg.netfn |= 1; /* Convert to a response. */ 932 msg->msg.data_len = 1; 933 msg->msg.data = msg->msg_data; 934 deliver_local_response(intf, msg); 935 } 936 937 static void smi_add_watch(struct ipmi_smi *intf, unsigned int flags) 938 { 939 unsigned long iflags; 940 941 if (!intf->handlers->set_need_watch) 942 return; 943 944 spin_lock_irqsave(&intf->watch_lock, iflags); 945 if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES) 946 intf->response_waiters++; 947 948 if (flags & IPMI_WATCH_MASK_CHECK_WATCHDOG) 949 intf->watchdog_waiters++; 950 951 if (flags & IPMI_WATCH_MASK_CHECK_COMMANDS) 952 intf->command_waiters++; 953 954 if ((intf->last_watch_mask & flags) != flags) { 955 intf->last_watch_mask |= flags; 956 intf->handlers->set_need_watch(intf->send_info, 957 intf->last_watch_mask); 958 } 959 spin_unlock_irqrestore(&intf->watch_lock, iflags); 960 } 961 962 static void smi_remove_watch(struct ipmi_smi *intf, unsigned int flags) 963 { 964 unsigned long iflags; 965 966 if (!intf->handlers->set_need_watch) 967 return; 968 969 spin_lock_irqsave(&intf->watch_lock, iflags); 970 if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES) 971 intf->response_waiters--; 972 973 if (flags & IPMI_WATCH_MASK_CHECK_WATCHDOG) 974 intf->watchdog_waiters--; 975 976 if (flags & IPMI_WATCH_MASK_CHECK_COMMANDS) 977 intf->command_waiters--; 978 979 flags = 0; 980 if (intf->response_waiters) 981 flags |= IPMI_WATCH_MASK_CHECK_MESSAGES; 982 if (intf->watchdog_waiters) 983 flags |= IPMI_WATCH_MASK_CHECK_WATCHDOG; 984 if (intf->command_waiters) 985 flags |= IPMI_WATCH_MASK_CHECK_COMMANDS; 986 987 if (intf->last_watch_mask != flags) { 988 intf->last_watch_mask = flags; 989 intf->handlers->set_need_watch(intf->send_info, 990 intf->last_watch_mask); 991 } 992 spin_unlock_irqrestore(&intf->watch_lock, iflags); 993 } 994 995 /* 996 * Find the next sequence number not being used and add the given 997 * message with the given timeout to the sequence table. This must be 998 * called with the interface's seq_lock held. 999 */ 1000 static int intf_next_seq(struct ipmi_smi *intf, 1001 struct ipmi_recv_msg *recv_msg, 1002 unsigned long timeout, 1003 int retries, 1004 int broadcast, 1005 unsigned char *seq, 1006 long *seqid) 1007 { 1008 int rv = 0; 1009 unsigned int i; 1010 1011 if (timeout == 0) 1012 timeout = default_retry_ms; 1013 if (retries < 0) 1014 retries = default_max_retries; 1015 1016 for (i = intf->curr_seq; (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq; 1017 i = (i+1)%IPMI_IPMB_NUM_SEQ) { 1018 if (!intf->seq_table[i].inuse) 1019 break; 1020 } 1021 1022 if (!intf->seq_table[i].inuse) { 1023 intf->seq_table[i].recv_msg = recv_msg; 1024 1025 /* 1026 * Start with the maximum timeout, when the send response 1027 * comes in we will start the real timer. 1028 */ 1029 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT; 1030 intf->seq_table[i].orig_timeout = timeout; 1031 intf->seq_table[i].retries_left = retries; 1032 intf->seq_table[i].broadcast = broadcast; 1033 intf->seq_table[i].inuse = 1; 1034 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid); 1035 *seq = i; 1036 *seqid = intf->seq_table[i].seqid; 1037 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ; 1038 smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 1039 need_waiter(intf); 1040 } else { 1041 rv = -EAGAIN; 1042 } 1043 1044 return rv; 1045 } 1046 1047 /* 1048 * Return the receive message for the given sequence number and 1049 * release the sequence number so it can be reused. Some other data 1050 * is passed in to be sure the message matches up correctly (to help 1051 * guard against message coming in after their timeout and the 1052 * sequence number being reused). 1053 */ 1054 static int intf_find_seq(struct ipmi_smi *intf, 1055 unsigned char seq, 1056 short channel, 1057 unsigned char cmd, 1058 unsigned char netfn, 1059 struct ipmi_addr *addr, 1060 struct ipmi_recv_msg **recv_msg) 1061 { 1062 int rv = -ENODEV; 1063 unsigned long flags; 1064 1065 if (seq >= IPMI_IPMB_NUM_SEQ) 1066 return -EINVAL; 1067 1068 spin_lock_irqsave(&intf->seq_lock, flags); 1069 if (intf->seq_table[seq].inuse) { 1070 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg; 1071 1072 if ((msg->addr.channel == channel) && (msg->msg.cmd == cmd) 1073 && (msg->msg.netfn == netfn) 1074 && (ipmi_addr_equal(addr, &msg->addr))) { 1075 *recv_msg = msg; 1076 intf->seq_table[seq].inuse = 0; 1077 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 1078 rv = 0; 1079 } 1080 } 1081 spin_unlock_irqrestore(&intf->seq_lock, flags); 1082 1083 return rv; 1084 } 1085 1086 1087 /* Start the timer for a specific sequence table entry. */ 1088 static int intf_start_seq_timer(struct ipmi_smi *intf, 1089 long msgid) 1090 { 1091 int rv = -ENODEV; 1092 unsigned long flags; 1093 unsigned char seq; 1094 unsigned long seqid; 1095 1096 1097 GET_SEQ_FROM_MSGID(msgid, seq, seqid); 1098 1099 spin_lock_irqsave(&intf->seq_lock, flags); 1100 /* 1101 * We do this verification because the user can be deleted 1102 * while a message is outstanding. 1103 */ 1104 if ((intf->seq_table[seq].inuse) 1105 && (intf->seq_table[seq].seqid == seqid)) { 1106 struct seq_table *ent = &intf->seq_table[seq]; 1107 ent->timeout = ent->orig_timeout; 1108 rv = 0; 1109 } 1110 spin_unlock_irqrestore(&intf->seq_lock, flags); 1111 1112 return rv; 1113 } 1114 1115 /* Got an error for the send message for a specific sequence number. */ 1116 static int intf_err_seq(struct ipmi_smi *intf, 1117 long msgid, 1118 unsigned int err) 1119 { 1120 int rv = -ENODEV; 1121 unsigned long flags; 1122 unsigned char seq; 1123 unsigned long seqid; 1124 struct ipmi_recv_msg *msg = NULL; 1125 1126 1127 GET_SEQ_FROM_MSGID(msgid, seq, seqid); 1128 1129 spin_lock_irqsave(&intf->seq_lock, flags); 1130 /* 1131 * We do this verification because the user can be deleted 1132 * while a message is outstanding. 1133 */ 1134 if ((intf->seq_table[seq].inuse) 1135 && (intf->seq_table[seq].seqid == seqid)) { 1136 struct seq_table *ent = &intf->seq_table[seq]; 1137 1138 ent->inuse = 0; 1139 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 1140 msg = ent->recv_msg; 1141 rv = 0; 1142 } 1143 spin_unlock_irqrestore(&intf->seq_lock, flags); 1144 1145 if (msg) 1146 deliver_err_response(intf, msg, err); 1147 1148 return rv; 1149 } 1150 1151 static void free_user_work(struct work_struct *work) 1152 { 1153 struct ipmi_user *user = container_of(work, struct ipmi_user, 1154 remove_work); 1155 1156 cleanup_srcu_struct(&user->release_barrier); 1157 vfree(user); 1158 } 1159 1160 int ipmi_create_user(unsigned int if_num, 1161 const struct ipmi_user_hndl *handler, 1162 void *handler_data, 1163 struct ipmi_user **user) 1164 { 1165 unsigned long flags; 1166 struct ipmi_user *new_user; 1167 int rv, index; 1168 struct ipmi_smi *intf; 1169 1170 /* 1171 * There is no module usecount here, because it's not 1172 * required. Since this can only be used by and called from 1173 * other modules, they will implicitly use this module, and 1174 * thus this can't be removed unless the other modules are 1175 * removed. 1176 */ 1177 1178 if (handler == NULL) 1179 return -EINVAL; 1180 1181 /* 1182 * Make sure the driver is actually initialized, this handles 1183 * problems with initialization order. 1184 */ 1185 rv = ipmi_init_msghandler(); 1186 if (rv) 1187 return rv; 1188 1189 new_user = vzalloc(sizeof(*new_user)); 1190 if (!new_user) 1191 return -ENOMEM; 1192 1193 index = srcu_read_lock(&ipmi_interfaces_srcu); 1194 list_for_each_entry_rcu(intf, &ipmi_interfaces, link) { 1195 if (intf->intf_num == if_num) 1196 goto found; 1197 } 1198 /* Not found, return an error */ 1199 rv = -EINVAL; 1200 goto out_kfree; 1201 1202 found: 1203 INIT_WORK(&new_user->remove_work, free_user_work); 1204 1205 rv = init_srcu_struct(&new_user->release_barrier); 1206 if (rv) 1207 goto out_kfree; 1208 1209 if (!try_module_get(intf->owner)) { 1210 rv = -ENODEV; 1211 goto out_kfree; 1212 } 1213 1214 /* Note that each existing user holds a refcount to the interface. */ 1215 kref_get(&intf->refcount); 1216 1217 kref_init(&new_user->refcount); 1218 new_user->handler = handler; 1219 new_user->handler_data = handler_data; 1220 new_user->intf = intf; 1221 new_user->gets_events = false; 1222 1223 rcu_assign_pointer(new_user->self, new_user); 1224 spin_lock_irqsave(&intf->seq_lock, flags); 1225 list_add_rcu(&new_user->link, &intf->users); 1226 spin_unlock_irqrestore(&intf->seq_lock, flags); 1227 if (handler->ipmi_watchdog_pretimeout) 1228 /* User wants pretimeouts, so make sure to watch for them. */ 1229 smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG); 1230 srcu_read_unlock(&ipmi_interfaces_srcu, index); 1231 *user = new_user; 1232 return 0; 1233 1234 out_kfree: 1235 srcu_read_unlock(&ipmi_interfaces_srcu, index); 1236 vfree(new_user); 1237 return rv; 1238 } 1239 EXPORT_SYMBOL(ipmi_create_user); 1240 1241 int ipmi_get_smi_info(int if_num, struct ipmi_smi_info *data) 1242 { 1243 int rv, index; 1244 struct ipmi_smi *intf; 1245 1246 index = srcu_read_lock(&ipmi_interfaces_srcu); 1247 list_for_each_entry_rcu(intf, &ipmi_interfaces, link) { 1248 if (intf->intf_num == if_num) 1249 goto found; 1250 } 1251 srcu_read_unlock(&ipmi_interfaces_srcu, index); 1252 1253 /* Not found, return an error */ 1254 return -EINVAL; 1255 1256 found: 1257 if (!intf->handlers->get_smi_info) 1258 rv = -ENOTTY; 1259 else 1260 rv = intf->handlers->get_smi_info(intf->send_info, data); 1261 srcu_read_unlock(&ipmi_interfaces_srcu, index); 1262 1263 return rv; 1264 } 1265 EXPORT_SYMBOL(ipmi_get_smi_info); 1266 1267 static void free_user(struct kref *ref) 1268 { 1269 struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount); 1270 1271 /* SRCU cleanup must happen in task context. */ 1272 schedule_work(&user->remove_work); 1273 } 1274 1275 static void _ipmi_destroy_user(struct ipmi_user *user) 1276 { 1277 struct ipmi_smi *intf = user->intf; 1278 int i; 1279 unsigned long flags; 1280 struct cmd_rcvr *rcvr; 1281 struct cmd_rcvr *rcvrs = NULL; 1282 1283 if (!acquire_ipmi_user(user, &i)) { 1284 /* 1285 * The user has already been cleaned up, just make sure 1286 * nothing is using it and return. 1287 */ 1288 synchronize_srcu(&user->release_barrier); 1289 return; 1290 } 1291 1292 rcu_assign_pointer(user->self, NULL); 1293 release_ipmi_user(user, i); 1294 1295 synchronize_srcu(&user->release_barrier); 1296 1297 if (user->handler->shutdown) 1298 user->handler->shutdown(user->handler_data); 1299 1300 if (user->handler->ipmi_watchdog_pretimeout) 1301 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG); 1302 1303 if (user->gets_events) 1304 atomic_dec(&intf->event_waiters); 1305 1306 /* Remove the user from the interface's sequence table. */ 1307 spin_lock_irqsave(&intf->seq_lock, flags); 1308 list_del_rcu(&user->link); 1309 1310 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) { 1311 if (intf->seq_table[i].inuse 1312 && (intf->seq_table[i].recv_msg->user == user)) { 1313 intf->seq_table[i].inuse = 0; 1314 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 1315 ipmi_free_recv_msg(intf->seq_table[i].recv_msg); 1316 } 1317 } 1318 spin_unlock_irqrestore(&intf->seq_lock, flags); 1319 1320 /* 1321 * Remove the user from the command receiver's table. First 1322 * we build a list of everything (not using the standard link, 1323 * since other things may be using it till we do 1324 * synchronize_srcu()) then free everything in that list. 1325 */ 1326 mutex_lock(&intf->cmd_rcvrs_mutex); 1327 list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link, 1328 lockdep_is_held(&intf->cmd_rcvrs_mutex)) { 1329 if (rcvr->user == user) { 1330 list_del_rcu(&rcvr->link); 1331 rcvr->next = rcvrs; 1332 rcvrs = rcvr; 1333 } 1334 } 1335 mutex_unlock(&intf->cmd_rcvrs_mutex); 1336 synchronize_rcu(); 1337 while (rcvrs) { 1338 rcvr = rcvrs; 1339 rcvrs = rcvr->next; 1340 kfree(rcvr); 1341 } 1342 1343 kref_put(&intf->refcount, intf_free); 1344 module_put(intf->owner); 1345 } 1346 1347 int ipmi_destroy_user(struct ipmi_user *user) 1348 { 1349 _ipmi_destroy_user(user); 1350 1351 kref_put(&user->refcount, free_user); 1352 1353 return 0; 1354 } 1355 EXPORT_SYMBOL(ipmi_destroy_user); 1356 1357 int ipmi_get_version(struct ipmi_user *user, 1358 unsigned char *major, 1359 unsigned char *minor) 1360 { 1361 struct ipmi_device_id id; 1362 int rv, index; 1363 1364 user = acquire_ipmi_user(user, &index); 1365 if (!user) 1366 return -ENODEV; 1367 1368 rv = bmc_get_device_id(user->intf, NULL, &id, NULL, NULL); 1369 if (!rv) { 1370 *major = ipmi_version_major(&id); 1371 *minor = ipmi_version_minor(&id); 1372 } 1373 release_ipmi_user(user, index); 1374 1375 return rv; 1376 } 1377 EXPORT_SYMBOL(ipmi_get_version); 1378 1379 int ipmi_set_my_address(struct ipmi_user *user, 1380 unsigned int channel, 1381 unsigned char address) 1382 { 1383 int index, rv = 0; 1384 1385 user = acquire_ipmi_user(user, &index); 1386 if (!user) 1387 return -ENODEV; 1388 1389 if (channel >= IPMI_MAX_CHANNELS) { 1390 rv = -EINVAL; 1391 } else { 1392 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS); 1393 user->intf->addrinfo[channel].address = address; 1394 } 1395 release_ipmi_user(user, index); 1396 1397 return rv; 1398 } 1399 EXPORT_SYMBOL(ipmi_set_my_address); 1400 1401 int ipmi_get_my_address(struct ipmi_user *user, 1402 unsigned int channel, 1403 unsigned char *address) 1404 { 1405 int index, rv = 0; 1406 1407 user = acquire_ipmi_user(user, &index); 1408 if (!user) 1409 return -ENODEV; 1410 1411 if (channel >= IPMI_MAX_CHANNELS) { 1412 rv = -EINVAL; 1413 } else { 1414 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS); 1415 *address = user->intf->addrinfo[channel].address; 1416 } 1417 release_ipmi_user(user, index); 1418 1419 return rv; 1420 } 1421 EXPORT_SYMBOL(ipmi_get_my_address); 1422 1423 int ipmi_set_my_LUN(struct ipmi_user *user, 1424 unsigned int channel, 1425 unsigned char LUN) 1426 { 1427 int index, rv = 0; 1428 1429 user = acquire_ipmi_user(user, &index); 1430 if (!user) 1431 return -ENODEV; 1432 1433 if (channel >= IPMI_MAX_CHANNELS) { 1434 rv = -EINVAL; 1435 } else { 1436 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS); 1437 user->intf->addrinfo[channel].lun = LUN & 0x3; 1438 } 1439 release_ipmi_user(user, index); 1440 1441 return rv; 1442 } 1443 EXPORT_SYMBOL(ipmi_set_my_LUN); 1444 1445 int ipmi_get_my_LUN(struct ipmi_user *user, 1446 unsigned int channel, 1447 unsigned char *address) 1448 { 1449 int index, rv = 0; 1450 1451 user = acquire_ipmi_user(user, &index); 1452 if (!user) 1453 return -ENODEV; 1454 1455 if (channel >= IPMI_MAX_CHANNELS) { 1456 rv = -EINVAL; 1457 } else { 1458 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS); 1459 *address = user->intf->addrinfo[channel].lun; 1460 } 1461 release_ipmi_user(user, index); 1462 1463 return rv; 1464 } 1465 EXPORT_SYMBOL(ipmi_get_my_LUN); 1466 1467 int ipmi_get_maintenance_mode(struct ipmi_user *user) 1468 { 1469 int mode, index; 1470 unsigned long flags; 1471 1472 user = acquire_ipmi_user(user, &index); 1473 if (!user) 1474 return -ENODEV; 1475 1476 spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags); 1477 mode = user->intf->maintenance_mode; 1478 spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags); 1479 release_ipmi_user(user, index); 1480 1481 return mode; 1482 } 1483 EXPORT_SYMBOL(ipmi_get_maintenance_mode); 1484 1485 static void maintenance_mode_update(struct ipmi_smi *intf) 1486 { 1487 if (intf->handlers->set_maintenance_mode) 1488 intf->handlers->set_maintenance_mode( 1489 intf->send_info, intf->maintenance_mode_enable); 1490 } 1491 1492 int ipmi_set_maintenance_mode(struct ipmi_user *user, int mode) 1493 { 1494 int rv = 0, index; 1495 unsigned long flags; 1496 struct ipmi_smi *intf = user->intf; 1497 1498 user = acquire_ipmi_user(user, &index); 1499 if (!user) 1500 return -ENODEV; 1501 1502 spin_lock_irqsave(&intf->maintenance_mode_lock, flags); 1503 if (intf->maintenance_mode != mode) { 1504 switch (mode) { 1505 case IPMI_MAINTENANCE_MODE_AUTO: 1506 intf->maintenance_mode_enable 1507 = (intf->auto_maintenance_timeout > 0); 1508 break; 1509 1510 case IPMI_MAINTENANCE_MODE_OFF: 1511 intf->maintenance_mode_enable = false; 1512 break; 1513 1514 case IPMI_MAINTENANCE_MODE_ON: 1515 intf->maintenance_mode_enable = true; 1516 break; 1517 1518 default: 1519 rv = -EINVAL; 1520 goto out_unlock; 1521 } 1522 intf->maintenance_mode = mode; 1523 1524 maintenance_mode_update(intf); 1525 } 1526 out_unlock: 1527 spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags); 1528 release_ipmi_user(user, index); 1529 1530 return rv; 1531 } 1532 EXPORT_SYMBOL(ipmi_set_maintenance_mode); 1533 1534 int ipmi_set_gets_events(struct ipmi_user *user, bool val) 1535 { 1536 unsigned long flags; 1537 struct ipmi_smi *intf = user->intf; 1538 struct ipmi_recv_msg *msg, *msg2; 1539 struct list_head msgs; 1540 int index; 1541 1542 user = acquire_ipmi_user(user, &index); 1543 if (!user) 1544 return -ENODEV; 1545 1546 INIT_LIST_HEAD(&msgs); 1547 1548 spin_lock_irqsave(&intf->events_lock, flags); 1549 if (user->gets_events == val) 1550 goto out; 1551 1552 user->gets_events = val; 1553 1554 if (val) { 1555 if (atomic_inc_return(&intf->event_waiters) == 1) 1556 need_waiter(intf); 1557 } else { 1558 atomic_dec(&intf->event_waiters); 1559 } 1560 1561 if (intf->delivering_events) 1562 /* 1563 * Another thread is delivering events for this, so 1564 * let it handle any new events. 1565 */ 1566 goto out; 1567 1568 /* Deliver any queued events. */ 1569 while (user->gets_events && !list_empty(&intf->waiting_events)) { 1570 list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link) 1571 list_move_tail(&msg->link, &msgs); 1572 intf->waiting_events_count = 0; 1573 if (intf->event_msg_printed) { 1574 dev_warn(intf->si_dev, "Event queue no longer full\n"); 1575 intf->event_msg_printed = 0; 1576 } 1577 1578 intf->delivering_events = 1; 1579 spin_unlock_irqrestore(&intf->events_lock, flags); 1580 1581 list_for_each_entry_safe(msg, msg2, &msgs, link) { 1582 msg->user = user; 1583 kref_get(&user->refcount); 1584 deliver_local_response(intf, msg); 1585 } 1586 1587 spin_lock_irqsave(&intf->events_lock, flags); 1588 intf->delivering_events = 0; 1589 } 1590 1591 out: 1592 spin_unlock_irqrestore(&intf->events_lock, flags); 1593 release_ipmi_user(user, index); 1594 1595 return 0; 1596 } 1597 EXPORT_SYMBOL(ipmi_set_gets_events); 1598 1599 static struct cmd_rcvr *find_cmd_rcvr(struct ipmi_smi *intf, 1600 unsigned char netfn, 1601 unsigned char cmd, 1602 unsigned char chan) 1603 { 1604 struct cmd_rcvr *rcvr; 1605 1606 list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link, 1607 lockdep_is_held(&intf->cmd_rcvrs_mutex)) { 1608 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd) 1609 && (rcvr->chans & (1 << chan))) 1610 return rcvr; 1611 } 1612 return NULL; 1613 } 1614 1615 static int is_cmd_rcvr_exclusive(struct ipmi_smi *intf, 1616 unsigned char netfn, 1617 unsigned char cmd, 1618 unsigned int chans) 1619 { 1620 struct cmd_rcvr *rcvr; 1621 1622 list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link, 1623 lockdep_is_held(&intf->cmd_rcvrs_mutex)) { 1624 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd) 1625 && (rcvr->chans & chans)) 1626 return 0; 1627 } 1628 return 1; 1629 } 1630 1631 int ipmi_register_for_cmd(struct ipmi_user *user, 1632 unsigned char netfn, 1633 unsigned char cmd, 1634 unsigned int chans) 1635 { 1636 struct ipmi_smi *intf = user->intf; 1637 struct cmd_rcvr *rcvr; 1638 int rv = 0, index; 1639 1640 user = acquire_ipmi_user(user, &index); 1641 if (!user) 1642 return -ENODEV; 1643 1644 rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL); 1645 if (!rcvr) { 1646 rv = -ENOMEM; 1647 goto out_release; 1648 } 1649 rcvr->cmd = cmd; 1650 rcvr->netfn = netfn; 1651 rcvr->chans = chans; 1652 rcvr->user = user; 1653 1654 mutex_lock(&intf->cmd_rcvrs_mutex); 1655 /* Make sure the command/netfn is not already registered. */ 1656 if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) { 1657 rv = -EBUSY; 1658 goto out_unlock; 1659 } 1660 1661 smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS); 1662 1663 list_add_rcu(&rcvr->link, &intf->cmd_rcvrs); 1664 1665 out_unlock: 1666 mutex_unlock(&intf->cmd_rcvrs_mutex); 1667 if (rv) 1668 kfree(rcvr); 1669 out_release: 1670 release_ipmi_user(user, index); 1671 1672 return rv; 1673 } 1674 EXPORT_SYMBOL(ipmi_register_for_cmd); 1675 1676 int ipmi_unregister_for_cmd(struct ipmi_user *user, 1677 unsigned char netfn, 1678 unsigned char cmd, 1679 unsigned int chans) 1680 { 1681 struct ipmi_smi *intf = user->intf; 1682 struct cmd_rcvr *rcvr; 1683 struct cmd_rcvr *rcvrs = NULL; 1684 int i, rv = -ENOENT, index; 1685 1686 user = acquire_ipmi_user(user, &index); 1687 if (!user) 1688 return -ENODEV; 1689 1690 mutex_lock(&intf->cmd_rcvrs_mutex); 1691 for (i = 0; i < IPMI_NUM_CHANNELS; i++) { 1692 if (((1 << i) & chans) == 0) 1693 continue; 1694 rcvr = find_cmd_rcvr(intf, netfn, cmd, i); 1695 if (rcvr == NULL) 1696 continue; 1697 if (rcvr->user == user) { 1698 rv = 0; 1699 rcvr->chans &= ~chans; 1700 if (rcvr->chans == 0) { 1701 list_del_rcu(&rcvr->link); 1702 rcvr->next = rcvrs; 1703 rcvrs = rcvr; 1704 } 1705 } 1706 } 1707 mutex_unlock(&intf->cmd_rcvrs_mutex); 1708 synchronize_rcu(); 1709 release_ipmi_user(user, index); 1710 while (rcvrs) { 1711 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS); 1712 rcvr = rcvrs; 1713 rcvrs = rcvr->next; 1714 kfree(rcvr); 1715 } 1716 1717 return rv; 1718 } 1719 EXPORT_SYMBOL(ipmi_unregister_for_cmd); 1720 1721 static unsigned char 1722 ipmb_checksum(unsigned char *data, int size) 1723 { 1724 unsigned char csum = 0; 1725 1726 for (; size > 0; size--, data++) 1727 csum += *data; 1728 1729 return -csum; 1730 } 1731 1732 static inline void format_ipmb_msg(struct ipmi_smi_msg *smi_msg, 1733 struct kernel_ipmi_msg *msg, 1734 struct ipmi_ipmb_addr *ipmb_addr, 1735 long msgid, 1736 unsigned char ipmb_seq, 1737 int broadcast, 1738 unsigned char source_address, 1739 unsigned char source_lun) 1740 { 1741 int i = broadcast; 1742 1743 /* Format the IPMB header data. */ 1744 smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); 1745 smi_msg->data[1] = IPMI_SEND_MSG_CMD; 1746 smi_msg->data[2] = ipmb_addr->channel; 1747 if (broadcast) 1748 smi_msg->data[3] = 0; 1749 smi_msg->data[i+3] = ipmb_addr->slave_addr; 1750 smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3); 1751 smi_msg->data[i+5] = ipmb_checksum(&smi_msg->data[i + 3], 2); 1752 smi_msg->data[i+6] = source_address; 1753 smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun; 1754 smi_msg->data[i+8] = msg->cmd; 1755 1756 /* Now tack on the data to the message. */ 1757 if (msg->data_len > 0) 1758 memcpy(&smi_msg->data[i + 9], msg->data, msg->data_len); 1759 smi_msg->data_size = msg->data_len + 9; 1760 1761 /* Now calculate the checksum and tack it on. */ 1762 smi_msg->data[i+smi_msg->data_size] 1763 = ipmb_checksum(&smi_msg->data[i + 6], smi_msg->data_size - 6); 1764 1765 /* 1766 * Add on the checksum size and the offset from the 1767 * broadcast. 1768 */ 1769 smi_msg->data_size += 1 + i; 1770 1771 smi_msg->msgid = msgid; 1772 } 1773 1774 static inline void format_lan_msg(struct ipmi_smi_msg *smi_msg, 1775 struct kernel_ipmi_msg *msg, 1776 struct ipmi_lan_addr *lan_addr, 1777 long msgid, 1778 unsigned char ipmb_seq, 1779 unsigned char source_lun) 1780 { 1781 /* Format the IPMB header data. */ 1782 smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); 1783 smi_msg->data[1] = IPMI_SEND_MSG_CMD; 1784 smi_msg->data[2] = lan_addr->channel; 1785 smi_msg->data[3] = lan_addr->session_handle; 1786 smi_msg->data[4] = lan_addr->remote_SWID; 1787 smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3); 1788 smi_msg->data[6] = ipmb_checksum(&smi_msg->data[4], 2); 1789 smi_msg->data[7] = lan_addr->local_SWID; 1790 smi_msg->data[8] = (ipmb_seq << 2) | source_lun; 1791 smi_msg->data[9] = msg->cmd; 1792 1793 /* Now tack on the data to the message. */ 1794 if (msg->data_len > 0) 1795 memcpy(&smi_msg->data[10], msg->data, msg->data_len); 1796 smi_msg->data_size = msg->data_len + 10; 1797 1798 /* Now calculate the checksum and tack it on. */ 1799 smi_msg->data[smi_msg->data_size] 1800 = ipmb_checksum(&smi_msg->data[7], smi_msg->data_size - 7); 1801 1802 /* 1803 * Add on the checksum size and the offset from the 1804 * broadcast. 1805 */ 1806 smi_msg->data_size += 1; 1807 1808 smi_msg->msgid = msgid; 1809 } 1810 1811 static struct ipmi_smi_msg *smi_add_send_msg(struct ipmi_smi *intf, 1812 struct ipmi_smi_msg *smi_msg, 1813 int priority) 1814 { 1815 if (intf->curr_msg) { 1816 if (priority > 0) 1817 list_add_tail(&smi_msg->link, &intf->hp_xmit_msgs); 1818 else 1819 list_add_tail(&smi_msg->link, &intf->xmit_msgs); 1820 smi_msg = NULL; 1821 } else { 1822 intf->curr_msg = smi_msg; 1823 } 1824 1825 return smi_msg; 1826 } 1827 1828 static void smi_send(struct ipmi_smi *intf, 1829 const struct ipmi_smi_handlers *handlers, 1830 struct ipmi_smi_msg *smi_msg, int priority) 1831 { 1832 int run_to_completion = intf->run_to_completion; 1833 unsigned long flags = 0; 1834 1835 if (!run_to_completion) 1836 spin_lock_irqsave(&intf->xmit_msgs_lock, flags); 1837 smi_msg = smi_add_send_msg(intf, smi_msg, priority); 1838 1839 if (!run_to_completion) 1840 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags); 1841 1842 if (smi_msg) 1843 handlers->sender(intf->send_info, smi_msg); 1844 } 1845 1846 static bool is_maintenance_mode_cmd(struct kernel_ipmi_msg *msg) 1847 { 1848 return (((msg->netfn == IPMI_NETFN_APP_REQUEST) 1849 && ((msg->cmd == IPMI_COLD_RESET_CMD) 1850 || (msg->cmd == IPMI_WARM_RESET_CMD))) 1851 || (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST)); 1852 } 1853 1854 static int i_ipmi_req_sysintf(struct ipmi_smi *intf, 1855 struct ipmi_addr *addr, 1856 long msgid, 1857 struct kernel_ipmi_msg *msg, 1858 struct ipmi_smi_msg *smi_msg, 1859 struct ipmi_recv_msg *recv_msg, 1860 int retries, 1861 unsigned int retry_time_ms) 1862 { 1863 struct ipmi_system_interface_addr *smi_addr; 1864 1865 if (msg->netfn & 1) 1866 /* Responses are not allowed to the SMI. */ 1867 return -EINVAL; 1868 1869 smi_addr = (struct ipmi_system_interface_addr *) addr; 1870 if (smi_addr->lun > 3) { 1871 ipmi_inc_stat(intf, sent_invalid_commands); 1872 return -EINVAL; 1873 } 1874 1875 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr)); 1876 1877 if ((msg->netfn == IPMI_NETFN_APP_REQUEST) 1878 && ((msg->cmd == IPMI_SEND_MSG_CMD) 1879 || (msg->cmd == IPMI_GET_MSG_CMD) 1880 || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD))) { 1881 /* 1882 * We don't let the user do these, since we manage 1883 * the sequence numbers. 1884 */ 1885 ipmi_inc_stat(intf, sent_invalid_commands); 1886 return -EINVAL; 1887 } 1888 1889 if (is_maintenance_mode_cmd(msg)) { 1890 unsigned long flags; 1891 1892 spin_lock_irqsave(&intf->maintenance_mode_lock, flags); 1893 intf->auto_maintenance_timeout 1894 = maintenance_mode_timeout_ms; 1895 if (!intf->maintenance_mode 1896 && !intf->maintenance_mode_enable) { 1897 intf->maintenance_mode_enable = true; 1898 maintenance_mode_update(intf); 1899 } 1900 spin_unlock_irqrestore(&intf->maintenance_mode_lock, 1901 flags); 1902 } 1903 1904 if (msg->data_len + 2 > IPMI_MAX_MSG_LENGTH) { 1905 ipmi_inc_stat(intf, sent_invalid_commands); 1906 return -EMSGSIZE; 1907 } 1908 1909 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3); 1910 smi_msg->data[1] = msg->cmd; 1911 smi_msg->msgid = msgid; 1912 smi_msg->user_data = recv_msg; 1913 if (msg->data_len > 0) 1914 memcpy(&smi_msg->data[2], msg->data, msg->data_len); 1915 smi_msg->data_size = msg->data_len + 2; 1916 ipmi_inc_stat(intf, sent_local_commands); 1917 1918 return 0; 1919 } 1920 1921 static int i_ipmi_req_ipmb(struct ipmi_smi *intf, 1922 struct ipmi_addr *addr, 1923 long msgid, 1924 struct kernel_ipmi_msg *msg, 1925 struct ipmi_smi_msg *smi_msg, 1926 struct ipmi_recv_msg *recv_msg, 1927 unsigned char source_address, 1928 unsigned char source_lun, 1929 int retries, 1930 unsigned int retry_time_ms) 1931 { 1932 struct ipmi_ipmb_addr *ipmb_addr; 1933 unsigned char ipmb_seq; 1934 long seqid; 1935 int broadcast = 0; 1936 struct ipmi_channel *chans; 1937 int rv = 0; 1938 1939 if (addr->channel >= IPMI_MAX_CHANNELS) { 1940 ipmi_inc_stat(intf, sent_invalid_commands); 1941 return -EINVAL; 1942 } 1943 1944 chans = READ_ONCE(intf->channel_list)->c; 1945 1946 if (chans[addr->channel].medium != IPMI_CHANNEL_MEDIUM_IPMB) { 1947 ipmi_inc_stat(intf, sent_invalid_commands); 1948 return -EINVAL; 1949 } 1950 1951 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) { 1952 /* 1953 * Broadcasts add a zero at the beginning of the 1954 * message, but otherwise is the same as an IPMB 1955 * address. 1956 */ 1957 addr->addr_type = IPMI_IPMB_ADDR_TYPE; 1958 broadcast = 1; 1959 retries = 0; /* Don't retry broadcasts. */ 1960 } 1961 1962 /* 1963 * 9 for the header and 1 for the checksum, plus 1964 * possibly one for the broadcast. 1965 */ 1966 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) { 1967 ipmi_inc_stat(intf, sent_invalid_commands); 1968 return -EMSGSIZE; 1969 } 1970 1971 ipmb_addr = (struct ipmi_ipmb_addr *) addr; 1972 if (ipmb_addr->lun > 3) { 1973 ipmi_inc_stat(intf, sent_invalid_commands); 1974 return -EINVAL; 1975 } 1976 1977 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr)); 1978 1979 if (recv_msg->msg.netfn & 0x1) { 1980 /* 1981 * It's a response, so use the user's sequence 1982 * from msgid. 1983 */ 1984 ipmi_inc_stat(intf, sent_ipmb_responses); 1985 format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid, 1986 msgid, broadcast, 1987 source_address, source_lun); 1988 1989 /* 1990 * Save the receive message so we can use it 1991 * to deliver the response. 1992 */ 1993 smi_msg->user_data = recv_msg; 1994 } else { 1995 /* It's a command, so get a sequence for it. */ 1996 unsigned long flags; 1997 1998 spin_lock_irqsave(&intf->seq_lock, flags); 1999 2000 if (is_maintenance_mode_cmd(msg)) 2001 intf->ipmb_maintenance_mode_timeout = 2002 maintenance_mode_timeout_ms; 2003 2004 if (intf->ipmb_maintenance_mode_timeout && retry_time_ms == 0) 2005 /* Different default in maintenance mode */ 2006 retry_time_ms = default_maintenance_retry_ms; 2007 2008 /* 2009 * Create a sequence number with a 1 second 2010 * timeout and 4 retries. 2011 */ 2012 rv = intf_next_seq(intf, 2013 recv_msg, 2014 retry_time_ms, 2015 retries, 2016 broadcast, 2017 &ipmb_seq, 2018 &seqid); 2019 if (rv) 2020 /* 2021 * We have used up all the sequence numbers, 2022 * probably, so abort. 2023 */ 2024 goto out_err; 2025 2026 ipmi_inc_stat(intf, sent_ipmb_commands); 2027 2028 /* 2029 * Store the sequence number in the message, 2030 * so that when the send message response 2031 * comes back we can start the timer. 2032 */ 2033 format_ipmb_msg(smi_msg, msg, ipmb_addr, 2034 STORE_SEQ_IN_MSGID(ipmb_seq, seqid), 2035 ipmb_seq, broadcast, 2036 source_address, source_lun); 2037 2038 /* 2039 * Copy the message into the recv message data, so we 2040 * can retransmit it later if necessary. 2041 */ 2042 memcpy(recv_msg->msg_data, smi_msg->data, 2043 smi_msg->data_size); 2044 recv_msg->msg.data = recv_msg->msg_data; 2045 recv_msg->msg.data_len = smi_msg->data_size; 2046 2047 /* 2048 * We don't unlock until here, because we need 2049 * to copy the completed message into the 2050 * recv_msg before we release the lock. 2051 * Otherwise, race conditions may bite us. I 2052 * know that's pretty paranoid, but I prefer 2053 * to be correct. 2054 */ 2055 out_err: 2056 spin_unlock_irqrestore(&intf->seq_lock, flags); 2057 } 2058 2059 return rv; 2060 } 2061 2062 static int i_ipmi_req_lan(struct ipmi_smi *intf, 2063 struct ipmi_addr *addr, 2064 long msgid, 2065 struct kernel_ipmi_msg *msg, 2066 struct ipmi_smi_msg *smi_msg, 2067 struct ipmi_recv_msg *recv_msg, 2068 unsigned char source_lun, 2069 int retries, 2070 unsigned int retry_time_ms) 2071 { 2072 struct ipmi_lan_addr *lan_addr; 2073 unsigned char ipmb_seq; 2074 long seqid; 2075 struct ipmi_channel *chans; 2076 int rv = 0; 2077 2078 if (addr->channel >= IPMI_MAX_CHANNELS) { 2079 ipmi_inc_stat(intf, sent_invalid_commands); 2080 return -EINVAL; 2081 } 2082 2083 chans = READ_ONCE(intf->channel_list)->c; 2084 2085 if ((chans[addr->channel].medium 2086 != IPMI_CHANNEL_MEDIUM_8023LAN) 2087 && (chans[addr->channel].medium 2088 != IPMI_CHANNEL_MEDIUM_ASYNC)) { 2089 ipmi_inc_stat(intf, sent_invalid_commands); 2090 return -EINVAL; 2091 } 2092 2093 /* 11 for the header and 1 for the checksum. */ 2094 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) { 2095 ipmi_inc_stat(intf, sent_invalid_commands); 2096 return -EMSGSIZE; 2097 } 2098 2099 lan_addr = (struct ipmi_lan_addr *) addr; 2100 if (lan_addr->lun > 3) { 2101 ipmi_inc_stat(intf, sent_invalid_commands); 2102 return -EINVAL; 2103 } 2104 2105 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr)); 2106 2107 if (recv_msg->msg.netfn & 0x1) { 2108 /* 2109 * It's a response, so use the user's sequence 2110 * from msgid. 2111 */ 2112 ipmi_inc_stat(intf, sent_lan_responses); 2113 format_lan_msg(smi_msg, msg, lan_addr, msgid, 2114 msgid, source_lun); 2115 2116 /* 2117 * Save the receive message so we can use it 2118 * to deliver the response. 2119 */ 2120 smi_msg->user_data = recv_msg; 2121 } else { 2122 /* It's a command, so get a sequence for it. */ 2123 unsigned long flags; 2124 2125 spin_lock_irqsave(&intf->seq_lock, flags); 2126 2127 /* 2128 * Create a sequence number with a 1 second 2129 * timeout and 4 retries. 2130 */ 2131 rv = intf_next_seq(intf, 2132 recv_msg, 2133 retry_time_ms, 2134 retries, 2135 0, 2136 &ipmb_seq, 2137 &seqid); 2138 if (rv) 2139 /* 2140 * We have used up all the sequence numbers, 2141 * probably, so abort. 2142 */ 2143 goto out_err; 2144 2145 ipmi_inc_stat(intf, sent_lan_commands); 2146 2147 /* 2148 * Store the sequence number in the message, 2149 * so that when the send message response 2150 * comes back we can start the timer. 2151 */ 2152 format_lan_msg(smi_msg, msg, lan_addr, 2153 STORE_SEQ_IN_MSGID(ipmb_seq, seqid), 2154 ipmb_seq, source_lun); 2155 2156 /* 2157 * Copy the message into the recv message data, so we 2158 * can retransmit it later if necessary. 2159 */ 2160 memcpy(recv_msg->msg_data, smi_msg->data, 2161 smi_msg->data_size); 2162 recv_msg->msg.data = recv_msg->msg_data; 2163 recv_msg->msg.data_len = smi_msg->data_size; 2164 2165 /* 2166 * We don't unlock until here, because we need 2167 * to copy the completed message into the 2168 * recv_msg before we release the lock. 2169 * Otherwise, race conditions may bite us. I 2170 * know that's pretty paranoid, but I prefer 2171 * to be correct. 2172 */ 2173 out_err: 2174 spin_unlock_irqrestore(&intf->seq_lock, flags); 2175 } 2176 2177 return rv; 2178 } 2179 2180 /* 2181 * Separate from ipmi_request so that the user does not have to be 2182 * supplied in certain circumstances (mainly at panic time). If 2183 * messages are supplied, they will be freed, even if an error 2184 * occurs. 2185 */ 2186 static int i_ipmi_request(struct ipmi_user *user, 2187 struct ipmi_smi *intf, 2188 struct ipmi_addr *addr, 2189 long msgid, 2190 struct kernel_ipmi_msg *msg, 2191 void *user_msg_data, 2192 void *supplied_smi, 2193 struct ipmi_recv_msg *supplied_recv, 2194 int priority, 2195 unsigned char source_address, 2196 unsigned char source_lun, 2197 int retries, 2198 unsigned int retry_time_ms) 2199 { 2200 struct ipmi_smi_msg *smi_msg; 2201 struct ipmi_recv_msg *recv_msg; 2202 int rv = 0; 2203 2204 if (supplied_recv) 2205 recv_msg = supplied_recv; 2206 else { 2207 recv_msg = ipmi_alloc_recv_msg(); 2208 if (recv_msg == NULL) { 2209 rv = -ENOMEM; 2210 goto out; 2211 } 2212 } 2213 recv_msg->user_msg_data = user_msg_data; 2214 2215 if (supplied_smi) 2216 smi_msg = (struct ipmi_smi_msg *) supplied_smi; 2217 else { 2218 smi_msg = ipmi_alloc_smi_msg(); 2219 if (smi_msg == NULL) { 2220 if (!supplied_recv) 2221 ipmi_free_recv_msg(recv_msg); 2222 rv = -ENOMEM; 2223 goto out; 2224 } 2225 } 2226 2227 rcu_read_lock(); 2228 if (intf->in_shutdown) { 2229 rv = -ENODEV; 2230 goto out_err; 2231 } 2232 2233 recv_msg->user = user; 2234 if (user) 2235 /* The put happens when the message is freed. */ 2236 kref_get(&user->refcount); 2237 recv_msg->msgid = msgid; 2238 /* 2239 * Store the message to send in the receive message so timeout 2240 * responses can get the proper response data. 2241 */ 2242 recv_msg->msg = *msg; 2243 2244 if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) { 2245 rv = i_ipmi_req_sysintf(intf, addr, msgid, msg, smi_msg, 2246 recv_msg, retries, retry_time_ms); 2247 } else if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) { 2248 rv = i_ipmi_req_ipmb(intf, addr, msgid, msg, smi_msg, recv_msg, 2249 source_address, source_lun, 2250 retries, retry_time_ms); 2251 } else if (is_lan_addr(addr)) { 2252 rv = i_ipmi_req_lan(intf, addr, msgid, msg, smi_msg, recv_msg, 2253 source_lun, retries, retry_time_ms); 2254 } else { 2255 /* Unknown address type. */ 2256 ipmi_inc_stat(intf, sent_invalid_commands); 2257 rv = -EINVAL; 2258 } 2259 2260 if (rv) { 2261 out_err: 2262 ipmi_free_smi_msg(smi_msg); 2263 ipmi_free_recv_msg(recv_msg); 2264 } else { 2265 pr_debug("Send: %*ph\n", smi_msg->data_size, smi_msg->data); 2266 2267 smi_send(intf, intf->handlers, smi_msg, priority); 2268 } 2269 rcu_read_unlock(); 2270 2271 out: 2272 return rv; 2273 } 2274 2275 static int check_addr(struct ipmi_smi *intf, 2276 struct ipmi_addr *addr, 2277 unsigned char *saddr, 2278 unsigned char *lun) 2279 { 2280 if (addr->channel >= IPMI_MAX_CHANNELS) 2281 return -EINVAL; 2282 addr->channel = array_index_nospec(addr->channel, IPMI_MAX_CHANNELS); 2283 *lun = intf->addrinfo[addr->channel].lun; 2284 *saddr = intf->addrinfo[addr->channel].address; 2285 return 0; 2286 } 2287 2288 int ipmi_request_settime(struct ipmi_user *user, 2289 struct ipmi_addr *addr, 2290 long msgid, 2291 struct kernel_ipmi_msg *msg, 2292 void *user_msg_data, 2293 int priority, 2294 int retries, 2295 unsigned int retry_time_ms) 2296 { 2297 unsigned char saddr = 0, lun = 0; 2298 int rv, index; 2299 2300 if (!user) 2301 return -EINVAL; 2302 2303 user = acquire_ipmi_user(user, &index); 2304 if (!user) 2305 return -ENODEV; 2306 2307 rv = check_addr(user->intf, addr, &saddr, &lun); 2308 if (!rv) 2309 rv = i_ipmi_request(user, 2310 user->intf, 2311 addr, 2312 msgid, 2313 msg, 2314 user_msg_data, 2315 NULL, NULL, 2316 priority, 2317 saddr, 2318 lun, 2319 retries, 2320 retry_time_ms); 2321 2322 release_ipmi_user(user, index); 2323 return rv; 2324 } 2325 EXPORT_SYMBOL(ipmi_request_settime); 2326 2327 int ipmi_request_supply_msgs(struct ipmi_user *user, 2328 struct ipmi_addr *addr, 2329 long msgid, 2330 struct kernel_ipmi_msg *msg, 2331 void *user_msg_data, 2332 void *supplied_smi, 2333 struct ipmi_recv_msg *supplied_recv, 2334 int priority) 2335 { 2336 unsigned char saddr = 0, lun = 0; 2337 int rv, index; 2338 2339 if (!user) 2340 return -EINVAL; 2341 2342 user = acquire_ipmi_user(user, &index); 2343 if (!user) 2344 return -ENODEV; 2345 2346 rv = check_addr(user->intf, addr, &saddr, &lun); 2347 if (!rv) 2348 rv = i_ipmi_request(user, 2349 user->intf, 2350 addr, 2351 msgid, 2352 msg, 2353 user_msg_data, 2354 supplied_smi, 2355 supplied_recv, 2356 priority, 2357 saddr, 2358 lun, 2359 -1, 0); 2360 2361 release_ipmi_user(user, index); 2362 return rv; 2363 } 2364 EXPORT_SYMBOL(ipmi_request_supply_msgs); 2365 2366 static void bmc_device_id_handler(struct ipmi_smi *intf, 2367 struct ipmi_recv_msg *msg) 2368 { 2369 int rv; 2370 2371 if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 2372 || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE) 2373 || (msg->msg.cmd != IPMI_GET_DEVICE_ID_CMD)) { 2374 dev_warn(intf->si_dev, 2375 "invalid device_id msg: addr_type=%d netfn=%x cmd=%x\n", 2376 msg->addr.addr_type, msg->msg.netfn, msg->msg.cmd); 2377 return; 2378 } 2379 2380 rv = ipmi_demangle_device_id(msg->msg.netfn, msg->msg.cmd, 2381 msg->msg.data, msg->msg.data_len, &intf->bmc->fetch_id); 2382 if (rv) { 2383 dev_warn(intf->si_dev, "device id demangle failed: %d\n", rv); 2384 intf->bmc->dyn_id_set = 0; 2385 } else { 2386 /* 2387 * Make sure the id data is available before setting 2388 * dyn_id_set. 2389 */ 2390 smp_wmb(); 2391 intf->bmc->dyn_id_set = 1; 2392 } 2393 2394 wake_up(&intf->waitq); 2395 } 2396 2397 static int 2398 send_get_device_id_cmd(struct ipmi_smi *intf) 2399 { 2400 struct ipmi_system_interface_addr si; 2401 struct kernel_ipmi_msg msg; 2402 2403 si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 2404 si.channel = IPMI_BMC_CHANNEL; 2405 si.lun = 0; 2406 2407 msg.netfn = IPMI_NETFN_APP_REQUEST; 2408 msg.cmd = IPMI_GET_DEVICE_ID_CMD; 2409 msg.data = NULL; 2410 msg.data_len = 0; 2411 2412 return i_ipmi_request(NULL, 2413 intf, 2414 (struct ipmi_addr *) &si, 2415 0, 2416 &msg, 2417 intf, 2418 NULL, 2419 NULL, 2420 0, 2421 intf->addrinfo[0].address, 2422 intf->addrinfo[0].lun, 2423 -1, 0); 2424 } 2425 2426 static int __get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc) 2427 { 2428 int rv; 2429 2430 bmc->dyn_id_set = 2; 2431 2432 intf->null_user_handler = bmc_device_id_handler; 2433 2434 rv = send_get_device_id_cmd(intf); 2435 if (rv) 2436 return rv; 2437 2438 wait_event(intf->waitq, bmc->dyn_id_set != 2); 2439 2440 if (!bmc->dyn_id_set) 2441 rv = -EIO; /* Something went wrong in the fetch. */ 2442 2443 /* dyn_id_set makes the id data available. */ 2444 smp_rmb(); 2445 2446 intf->null_user_handler = NULL; 2447 2448 return rv; 2449 } 2450 2451 /* 2452 * Fetch the device id for the bmc/interface. You must pass in either 2453 * bmc or intf, this code will get the other one. If the data has 2454 * been recently fetched, this will just use the cached data. Otherwise 2455 * it will run a new fetch. 2456 * 2457 * Except for the first time this is called (in ipmi_add_smi()), 2458 * this will always return good data; 2459 */ 2460 static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, 2461 struct ipmi_device_id *id, 2462 bool *guid_set, guid_t *guid, int intf_num) 2463 { 2464 int rv = 0; 2465 int prev_dyn_id_set, prev_guid_set; 2466 bool intf_set = intf != NULL; 2467 2468 if (!intf) { 2469 mutex_lock(&bmc->dyn_mutex); 2470 retry_bmc_lock: 2471 if (list_empty(&bmc->intfs)) { 2472 mutex_unlock(&bmc->dyn_mutex); 2473 return -ENOENT; 2474 } 2475 intf = list_first_entry(&bmc->intfs, struct ipmi_smi, 2476 bmc_link); 2477 kref_get(&intf->refcount); 2478 mutex_unlock(&bmc->dyn_mutex); 2479 mutex_lock(&intf->bmc_reg_mutex); 2480 mutex_lock(&bmc->dyn_mutex); 2481 if (intf != list_first_entry(&bmc->intfs, struct ipmi_smi, 2482 bmc_link)) { 2483 mutex_unlock(&intf->bmc_reg_mutex); 2484 kref_put(&intf->refcount, intf_free); 2485 goto retry_bmc_lock; 2486 } 2487 } else { 2488 mutex_lock(&intf->bmc_reg_mutex); 2489 bmc = intf->bmc; 2490 mutex_lock(&bmc->dyn_mutex); 2491 kref_get(&intf->refcount); 2492 } 2493 2494 /* If we have a valid and current ID, just return that. */ 2495 if (intf->in_bmc_register || 2496 (bmc->dyn_id_set && time_is_after_jiffies(bmc->dyn_id_expiry))) 2497 goto out_noprocessing; 2498 2499 prev_guid_set = bmc->dyn_guid_set; 2500 __get_guid(intf); 2501 2502 prev_dyn_id_set = bmc->dyn_id_set; 2503 rv = __get_device_id(intf, bmc); 2504 if (rv) 2505 goto out; 2506 2507 /* 2508 * The guid, device id, manufacturer id, and product id should 2509 * not change on a BMC. If it does we have to do some dancing. 2510 */ 2511 if (!intf->bmc_registered 2512 || (!prev_guid_set && bmc->dyn_guid_set) 2513 || (!prev_dyn_id_set && bmc->dyn_id_set) 2514 || (prev_guid_set && bmc->dyn_guid_set 2515 && !guid_equal(&bmc->guid, &bmc->fetch_guid)) 2516 || bmc->id.device_id != bmc->fetch_id.device_id 2517 || bmc->id.manufacturer_id != bmc->fetch_id.manufacturer_id 2518 || bmc->id.product_id != bmc->fetch_id.product_id) { 2519 struct ipmi_device_id id = bmc->fetch_id; 2520 int guid_set = bmc->dyn_guid_set; 2521 guid_t guid; 2522 2523 guid = bmc->fetch_guid; 2524 mutex_unlock(&bmc->dyn_mutex); 2525 2526 __ipmi_bmc_unregister(intf); 2527 /* Fill in the temporary BMC for good measure. */ 2528 intf->bmc->id = id; 2529 intf->bmc->dyn_guid_set = guid_set; 2530 intf->bmc->guid = guid; 2531 if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num)) 2532 need_waiter(intf); /* Retry later on an error. */ 2533 else 2534 __scan_channels(intf, &id); 2535 2536 2537 if (!intf_set) { 2538 /* 2539 * We weren't given the interface on the 2540 * command line, so restart the operation on 2541 * the next interface for the BMC. 2542 */ 2543 mutex_unlock(&intf->bmc_reg_mutex); 2544 mutex_lock(&bmc->dyn_mutex); 2545 goto retry_bmc_lock; 2546 } 2547 2548 /* We have a new BMC, set it up. */ 2549 bmc = intf->bmc; 2550 mutex_lock(&bmc->dyn_mutex); 2551 goto out_noprocessing; 2552 } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id))) 2553 /* Version info changes, scan the channels again. */ 2554 __scan_channels(intf, &bmc->fetch_id); 2555 2556 bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY; 2557 2558 out: 2559 if (rv && prev_dyn_id_set) { 2560 rv = 0; /* Ignore failures if we have previous data. */ 2561 bmc->dyn_id_set = prev_dyn_id_set; 2562 } 2563 if (!rv) { 2564 bmc->id = bmc->fetch_id; 2565 if (bmc->dyn_guid_set) 2566 bmc->guid = bmc->fetch_guid; 2567 else if (prev_guid_set) 2568 /* 2569 * The guid used to be valid and it failed to fetch, 2570 * just use the cached value. 2571 */ 2572 bmc->dyn_guid_set = prev_guid_set; 2573 } 2574 out_noprocessing: 2575 if (!rv) { 2576 if (id) 2577 *id = bmc->id; 2578 2579 if (guid_set) 2580 *guid_set = bmc->dyn_guid_set; 2581 2582 if (guid && bmc->dyn_guid_set) 2583 *guid = bmc->guid; 2584 } 2585 2586 mutex_unlock(&bmc->dyn_mutex); 2587 mutex_unlock(&intf->bmc_reg_mutex); 2588 2589 kref_put(&intf->refcount, intf_free); 2590 return rv; 2591 } 2592 2593 static int bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, 2594 struct ipmi_device_id *id, 2595 bool *guid_set, guid_t *guid) 2596 { 2597 return __bmc_get_device_id(intf, bmc, id, guid_set, guid, -1); 2598 } 2599 2600 static ssize_t device_id_show(struct device *dev, 2601 struct device_attribute *attr, 2602 char *buf) 2603 { 2604 struct bmc_device *bmc = to_bmc_device(dev); 2605 struct ipmi_device_id id; 2606 int rv; 2607 2608 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2609 if (rv) 2610 return rv; 2611 2612 return snprintf(buf, 10, "%u\n", id.device_id); 2613 } 2614 static DEVICE_ATTR_RO(device_id); 2615 2616 static ssize_t provides_device_sdrs_show(struct device *dev, 2617 struct device_attribute *attr, 2618 char *buf) 2619 { 2620 struct bmc_device *bmc = to_bmc_device(dev); 2621 struct ipmi_device_id id; 2622 int rv; 2623 2624 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2625 if (rv) 2626 return rv; 2627 2628 return snprintf(buf, 10, "%u\n", (id.device_revision & 0x80) >> 7); 2629 } 2630 static DEVICE_ATTR_RO(provides_device_sdrs); 2631 2632 static ssize_t revision_show(struct device *dev, struct device_attribute *attr, 2633 char *buf) 2634 { 2635 struct bmc_device *bmc = to_bmc_device(dev); 2636 struct ipmi_device_id id; 2637 int rv; 2638 2639 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2640 if (rv) 2641 return rv; 2642 2643 return snprintf(buf, 20, "%u\n", id.device_revision & 0x0F); 2644 } 2645 static DEVICE_ATTR_RO(revision); 2646 2647 static ssize_t firmware_revision_show(struct device *dev, 2648 struct device_attribute *attr, 2649 char *buf) 2650 { 2651 struct bmc_device *bmc = to_bmc_device(dev); 2652 struct ipmi_device_id id; 2653 int rv; 2654 2655 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2656 if (rv) 2657 return rv; 2658 2659 return snprintf(buf, 20, "%u.%x\n", id.firmware_revision_1, 2660 id.firmware_revision_2); 2661 } 2662 static DEVICE_ATTR_RO(firmware_revision); 2663 2664 static ssize_t ipmi_version_show(struct device *dev, 2665 struct device_attribute *attr, 2666 char *buf) 2667 { 2668 struct bmc_device *bmc = to_bmc_device(dev); 2669 struct ipmi_device_id id; 2670 int rv; 2671 2672 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2673 if (rv) 2674 return rv; 2675 2676 return snprintf(buf, 20, "%u.%u\n", 2677 ipmi_version_major(&id), 2678 ipmi_version_minor(&id)); 2679 } 2680 static DEVICE_ATTR_RO(ipmi_version); 2681 2682 static ssize_t add_dev_support_show(struct device *dev, 2683 struct device_attribute *attr, 2684 char *buf) 2685 { 2686 struct bmc_device *bmc = to_bmc_device(dev); 2687 struct ipmi_device_id id; 2688 int rv; 2689 2690 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2691 if (rv) 2692 return rv; 2693 2694 return snprintf(buf, 10, "0x%02x\n", id.additional_device_support); 2695 } 2696 static DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show, 2697 NULL); 2698 2699 static ssize_t manufacturer_id_show(struct device *dev, 2700 struct device_attribute *attr, 2701 char *buf) 2702 { 2703 struct bmc_device *bmc = to_bmc_device(dev); 2704 struct ipmi_device_id id; 2705 int rv; 2706 2707 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2708 if (rv) 2709 return rv; 2710 2711 return snprintf(buf, 20, "0x%6.6x\n", id.manufacturer_id); 2712 } 2713 static DEVICE_ATTR_RO(manufacturer_id); 2714 2715 static ssize_t product_id_show(struct device *dev, 2716 struct device_attribute *attr, 2717 char *buf) 2718 { 2719 struct bmc_device *bmc = to_bmc_device(dev); 2720 struct ipmi_device_id id; 2721 int rv; 2722 2723 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2724 if (rv) 2725 return rv; 2726 2727 return snprintf(buf, 10, "0x%4.4x\n", id.product_id); 2728 } 2729 static DEVICE_ATTR_RO(product_id); 2730 2731 static ssize_t aux_firmware_rev_show(struct device *dev, 2732 struct device_attribute *attr, 2733 char *buf) 2734 { 2735 struct bmc_device *bmc = to_bmc_device(dev); 2736 struct ipmi_device_id id; 2737 int rv; 2738 2739 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2740 if (rv) 2741 return rv; 2742 2743 return snprintf(buf, 21, "0x%02x 0x%02x 0x%02x 0x%02x\n", 2744 id.aux_firmware_revision[3], 2745 id.aux_firmware_revision[2], 2746 id.aux_firmware_revision[1], 2747 id.aux_firmware_revision[0]); 2748 } 2749 static DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL); 2750 2751 static ssize_t guid_show(struct device *dev, struct device_attribute *attr, 2752 char *buf) 2753 { 2754 struct bmc_device *bmc = to_bmc_device(dev); 2755 bool guid_set; 2756 guid_t guid; 2757 int rv; 2758 2759 rv = bmc_get_device_id(NULL, bmc, NULL, &guid_set, &guid); 2760 if (rv) 2761 return rv; 2762 if (!guid_set) 2763 return -ENOENT; 2764 2765 return snprintf(buf, UUID_STRING_LEN + 1 + 1, "%pUl\n", &guid); 2766 } 2767 static DEVICE_ATTR_RO(guid); 2768 2769 static struct attribute *bmc_dev_attrs[] = { 2770 &dev_attr_device_id.attr, 2771 &dev_attr_provides_device_sdrs.attr, 2772 &dev_attr_revision.attr, 2773 &dev_attr_firmware_revision.attr, 2774 &dev_attr_ipmi_version.attr, 2775 &dev_attr_additional_device_support.attr, 2776 &dev_attr_manufacturer_id.attr, 2777 &dev_attr_product_id.attr, 2778 &dev_attr_aux_firmware_revision.attr, 2779 &dev_attr_guid.attr, 2780 NULL 2781 }; 2782 2783 static umode_t bmc_dev_attr_is_visible(struct kobject *kobj, 2784 struct attribute *attr, int idx) 2785 { 2786 struct device *dev = kobj_to_dev(kobj); 2787 struct bmc_device *bmc = to_bmc_device(dev); 2788 umode_t mode = attr->mode; 2789 int rv; 2790 2791 if (attr == &dev_attr_aux_firmware_revision.attr) { 2792 struct ipmi_device_id id; 2793 2794 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2795 return (!rv && id.aux_firmware_revision_set) ? mode : 0; 2796 } 2797 if (attr == &dev_attr_guid.attr) { 2798 bool guid_set; 2799 2800 rv = bmc_get_device_id(NULL, bmc, NULL, &guid_set, NULL); 2801 return (!rv && guid_set) ? mode : 0; 2802 } 2803 return mode; 2804 } 2805 2806 static const struct attribute_group bmc_dev_attr_group = { 2807 .attrs = bmc_dev_attrs, 2808 .is_visible = bmc_dev_attr_is_visible, 2809 }; 2810 2811 static const struct attribute_group *bmc_dev_attr_groups[] = { 2812 &bmc_dev_attr_group, 2813 NULL 2814 }; 2815 2816 static const struct device_type bmc_device_type = { 2817 .groups = bmc_dev_attr_groups, 2818 }; 2819 2820 static int __find_bmc_guid(struct device *dev, const void *data) 2821 { 2822 const guid_t *guid = data; 2823 struct bmc_device *bmc; 2824 int rv; 2825 2826 if (dev->type != &bmc_device_type) 2827 return 0; 2828 2829 bmc = to_bmc_device(dev); 2830 rv = bmc->dyn_guid_set && guid_equal(&bmc->guid, guid); 2831 if (rv) 2832 rv = kref_get_unless_zero(&bmc->usecount); 2833 return rv; 2834 } 2835 2836 /* 2837 * Returns with the bmc's usecount incremented, if it is non-NULL. 2838 */ 2839 static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv, 2840 guid_t *guid) 2841 { 2842 struct device *dev; 2843 struct bmc_device *bmc = NULL; 2844 2845 dev = driver_find_device(drv, NULL, guid, __find_bmc_guid); 2846 if (dev) { 2847 bmc = to_bmc_device(dev); 2848 put_device(dev); 2849 } 2850 return bmc; 2851 } 2852 2853 struct prod_dev_id { 2854 unsigned int product_id; 2855 unsigned char device_id; 2856 }; 2857 2858 static int __find_bmc_prod_dev_id(struct device *dev, const void *data) 2859 { 2860 const struct prod_dev_id *cid = data; 2861 struct bmc_device *bmc; 2862 int rv; 2863 2864 if (dev->type != &bmc_device_type) 2865 return 0; 2866 2867 bmc = to_bmc_device(dev); 2868 rv = (bmc->id.product_id == cid->product_id 2869 && bmc->id.device_id == cid->device_id); 2870 if (rv) 2871 rv = kref_get_unless_zero(&bmc->usecount); 2872 return rv; 2873 } 2874 2875 /* 2876 * Returns with the bmc's usecount incremented, if it is non-NULL. 2877 */ 2878 static struct bmc_device *ipmi_find_bmc_prod_dev_id( 2879 struct device_driver *drv, 2880 unsigned int product_id, unsigned char device_id) 2881 { 2882 struct prod_dev_id id = { 2883 .product_id = product_id, 2884 .device_id = device_id, 2885 }; 2886 struct device *dev; 2887 struct bmc_device *bmc = NULL; 2888 2889 dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id); 2890 if (dev) { 2891 bmc = to_bmc_device(dev); 2892 put_device(dev); 2893 } 2894 return bmc; 2895 } 2896 2897 static DEFINE_IDA(ipmi_bmc_ida); 2898 2899 static void 2900 release_bmc_device(struct device *dev) 2901 { 2902 kfree(to_bmc_device(dev)); 2903 } 2904 2905 static void cleanup_bmc_work(struct work_struct *work) 2906 { 2907 struct bmc_device *bmc = container_of(work, struct bmc_device, 2908 remove_work); 2909 int id = bmc->pdev.id; /* Unregister overwrites id */ 2910 2911 platform_device_unregister(&bmc->pdev); 2912 ida_simple_remove(&ipmi_bmc_ida, id); 2913 } 2914 2915 static void 2916 cleanup_bmc_device(struct kref *ref) 2917 { 2918 struct bmc_device *bmc = container_of(ref, struct bmc_device, usecount); 2919 2920 /* 2921 * Remove the platform device in a work queue to avoid issues 2922 * with removing the device attributes while reading a device 2923 * attribute. 2924 */ 2925 schedule_work(&bmc->remove_work); 2926 } 2927 2928 /* 2929 * Must be called with intf->bmc_reg_mutex held. 2930 */ 2931 static void __ipmi_bmc_unregister(struct ipmi_smi *intf) 2932 { 2933 struct bmc_device *bmc = intf->bmc; 2934 2935 if (!intf->bmc_registered) 2936 return; 2937 2938 sysfs_remove_link(&intf->si_dev->kobj, "bmc"); 2939 sysfs_remove_link(&bmc->pdev.dev.kobj, intf->my_dev_name); 2940 kfree(intf->my_dev_name); 2941 intf->my_dev_name = NULL; 2942 2943 mutex_lock(&bmc->dyn_mutex); 2944 list_del(&intf->bmc_link); 2945 mutex_unlock(&bmc->dyn_mutex); 2946 intf->bmc = &intf->tmp_bmc; 2947 kref_put(&bmc->usecount, cleanup_bmc_device); 2948 intf->bmc_registered = false; 2949 } 2950 2951 static void ipmi_bmc_unregister(struct ipmi_smi *intf) 2952 { 2953 mutex_lock(&intf->bmc_reg_mutex); 2954 __ipmi_bmc_unregister(intf); 2955 mutex_unlock(&intf->bmc_reg_mutex); 2956 } 2957 2958 /* 2959 * Must be called with intf->bmc_reg_mutex held. 2960 */ 2961 static int __ipmi_bmc_register(struct ipmi_smi *intf, 2962 struct ipmi_device_id *id, 2963 bool guid_set, guid_t *guid, int intf_num) 2964 { 2965 int rv; 2966 struct bmc_device *bmc; 2967 struct bmc_device *old_bmc; 2968 2969 /* 2970 * platform_device_register() can cause bmc_reg_mutex to 2971 * be claimed because of the is_visible functions of 2972 * the attributes. Eliminate possible recursion and 2973 * release the lock. 2974 */ 2975 intf->in_bmc_register = true; 2976 mutex_unlock(&intf->bmc_reg_mutex); 2977 2978 /* 2979 * Try to find if there is an bmc_device struct 2980 * representing the interfaced BMC already 2981 */ 2982 mutex_lock(&ipmidriver_mutex); 2983 if (guid_set) 2984 old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, guid); 2985 else 2986 old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver, 2987 id->product_id, 2988 id->device_id); 2989 2990 /* 2991 * If there is already an bmc_device, free the new one, 2992 * otherwise register the new BMC device 2993 */ 2994 if (old_bmc) { 2995 bmc = old_bmc; 2996 /* 2997 * Note: old_bmc already has usecount incremented by 2998 * the BMC find functions. 2999 */ 3000 intf->bmc = old_bmc; 3001 mutex_lock(&bmc->dyn_mutex); 3002 list_add_tail(&intf->bmc_link, &bmc->intfs); 3003 mutex_unlock(&bmc->dyn_mutex); 3004 3005 dev_info(intf->si_dev, 3006 "interfacing existing BMC (man_id: 0x%6.6x, prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n", 3007 bmc->id.manufacturer_id, 3008 bmc->id.product_id, 3009 bmc->id.device_id); 3010 } else { 3011 bmc = kzalloc(sizeof(*bmc), GFP_KERNEL); 3012 if (!bmc) { 3013 rv = -ENOMEM; 3014 goto out; 3015 } 3016 INIT_LIST_HEAD(&bmc->intfs); 3017 mutex_init(&bmc->dyn_mutex); 3018 INIT_WORK(&bmc->remove_work, cleanup_bmc_work); 3019 3020 bmc->id = *id; 3021 bmc->dyn_id_set = 1; 3022 bmc->dyn_guid_set = guid_set; 3023 bmc->guid = *guid; 3024 bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY; 3025 3026 bmc->pdev.name = "ipmi_bmc"; 3027 3028 rv = ida_simple_get(&ipmi_bmc_ida, 0, 0, GFP_KERNEL); 3029 if (rv < 0) { 3030 kfree(bmc); 3031 goto out; 3032 } 3033 3034 bmc->pdev.dev.driver = &ipmidriver.driver; 3035 bmc->pdev.id = rv; 3036 bmc->pdev.dev.release = release_bmc_device; 3037 bmc->pdev.dev.type = &bmc_device_type; 3038 kref_init(&bmc->usecount); 3039 3040 intf->bmc = bmc; 3041 mutex_lock(&bmc->dyn_mutex); 3042 list_add_tail(&intf->bmc_link, &bmc->intfs); 3043 mutex_unlock(&bmc->dyn_mutex); 3044 3045 rv = platform_device_register(&bmc->pdev); 3046 if (rv) { 3047 dev_err(intf->si_dev, 3048 "Unable to register bmc device: %d\n", 3049 rv); 3050 goto out_list_del; 3051 } 3052 3053 dev_info(intf->si_dev, 3054 "Found new BMC (man_id: 0x%6.6x, prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n", 3055 bmc->id.manufacturer_id, 3056 bmc->id.product_id, 3057 bmc->id.device_id); 3058 } 3059 3060 /* 3061 * create symlink from system interface device to bmc device 3062 * and back. 3063 */ 3064 rv = sysfs_create_link(&intf->si_dev->kobj, &bmc->pdev.dev.kobj, "bmc"); 3065 if (rv) { 3066 dev_err(intf->si_dev, "Unable to create bmc symlink: %d\n", rv); 3067 goto out_put_bmc; 3068 } 3069 3070 if (intf_num == -1) 3071 intf_num = intf->intf_num; 3072 intf->my_dev_name = kasprintf(GFP_KERNEL, "ipmi%d", intf_num); 3073 if (!intf->my_dev_name) { 3074 rv = -ENOMEM; 3075 dev_err(intf->si_dev, "Unable to allocate link from BMC: %d\n", 3076 rv); 3077 goto out_unlink1; 3078 } 3079 3080 rv = sysfs_create_link(&bmc->pdev.dev.kobj, &intf->si_dev->kobj, 3081 intf->my_dev_name); 3082 if (rv) { 3083 dev_err(intf->si_dev, "Unable to create symlink to bmc: %d\n", 3084 rv); 3085 goto out_free_my_dev_name; 3086 } 3087 3088 intf->bmc_registered = true; 3089 3090 out: 3091 mutex_unlock(&ipmidriver_mutex); 3092 mutex_lock(&intf->bmc_reg_mutex); 3093 intf->in_bmc_register = false; 3094 return rv; 3095 3096 3097 out_free_my_dev_name: 3098 kfree(intf->my_dev_name); 3099 intf->my_dev_name = NULL; 3100 3101 out_unlink1: 3102 sysfs_remove_link(&intf->si_dev->kobj, "bmc"); 3103 3104 out_put_bmc: 3105 mutex_lock(&bmc->dyn_mutex); 3106 list_del(&intf->bmc_link); 3107 mutex_unlock(&bmc->dyn_mutex); 3108 intf->bmc = &intf->tmp_bmc; 3109 kref_put(&bmc->usecount, cleanup_bmc_device); 3110 goto out; 3111 3112 out_list_del: 3113 mutex_lock(&bmc->dyn_mutex); 3114 list_del(&intf->bmc_link); 3115 mutex_unlock(&bmc->dyn_mutex); 3116 intf->bmc = &intf->tmp_bmc; 3117 put_device(&bmc->pdev.dev); 3118 goto out; 3119 } 3120 3121 static int 3122 send_guid_cmd(struct ipmi_smi *intf, int chan) 3123 { 3124 struct kernel_ipmi_msg msg; 3125 struct ipmi_system_interface_addr si; 3126 3127 si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 3128 si.channel = IPMI_BMC_CHANNEL; 3129 si.lun = 0; 3130 3131 msg.netfn = IPMI_NETFN_APP_REQUEST; 3132 msg.cmd = IPMI_GET_DEVICE_GUID_CMD; 3133 msg.data = NULL; 3134 msg.data_len = 0; 3135 return i_ipmi_request(NULL, 3136 intf, 3137 (struct ipmi_addr *) &si, 3138 0, 3139 &msg, 3140 intf, 3141 NULL, 3142 NULL, 3143 0, 3144 intf->addrinfo[0].address, 3145 intf->addrinfo[0].lun, 3146 -1, 0); 3147 } 3148 3149 static void guid_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) 3150 { 3151 struct bmc_device *bmc = intf->bmc; 3152 3153 if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 3154 || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE) 3155 || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD)) 3156 /* Not for me */ 3157 return; 3158 3159 if (msg->msg.data[0] != 0) { 3160 /* Error from getting the GUID, the BMC doesn't have one. */ 3161 bmc->dyn_guid_set = 0; 3162 goto out; 3163 } 3164 3165 if (msg->msg.data_len < UUID_SIZE + 1) { 3166 bmc->dyn_guid_set = 0; 3167 dev_warn(intf->si_dev, 3168 "The GUID response from the BMC was too short, it was %d but should have been %d. Assuming GUID is not available.\n", 3169 msg->msg.data_len, UUID_SIZE + 1); 3170 goto out; 3171 } 3172 3173 import_guid(&bmc->fetch_guid, msg->msg.data + 1); 3174 /* 3175 * Make sure the guid data is available before setting 3176 * dyn_guid_set. 3177 */ 3178 smp_wmb(); 3179 bmc->dyn_guid_set = 1; 3180 out: 3181 wake_up(&intf->waitq); 3182 } 3183 3184 static void __get_guid(struct ipmi_smi *intf) 3185 { 3186 int rv; 3187 struct bmc_device *bmc = intf->bmc; 3188 3189 bmc->dyn_guid_set = 2; 3190 intf->null_user_handler = guid_handler; 3191 rv = send_guid_cmd(intf, 0); 3192 if (rv) 3193 /* Send failed, no GUID available. */ 3194 bmc->dyn_guid_set = 0; 3195 else 3196 wait_event(intf->waitq, bmc->dyn_guid_set != 2); 3197 3198 /* dyn_guid_set makes the guid data available. */ 3199 smp_rmb(); 3200 3201 intf->null_user_handler = NULL; 3202 } 3203 3204 static int 3205 send_channel_info_cmd(struct ipmi_smi *intf, int chan) 3206 { 3207 struct kernel_ipmi_msg msg; 3208 unsigned char data[1]; 3209 struct ipmi_system_interface_addr si; 3210 3211 si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 3212 si.channel = IPMI_BMC_CHANNEL; 3213 si.lun = 0; 3214 3215 msg.netfn = IPMI_NETFN_APP_REQUEST; 3216 msg.cmd = IPMI_GET_CHANNEL_INFO_CMD; 3217 msg.data = data; 3218 msg.data_len = 1; 3219 data[0] = chan; 3220 return i_ipmi_request(NULL, 3221 intf, 3222 (struct ipmi_addr *) &si, 3223 0, 3224 &msg, 3225 intf, 3226 NULL, 3227 NULL, 3228 0, 3229 intf->addrinfo[0].address, 3230 intf->addrinfo[0].lun, 3231 -1, 0); 3232 } 3233 3234 static void 3235 channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) 3236 { 3237 int rv = 0; 3238 int ch; 3239 unsigned int set = intf->curr_working_cset; 3240 struct ipmi_channel *chans; 3241 3242 if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 3243 && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE) 3244 && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD)) { 3245 /* It's the one we want */ 3246 if (msg->msg.data[0] != 0) { 3247 /* Got an error from the channel, just go on. */ 3248 3249 if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) { 3250 /* 3251 * If the MC does not support this 3252 * command, that is legal. We just 3253 * assume it has one IPMB at channel 3254 * zero. 3255 */ 3256 intf->wchannels[set].c[0].medium 3257 = IPMI_CHANNEL_MEDIUM_IPMB; 3258 intf->wchannels[set].c[0].protocol 3259 = IPMI_CHANNEL_PROTOCOL_IPMB; 3260 3261 intf->channel_list = intf->wchannels + set; 3262 intf->channels_ready = true; 3263 wake_up(&intf->waitq); 3264 goto out; 3265 } 3266 goto next_channel; 3267 } 3268 if (msg->msg.data_len < 4) { 3269 /* Message not big enough, just go on. */ 3270 goto next_channel; 3271 } 3272 ch = intf->curr_channel; 3273 chans = intf->wchannels[set].c; 3274 chans[ch].medium = msg->msg.data[2] & 0x7f; 3275 chans[ch].protocol = msg->msg.data[3] & 0x1f; 3276 3277 next_channel: 3278 intf->curr_channel++; 3279 if (intf->curr_channel >= IPMI_MAX_CHANNELS) { 3280 intf->channel_list = intf->wchannels + set; 3281 intf->channels_ready = true; 3282 wake_up(&intf->waitq); 3283 } else { 3284 intf->channel_list = intf->wchannels + set; 3285 intf->channels_ready = true; 3286 rv = send_channel_info_cmd(intf, intf->curr_channel); 3287 } 3288 3289 if (rv) { 3290 /* Got an error somehow, just give up. */ 3291 dev_warn(intf->si_dev, 3292 "Error sending channel information for channel %d: %d\n", 3293 intf->curr_channel, rv); 3294 3295 intf->channel_list = intf->wchannels + set; 3296 intf->channels_ready = true; 3297 wake_up(&intf->waitq); 3298 } 3299 } 3300 out: 3301 return; 3302 } 3303 3304 /* 3305 * Must be holding intf->bmc_reg_mutex to call this. 3306 */ 3307 static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id) 3308 { 3309 int rv; 3310 3311 if (ipmi_version_major(id) > 1 3312 || (ipmi_version_major(id) == 1 3313 && ipmi_version_minor(id) >= 5)) { 3314 unsigned int set; 3315 3316 /* 3317 * Start scanning the channels to see what is 3318 * available. 3319 */ 3320 set = !intf->curr_working_cset; 3321 intf->curr_working_cset = set; 3322 memset(&intf->wchannels[set], 0, 3323 sizeof(struct ipmi_channel_set)); 3324 3325 intf->null_user_handler = channel_handler; 3326 intf->curr_channel = 0; 3327 rv = send_channel_info_cmd(intf, 0); 3328 if (rv) { 3329 dev_warn(intf->si_dev, 3330 "Error sending channel information for channel 0, %d\n", 3331 rv); 3332 return -EIO; 3333 } 3334 3335 /* Wait for the channel info to be read. */ 3336 wait_event(intf->waitq, intf->channels_ready); 3337 intf->null_user_handler = NULL; 3338 } else { 3339 unsigned int set = intf->curr_working_cset; 3340 3341 /* Assume a single IPMB channel at zero. */ 3342 intf->wchannels[set].c[0].medium = IPMI_CHANNEL_MEDIUM_IPMB; 3343 intf->wchannels[set].c[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB; 3344 intf->channel_list = intf->wchannels + set; 3345 intf->channels_ready = true; 3346 } 3347 3348 return 0; 3349 } 3350 3351 static void ipmi_poll(struct ipmi_smi *intf) 3352 { 3353 if (intf->handlers->poll) 3354 intf->handlers->poll(intf->send_info); 3355 /* In case something came in */ 3356 handle_new_recv_msgs(intf); 3357 } 3358 3359 void ipmi_poll_interface(struct ipmi_user *user) 3360 { 3361 ipmi_poll(user->intf); 3362 } 3363 EXPORT_SYMBOL(ipmi_poll_interface); 3364 3365 static void redo_bmc_reg(struct work_struct *work) 3366 { 3367 struct ipmi_smi *intf = container_of(work, struct ipmi_smi, 3368 bmc_reg_work); 3369 3370 if (!intf->in_shutdown) 3371 bmc_get_device_id(intf, NULL, NULL, NULL, NULL); 3372 3373 kref_put(&intf->refcount, intf_free); 3374 } 3375 3376 int ipmi_add_smi(struct module *owner, 3377 const struct ipmi_smi_handlers *handlers, 3378 void *send_info, 3379 struct device *si_dev, 3380 unsigned char slave_addr) 3381 { 3382 int i, j; 3383 int rv; 3384 struct ipmi_smi *intf, *tintf; 3385 struct list_head *link; 3386 struct ipmi_device_id id; 3387 3388 /* 3389 * Make sure the driver is actually initialized, this handles 3390 * problems with initialization order. 3391 */ 3392 rv = ipmi_init_msghandler(); 3393 if (rv) 3394 return rv; 3395 3396 intf = kzalloc(sizeof(*intf), GFP_KERNEL); 3397 if (!intf) 3398 return -ENOMEM; 3399 3400 rv = init_srcu_struct(&intf->users_srcu); 3401 if (rv) { 3402 kfree(intf); 3403 return rv; 3404 } 3405 3406 intf->owner = owner; 3407 intf->bmc = &intf->tmp_bmc; 3408 INIT_LIST_HEAD(&intf->bmc->intfs); 3409 mutex_init(&intf->bmc->dyn_mutex); 3410 INIT_LIST_HEAD(&intf->bmc_link); 3411 mutex_init(&intf->bmc_reg_mutex); 3412 intf->intf_num = -1; /* Mark it invalid for now. */ 3413 kref_init(&intf->refcount); 3414 INIT_WORK(&intf->bmc_reg_work, redo_bmc_reg); 3415 intf->si_dev = si_dev; 3416 for (j = 0; j < IPMI_MAX_CHANNELS; j++) { 3417 intf->addrinfo[j].address = IPMI_BMC_SLAVE_ADDR; 3418 intf->addrinfo[j].lun = 2; 3419 } 3420 if (slave_addr != 0) 3421 intf->addrinfo[0].address = slave_addr; 3422 INIT_LIST_HEAD(&intf->users); 3423 intf->handlers = handlers; 3424 intf->send_info = send_info; 3425 spin_lock_init(&intf->seq_lock); 3426 for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) { 3427 intf->seq_table[j].inuse = 0; 3428 intf->seq_table[j].seqid = 0; 3429 } 3430 intf->curr_seq = 0; 3431 spin_lock_init(&intf->waiting_rcv_msgs_lock); 3432 INIT_LIST_HEAD(&intf->waiting_rcv_msgs); 3433 tasklet_init(&intf->recv_tasklet, 3434 smi_recv_tasklet, 3435 (unsigned long) intf); 3436 atomic_set(&intf->watchdog_pretimeouts_to_deliver, 0); 3437 spin_lock_init(&intf->xmit_msgs_lock); 3438 INIT_LIST_HEAD(&intf->xmit_msgs); 3439 INIT_LIST_HEAD(&intf->hp_xmit_msgs); 3440 spin_lock_init(&intf->events_lock); 3441 spin_lock_init(&intf->watch_lock); 3442 atomic_set(&intf->event_waiters, 0); 3443 intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME; 3444 INIT_LIST_HEAD(&intf->waiting_events); 3445 intf->waiting_events_count = 0; 3446 mutex_init(&intf->cmd_rcvrs_mutex); 3447 spin_lock_init(&intf->maintenance_mode_lock); 3448 INIT_LIST_HEAD(&intf->cmd_rcvrs); 3449 init_waitqueue_head(&intf->waitq); 3450 for (i = 0; i < IPMI_NUM_STATS; i++) 3451 atomic_set(&intf->stats[i], 0); 3452 3453 mutex_lock(&ipmi_interfaces_mutex); 3454 /* Look for a hole in the numbers. */ 3455 i = 0; 3456 link = &ipmi_interfaces; 3457 list_for_each_entry_rcu(tintf, &ipmi_interfaces, link, 3458 ipmi_interfaces_mutex_held()) { 3459 if (tintf->intf_num != i) { 3460 link = &tintf->link; 3461 break; 3462 } 3463 i++; 3464 } 3465 /* Add the new interface in numeric order. */ 3466 if (i == 0) 3467 list_add_rcu(&intf->link, &ipmi_interfaces); 3468 else 3469 list_add_tail_rcu(&intf->link, link); 3470 3471 rv = handlers->start_processing(send_info, intf); 3472 if (rv) 3473 goto out_err; 3474 3475 rv = __bmc_get_device_id(intf, NULL, &id, NULL, NULL, i); 3476 if (rv) { 3477 dev_err(si_dev, "Unable to get the device id: %d\n", rv); 3478 goto out_err_started; 3479 } 3480 3481 mutex_lock(&intf->bmc_reg_mutex); 3482 rv = __scan_channels(intf, &id); 3483 mutex_unlock(&intf->bmc_reg_mutex); 3484 if (rv) 3485 goto out_err_bmc_reg; 3486 3487 /* 3488 * Keep memory order straight for RCU readers. Make 3489 * sure everything else is committed to memory before 3490 * setting intf_num to mark the interface valid. 3491 */ 3492 smp_wmb(); 3493 intf->intf_num = i; 3494 mutex_unlock(&ipmi_interfaces_mutex); 3495 3496 /* After this point the interface is legal to use. */ 3497 call_smi_watchers(i, intf->si_dev); 3498 3499 return 0; 3500 3501 out_err_bmc_reg: 3502 ipmi_bmc_unregister(intf); 3503 out_err_started: 3504 if (intf->handlers->shutdown) 3505 intf->handlers->shutdown(intf->send_info); 3506 out_err: 3507 list_del_rcu(&intf->link); 3508 mutex_unlock(&ipmi_interfaces_mutex); 3509 synchronize_srcu(&ipmi_interfaces_srcu); 3510 cleanup_srcu_struct(&intf->users_srcu); 3511 kref_put(&intf->refcount, intf_free); 3512 3513 return rv; 3514 } 3515 EXPORT_SYMBOL(ipmi_add_smi); 3516 3517 static void deliver_smi_err_response(struct ipmi_smi *intf, 3518 struct ipmi_smi_msg *msg, 3519 unsigned char err) 3520 { 3521 msg->rsp[0] = msg->data[0] | 4; 3522 msg->rsp[1] = msg->data[1]; 3523 msg->rsp[2] = err; 3524 msg->rsp_size = 3; 3525 /* It's an error, so it will never requeue, no need to check return. */ 3526 handle_one_recv_msg(intf, msg); 3527 } 3528 3529 static void cleanup_smi_msgs(struct ipmi_smi *intf) 3530 { 3531 int i; 3532 struct seq_table *ent; 3533 struct ipmi_smi_msg *msg; 3534 struct list_head *entry; 3535 struct list_head tmplist; 3536 3537 /* Clear out our transmit queues and hold the messages. */ 3538 INIT_LIST_HEAD(&tmplist); 3539 list_splice_tail(&intf->hp_xmit_msgs, &tmplist); 3540 list_splice_tail(&intf->xmit_msgs, &tmplist); 3541 3542 /* Current message first, to preserve order */ 3543 while (intf->curr_msg && !list_empty(&intf->waiting_rcv_msgs)) { 3544 /* Wait for the message to clear out. */ 3545 schedule_timeout(1); 3546 } 3547 3548 /* No need for locks, the interface is down. */ 3549 3550 /* 3551 * Return errors for all pending messages in queue and in the 3552 * tables waiting for remote responses. 3553 */ 3554 while (!list_empty(&tmplist)) { 3555 entry = tmplist.next; 3556 list_del(entry); 3557 msg = list_entry(entry, struct ipmi_smi_msg, link); 3558 deliver_smi_err_response(intf, msg, IPMI_ERR_UNSPECIFIED); 3559 } 3560 3561 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) { 3562 ent = &intf->seq_table[i]; 3563 if (!ent->inuse) 3564 continue; 3565 deliver_err_response(intf, ent->recv_msg, IPMI_ERR_UNSPECIFIED); 3566 } 3567 } 3568 3569 void ipmi_unregister_smi(struct ipmi_smi *intf) 3570 { 3571 struct ipmi_smi_watcher *w; 3572 int intf_num = intf->intf_num, index; 3573 3574 mutex_lock(&ipmi_interfaces_mutex); 3575 intf->intf_num = -1; 3576 intf->in_shutdown = true; 3577 list_del_rcu(&intf->link); 3578 mutex_unlock(&ipmi_interfaces_mutex); 3579 synchronize_srcu(&ipmi_interfaces_srcu); 3580 3581 /* At this point no users can be added to the interface. */ 3582 3583 /* 3584 * Call all the watcher interfaces to tell them that 3585 * an interface is going away. 3586 */ 3587 mutex_lock(&smi_watchers_mutex); 3588 list_for_each_entry(w, &smi_watchers, link) 3589 w->smi_gone(intf_num); 3590 mutex_unlock(&smi_watchers_mutex); 3591 3592 index = srcu_read_lock(&intf->users_srcu); 3593 while (!list_empty(&intf->users)) { 3594 struct ipmi_user *user = 3595 container_of(list_next_rcu(&intf->users), 3596 struct ipmi_user, link); 3597 3598 _ipmi_destroy_user(user); 3599 } 3600 srcu_read_unlock(&intf->users_srcu, index); 3601 3602 if (intf->handlers->shutdown) 3603 intf->handlers->shutdown(intf->send_info); 3604 3605 cleanup_smi_msgs(intf); 3606 3607 ipmi_bmc_unregister(intf); 3608 3609 cleanup_srcu_struct(&intf->users_srcu); 3610 kref_put(&intf->refcount, intf_free); 3611 } 3612 EXPORT_SYMBOL(ipmi_unregister_smi); 3613 3614 static int handle_ipmb_get_msg_rsp(struct ipmi_smi *intf, 3615 struct ipmi_smi_msg *msg) 3616 { 3617 struct ipmi_ipmb_addr ipmb_addr; 3618 struct ipmi_recv_msg *recv_msg; 3619 3620 /* 3621 * This is 11, not 10, because the response must contain a 3622 * completion code. 3623 */ 3624 if (msg->rsp_size < 11) { 3625 /* Message not big enough, just ignore it. */ 3626 ipmi_inc_stat(intf, invalid_ipmb_responses); 3627 return 0; 3628 } 3629 3630 if (msg->rsp[2] != 0) { 3631 /* An error getting the response, just ignore it. */ 3632 return 0; 3633 } 3634 3635 ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE; 3636 ipmb_addr.slave_addr = msg->rsp[6]; 3637 ipmb_addr.channel = msg->rsp[3] & 0x0f; 3638 ipmb_addr.lun = msg->rsp[7] & 3; 3639 3640 /* 3641 * It's a response from a remote entity. Look up the sequence 3642 * number and handle the response. 3643 */ 3644 if (intf_find_seq(intf, 3645 msg->rsp[7] >> 2, 3646 msg->rsp[3] & 0x0f, 3647 msg->rsp[8], 3648 (msg->rsp[4] >> 2) & (~1), 3649 (struct ipmi_addr *) &ipmb_addr, 3650 &recv_msg)) { 3651 /* 3652 * We were unable to find the sequence number, 3653 * so just nuke the message. 3654 */ 3655 ipmi_inc_stat(intf, unhandled_ipmb_responses); 3656 return 0; 3657 } 3658 3659 memcpy(recv_msg->msg_data, &msg->rsp[9], msg->rsp_size - 9); 3660 /* 3661 * The other fields matched, so no need to set them, except 3662 * for netfn, which needs to be the response that was 3663 * returned, not the request value. 3664 */ 3665 recv_msg->msg.netfn = msg->rsp[4] >> 2; 3666 recv_msg->msg.data = recv_msg->msg_data; 3667 recv_msg->msg.data_len = msg->rsp_size - 10; 3668 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 3669 if (deliver_response(intf, recv_msg)) 3670 ipmi_inc_stat(intf, unhandled_ipmb_responses); 3671 else 3672 ipmi_inc_stat(intf, handled_ipmb_responses); 3673 3674 return 0; 3675 } 3676 3677 static int handle_ipmb_get_msg_cmd(struct ipmi_smi *intf, 3678 struct ipmi_smi_msg *msg) 3679 { 3680 struct cmd_rcvr *rcvr; 3681 int rv = 0; 3682 unsigned char netfn; 3683 unsigned char cmd; 3684 unsigned char chan; 3685 struct ipmi_user *user = NULL; 3686 struct ipmi_ipmb_addr *ipmb_addr; 3687 struct ipmi_recv_msg *recv_msg; 3688 3689 if (msg->rsp_size < 10) { 3690 /* Message not big enough, just ignore it. */ 3691 ipmi_inc_stat(intf, invalid_commands); 3692 return 0; 3693 } 3694 3695 if (msg->rsp[2] != 0) { 3696 /* An error getting the response, just ignore it. */ 3697 return 0; 3698 } 3699 3700 netfn = msg->rsp[4] >> 2; 3701 cmd = msg->rsp[8]; 3702 chan = msg->rsp[3] & 0xf; 3703 3704 rcu_read_lock(); 3705 rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); 3706 if (rcvr) { 3707 user = rcvr->user; 3708 kref_get(&user->refcount); 3709 } else 3710 user = NULL; 3711 rcu_read_unlock(); 3712 3713 if (user == NULL) { 3714 /* We didn't find a user, deliver an error response. */ 3715 ipmi_inc_stat(intf, unhandled_commands); 3716 3717 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); 3718 msg->data[1] = IPMI_SEND_MSG_CMD; 3719 msg->data[2] = msg->rsp[3]; 3720 msg->data[3] = msg->rsp[6]; 3721 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3); 3722 msg->data[5] = ipmb_checksum(&msg->data[3], 2); 3723 msg->data[6] = intf->addrinfo[msg->rsp[3] & 0xf].address; 3724 /* rqseq/lun */ 3725 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3); 3726 msg->data[8] = msg->rsp[8]; /* cmd */ 3727 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE; 3728 msg->data[10] = ipmb_checksum(&msg->data[6], 4); 3729 msg->data_size = 11; 3730 3731 pr_debug("Invalid command: %*ph\n", msg->data_size, msg->data); 3732 3733 rcu_read_lock(); 3734 if (!intf->in_shutdown) { 3735 smi_send(intf, intf->handlers, msg, 0); 3736 /* 3737 * We used the message, so return the value 3738 * that causes it to not be freed or 3739 * queued. 3740 */ 3741 rv = -1; 3742 } 3743 rcu_read_unlock(); 3744 } else { 3745 recv_msg = ipmi_alloc_recv_msg(); 3746 if (!recv_msg) { 3747 /* 3748 * We couldn't allocate memory for the 3749 * message, so requeue it for handling 3750 * later. 3751 */ 3752 rv = 1; 3753 kref_put(&user->refcount, free_user); 3754 } else { 3755 /* Extract the source address from the data. */ 3756 ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr; 3757 ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE; 3758 ipmb_addr->slave_addr = msg->rsp[6]; 3759 ipmb_addr->lun = msg->rsp[7] & 3; 3760 ipmb_addr->channel = msg->rsp[3] & 0xf; 3761 3762 /* 3763 * Extract the rest of the message information 3764 * from the IPMB header. 3765 */ 3766 recv_msg->user = user; 3767 recv_msg->recv_type = IPMI_CMD_RECV_TYPE; 3768 recv_msg->msgid = msg->rsp[7] >> 2; 3769 recv_msg->msg.netfn = msg->rsp[4] >> 2; 3770 recv_msg->msg.cmd = msg->rsp[8]; 3771 recv_msg->msg.data = recv_msg->msg_data; 3772 3773 /* 3774 * We chop off 10, not 9 bytes because the checksum 3775 * at the end also needs to be removed. 3776 */ 3777 recv_msg->msg.data_len = msg->rsp_size - 10; 3778 memcpy(recv_msg->msg_data, &msg->rsp[9], 3779 msg->rsp_size - 10); 3780 if (deliver_response(intf, recv_msg)) 3781 ipmi_inc_stat(intf, unhandled_commands); 3782 else 3783 ipmi_inc_stat(intf, handled_commands); 3784 } 3785 } 3786 3787 return rv; 3788 } 3789 3790 static int handle_lan_get_msg_rsp(struct ipmi_smi *intf, 3791 struct ipmi_smi_msg *msg) 3792 { 3793 struct ipmi_lan_addr lan_addr; 3794 struct ipmi_recv_msg *recv_msg; 3795 3796 3797 /* 3798 * This is 13, not 12, because the response must contain a 3799 * completion code. 3800 */ 3801 if (msg->rsp_size < 13) { 3802 /* Message not big enough, just ignore it. */ 3803 ipmi_inc_stat(intf, invalid_lan_responses); 3804 return 0; 3805 } 3806 3807 if (msg->rsp[2] != 0) { 3808 /* An error getting the response, just ignore it. */ 3809 return 0; 3810 } 3811 3812 lan_addr.addr_type = IPMI_LAN_ADDR_TYPE; 3813 lan_addr.session_handle = msg->rsp[4]; 3814 lan_addr.remote_SWID = msg->rsp[8]; 3815 lan_addr.local_SWID = msg->rsp[5]; 3816 lan_addr.channel = msg->rsp[3] & 0x0f; 3817 lan_addr.privilege = msg->rsp[3] >> 4; 3818 lan_addr.lun = msg->rsp[9] & 3; 3819 3820 /* 3821 * It's a response from a remote entity. Look up the sequence 3822 * number and handle the response. 3823 */ 3824 if (intf_find_seq(intf, 3825 msg->rsp[9] >> 2, 3826 msg->rsp[3] & 0x0f, 3827 msg->rsp[10], 3828 (msg->rsp[6] >> 2) & (~1), 3829 (struct ipmi_addr *) &lan_addr, 3830 &recv_msg)) { 3831 /* 3832 * We were unable to find the sequence number, 3833 * so just nuke the message. 3834 */ 3835 ipmi_inc_stat(intf, unhandled_lan_responses); 3836 return 0; 3837 } 3838 3839 memcpy(recv_msg->msg_data, &msg->rsp[11], msg->rsp_size - 11); 3840 /* 3841 * The other fields matched, so no need to set them, except 3842 * for netfn, which needs to be the response that was 3843 * returned, not the request value. 3844 */ 3845 recv_msg->msg.netfn = msg->rsp[6] >> 2; 3846 recv_msg->msg.data = recv_msg->msg_data; 3847 recv_msg->msg.data_len = msg->rsp_size - 12; 3848 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 3849 if (deliver_response(intf, recv_msg)) 3850 ipmi_inc_stat(intf, unhandled_lan_responses); 3851 else 3852 ipmi_inc_stat(intf, handled_lan_responses); 3853 3854 return 0; 3855 } 3856 3857 static int handle_lan_get_msg_cmd(struct ipmi_smi *intf, 3858 struct ipmi_smi_msg *msg) 3859 { 3860 struct cmd_rcvr *rcvr; 3861 int rv = 0; 3862 unsigned char netfn; 3863 unsigned char cmd; 3864 unsigned char chan; 3865 struct ipmi_user *user = NULL; 3866 struct ipmi_lan_addr *lan_addr; 3867 struct ipmi_recv_msg *recv_msg; 3868 3869 if (msg->rsp_size < 12) { 3870 /* Message not big enough, just ignore it. */ 3871 ipmi_inc_stat(intf, invalid_commands); 3872 return 0; 3873 } 3874 3875 if (msg->rsp[2] != 0) { 3876 /* An error getting the response, just ignore it. */ 3877 return 0; 3878 } 3879 3880 netfn = msg->rsp[6] >> 2; 3881 cmd = msg->rsp[10]; 3882 chan = msg->rsp[3] & 0xf; 3883 3884 rcu_read_lock(); 3885 rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); 3886 if (rcvr) { 3887 user = rcvr->user; 3888 kref_get(&user->refcount); 3889 } else 3890 user = NULL; 3891 rcu_read_unlock(); 3892 3893 if (user == NULL) { 3894 /* We didn't find a user, just give up. */ 3895 ipmi_inc_stat(intf, unhandled_commands); 3896 3897 /* 3898 * Don't do anything with these messages, just allow 3899 * them to be freed. 3900 */ 3901 rv = 0; 3902 } else { 3903 recv_msg = ipmi_alloc_recv_msg(); 3904 if (!recv_msg) { 3905 /* 3906 * We couldn't allocate memory for the 3907 * message, so requeue it for handling later. 3908 */ 3909 rv = 1; 3910 kref_put(&user->refcount, free_user); 3911 } else { 3912 /* Extract the source address from the data. */ 3913 lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr; 3914 lan_addr->addr_type = IPMI_LAN_ADDR_TYPE; 3915 lan_addr->session_handle = msg->rsp[4]; 3916 lan_addr->remote_SWID = msg->rsp[8]; 3917 lan_addr->local_SWID = msg->rsp[5]; 3918 lan_addr->lun = msg->rsp[9] & 3; 3919 lan_addr->channel = msg->rsp[3] & 0xf; 3920 lan_addr->privilege = msg->rsp[3] >> 4; 3921 3922 /* 3923 * Extract the rest of the message information 3924 * from the IPMB header. 3925 */ 3926 recv_msg->user = user; 3927 recv_msg->recv_type = IPMI_CMD_RECV_TYPE; 3928 recv_msg->msgid = msg->rsp[9] >> 2; 3929 recv_msg->msg.netfn = msg->rsp[6] >> 2; 3930 recv_msg->msg.cmd = msg->rsp[10]; 3931 recv_msg->msg.data = recv_msg->msg_data; 3932 3933 /* 3934 * We chop off 12, not 11 bytes because the checksum 3935 * at the end also needs to be removed. 3936 */ 3937 recv_msg->msg.data_len = msg->rsp_size - 12; 3938 memcpy(recv_msg->msg_data, &msg->rsp[11], 3939 msg->rsp_size - 12); 3940 if (deliver_response(intf, recv_msg)) 3941 ipmi_inc_stat(intf, unhandled_commands); 3942 else 3943 ipmi_inc_stat(intf, handled_commands); 3944 } 3945 } 3946 3947 return rv; 3948 } 3949 3950 /* 3951 * This routine will handle "Get Message" command responses with 3952 * channels that use an OEM Medium. The message format belongs to 3953 * the OEM. See IPMI 2.0 specification, Chapter 6 and 3954 * Chapter 22, sections 22.6 and 22.24 for more details. 3955 */ 3956 static int handle_oem_get_msg_cmd(struct ipmi_smi *intf, 3957 struct ipmi_smi_msg *msg) 3958 { 3959 struct cmd_rcvr *rcvr; 3960 int rv = 0; 3961 unsigned char netfn; 3962 unsigned char cmd; 3963 unsigned char chan; 3964 struct ipmi_user *user = NULL; 3965 struct ipmi_system_interface_addr *smi_addr; 3966 struct ipmi_recv_msg *recv_msg; 3967 3968 /* 3969 * We expect the OEM SW to perform error checking 3970 * so we just do some basic sanity checks 3971 */ 3972 if (msg->rsp_size < 4) { 3973 /* Message not big enough, just ignore it. */ 3974 ipmi_inc_stat(intf, invalid_commands); 3975 return 0; 3976 } 3977 3978 if (msg->rsp[2] != 0) { 3979 /* An error getting the response, just ignore it. */ 3980 return 0; 3981 } 3982 3983 /* 3984 * This is an OEM Message so the OEM needs to know how 3985 * handle the message. We do no interpretation. 3986 */ 3987 netfn = msg->rsp[0] >> 2; 3988 cmd = msg->rsp[1]; 3989 chan = msg->rsp[3] & 0xf; 3990 3991 rcu_read_lock(); 3992 rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); 3993 if (rcvr) { 3994 user = rcvr->user; 3995 kref_get(&user->refcount); 3996 } else 3997 user = NULL; 3998 rcu_read_unlock(); 3999 4000 if (user == NULL) { 4001 /* We didn't find a user, just give up. */ 4002 ipmi_inc_stat(intf, unhandled_commands); 4003 4004 /* 4005 * Don't do anything with these messages, just allow 4006 * them to be freed. 4007 */ 4008 4009 rv = 0; 4010 } else { 4011 recv_msg = ipmi_alloc_recv_msg(); 4012 if (!recv_msg) { 4013 /* 4014 * We couldn't allocate memory for the 4015 * message, so requeue it for handling 4016 * later. 4017 */ 4018 rv = 1; 4019 kref_put(&user->refcount, free_user); 4020 } else { 4021 /* 4022 * OEM Messages are expected to be delivered via 4023 * the system interface to SMS software. We might 4024 * need to visit this again depending on OEM 4025 * requirements 4026 */ 4027 smi_addr = ((struct ipmi_system_interface_addr *) 4028 &recv_msg->addr); 4029 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 4030 smi_addr->channel = IPMI_BMC_CHANNEL; 4031 smi_addr->lun = msg->rsp[0] & 3; 4032 4033 recv_msg->user = user; 4034 recv_msg->user_msg_data = NULL; 4035 recv_msg->recv_type = IPMI_OEM_RECV_TYPE; 4036 recv_msg->msg.netfn = msg->rsp[0] >> 2; 4037 recv_msg->msg.cmd = msg->rsp[1]; 4038 recv_msg->msg.data = recv_msg->msg_data; 4039 4040 /* 4041 * The message starts at byte 4 which follows the 4042 * the Channel Byte in the "GET MESSAGE" command 4043 */ 4044 recv_msg->msg.data_len = msg->rsp_size - 4; 4045 memcpy(recv_msg->msg_data, &msg->rsp[4], 4046 msg->rsp_size - 4); 4047 if (deliver_response(intf, recv_msg)) 4048 ipmi_inc_stat(intf, unhandled_commands); 4049 else 4050 ipmi_inc_stat(intf, handled_commands); 4051 } 4052 } 4053 4054 return rv; 4055 } 4056 4057 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg, 4058 struct ipmi_smi_msg *msg) 4059 { 4060 struct ipmi_system_interface_addr *smi_addr; 4061 4062 recv_msg->msgid = 0; 4063 smi_addr = (struct ipmi_system_interface_addr *) &recv_msg->addr; 4064 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 4065 smi_addr->channel = IPMI_BMC_CHANNEL; 4066 smi_addr->lun = msg->rsp[0] & 3; 4067 recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE; 4068 recv_msg->msg.netfn = msg->rsp[0] >> 2; 4069 recv_msg->msg.cmd = msg->rsp[1]; 4070 memcpy(recv_msg->msg_data, &msg->rsp[3], msg->rsp_size - 3); 4071 recv_msg->msg.data = recv_msg->msg_data; 4072 recv_msg->msg.data_len = msg->rsp_size - 3; 4073 } 4074 4075 static int handle_read_event_rsp(struct ipmi_smi *intf, 4076 struct ipmi_smi_msg *msg) 4077 { 4078 struct ipmi_recv_msg *recv_msg, *recv_msg2; 4079 struct list_head msgs; 4080 struct ipmi_user *user; 4081 int rv = 0, deliver_count = 0, index; 4082 unsigned long flags; 4083 4084 if (msg->rsp_size < 19) { 4085 /* Message is too small to be an IPMB event. */ 4086 ipmi_inc_stat(intf, invalid_events); 4087 return 0; 4088 } 4089 4090 if (msg->rsp[2] != 0) { 4091 /* An error getting the event, just ignore it. */ 4092 return 0; 4093 } 4094 4095 INIT_LIST_HEAD(&msgs); 4096 4097 spin_lock_irqsave(&intf->events_lock, flags); 4098 4099 ipmi_inc_stat(intf, events); 4100 4101 /* 4102 * Allocate and fill in one message for every user that is 4103 * getting events. 4104 */ 4105 index = srcu_read_lock(&intf->users_srcu); 4106 list_for_each_entry_rcu(user, &intf->users, link) { 4107 if (!user->gets_events) 4108 continue; 4109 4110 recv_msg = ipmi_alloc_recv_msg(); 4111 if (!recv_msg) { 4112 rcu_read_unlock(); 4113 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, 4114 link) { 4115 list_del(&recv_msg->link); 4116 ipmi_free_recv_msg(recv_msg); 4117 } 4118 /* 4119 * We couldn't allocate memory for the 4120 * message, so requeue it for handling 4121 * later. 4122 */ 4123 rv = 1; 4124 goto out; 4125 } 4126 4127 deliver_count++; 4128 4129 copy_event_into_recv_msg(recv_msg, msg); 4130 recv_msg->user = user; 4131 kref_get(&user->refcount); 4132 list_add_tail(&recv_msg->link, &msgs); 4133 } 4134 srcu_read_unlock(&intf->users_srcu, index); 4135 4136 if (deliver_count) { 4137 /* Now deliver all the messages. */ 4138 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) { 4139 list_del(&recv_msg->link); 4140 deliver_local_response(intf, recv_msg); 4141 } 4142 } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) { 4143 /* 4144 * No one to receive the message, put it in queue if there's 4145 * not already too many things in the queue. 4146 */ 4147 recv_msg = ipmi_alloc_recv_msg(); 4148 if (!recv_msg) { 4149 /* 4150 * We couldn't allocate memory for the 4151 * message, so requeue it for handling 4152 * later. 4153 */ 4154 rv = 1; 4155 goto out; 4156 } 4157 4158 copy_event_into_recv_msg(recv_msg, msg); 4159 list_add_tail(&recv_msg->link, &intf->waiting_events); 4160 intf->waiting_events_count++; 4161 } else if (!intf->event_msg_printed) { 4162 /* 4163 * There's too many things in the queue, discard this 4164 * message. 4165 */ 4166 dev_warn(intf->si_dev, 4167 "Event queue full, discarding incoming events\n"); 4168 intf->event_msg_printed = 1; 4169 } 4170 4171 out: 4172 spin_unlock_irqrestore(&intf->events_lock, flags); 4173 4174 return rv; 4175 } 4176 4177 static int handle_bmc_rsp(struct ipmi_smi *intf, 4178 struct ipmi_smi_msg *msg) 4179 { 4180 struct ipmi_recv_msg *recv_msg; 4181 struct ipmi_system_interface_addr *smi_addr; 4182 4183 recv_msg = (struct ipmi_recv_msg *) msg->user_data; 4184 if (recv_msg == NULL) { 4185 dev_warn(intf->si_dev, 4186 "IPMI message received with no owner. This could be because of a malformed message, or because of a hardware error. Contact your hardware vendor for assistance.\n"); 4187 return 0; 4188 } 4189 4190 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 4191 recv_msg->msgid = msg->msgid; 4192 smi_addr = ((struct ipmi_system_interface_addr *) 4193 &recv_msg->addr); 4194 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 4195 smi_addr->channel = IPMI_BMC_CHANNEL; 4196 smi_addr->lun = msg->rsp[0] & 3; 4197 recv_msg->msg.netfn = msg->rsp[0] >> 2; 4198 recv_msg->msg.cmd = msg->rsp[1]; 4199 memcpy(recv_msg->msg_data, &msg->rsp[2], msg->rsp_size - 2); 4200 recv_msg->msg.data = recv_msg->msg_data; 4201 recv_msg->msg.data_len = msg->rsp_size - 2; 4202 deliver_local_response(intf, recv_msg); 4203 4204 return 0; 4205 } 4206 4207 /* 4208 * Handle a received message. Return 1 if the message should be requeued, 4209 * 0 if the message should be freed, or -1 if the message should not 4210 * be freed or requeued. 4211 */ 4212 static int handle_one_recv_msg(struct ipmi_smi *intf, 4213 struct ipmi_smi_msg *msg) 4214 { 4215 int requeue; 4216 int chan; 4217 4218 pr_debug("Recv: %*ph\n", msg->rsp_size, msg->rsp); 4219 4220 if ((msg->data_size >= 2) 4221 && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2)) 4222 && (msg->data[1] == IPMI_SEND_MSG_CMD) 4223 && (msg->user_data == NULL)) { 4224 4225 if (intf->in_shutdown) 4226 goto free_msg; 4227 4228 /* 4229 * This is the local response to a command send, start 4230 * the timer for these. The user_data will not be 4231 * NULL if this is a response send, and we will let 4232 * response sends just go through. 4233 */ 4234 4235 /* 4236 * Check for errors, if we get certain errors (ones 4237 * that mean basically we can try again later), we 4238 * ignore them and start the timer. Otherwise we 4239 * report the error immediately. 4240 */ 4241 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0) 4242 && (msg->rsp[2] != IPMI_NODE_BUSY_ERR) 4243 && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR) 4244 && (msg->rsp[2] != IPMI_BUS_ERR) 4245 && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) { 4246 int ch = msg->rsp[3] & 0xf; 4247 struct ipmi_channel *chans; 4248 4249 /* Got an error sending the message, handle it. */ 4250 4251 chans = READ_ONCE(intf->channel_list)->c; 4252 if ((chans[ch].medium == IPMI_CHANNEL_MEDIUM_8023LAN) 4253 || (chans[ch].medium == IPMI_CHANNEL_MEDIUM_ASYNC)) 4254 ipmi_inc_stat(intf, sent_lan_command_errs); 4255 else 4256 ipmi_inc_stat(intf, sent_ipmb_command_errs); 4257 intf_err_seq(intf, msg->msgid, msg->rsp[2]); 4258 } else 4259 /* The message was sent, start the timer. */ 4260 intf_start_seq_timer(intf, msg->msgid); 4261 free_msg: 4262 requeue = 0; 4263 goto out; 4264 4265 } else if (msg->rsp_size < 2) { 4266 /* Message is too small to be correct. */ 4267 dev_warn(intf->si_dev, 4268 "BMC returned too small a message for netfn %x cmd %x, got %d bytes\n", 4269 (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size); 4270 4271 /* Generate an error response for the message. */ 4272 msg->rsp[0] = msg->data[0] | (1 << 2); 4273 msg->rsp[1] = msg->data[1]; 4274 msg->rsp[2] = IPMI_ERR_UNSPECIFIED; 4275 msg->rsp_size = 3; 4276 } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1)) 4277 || (msg->rsp[1] != msg->data[1])) { 4278 /* 4279 * The NetFN and Command in the response is not even 4280 * marginally correct. 4281 */ 4282 dev_warn(intf->si_dev, 4283 "BMC returned incorrect response, expected netfn %x cmd %x, got netfn %x cmd %x\n", 4284 (msg->data[0] >> 2) | 1, msg->data[1], 4285 msg->rsp[0] >> 2, msg->rsp[1]); 4286 4287 /* Generate an error response for the message. */ 4288 msg->rsp[0] = msg->data[0] | (1 << 2); 4289 msg->rsp[1] = msg->data[1]; 4290 msg->rsp[2] = IPMI_ERR_UNSPECIFIED; 4291 msg->rsp_size = 3; 4292 } 4293 4294 if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2)) 4295 && (msg->rsp[1] == IPMI_SEND_MSG_CMD) 4296 && (msg->user_data != NULL)) { 4297 /* 4298 * It's a response to a response we sent. For this we 4299 * deliver a send message response to the user. 4300 */ 4301 struct ipmi_recv_msg *recv_msg = msg->user_data; 4302 4303 requeue = 0; 4304 if (msg->rsp_size < 2) 4305 /* Message is too small to be correct. */ 4306 goto out; 4307 4308 chan = msg->data[2] & 0x0f; 4309 if (chan >= IPMI_MAX_CHANNELS) 4310 /* Invalid channel number */ 4311 goto out; 4312 4313 if (!recv_msg) 4314 goto out; 4315 4316 recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE; 4317 recv_msg->msg.data = recv_msg->msg_data; 4318 recv_msg->msg.data_len = 1; 4319 recv_msg->msg_data[0] = msg->rsp[2]; 4320 deliver_local_response(intf, recv_msg); 4321 } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2)) 4322 && (msg->rsp[1] == IPMI_GET_MSG_CMD)) { 4323 struct ipmi_channel *chans; 4324 4325 /* It's from the receive queue. */ 4326 chan = msg->rsp[3] & 0xf; 4327 if (chan >= IPMI_MAX_CHANNELS) { 4328 /* Invalid channel number */ 4329 requeue = 0; 4330 goto out; 4331 } 4332 4333 /* 4334 * We need to make sure the channels have been initialized. 4335 * The channel_handler routine will set the "curr_channel" 4336 * equal to or greater than IPMI_MAX_CHANNELS when all the 4337 * channels for this interface have been initialized. 4338 */ 4339 if (!intf->channels_ready) { 4340 requeue = 0; /* Throw the message away */ 4341 goto out; 4342 } 4343 4344 chans = READ_ONCE(intf->channel_list)->c; 4345 4346 switch (chans[chan].medium) { 4347 case IPMI_CHANNEL_MEDIUM_IPMB: 4348 if (msg->rsp[4] & 0x04) { 4349 /* 4350 * It's a response, so find the 4351 * requesting message and send it up. 4352 */ 4353 requeue = handle_ipmb_get_msg_rsp(intf, msg); 4354 } else { 4355 /* 4356 * It's a command to the SMS from some other 4357 * entity. Handle that. 4358 */ 4359 requeue = handle_ipmb_get_msg_cmd(intf, msg); 4360 } 4361 break; 4362 4363 case IPMI_CHANNEL_MEDIUM_8023LAN: 4364 case IPMI_CHANNEL_MEDIUM_ASYNC: 4365 if (msg->rsp[6] & 0x04) { 4366 /* 4367 * It's a response, so find the 4368 * requesting message and send it up. 4369 */ 4370 requeue = handle_lan_get_msg_rsp(intf, msg); 4371 } else { 4372 /* 4373 * It's a command to the SMS from some other 4374 * entity. Handle that. 4375 */ 4376 requeue = handle_lan_get_msg_cmd(intf, msg); 4377 } 4378 break; 4379 4380 default: 4381 /* Check for OEM Channels. Clients had better 4382 register for these commands. */ 4383 if ((chans[chan].medium >= IPMI_CHANNEL_MEDIUM_OEM_MIN) 4384 && (chans[chan].medium 4385 <= IPMI_CHANNEL_MEDIUM_OEM_MAX)) { 4386 requeue = handle_oem_get_msg_cmd(intf, msg); 4387 } else { 4388 /* 4389 * We don't handle the channel type, so just 4390 * free the message. 4391 */ 4392 requeue = 0; 4393 } 4394 } 4395 4396 } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2)) 4397 && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD)) { 4398 /* It's an asynchronous event. */ 4399 requeue = handle_read_event_rsp(intf, msg); 4400 } else { 4401 /* It's a response from the local BMC. */ 4402 requeue = handle_bmc_rsp(intf, msg); 4403 } 4404 4405 out: 4406 return requeue; 4407 } 4408 4409 /* 4410 * If there are messages in the queue or pretimeouts, handle them. 4411 */ 4412 static void handle_new_recv_msgs(struct ipmi_smi *intf) 4413 { 4414 struct ipmi_smi_msg *smi_msg; 4415 unsigned long flags = 0; 4416 int rv; 4417 int run_to_completion = intf->run_to_completion; 4418 4419 /* See if any waiting messages need to be processed. */ 4420 if (!run_to_completion) 4421 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags); 4422 while (!list_empty(&intf->waiting_rcv_msgs)) { 4423 smi_msg = list_entry(intf->waiting_rcv_msgs.next, 4424 struct ipmi_smi_msg, link); 4425 list_del(&smi_msg->link); 4426 if (!run_to_completion) 4427 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, 4428 flags); 4429 rv = handle_one_recv_msg(intf, smi_msg); 4430 if (!run_to_completion) 4431 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags); 4432 if (rv > 0) { 4433 /* 4434 * To preserve message order, quit if we 4435 * can't handle a message. Add the message 4436 * back at the head, this is safe because this 4437 * tasklet is the only thing that pulls the 4438 * messages. 4439 */ 4440 list_add(&smi_msg->link, &intf->waiting_rcv_msgs); 4441 break; 4442 } else { 4443 if (rv == 0) 4444 /* Message handled */ 4445 ipmi_free_smi_msg(smi_msg); 4446 /* If rv < 0, fatal error, del but don't free. */ 4447 } 4448 } 4449 if (!run_to_completion) 4450 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, flags); 4451 4452 /* 4453 * If the pretimout count is non-zero, decrement one from it and 4454 * deliver pretimeouts to all the users. 4455 */ 4456 if (atomic_add_unless(&intf->watchdog_pretimeouts_to_deliver, -1, 0)) { 4457 struct ipmi_user *user; 4458 int index; 4459 4460 index = srcu_read_lock(&intf->users_srcu); 4461 list_for_each_entry_rcu(user, &intf->users, link) { 4462 if (user->handler->ipmi_watchdog_pretimeout) 4463 user->handler->ipmi_watchdog_pretimeout( 4464 user->handler_data); 4465 } 4466 srcu_read_unlock(&intf->users_srcu, index); 4467 } 4468 } 4469 4470 static void smi_recv_tasklet(unsigned long val) 4471 { 4472 unsigned long flags = 0; /* keep us warning-free. */ 4473 struct ipmi_smi *intf = (struct ipmi_smi *) val; 4474 int run_to_completion = intf->run_to_completion; 4475 struct ipmi_smi_msg *newmsg = NULL; 4476 4477 /* 4478 * Start the next message if available. 4479 * 4480 * Do this here, not in the actual receiver, because we may deadlock 4481 * because the lower layer is allowed to hold locks while calling 4482 * message delivery. 4483 */ 4484 4485 rcu_read_lock(); 4486 4487 if (!run_to_completion) 4488 spin_lock_irqsave(&intf->xmit_msgs_lock, flags); 4489 if (intf->curr_msg == NULL && !intf->in_shutdown) { 4490 struct list_head *entry = NULL; 4491 4492 /* Pick the high priority queue first. */ 4493 if (!list_empty(&intf->hp_xmit_msgs)) 4494 entry = intf->hp_xmit_msgs.next; 4495 else if (!list_empty(&intf->xmit_msgs)) 4496 entry = intf->xmit_msgs.next; 4497 4498 if (entry) { 4499 list_del(entry); 4500 newmsg = list_entry(entry, struct ipmi_smi_msg, link); 4501 intf->curr_msg = newmsg; 4502 } 4503 } 4504 4505 if (!run_to_completion) 4506 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags); 4507 if (newmsg) 4508 intf->handlers->sender(intf->send_info, newmsg); 4509 4510 rcu_read_unlock(); 4511 4512 handle_new_recv_msgs(intf); 4513 } 4514 4515 /* Handle a new message from the lower layer. */ 4516 void ipmi_smi_msg_received(struct ipmi_smi *intf, 4517 struct ipmi_smi_msg *msg) 4518 { 4519 unsigned long flags = 0; /* keep us warning-free. */ 4520 int run_to_completion = intf->run_to_completion; 4521 4522 /* 4523 * To preserve message order, we keep a queue and deliver from 4524 * a tasklet. 4525 */ 4526 if (!run_to_completion) 4527 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags); 4528 list_add_tail(&msg->link, &intf->waiting_rcv_msgs); 4529 if (!run_to_completion) 4530 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, 4531 flags); 4532 4533 if (!run_to_completion) 4534 spin_lock_irqsave(&intf->xmit_msgs_lock, flags); 4535 /* 4536 * We can get an asynchronous event or receive message in addition 4537 * to commands we send. 4538 */ 4539 if (msg == intf->curr_msg) 4540 intf->curr_msg = NULL; 4541 if (!run_to_completion) 4542 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags); 4543 4544 if (run_to_completion) 4545 smi_recv_tasklet((unsigned long) intf); 4546 else 4547 tasklet_schedule(&intf->recv_tasklet); 4548 } 4549 EXPORT_SYMBOL(ipmi_smi_msg_received); 4550 4551 void ipmi_smi_watchdog_pretimeout(struct ipmi_smi *intf) 4552 { 4553 if (intf->in_shutdown) 4554 return; 4555 4556 atomic_set(&intf->watchdog_pretimeouts_to_deliver, 1); 4557 tasklet_schedule(&intf->recv_tasklet); 4558 } 4559 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout); 4560 4561 static struct ipmi_smi_msg * 4562 smi_from_recv_msg(struct ipmi_smi *intf, struct ipmi_recv_msg *recv_msg, 4563 unsigned char seq, long seqid) 4564 { 4565 struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg(); 4566 if (!smi_msg) 4567 /* 4568 * If we can't allocate the message, then just return, we 4569 * get 4 retries, so this should be ok. 4570 */ 4571 return NULL; 4572 4573 memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len); 4574 smi_msg->data_size = recv_msg->msg.data_len; 4575 smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid); 4576 4577 pr_debug("Resend: %*ph\n", smi_msg->data_size, smi_msg->data); 4578 4579 return smi_msg; 4580 } 4581 4582 static void check_msg_timeout(struct ipmi_smi *intf, struct seq_table *ent, 4583 struct list_head *timeouts, 4584 unsigned long timeout_period, 4585 int slot, unsigned long *flags, 4586 bool *need_timer) 4587 { 4588 struct ipmi_recv_msg *msg; 4589 4590 if (intf->in_shutdown) 4591 return; 4592 4593 if (!ent->inuse) 4594 return; 4595 4596 if (timeout_period < ent->timeout) { 4597 ent->timeout -= timeout_period; 4598 *need_timer = true; 4599 return; 4600 } 4601 4602 if (ent->retries_left == 0) { 4603 /* The message has used all its retries. */ 4604 ent->inuse = 0; 4605 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 4606 msg = ent->recv_msg; 4607 list_add_tail(&msg->link, timeouts); 4608 if (ent->broadcast) 4609 ipmi_inc_stat(intf, timed_out_ipmb_broadcasts); 4610 else if (is_lan_addr(&ent->recv_msg->addr)) 4611 ipmi_inc_stat(intf, timed_out_lan_commands); 4612 else 4613 ipmi_inc_stat(intf, timed_out_ipmb_commands); 4614 } else { 4615 struct ipmi_smi_msg *smi_msg; 4616 /* More retries, send again. */ 4617 4618 *need_timer = true; 4619 4620 /* 4621 * Start with the max timer, set to normal timer after 4622 * the message is sent. 4623 */ 4624 ent->timeout = MAX_MSG_TIMEOUT; 4625 ent->retries_left--; 4626 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot, 4627 ent->seqid); 4628 if (!smi_msg) { 4629 if (is_lan_addr(&ent->recv_msg->addr)) 4630 ipmi_inc_stat(intf, 4631 dropped_rexmit_lan_commands); 4632 else 4633 ipmi_inc_stat(intf, 4634 dropped_rexmit_ipmb_commands); 4635 return; 4636 } 4637 4638 spin_unlock_irqrestore(&intf->seq_lock, *flags); 4639 4640 /* 4641 * Send the new message. We send with a zero 4642 * priority. It timed out, I doubt time is that 4643 * critical now, and high priority messages are really 4644 * only for messages to the local MC, which don't get 4645 * resent. 4646 */ 4647 if (intf->handlers) { 4648 if (is_lan_addr(&ent->recv_msg->addr)) 4649 ipmi_inc_stat(intf, 4650 retransmitted_lan_commands); 4651 else 4652 ipmi_inc_stat(intf, 4653 retransmitted_ipmb_commands); 4654 4655 smi_send(intf, intf->handlers, smi_msg, 0); 4656 } else 4657 ipmi_free_smi_msg(smi_msg); 4658 4659 spin_lock_irqsave(&intf->seq_lock, *flags); 4660 } 4661 } 4662 4663 static bool ipmi_timeout_handler(struct ipmi_smi *intf, 4664 unsigned long timeout_period) 4665 { 4666 struct list_head timeouts; 4667 struct ipmi_recv_msg *msg, *msg2; 4668 unsigned long flags; 4669 int i; 4670 bool need_timer = false; 4671 4672 if (!intf->bmc_registered) { 4673 kref_get(&intf->refcount); 4674 if (!schedule_work(&intf->bmc_reg_work)) { 4675 kref_put(&intf->refcount, intf_free); 4676 need_timer = true; 4677 } 4678 } 4679 4680 /* 4681 * Go through the seq table and find any messages that 4682 * have timed out, putting them in the timeouts 4683 * list. 4684 */ 4685 INIT_LIST_HEAD(&timeouts); 4686 spin_lock_irqsave(&intf->seq_lock, flags); 4687 if (intf->ipmb_maintenance_mode_timeout) { 4688 if (intf->ipmb_maintenance_mode_timeout <= timeout_period) 4689 intf->ipmb_maintenance_mode_timeout = 0; 4690 else 4691 intf->ipmb_maintenance_mode_timeout -= timeout_period; 4692 } 4693 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) 4694 check_msg_timeout(intf, &intf->seq_table[i], 4695 &timeouts, timeout_period, i, 4696 &flags, &need_timer); 4697 spin_unlock_irqrestore(&intf->seq_lock, flags); 4698 4699 list_for_each_entry_safe(msg, msg2, &timeouts, link) 4700 deliver_err_response(intf, msg, IPMI_TIMEOUT_COMPLETION_CODE); 4701 4702 /* 4703 * Maintenance mode handling. Check the timeout 4704 * optimistically before we claim the lock. It may 4705 * mean a timeout gets missed occasionally, but that 4706 * only means the timeout gets extended by one period 4707 * in that case. No big deal, and it avoids the lock 4708 * most of the time. 4709 */ 4710 if (intf->auto_maintenance_timeout > 0) { 4711 spin_lock_irqsave(&intf->maintenance_mode_lock, flags); 4712 if (intf->auto_maintenance_timeout > 0) { 4713 intf->auto_maintenance_timeout 4714 -= timeout_period; 4715 if (!intf->maintenance_mode 4716 && (intf->auto_maintenance_timeout <= 0)) { 4717 intf->maintenance_mode_enable = false; 4718 maintenance_mode_update(intf); 4719 } 4720 } 4721 spin_unlock_irqrestore(&intf->maintenance_mode_lock, 4722 flags); 4723 } 4724 4725 tasklet_schedule(&intf->recv_tasklet); 4726 4727 return need_timer; 4728 } 4729 4730 static void ipmi_request_event(struct ipmi_smi *intf) 4731 { 4732 /* No event requests when in maintenance mode. */ 4733 if (intf->maintenance_mode_enable) 4734 return; 4735 4736 if (!intf->in_shutdown) 4737 intf->handlers->request_events(intf->send_info); 4738 } 4739 4740 static struct timer_list ipmi_timer; 4741 4742 static atomic_t stop_operation; 4743 4744 static void ipmi_timeout(struct timer_list *unused) 4745 { 4746 struct ipmi_smi *intf; 4747 bool need_timer = false; 4748 int index; 4749 4750 if (atomic_read(&stop_operation)) 4751 return; 4752 4753 index = srcu_read_lock(&ipmi_interfaces_srcu); 4754 list_for_each_entry_rcu(intf, &ipmi_interfaces, link) { 4755 if (atomic_read(&intf->event_waiters)) { 4756 intf->ticks_to_req_ev--; 4757 if (intf->ticks_to_req_ev == 0) { 4758 ipmi_request_event(intf); 4759 intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME; 4760 } 4761 need_timer = true; 4762 } 4763 4764 need_timer |= ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME); 4765 } 4766 srcu_read_unlock(&ipmi_interfaces_srcu, index); 4767 4768 if (need_timer) 4769 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); 4770 } 4771 4772 static void need_waiter(struct ipmi_smi *intf) 4773 { 4774 /* Racy, but worst case we start the timer twice. */ 4775 if (!timer_pending(&ipmi_timer)) 4776 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); 4777 } 4778 4779 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0); 4780 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0); 4781 4782 static void free_smi_msg(struct ipmi_smi_msg *msg) 4783 { 4784 atomic_dec(&smi_msg_inuse_count); 4785 kfree(msg); 4786 } 4787 4788 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void) 4789 { 4790 struct ipmi_smi_msg *rv; 4791 rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC); 4792 if (rv) { 4793 rv->done = free_smi_msg; 4794 rv->user_data = NULL; 4795 atomic_inc(&smi_msg_inuse_count); 4796 } 4797 return rv; 4798 } 4799 EXPORT_SYMBOL(ipmi_alloc_smi_msg); 4800 4801 static void free_recv_msg(struct ipmi_recv_msg *msg) 4802 { 4803 atomic_dec(&recv_msg_inuse_count); 4804 kfree(msg); 4805 } 4806 4807 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void) 4808 { 4809 struct ipmi_recv_msg *rv; 4810 4811 rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC); 4812 if (rv) { 4813 rv->user = NULL; 4814 rv->done = free_recv_msg; 4815 atomic_inc(&recv_msg_inuse_count); 4816 } 4817 return rv; 4818 } 4819 4820 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg) 4821 { 4822 if (msg->user) 4823 kref_put(&msg->user->refcount, free_user); 4824 msg->done(msg); 4825 } 4826 EXPORT_SYMBOL(ipmi_free_recv_msg); 4827 4828 static atomic_t panic_done_count = ATOMIC_INIT(0); 4829 4830 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg) 4831 { 4832 atomic_dec(&panic_done_count); 4833 } 4834 4835 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg) 4836 { 4837 atomic_dec(&panic_done_count); 4838 } 4839 4840 /* 4841 * Inside a panic, send a message and wait for a response. 4842 */ 4843 static void ipmi_panic_request_and_wait(struct ipmi_smi *intf, 4844 struct ipmi_addr *addr, 4845 struct kernel_ipmi_msg *msg) 4846 { 4847 struct ipmi_smi_msg smi_msg; 4848 struct ipmi_recv_msg recv_msg; 4849 int rv; 4850 4851 smi_msg.done = dummy_smi_done_handler; 4852 recv_msg.done = dummy_recv_done_handler; 4853 atomic_add(2, &panic_done_count); 4854 rv = i_ipmi_request(NULL, 4855 intf, 4856 addr, 4857 0, 4858 msg, 4859 intf, 4860 &smi_msg, 4861 &recv_msg, 4862 0, 4863 intf->addrinfo[0].address, 4864 intf->addrinfo[0].lun, 4865 0, 1); /* Don't retry, and don't wait. */ 4866 if (rv) 4867 atomic_sub(2, &panic_done_count); 4868 else if (intf->handlers->flush_messages) 4869 intf->handlers->flush_messages(intf->send_info); 4870 4871 while (atomic_read(&panic_done_count) != 0) 4872 ipmi_poll(intf); 4873 } 4874 4875 static void event_receiver_fetcher(struct ipmi_smi *intf, 4876 struct ipmi_recv_msg *msg) 4877 { 4878 if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 4879 && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE) 4880 && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD) 4881 && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) { 4882 /* A get event receiver command, save it. */ 4883 intf->event_receiver = msg->msg.data[1]; 4884 intf->event_receiver_lun = msg->msg.data[2] & 0x3; 4885 } 4886 } 4887 4888 static void device_id_fetcher(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) 4889 { 4890 if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 4891 && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE) 4892 && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD) 4893 && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) { 4894 /* 4895 * A get device id command, save if we are an event 4896 * receiver or generator. 4897 */ 4898 intf->local_sel_device = (msg->msg.data[6] >> 2) & 1; 4899 intf->local_event_generator = (msg->msg.data[6] >> 5) & 1; 4900 } 4901 } 4902 4903 static void send_panic_events(struct ipmi_smi *intf, char *str) 4904 { 4905 struct kernel_ipmi_msg msg; 4906 unsigned char data[16]; 4907 struct ipmi_system_interface_addr *si; 4908 struct ipmi_addr addr; 4909 char *p = str; 4910 struct ipmi_ipmb_addr *ipmb; 4911 int j; 4912 4913 if (ipmi_send_panic_event == IPMI_SEND_PANIC_EVENT_NONE) 4914 return; 4915 4916 si = (struct ipmi_system_interface_addr *) &addr; 4917 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 4918 si->channel = IPMI_BMC_CHANNEL; 4919 si->lun = 0; 4920 4921 /* Fill in an event telling that we have failed. */ 4922 msg.netfn = 0x04; /* Sensor or Event. */ 4923 msg.cmd = 2; /* Platform event command. */ 4924 msg.data = data; 4925 msg.data_len = 8; 4926 data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */ 4927 data[1] = 0x03; /* This is for IPMI 1.0. */ 4928 data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */ 4929 data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */ 4930 data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */ 4931 4932 /* 4933 * Put a few breadcrumbs in. Hopefully later we can add more things 4934 * to make the panic events more useful. 4935 */ 4936 if (str) { 4937 data[3] = str[0]; 4938 data[6] = str[1]; 4939 data[7] = str[2]; 4940 } 4941 4942 /* Send the event announcing the panic. */ 4943 ipmi_panic_request_and_wait(intf, &addr, &msg); 4944 4945 /* 4946 * On every interface, dump a bunch of OEM event holding the 4947 * string. 4948 */ 4949 if (ipmi_send_panic_event != IPMI_SEND_PANIC_EVENT_STRING || !str) 4950 return; 4951 4952 /* 4953 * intf_num is used as an marker to tell if the 4954 * interface is valid. Thus we need a read barrier to 4955 * make sure data fetched before checking intf_num 4956 * won't be used. 4957 */ 4958 smp_rmb(); 4959 4960 /* 4961 * First job here is to figure out where to send the 4962 * OEM events. There's no way in IPMI to send OEM 4963 * events using an event send command, so we have to 4964 * find the SEL to put them in and stick them in 4965 * there. 4966 */ 4967 4968 /* Get capabilities from the get device id. */ 4969 intf->local_sel_device = 0; 4970 intf->local_event_generator = 0; 4971 intf->event_receiver = 0; 4972 4973 /* Request the device info from the local MC. */ 4974 msg.netfn = IPMI_NETFN_APP_REQUEST; 4975 msg.cmd = IPMI_GET_DEVICE_ID_CMD; 4976 msg.data = NULL; 4977 msg.data_len = 0; 4978 intf->null_user_handler = device_id_fetcher; 4979 ipmi_panic_request_and_wait(intf, &addr, &msg); 4980 4981 if (intf->local_event_generator) { 4982 /* Request the event receiver from the local MC. */ 4983 msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST; 4984 msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD; 4985 msg.data = NULL; 4986 msg.data_len = 0; 4987 intf->null_user_handler = event_receiver_fetcher; 4988 ipmi_panic_request_and_wait(intf, &addr, &msg); 4989 } 4990 intf->null_user_handler = NULL; 4991 4992 /* 4993 * Validate the event receiver. The low bit must not 4994 * be 1 (it must be a valid IPMB address), it cannot 4995 * be zero, and it must not be my address. 4996 */ 4997 if (((intf->event_receiver & 1) == 0) 4998 && (intf->event_receiver != 0) 4999 && (intf->event_receiver != intf->addrinfo[0].address)) { 5000 /* 5001 * The event receiver is valid, send an IPMB 5002 * message. 5003 */ 5004 ipmb = (struct ipmi_ipmb_addr *) &addr; 5005 ipmb->addr_type = IPMI_IPMB_ADDR_TYPE; 5006 ipmb->channel = 0; /* FIXME - is this right? */ 5007 ipmb->lun = intf->event_receiver_lun; 5008 ipmb->slave_addr = intf->event_receiver; 5009 } else if (intf->local_sel_device) { 5010 /* 5011 * The event receiver was not valid (or was 5012 * me), but I am an SEL device, just dump it 5013 * in my SEL. 5014 */ 5015 si = (struct ipmi_system_interface_addr *) &addr; 5016 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 5017 si->channel = IPMI_BMC_CHANNEL; 5018 si->lun = 0; 5019 } else 5020 return; /* No where to send the event. */ 5021 5022 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */ 5023 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD; 5024 msg.data = data; 5025 msg.data_len = 16; 5026 5027 j = 0; 5028 while (*p) { 5029 int size = strlen(p); 5030 5031 if (size > 11) 5032 size = 11; 5033 data[0] = 0; 5034 data[1] = 0; 5035 data[2] = 0xf0; /* OEM event without timestamp. */ 5036 data[3] = intf->addrinfo[0].address; 5037 data[4] = j++; /* sequence # */ 5038 /* 5039 * Always give 11 bytes, so strncpy will fill 5040 * it with zeroes for me. 5041 */ 5042 strncpy(data+5, p, 11); 5043 p += size; 5044 5045 ipmi_panic_request_and_wait(intf, &addr, &msg); 5046 } 5047 } 5048 5049 static int has_panicked; 5050 5051 static int panic_event(struct notifier_block *this, 5052 unsigned long event, 5053 void *ptr) 5054 { 5055 struct ipmi_smi *intf; 5056 struct ipmi_user *user; 5057 5058 if (has_panicked) 5059 return NOTIFY_DONE; 5060 has_panicked = 1; 5061 5062 /* For every registered interface, set it to run to completion. */ 5063 list_for_each_entry_rcu(intf, &ipmi_interfaces, link) { 5064 if (!intf->handlers || intf->intf_num == -1) 5065 /* Interface is not ready. */ 5066 continue; 5067 5068 if (!intf->handlers->poll) 5069 continue; 5070 5071 /* 5072 * If we were interrupted while locking xmit_msgs_lock or 5073 * waiting_rcv_msgs_lock, the corresponding list may be 5074 * corrupted. In this case, drop items on the list for 5075 * the safety. 5076 */ 5077 if (!spin_trylock(&intf->xmit_msgs_lock)) { 5078 INIT_LIST_HEAD(&intf->xmit_msgs); 5079 INIT_LIST_HEAD(&intf->hp_xmit_msgs); 5080 } else 5081 spin_unlock(&intf->xmit_msgs_lock); 5082 5083 if (!spin_trylock(&intf->waiting_rcv_msgs_lock)) 5084 INIT_LIST_HEAD(&intf->waiting_rcv_msgs); 5085 else 5086 spin_unlock(&intf->waiting_rcv_msgs_lock); 5087 5088 intf->run_to_completion = 1; 5089 if (intf->handlers->set_run_to_completion) 5090 intf->handlers->set_run_to_completion(intf->send_info, 5091 1); 5092 5093 list_for_each_entry_rcu(user, &intf->users, link) { 5094 if (user->handler->ipmi_panic_handler) 5095 user->handler->ipmi_panic_handler( 5096 user->handler_data); 5097 } 5098 5099 send_panic_events(intf, ptr); 5100 } 5101 5102 return NOTIFY_DONE; 5103 } 5104 5105 /* Must be called with ipmi_interfaces_mutex held. */ 5106 static int ipmi_register_driver(void) 5107 { 5108 int rv; 5109 5110 if (drvregistered) 5111 return 0; 5112 5113 rv = driver_register(&ipmidriver.driver); 5114 if (rv) 5115 pr_err("Could not register IPMI driver\n"); 5116 else 5117 drvregistered = true; 5118 return rv; 5119 } 5120 5121 static struct notifier_block panic_block = { 5122 .notifier_call = panic_event, 5123 .next = NULL, 5124 .priority = 200 /* priority: INT_MAX >= x >= 0 */ 5125 }; 5126 5127 static int ipmi_init_msghandler(void) 5128 { 5129 int rv; 5130 5131 mutex_lock(&ipmi_interfaces_mutex); 5132 rv = ipmi_register_driver(); 5133 if (rv) 5134 goto out; 5135 if (initialized) 5136 goto out; 5137 5138 init_srcu_struct(&ipmi_interfaces_srcu); 5139 5140 timer_setup(&ipmi_timer, ipmi_timeout, 0); 5141 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); 5142 5143 atomic_notifier_chain_register(&panic_notifier_list, &panic_block); 5144 5145 initialized = true; 5146 5147 out: 5148 mutex_unlock(&ipmi_interfaces_mutex); 5149 return rv; 5150 } 5151 5152 static int __init ipmi_init_msghandler_mod(void) 5153 { 5154 int rv; 5155 5156 pr_info("version " IPMI_DRIVER_VERSION "\n"); 5157 5158 mutex_lock(&ipmi_interfaces_mutex); 5159 rv = ipmi_register_driver(); 5160 mutex_unlock(&ipmi_interfaces_mutex); 5161 5162 return rv; 5163 } 5164 5165 static void __exit cleanup_ipmi(void) 5166 { 5167 int count; 5168 5169 if (initialized) { 5170 atomic_notifier_chain_unregister(&panic_notifier_list, 5171 &panic_block); 5172 5173 /* 5174 * This can't be called if any interfaces exist, so no worry 5175 * about shutting down the interfaces. 5176 */ 5177 5178 /* 5179 * Tell the timer to stop, then wait for it to stop. This 5180 * avoids problems with race conditions removing the timer 5181 * here. 5182 */ 5183 atomic_set(&stop_operation, 1); 5184 del_timer_sync(&ipmi_timer); 5185 5186 initialized = false; 5187 5188 /* Check for buffer leaks. */ 5189 count = atomic_read(&smi_msg_inuse_count); 5190 if (count != 0) 5191 pr_warn("SMI message count %d at exit\n", count); 5192 count = atomic_read(&recv_msg_inuse_count); 5193 if (count != 0) 5194 pr_warn("recv message count %d at exit\n", count); 5195 5196 cleanup_srcu_struct(&ipmi_interfaces_srcu); 5197 } 5198 if (drvregistered) 5199 driver_unregister(&ipmidriver.driver); 5200 } 5201 module_exit(cleanup_ipmi); 5202 5203 module_init(ipmi_init_msghandler_mod); 5204 MODULE_LICENSE("GPL"); 5205 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>"); 5206 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI" 5207 " interface."); 5208 MODULE_VERSION(IPMI_DRIVER_VERSION); 5209 MODULE_SOFTDEP("post: ipmi_devintf"); 5210