1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * ipmi_msghandler.c 4 * 5 * Incoming and outgoing message routing for an IPMI interface. 6 * 7 * Author: MontaVista Software, Inc. 8 * Corey Minyard <minyard@mvista.com> 9 * source@mvista.com 10 * 11 * Copyright 2002 MontaVista Software Inc. 12 */ 13 14 #define pr_fmt(fmt) "IPMI message handler: " fmt 15 #define dev_fmt(fmt) pr_fmt(fmt) 16 17 #include <linux/module.h> 18 #include <linux/errno.h> 19 #include <linux/panic_notifier.h> 20 #include <linux/poll.h> 21 #include <linux/sched.h> 22 #include <linux/seq_file.h> 23 #include <linux/spinlock.h> 24 #include <linux/mutex.h> 25 #include <linux/slab.h> 26 #include <linux/ipmi.h> 27 #include <linux/ipmi_smi.h> 28 #include <linux/notifier.h> 29 #include <linux/init.h> 30 #include <linux/rcupdate.h> 31 #include <linux/interrupt.h> 32 #include <linux/moduleparam.h> 33 #include <linux/workqueue.h> 34 #include <linux/uuid.h> 35 #include <linux/nospec.h> 36 #include <linux/vmalloc.h> 37 #include <linux/delay.h> 38 39 #define IPMI_DRIVER_VERSION "39.2" 40 41 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(struct ipmi_user *user); 42 static void ipmi_set_recv_msg_user(struct ipmi_recv_msg *msg, 43 struct ipmi_user *user); 44 static int ipmi_init_msghandler(void); 45 static void smi_work(struct work_struct *t); 46 static void handle_new_recv_msgs(struct ipmi_smi *intf); 47 static void need_waiter(struct ipmi_smi *intf); 48 static int handle_one_recv_msg(struct ipmi_smi *intf, 49 struct ipmi_smi_msg *msg); 50 static void intf_free(struct kref *ref); 51 52 static bool initialized; 53 static bool drvregistered; 54 55 static struct timer_list ipmi_timer; 56 57 /* Numbers in this enumerator should be mapped to ipmi_panic_event_str */ 58 enum ipmi_panic_event_op { 59 IPMI_SEND_PANIC_EVENT_NONE, 60 IPMI_SEND_PANIC_EVENT, 61 IPMI_SEND_PANIC_EVENT_STRING, 62 IPMI_SEND_PANIC_EVENT_MAX 63 }; 64 65 /* Indices in this array should be mapped to enum ipmi_panic_event_op */ 66 static const char *const ipmi_panic_event_str[] = { "none", "event", "string", NULL }; 67 68 #ifdef CONFIG_IPMI_PANIC_STRING 69 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT_STRING 70 #elif defined(CONFIG_IPMI_PANIC_EVENT) 71 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT 72 #else 73 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT_NONE 74 #endif 75 76 static enum ipmi_panic_event_op ipmi_send_panic_event = IPMI_PANIC_DEFAULT; 77 78 static int panic_op_write_handler(const char *val, 79 const struct kernel_param *kp) 80 { 81 char valcp[16]; 82 int e; 83 84 strscpy(valcp, val, sizeof(valcp)); 85 e = match_string(ipmi_panic_event_str, -1, strstrip(valcp)); 86 if (e < 0) 87 return e; 88 89 ipmi_send_panic_event = e; 90 return 0; 91 } 92 93 static int panic_op_read_handler(char *buffer, const struct kernel_param *kp) 94 { 95 const char *event_str; 96 97 if (ipmi_send_panic_event >= IPMI_SEND_PANIC_EVENT_MAX) 98 event_str = "???"; 99 else 100 event_str = ipmi_panic_event_str[ipmi_send_panic_event]; 101 102 return sprintf(buffer, "%s\n", event_str); 103 } 104 105 static const struct kernel_param_ops panic_op_ops = { 106 .set = panic_op_write_handler, 107 .get = panic_op_read_handler 108 }; 109 module_param_cb(panic_op, &panic_op_ops, NULL, 0600); 110 MODULE_PARM_DESC(panic_op, "Sets if the IPMI driver will attempt to store panic information in the event log in the event of a panic. Set to 'none' for no, 'event' for a single event, or 'string' for a generic event and the panic string in IPMI OEM events."); 111 112 113 #define MAX_EVENTS_IN_QUEUE 25 114 115 /* Remain in auto-maintenance mode for this amount of time (in ms). */ 116 static unsigned long maintenance_mode_timeout_ms = 30000; 117 module_param(maintenance_mode_timeout_ms, ulong, 0644); 118 MODULE_PARM_DESC(maintenance_mode_timeout_ms, 119 "The time (milliseconds) after the last maintenance message that the connection stays in maintenance mode."); 120 121 /* 122 * Don't let a message sit in a queue forever, always time it with at lest 123 * the max message timer. This is in milliseconds. 124 */ 125 #define MAX_MSG_TIMEOUT 60000 126 127 /* 128 * Timeout times below are in milliseconds, and are done off a 1 129 * second timer. So setting the value to 1000 would mean anything 130 * between 0 and 1000ms. So really the only reasonable minimum 131 * setting it 2000ms, which is between 1 and 2 seconds. 132 */ 133 134 /* The default timeout for message retries. */ 135 static unsigned long default_retry_ms = 2000; 136 module_param(default_retry_ms, ulong, 0644); 137 MODULE_PARM_DESC(default_retry_ms, 138 "The time (milliseconds) between retry sends"); 139 140 /* The default timeout for maintenance mode message retries. */ 141 static unsigned long default_maintenance_retry_ms = 3000; 142 module_param(default_maintenance_retry_ms, ulong, 0644); 143 MODULE_PARM_DESC(default_maintenance_retry_ms, 144 "The time (milliseconds) between retry sends in maintenance mode"); 145 146 /* The default maximum number of retries */ 147 static unsigned int default_max_retries = 4; 148 module_param(default_max_retries, uint, 0644); 149 MODULE_PARM_DESC(default_max_retries, 150 "The time (milliseconds) between retry sends in maintenance mode"); 151 152 /* The default maximum number of users that may register. */ 153 static unsigned int max_users = 30; 154 module_param(max_users, uint, 0644); 155 MODULE_PARM_DESC(max_users, 156 "The most users that may use the IPMI stack at one time."); 157 158 /* The default maximum number of message a user may have outstanding. */ 159 static unsigned int max_msgs_per_user = 100; 160 module_param(max_msgs_per_user, uint, 0644); 161 MODULE_PARM_DESC(max_msgs_per_user, 162 "The most message a user may have outstanding."); 163 164 /* Call every ~1000 ms. */ 165 #define IPMI_TIMEOUT_TIME 1000 166 167 /* How many jiffies does it take to get to the timeout time. */ 168 #define IPMI_TIMEOUT_JIFFIES ((IPMI_TIMEOUT_TIME * HZ) / 1000) 169 170 /* 171 * Request events from the queue every second (this is the number of 172 * IPMI_TIMEOUT_TIMES between event requests). Hopefully, in the 173 * future, IPMI will add a way to know immediately if an event is in 174 * the queue and this silliness can go away. 175 */ 176 #define IPMI_REQUEST_EV_TIME (1000 / (IPMI_TIMEOUT_TIME)) 177 178 /* How long should we cache dynamic device IDs? */ 179 #define IPMI_DYN_DEV_ID_EXPIRY (10 * HZ) 180 181 /* 182 * The main "user" data structure. 183 */ 184 struct ipmi_user { 185 struct list_head link; 186 187 struct kref refcount; 188 refcount_t destroyed; 189 190 /* The upper layer that handles receive messages. */ 191 const struct ipmi_user_hndl *handler; 192 void *handler_data; 193 194 /* The interface this user is bound to. */ 195 struct ipmi_smi *intf; 196 197 /* Does this interface receive IPMI events? */ 198 bool gets_events; 199 200 atomic_t nr_msgs; 201 }; 202 203 struct cmd_rcvr { 204 struct list_head link; 205 206 struct ipmi_user *user; 207 unsigned char netfn; 208 unsigned char cmd; 209 unsigned int chans; 210 211 /* 212 * This is used to form a linked lised during mass deletion. 213 * Since this is in an RCU list, we cannot use the link above 214 * or change any data until the RCU period completes. So we 215 * use this next variable during mass deletion so we can have 216 * a list and don't have to wait and restart the search on 217 * every individual deletion of a command. 218 */ 219 struct cmd_rcvr *next; 220 }; 221 222 struct seq_table { 223 unsigned int inuse : 1; 224 unsigned int broadcast : 1; 225 226 unsigned long timeout; 227 unsigned long orig_timeout; 228 unsigned int retries_left; 229 230 /* 231 * To verify on an incoming send message response that this is 232 * the message that the response is for, we keep a sequence id 233 * and increment it every time we send a message. 234 */ 235 long seqid; 236 237 /* 238 * This is held so we can properly respond to the message on a 239 * timeout, and it is used to hold the temporary data for 240 * retransmission, too. 241 */ 242 struct ipmi_recv_msg *recv_msg; 243 }; 244 245 /* 246 * Store the information in a msgid (long) to allow us to find a 247 * sequence table entry from the msgid. 248 */ 249 #define STORE_SEQ_IN_MSGID(seq, seqid) \ 250 ((((seq) & 0x3f) << 26) | ((seqid) & 0x3ffffff)) 251 252 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \ 253 do { \ 254 seq = (((msgid) >> 26) & 0x3f); \ 255 seqid = ((msgid) & 0x3ffffff); \ 256 } while (0) 257 258 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3ffffff) 259 260 #define IPMI_MAX_CHANNELS 16 261 struct ipmi_channel { 262 unsigned char medium; 263 unsigned char protocol; 264 }; 265 266 struct ipmi_channel_set { 267 struct ipmi_channel c[IPMI_MAX_CHANNELS]; 268 }; 269 270 struct ipmi_my_addrinfo { 271 /* 272 * My slave address. This is initialized to IPMI_BMC_SLAVE_ADDR, 273 * but may be changed by the user. 274 */ 275 unsigned char address; 276 277 /* 278 * My LUN. This should generally stay the SMS LUN, but just in 279 * case... 280 */ 281 unsigned char lun; 282 }; 283 284 /* 285 * Note that the product id, manufacturer id, guid, and device id are 286 * immutable in this structure, so dyn_mutex is not required for 287 * accessing those. If those change on a BMC, a new BMC is allocated. 288 */ 289 struct bmc_device { 290 struct platform_device pdev; 291 struct list_head intfs; /* Interfaces on this BMC. */ 292 struct ipmi_device_id id; 293 struct ipmi_device_id fetch_id; 294 int dyn_id_set; 295 unsigned long dyn_id_expiry; 296 struct mutex dyn_mutex; /* Protects id, intfs, & dyn* */ 297 guid_t guid; 298 guid_t fetch_guid; 299 int dyn_guid_set; 300 struct kref usecount; 301 struct work_struct remove_work; 302 unsigned char cc; /* completion code */ 303 }; 304 #define to_bmc_device(x) container_of((x), struct bmc_device, pdev.dev) 305 306 static struct workqueue_struct *bmc_remove_work_wq; 307 308 static int bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, 309 struct ipmi_device_id *id, 310 bool *guid_set, guid_t *guid); 311 312 /* 313 * Various statistics for IPMI, these index stats[] in the ipmi_smi 314 * structure. 315 */ 316 enum ipmi_stat_indexes { 317 /* Commands we got from the user that were invalid. */ 318 IPMI_STAT_sent_invalid_commands = 0, 319 320 /* Commands we sent to the MC. */ 321 IPMI_STAT_sent_local_commands, 322 323 /* Responses from the MC that were delivered to a user. */ 324 IPMI_STAT_handled_local_responses, 325 326 /* Responses from the MC that were not delivered to a user. */ 327 IPMI_STAT_unhandled_local_responses, 328 329 /* Commands we sent out to the IPMB bus. */ 330 IPMI_STAT_sent_ipmb_commands, 331 332 /* Commands sent on the IPMB that had errors on the SEND CMD */ 333 IPMI_STAT_sent_ipmb_command_errs, 334 335 /* Each retransmit increments this count. */ 336 IPMI_STAT_retransmitted_ipmb_commands, 337 338 /* 339 * When a message times out (runs out of retransmits) this is 340 * incremented. 341 */ 342 IPMI_STAT_timed_out_ipmb_commands, 343 344 /* 345 * This is like above, but for broadcasts. Broadcasts are 346 * *not* included in the above count (they are expected to 347 * time out). 348 */ 349 IPMI_STAT_timed_out_ipmb_broadcasts, 350 351 /* Responses I have sent to the IPMB bus. */ 352 IPMI_STAT_sent_ipmb_responses, 353 354 /* The response was delivered to the user. */ 355 IPMI_STAT_handled_ipmb_responses, 356 357 /* The response had invalid data in it. */ 358 IPMI_STAT_invalid_ipmb_responses, 359 360 /* The response didn't have anyone waiting for it. */ 361 IPMI_STAT_unhandled_ipmb_responses, 362 363 /* Commands we sent out to the IPMB bus. */ 364 IPMI_STAT_sent_lan_commands, 365 366 /* Commands sent on the IPMB that had errors on the SEND CMD */ 367 IPMI_STAT_sent_lan_command_errs, 368 369 /* Each retransmit increments this count. */ 370 IPMI_STAT_retransmitted_lan_commands, 371 372 /* 373 * When a message times out (runs out of retransmits) this is 374 * incremented. 375 */ 376 IPMI_STAT_timed_out_lan_commands, 377 378 /* Responses I have sent to the IPMB bus. */ 379 IPMI_STAT_sent_lan_responses, 380 381 /* The response was delivered to the user. */ 382 IPMI_STAT_handled_lan_responses, 383 384 /* The response had invalid data in it. */ 385 IPMI_STAT_invalid_lan_responses, 386 387 /* The response didn't have anyone waiting for it. */ 388 IPMI_STAT_unhandled_lan_responses, 389 390 /* The command was delivered to the user. */ 391 IPMI_STAT_handled_commands, 392 393 /* The command had invalid data in it. */ 394 IPMI_STAT_invalid_commands, 395 396 /* The command didn't have anyone waiting for it. */ 397 IPMI_STAT_unhandled_commands, 398 399 /* Invalid data in an event. */ 400 IPMI_STAT_invalid_events, 401 402 /* Events that were received with the proper format. */ 403 IPMI_STAT_events, 404 405 /* Retransmissions on IPMB that failed. */ 406 IPMI_STAT_dropped_rexmit_ipmb_commands, 407 408 /* Retransmissions on LAN that failed. */ 409 IPMI_STAT_dropped_rexmit_lan_commands, 410 411 /* This *must* remain last, add new values above this. */ 412 IPMI_NUM_STATS 413 }; 414 415 416 #define IPMI_IPMB_NUM_SEQ 64 417 struct ipmi_smi { 418 struct module *owner; 419 420 /* What interface number are we? */ 421 int intf_num; 422 423 struct kref refcount; 424 425 /* Set when the interface is being unregistered. */ 426 bool in_shutdown; 427 428 /* Used for a list of interfaces. */ 429 struct list_head link; 430 431 /* 432 * The list of upper layers that are using me. 433 */ 434 struct list_head users; 435 struct mutex users_mutex; 436 atomic_t nr_users; 437 struct device_attribute nr_users_devattr; 438 struct device_attribute nr_msgs_devattr; 439 struct device_attribute maintenance_mode_devattr; 440 441 442 /* Used for wake ups at startup. */ 443 wait_queue_head_t waitq; 444 445 /* 446 * Prevents the interface from being unregistered when the 447 * interface is used by being looked up through the BMC 448 * structure. 449 */ 450 struct mutex bmc_reg_mutex; 451 452 struct bmc_device tmp_bmc; 453 struct bmc_device *bmc; 454 bool bmc_registered; 455 struct list_head bmc_link; 456 char *my_dev_name; 457 bool in_bmc_register; /* Handle recursive situations. Yuck. */ 458 struct work_struct bmc_reg_work; 459 460 const struct ipmi_smi_handlers *handlers; 461 void *send_info; 462 463 /* Driver-model device for the system interface. */ 464 struct device *si_dev; 465 466 /* 467 * A table of sequence numbers for this interface. We use the 468 * sequence numbers for IPMB messages that go out of the 469 * interface to match them up with their responses. A routine 470 * is called periodically to time the items in this list. 471 */ 472 struct mutex seq_lock; 473 struct seq_table seq_table[IPMI_IPMB_NUM_SEQ]; 474 int curr_seq; 475 476 /* 477 * Messages queued for deliver to the user. 478 */ 479 struct mutex user_msgs_mutex; 480 struct list_head user_msgs; 481 482 /* 483 * Messages queued for processing. If processing fails (out 484 * of memory for instance), They will stay in here to be 485 * processed later in a periodic timer interrupt. The 486 * workqueue is for handling received messages directly from 487 * the handler. 488 */ 489 spinlock_t waiting_rcv_msgs_lock; 490 struct list_head waiting_rcv_msgs; 491 atomic_t watchdog_pretimeouts_to_deliver; 492 struct work_struct smi_work; 493 494 spinlock_t xmit_msgs_lock; 495 struct list_head xmit_msgs; 496 struct ipmi_smi_msg *curr_msg; 497 struct list_head hp_xmit_msgs; 498 499 /* 500 * The list of command receivers that are registered for commands 501 * on this interface. 502 */ 503 struct mutex cmd_rcvrs_mutex; 504 struct list_head cmd_rcvrs; 505 506 /* 507 * Events that were queues because no one was there to receive 508 * them. 509 */ 510 struct mutex events_mutex; /* For dealing with event stuff. */ 511 struct list_head waiting_events; 512 unsigned int waiting_events_count; /* How many events in queue? */ 513 char event_msg_printed; 514 515 /* How many users are waiting for events? */ 516 atomic_t event_waiters; 517 unsigned int ticks_to_req_ev; 518 519 spinlock_t watch_lock; /* For dealing with watch stuff below. */ 520 521 /* How many users are waiting for commands? */ 522 unsigned int command_waiters; 523 524 /* How many users are waiting for watchdogs? */ 525 unsigned int watchdog_waiters; 526 527 /* How many users are waiting for message responses? */ 528 unsigned int response_waiters; 529 530 /* 531 * Tells what the lower layer has last been asked to watch for, 532 * messages and/or watchdogs. Protected by watch_lock. 533 */ 534 unsigned int last_watch_mask; 535 536 /* 537 * The event receiver for my BMC, only really used at panic 538 * shutdown as a place to store this. 539 */ 540 unsigned char event_receiver; 541 unsigned char event_receiver_lun; 542 unsigned char local_sel_device; 543 unsigned char local_event_generator; 544 545 /* For handling of maintenance mode. */ 546 int maintenance_mode; 547 548 #define IPMI_MAINTENANCE_MODE_STATE_OFF 0 549 #define IPMI_MAINTENANCE_MODE_STATE_FIRMWARE 1 550 #define IPMI_MAINTENANCE_MODE_STATE_RESET 2 551 int maintenance_mode_state; 552 int auto_maintenance_timeout; 553 spinlock_t maintenance_mode_lock; /* Used in a timer... */ 554 555 /* 556 * If we are doing maintenance on something on IPMB, extend 557 * the timeout time to avoid timeouts writing firmware and 558 * such. 559 */ 560 int ipmb_maintenance_mode_timeout; 561 562 /* 563 * A cheap hack, if this is non-null and a message to an 564 * interface comes in with a NULL user, call this routine with 565 * it. Note that the message will still be freed by the 566 * caller. This only works on the system interface. 567 * 568 * Protected by bmc_reg_mutex. 569 */ 570 void (*null_user_handler)(struct ipmi_smi *intf, 571 struct ipmi_recv_msg *msg); 572 573 /* 574 * When we are scanning the channels for an SMI, this will 575 * tell which channel we are scanning. 576 */ 577 int curr_channel; 578 579 /* Channel information */ 580 struct ipmi_channel_set *channel_list; 581 unsigned int curr_working_cset; /* First index into the following. */ 582 struct ipmi_channel_set wchannels[2]; 583 struct ipmi_my_addrinfo addrinfo[IPMI_MAX_CHANNELS]; 584 bool channels_ready; 585 586 atomic_t stats[IPMI_NUM_STATS]; 587 588 /* 589 * run_to_completion duplicate of smb_info, smi_info 590 * and ipmi_serial_info structures. Used to decrease numbers of 591 * parameters passed by "low" level IPMI code. 592 */ 593 int run_to_completion; 594 }; 595 #define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev) 596 597 static void __get_guid(struct ipmi_smi *intf); 598 static void __ipmi_bmc_unregister(struct ipmi_smi *intf); 599 static int __ipmi_bmc_register(struct ipmi_smi *intf, 600 struct ipmi_device_id *id, 601 bool guid_set, guid_t *guid, int intf_num); 602 static int __scan_channels(struct ipmi_smi *intf, 603 struct ipmi_device_id *id, bool rescan); 604 605 static void ipmi_lock_xmit_msgs(struct ipmi_smi *intf, int run_to_completion, 606 unsigned long *flags) 607 { 608 if (run_to_completion) 609 return; 610 spin_lock_irqsave(&intf->xmit_msgs_lock, *flags); 611 } 612 613 static void ipmi_unlock_xmit_msgs(struct ipmi_smi *intf, int run_to_completion, 614 unsigned long *flags) 615 { 616 if (run_to_completion) 617 return; 618 spin_unlock_irqrestore(&intf->xmit_msgs_lock, *flags); 619 } 620 621 static void free_ipmi_user(struct kref *ref) 622 { 623 struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount); 624 struct module *owner; 625 626 owner = user->intf->owner; 627 kref_put(&user->intf->refcount, intf_free); 628 module_put(owner); 629 vfree(user); 630 } 631 632 static void release_ipmi_user(struct ipmi_user *user) 633 { 634 kref_put(&user->refcount, free_ipmi_user); 635 } 636 637 static struct ipmi_user *acquire_ipmi_user(struct ipmi_user *user) 638 { 639 if (!kref_get_unless_zero(&user->refcount)) 640 return NULL; 641 return user; 642 } 643 644 /* 645 * The driver model view of the IPMI messaging driver. 646 */ 647 static struct platform_driver ipmidriver = { 648 .driver = { 649 .name = "ipmi", 650 .bus = &platform_bus_type 651 } 652 }; 653 /* 654 * This mutex keeps us from adding the same BMC twice. 655 */ 656 static DEFINE_MUTEX(ipmidriver_mutex); 657 658 static LIST_HEAD(ipmi_interfaces); 659 static DEFINE_MUTEX(ipmi_interfaces_mutex); 660 661 /* 662 * List of watchers that want to know when smi's are added and deleted. 663 */ 664 static LIST_HEAD(smi_watchers); 665 static DEFINE_MUTEX(smi_watchers_mutex); 666 667 #define ipmi_inc_stat(intf, stat) \ 668 atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat]) 669 #define ipmi_get_stat(intf, stat) \ 670 ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat])) 671 672 static const char * const addr_src_to_str[] = { 673 "invalid", "hotmod", "hardcoded", "SPMI", "ACPI", "SMBIOS", "PCI", 674 "device-tree", "platform" 675 }; 676 677 const char *ipmi_addr_src_to_str(enum ipmi_addr_src src) 678 { 679 if (src >= SI_LAST) 680 src = 0; /* Invalid */ 681 return addr_src_to_str[src]; 682 } 683 EXPORT_SYMBOL(ipmi_addr_src_to_str); 684 685 static int is_lan_addr(struct ipmi_addr *addr) 686 { 687 return addr->addr_type == IPMI_LAN_ADDR_TYPE; 688 } 689 690 static int is_ipmb_addr(struct ipmi_addr *addr) 691 { 692 return addr->addr_type == IPMI_IPMB_ADDR_TYPE; 693 } 694 695 static int is_ipmb_bcast_addr(struct ipmi_addr *addr) 696 { 697 return addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE; 698 } 699 700 static int is_ipmb_direct_addr(struct ipmi_addr *addr) 701 { 702 return addr->addr_type == IPMI_IPMB_DIRECT_ADDR_TYPE; 703 } 704 705 static void free_recv_msg_list(struct list_head *q) 706 { 707 struct ipmi_recv_msg *msg, *msg2; 708 709 list_for_each_entry_safe(msg, msg2, q, link) { 710 list_del(&msg->link); 711 ipmi_free_recv_msg(msg); 712 } 713 } 714 715 static void free_smi_msg_list(struct list_head *q) 716 { 717 struct ipmi_smi_msg *msg, *msg2; 718 719 list_for_each_entry_safe(msg, msg2, q, link) { 720 list_del(&msg->link); 721 ipmi_free_smi_msg(msg); 722 } 723 } 724 725 static void intf_free(struct kref *ref) 726 { 727 struct ipmi_smi *intf = container_of(ref, struct ipmi_smi, refcount); 728 int i; 729 struct cmd_rcvr *rcvr, *rcvr2; 730 731 free_smi_msg_list(&intf->waiting_rcv_msgs); 732 free_recv_msg_list(&intf->waiting_events); 733 734 /* 735 * Wholesale remove all the entries from the list in the 736 * interface. No need for locks, this is single-threaded. 737 */ 738 list_for_each_entry_safe(rcvr, rcvr2, &intf->cmd_rcvrs, link) 739 kfree(rcvr); 740 741 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) { 742 if ((intf->seq_table[i].inuse) 743 && (intf->seq_table[i].recv_msg)) 744 ipmi_free_recv_msg(intf->seq_table[i].recv_msg); 745 } 746 747 kfree(intf); 748 } 749 750 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher) 751 { 752 struct ipmi_smi *intf; 753 unsigned int count = 0, i; 754 int *interfaces = NULL; 755 struct device **devices = NULL; 756 int rv = 0; 757 758 /* 759 * Make sure the driver is actually initialized, this handles 760 * problems with initialization order. 761 */ 762 rv = ipmi_init_msghandler(); 763 if (rv) 764 return rv; 765 766 mutex_lock(&smi_watchers_mutex); 767 768 list_add(&watcher->link, &smi_watchers); 769 770 /* 771 * Build an array of ipmi interfaces and fill it in, and 772 * another array of the devices. We can't call the callback 773 * with ipmi_interfaces_mutex held. smi_watchers_mutex will 774 * keep things in order for the user. 775 */ 776 mutex_lock(&ipmi_interfaces_mutex); 777 list_for_each_entry(intf, &ipmi_interfaces, link) 778 count++; 779 if (count > 0) { 780 interfaces = kmalloc_objs(*interfaces, count); 781 if (!interfaces) { 782 rv = -ENOMEM; 783 } else { 784 devices = kmalloc_objs(*devices, count); 785 if (!devices) { 786 kfree(interfaces); 787 interfaces = NULL; 788 rv = -ENOMEM; 789 } 790 } 791 count = 0; 792 } 793 if (interfaces) { 794 list_for_each_entry(intf, &ipmi_interfaces, link) { 795 int intf_num = READ_ONCE(intf->intf_num); 796 797 if (intf_num == -1) 798 continue; 799 devices[count] = intf->si_dev; 800 interfaces[count++] = intf_num; 801 } 802 } 803 mutex_unlock(&ipmi_interfaces_mutex); 804 805 if (interfaces) { 806 for (i = 0; i < count; i++) 807 watcher->new_smi(interfaces[i], devices[i]); 808 kfree(interfaces); 809 kfree(devices); 810 } 811 812 mutex_unlock(&smi_watchers_mutex); 813 814 return rv; 815 } 816 EXPORT_SYMBOL(ipmi_smi_watcher_register); 817 818 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher) 819 { 820 mutex_lock(&smi_watchers_mutex); 821 list_del(&watcher->link); 822 mutex_unlock(&smi_watchers_mutex); 823 return 0; 824 } 825 EXPORT_SYMBOL(ipmi_smi_watcher_unregister); 826 827 static void 828 call_smi_watchers(int i, struct device *dev) 829 { 830 struct ipmi_smi_watcher *w; 831 832 list_for_each_entry(w, &smi_watchers, link) { 833 if (try_module_get(w->owner)) { 834 w->new_smi(i, dev); 835 module_put(w->owner); 836 } 837 } 838 } 839 840 static int 841 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2) 842 { 843 if (addr1->addr_type != addr2->addr_type) 844 return 0; 845 846 if (addr1->channel != addr2->channel) 847 return 0; 848 849 if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) { 850 struct ipmi_system_interface_addr *smi_addr1 851 = (struct ipmi_system_interface_addr *) addr1; 852 struct ipmi_system_interface_addr *smi_addr2 853 = (struct ipmi_system_interface_addr *) addr2; 854 return (smi_addr1->lun == smi_addr2->lun); 855 } 856 857 if (is_ipmb_addr(addr1) || is_ipmb_bcast_addr(addr1)) { 858 struct ipmi_ipmb_addr *ipmb_addr1 859 = (struct ipmi_ipmb_addr *) addr1; 860 struct ipmi_ipmb_addr *ipmb_addr2 861 = (struct ipmi_ipmb_addr *) addr2; 862 863 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr) 864 && (ipmb_addr1->lun == ipmb_addr2->lun)); 865 } 866 867 if (is_ipmb_direct_addr(addr1)) { 868 struct ipmi_ipmb_direct_addr *daddr1 869 = (struct ipmi_ipmb_direct_addr *) addr1; 870 struct ipmi_ipmb_direct_addr *daddr2 871 = (struct ipmi_ipmb_direct_addr *) addr2; 872 873 return daddr1->slave_addr == daddr2->slave_addr && 874 daddr1->rq_lun == daddr2->rq_lun && 875 daddr1->rs_lun == daddr2->rs_lun; 876 } 877 878 if (is_lan_addr(addr1)) { 879 struct ipmi_lan_addr *lan_addr1 880 = (struct ipmi_lan_addr *) addr1; 881 struct ipmi_lan_addr *lan_addr2 882 = (struct ipmi_lan_addr *) addr2; 883 884 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID) 885 && (lan_addr1->local_SWID == lan_addr2->local_SWID) 886 && (lan_addr1->session_handle 887 == lan_addr2->session_handle) 888 && (lan_addr1->lun == lan_addr2->lun)); 889 } 890 891 return 1; 892 } 893 894 int ipmi_validate_addr(struct ipmi_addr *addr, int len) 895 { 896 if (len < sizeof(struct ipmi_system_interface_addr)) 897 return -EINVAL; 898 899 if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) { 900 if (addr->channel != IPMI_BMC_CHANNEL) 901 return -EINVAL; 902 return 0; 903 } 904 905 if ((addr->channel == IPMI_BMC_CHANNEL) 906 || (addr->channel >= IPMI_MAX_CHANNELS) 907 || (addr->channel < 0)) 908 return -EINVAL; 909 910 if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) { 911 if (len < sizeof(struct ipmi_ipmb_addr)) 912 return -EINVAL; 913 return 0; 914 } 915 916 if (is_ipmb_direct_addr(addr)) { 917 struct ipmi_ipmb_direct_addr *daddr = (void *) addr; 918 919 if (addr->channel != 0) 920 return -EINVAL; 921 if (len < sizeof(struct ipmi_ipmb_direct_addr)) 922 return -EINVAL; 923 924 if (daddr->slave_addr & 0x01) 925 return -EINVAL; 926 if (daddr->rq_lun >= 4) 927 return -EINVAL; 928 if (daddr->rs_lun >= 4) 929 return -EINVAL; 930 return 0; 931 } 932 933 if (is_lan_addr(addr)) { 934 if (len < sizeof(struct ipmi_lan_addr)) 935 return -EINVAL; 936 return 0; 937 } 938 939 return -EINVAL; 940 } 941 EXPORT_SYMBOL(ipmi_validate_addr); 942 943 unsigned int ipmi_addr_length(int addr_type) 944 { 945 if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 946 return sizeof(struct ipmi_system_interface_addr); 947 948 if ((addr_type == IPMI_IPMB_ADDR_TYPE) 949 || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)) 950 return sizeof(struct ipmi_ipmb_addr); 951 952 if (addr_type == IPMI_IPMB_DIRECT_ADDR_TYPE) 953 return sizeof(struct ipmi_ipmb_direct_addr); 954 955 if (addr_type == IPMI_LAN_ADDR_TYPE) 956 return sizeof(struct ipmi_lan_addr); 957 958 return 0; 959 } 960 EXPORT_SYMBOL(ipmi_addr_length); 961 962 static int deliver_response(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) 963 { 964 int rv = 0; 965 966 if (!msg->user) { 967 /* Special handling for NULL users. */ 968 if (intf->null_user_handler) { 969 intf->null_user_handler(intf, msg); 970 } else { 971 /* No handler, so give up. */ 972 rv = -EINVAL; 973 } 974 ipmi_free_recv_msg(msg); 975 } else if (oops_in_progress) { 976 /* 977 * If we are running in the panic context, calling the 978 * receive handler doesn't much meaning and has a deadlock 979 * risk. At this moment, simply skip it in that case. 980 */ 981 ipmi_free_recv_msg(msg); 982 } else { 983 /* 984 * Deliver it in smi_work. The message will hold a 985 * refcount to the user. 986 */ 987 mutex_lock(&intf->user_msgs_mutex); 988 list_add_tail(&msg->link, &intf->user_msgs); 989 mutex_unlock(&intf->user_msgs_mutex); 990 queue_work(system_percpu_wq, &intf->smi_work); 991 } 992 993 return rv; 994 } 995 996 static void deliver_local_response(struct ipmi_smi *intf, 997 struct ipmi_recv_msg *msg) 998 { 999 if (deliver_response(intf, msg)) 1000 ipmi_inc_stat(intf, unhandled_local_responses); 1001 else 1002 ipmi_inc_stat(intf, handled_local_responses); 1003 } 1004 1005 static void deliver_err_response(struct ipmi_smi *intf, 1006 struct ipmi_recv_msg *msg, int err) 1007 { 1008 msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 1009 msg->msg_data[0] = err; 1010 msg->msg.netfn |= 1; /* Convert to a response. */ 1011 msg->msg.data_len = 1; 1012 msg->msg.data = msg->msg_data; 1013 deliver_local_response(intf, msg); 1014 } 1015 1016 static void smi_add_watch(struct ipmi_smi *intf, unsigned int flags) 1017 { 1018 unsigned long iflags; 1019 1020 if (!intf->handlers->set_need_watch) 1021 return; 1022 1023 spin_lock_irqsave(&intf->watch_lock, iflags); 1024 if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES) 1025 intf->response_waiters++; 1026 1027 if (flags & IPMI_WATCH_MASK_CHECK_WATCHDOG) 1028 intf->watchdog_waiters++; 1029 1030 if (flags & IPMI_WATCH_MASK_CHECK_COMMANDS) 1031 intf->command_waiters++; 1032 1033 if ((intf->last_watch_mask & flags) != flags) { 1034 intf->last_watch_mask |= flags; 1035 intf->handlers->set_need_watch(intf->send_info, 1036 intf->last_watch_mask); 1037 } 1038 spin_unlock_irqrestore(&intf->watch_lock, iflags); 1039 } 1040 1041 static void smi_remove_watch(struct ipmi_smi *intf, unsigned int flags) 1042 { 1043 unsigned long iflags; 1044 1045 if (!intf->handlers->set_need_watch) 1046 return; 1047 1048 spin_lock_irqsave(&intf->watch_lock, iflags); 1049 if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES) 1050 intf->response_waiters--; 1051 1052 if (flags & IPMI_WATCH_MASK_CHECK_WATCHDOG) 1053 intf->watchdog_waiters--; 1054 1055 if (flags & IPMI_WATCH_MASK_CHECK_COMMANDS) 1056 intf->command_waiters--; 1057 1058 flags = 0; 1059 if (intf->response_waiters) 1060 flags |= IPMI_WATCH_MASK_CHECK_MESSAGES; 1061 if (intf->watchdog_waiters) 1062 flags |= IPMI_WATCH_MASK_CHECK_WATCHDOG; 1063 if (intf->command_waiters) 1064 flags |= IPMI_WATCH_MASK_CHECK_COMMANDS; 1065 1066 if (intf->last_watch_mask != flags) { 1067 intf->last_watch_mask = flags; 1068 intf->handlers->set_need_watch(intf->send_info, 1069 intf->last_watch_mask); 1070 } 1071 spin_unlock_irqrestore(&intf->watch_lock, iflags); 1072 } 1073 1074 /* 1075 * Find the next sequence number not being used and add the given 1076 * message with the given timeout to the sequence table. This must be 1077 * called with the interface's seq_lock held. 1078 */ 1079 static int intf_next_seq(struct ipmi_smi *intf, 1080 struct ipmi_recv_msg *recv_msg, 1081 unsigned long timeout, 1082 int retries, 1083 int broadcast, 1084 unsigned char *seq, 1085 long *seqid) 1086 { 1087 int rv = 0; 1088 unsigned int i; 1089 1090 if (timeout == 0) 1091 timeout = default_retry_ms; 1092 if (retries < 0) 1093 retries = default_max_retries; 1094 1095 for (i = intf->curr_seq; (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq; 1096 i = (i+1)%IPMI_IPMB_NUM_SEQ) { 1097 if (!intf->seq_table[i].inuse) 1098 break; 1099 } 1100 1101 if (!intf->seq_table[i].inuse) { 1102 intf->seq_table[i].recv_msg = recv_msg; 1103 1104 /* 1105 * Start with the maximum timeout, when the send response 1106 * comes in we will start the real timer. 1107 */ 1108 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT; 1109 intf->seq_table[i].orig_timeout = timeout; 1110 intf->seq_table[i].retries_left = retries; 1111 intf->seq_table[i].broadcast = broadcast; 1112 intf->seq_table[i].inuse = 1; 1113 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid); 1114 *seq = i; 1115 *seqid = intf->seq_table[i].seqid; 1116 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ; 1117 smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 1118 need_waiter(intf); 1119 } else { 1120 rv = -EAGAIN; 1121 } 1122 1123 return rv; 1124 } 1125 1126 /* 1127 * Return the receive message for the given sequence number and 1128 * release the sequence number so it can be reused. Some other data 1129 * is passed in to be sure the message matches up correctly (to help 1130 * guard against message coming in after their timeout and the 1131 * sequence number being reused). 1132 */ 1133 static int intf_find_seq(struct ipmi_smi *intf, 1134 unsigned char seq, 1135 short channel, 1136 unsigned char cmd, 1137 unsigned char netfn, 1138 struct ipmi_addr *addr, 1139 struct ipmi_recv_msg **recv_msg) 1140 { 1141 int rv = -ENODEV; 1142 1143 if (seq >= IPMI_IPMB_NUM_SEQ) 1144 return -EINVAL; 1145 1146 mutex_lock(&intf->seq_lock); 1147 if (intf->seq_table[seq].inuse) { 1148 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg; 1149 1150 if ((msg->addr.channel == channel) && (msg->msg.cmd == cmd) 1151 && (msg->msg.netfn == netfn) 1152 && (ipmi_addr_equal(addr, &msg->addr))) { 1153 *recv_msg = msg; 1154 intf->seq_table[seq].inuse = 0; 1155 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 1156 rv = 0; 1157 } 1158 } 1159 mutex_unlock(&intf->seq_lock); 1160 1161 return rv; 1162 } 1163 1164 1165 /* Start the timer for a specific sequence table entry. */ 1166 static int intf_start_seq_timer(struct ipmi_smi *intf, 1167 long msgid) 1168 { 1169 int rv = -ENODEV; 1170 unsigned char seq; 1171 unsigned long seqid; 1172 1173 1174 GET_SEQ_FROM_MSGID(msgid, seq, seqid); 1175 1176 mutex_lock(&intf->seq_lock); 1177 /* 1178 * We do this verification because the user can be deleted 1179 * while a message is outstanding. 1180 */ 1181 if ((intf->seq_table[seq].inuse) 1182 && (intf->seq_table[seq].seqid == seqid)) { 1183 struct seq_table *ent = &intf->seq_table[seq]; 1184 ent->timeout = ent->orig_timeout; 1185 rv = 0; 1186 } 1187 mutex_unlock(&intf->seq_lock); 1188 1189 return rv; 1190 } 1191 1192 /* Got an error for the send message for a specific sequence number. */ 1193 static int intf_err_seq(struct ipmi_smi *intf, 1194 long msgid, 1195 unsigned int err) 1196 { 1197 int rv = -ENODEV; 1198 unsigned char seq; 1199 unsigned long seqid; 1200 struct ipmi_recv_msg *msg = NULL; 1201 1202 1203 GET_SEQ_FROM_MSGID(msgid, seq, seqid); 1204 1205 mutex_lock(&intf->seq_lock); 1206 /* 1207 * We do this verification because the user can be deleted 1208 * while a message is outstanding. 1209 */ 1210 if ((intf->seq_table[seq].inuse) 1211 && (intf->seq_table[seq].seqid == seqid)) { 1212 struct seq_table *ent = &intf->seq_table[seq]; 1213 1214 ent->inuse = 0; 1215 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 1216 msg = ent->recv_msg; 1217 rv = 0; 1218 } 1219 mutex_unlock(&intf->seq_lock); 1220 1221 if (msg) 1222 deliver_err_response(intf, msg, err); 1223 1224 return rv; 1225 } 1226 1227 int ipmi_create_user(unsigned int if_num, 1228 const struct ipmi_user_hndl *handler, 1229 void *handler_data, 1230 struct ipmi_user **user) 1231 { 1232 struct ipmi_user *new_user = NULL; 1233 int rv = 0; 1234 struct ipmi_smi *intf; 1235 1236 /* 1237 * There is no module usecount here, because it's not 1238 * required. Since this can only be used by and called from 1239 * other modules, they will implicitly use this module, and 1240 * thus this can't be removed unless the other modules are 1241 * removed. 1242 */ 1243 1244 if (handler == NULL) 1245 return -EINVAL; 1246 1247 /* 1248 * Make sure the driver is actually initialized, this handles 1249 * problems with initialization order. 1250 */ 1251 rv = ipmi_init_msghandler(); 1252 if (rv) 1253 return rv; 1254 1255 mutex_lock(&ipmi_interfaces_mutex); 1256 list_for_each_entry(intf, &ipmi_interfaces, link) { 1257 if (intf->intf_num == if_num) 1258 goto found; 1259 } 1260 /* Not found, return an error */ 1261 rv = -EINVAL; 1262 goto out_unlock; 1263 1264 found: 1265 if (intf->in_shutdown) { 1266 rv = -ENODEV; 1267 goto out_unlock; 1268 } 1269 1270 if (atomic_add_return(1, &intf->nr_users) > max_users) { 1271 rv = -EBUSY; 1272 goto out_kfree; 1273 } 1274 1275 new_user = vzalloc(sizeof(*new_user)); 1276 if (!new_user) { 1277 rv = -ENOMEM; 1278 goto out_kfree; 1279 } 1280 1281 if (!try_module_get(intf->owner)) { 1282 rv = -ENODEV; 1283 goto out_kfree; 1284 } 1285 1286 /* Note that each existing user holds a refcount to the interface. */ 1287 kref_get(&intf->refcount); 1288 1289 atomic_set(&new_user->nr_msgs, 0); 1290 kref_init(&new_user->refcount); 1291 refcount_set(&new_user->destroyed, 1); 1292 kref_get(&new_user->refcount); /* Destroy owns a refcount. */ 1293 new_user->handler = handler; 1294 new_user->handler_data = handler_data; 1295 new_user->intf = intf; 1296 new_user->gets_events = false; 1297 1298 mutex_lock(&intf->users_mutex); 1299 mutex_lock(&intf->seq_lock); 1300 list_add(&new_user->link, &intf->users); 1301 mutex_unlock(&intf->seq_lock); 1302 mutex_unlock(&intf->users_mutex); 1303 1304 if (handler->ipmi_watchdog_pretimeout) 1305 /* User wants pretimeouts, so make sure to watch for them. */ 1306 smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG); 1307 1308 out_kfree: 1309 if (rv) { 1310 atomic_dec(&intf->nr_users); 1311 vfree(new_user); 1312 } else { 1313 *user = new_user; 1314 } 1315 out_unlock: 1316 mutex_unlock(&ipmi_interfaces_mutex); 1317 return rv; 1318 } 1319 EXPORT_SYMBOL(ipmi_create_user); 1320 1321 int ipmi_get_smi_info(int if_num, struct ipmi_smi_info *data) 1322 { 1323 int rv = -EINVAL; 1324 struct ipmi_smi *intf; 1325 1326 mutex_lock(&ipmi_interfaces_mutex); 1327 list_for_each_entry(intf, &ipmi_interfaces, link) { 1328 if (intf->intf_num == if_num) { 1329 if (!intf->handlers->get_smi_info) 1330 rv = -ENOTTY; 1331 else 1332 rv = intf->handlers->get_smi_info(intf->send_info, data); 1333 break; 1334 } 1335 } 1336 mutex_unlock(&ipmi_interfaces_mutex); 1337 1338 return rv; 1339 } 1340 EXPORT_SYMBOL(ipmi_get_smi_info); 1341 1342 /* Must be called with intf->users_mutex held. */ 1343 static void _ipmi_destroy_user(struct ipmi_user *user) 1344 { 1345 struct ipmi_smi *intf = user->intf; 1346 int i; 1347 struct cmd_rcvr *rcvr; 1348 struct cmd_rcvr *rcvrs = NULL; 1349 struct ipmi_recv_msg *msg, *msg2; 1350 1351 if (!refcount_dec_if_one(&user->destroyed)) 1352 return; 1353 1354 if (user->handler->shutdown) 1355 user->handler->shutdown(user->handler_data); 1356 1357 if (user->handler->ipmi_watchdog_pretimeout) 1358 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG); 1359 1360 if (user->gets_events) 1361 atomic_dec(&intf->event_waiters); 1362 1363 /* Remove the user from the interface's list and sequence table. */ 1364 list_del(&user->link); 1365 atomic_dec(&intf->nr_users); 1366 1367 mutex_lock(&intf->seq_lock); 1368 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) { 1369 if (intf->seq_table[i].inuse 1370 && (intf->seq_table[i].recv_msg->user == user)) { 1371 intf->seq_table[i].inuse = 0; 1372 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 1373 ipmi_free_recv_msg(intf->seq_table[i].recv_msg); 1374 } 1375 } 1376 mutex_unlock(&intf->seq_lock); 1377 1378 /* 1379 * Remove the user from the command receiver's table. First 1380 * we build a list of everything (not using the standard link, 1381 * since other things may be using it till we do 1382 * synchronize_rcu()) then free everything in that list. 1383 */ 1384 mutex_lock(&intf->cmd_rcvrs_mutex); 1385 list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link, 1386 lockdep_is_held(&intf->cmd_rcvrs_mutex)) { 1387 if (rcvr->user == user) { 1388 list_del_rcu(&rcvr->link); 1389 rcvr->next = rcvrs; 1390 rcvrs = rcvr; 1391 } 1392 } 1393 mutex_unlock(&intf->cmd_rcvrs_mutex); 1394 synchronize_rcu(); 1395 while (rcvrs) { 1396 rcvr = rcvrs; 1397 rcvrs = rcvr->next; 1398 kfree(rcvr); 1399 } 1400 1401 mutex_lock(&intf->user_msgs_mutex); 1402 list_for_each_entry_safe(msg, msg2, &intf->user_msgs, link) { 1403 if (msg->user != user) 1404 continue; 1405 list_del(&msg->link); 1406 ipmi_free_recv_msg(msg); 1407 } 1408 mutex_unlock(&intf->user_msgs_mutex); 1409 1410 release_ipmi_user(user); 1411 } 1412 1413 void ipmi_destroy_user(struct ipmi_user *user) 1414 { 1415 struct ipmi_smi *intf = user->intf; 1416 1417 mutex_lock(&intf->users_mutex); 1418 _ipmi_destroy_user(user); 1419 mutex_unlock(&intf->users_mutex); 1420 1421 kref_put(&user->refcount, free_ipmi_user); 1422 } 1423 EXPORT_SYMBOL(ipmi_destroy_user); 1424 1425 int ipmi_get_version(struct ipmi_user *user, 1426 unsigned char *major, 1427 unsigned char *minor) 1428 { 1429 struct ipmi_device_id id; 1430 int rv; 1431 1432 user = acquire_ipmi_user(user); 1433 if (!user) 1434 return -ENODEV; 1435 1436 rv = bmc_get_device_id(user->intf, NULL, &id, NULL, NULL); 1437 if (!rv) { 1438 *major = ipmi_version_major(&id); 1439 *minor = ipmi_version_minor(&id); 1440 } 1441 release_ipmi_user(user); 1442 1443 return rv; 1444 } 1445 EXPORT_SYMBOL(ipmi_get_version); 1446 1447 int ipmi_set_my_address(struct ipmi_user *user, 1448 unsigned int channel, 1449 unsigned char address) 1450 { 1451 int rv = 0; 1452 1453 user = acquire_ipmi_user(user); 1454 if (!user) 1455 return -ENODEV; 1456 1457 if (channel >= IPMI_MAX_CHANNELS) { 1458 rv = -EINVAL; 1459 } else { 1460 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS); 1461 user->intf->addrinfo[channel].address = address; 1462 } 1463 release_ipmi_user(user); 1464 1465 return rv; 1466 } 1467 EXPORT_SYMBOL(ipmi_set_my_address); 1468 1469 int ipmi_get_my_address(struct ipmi_user *user, 1470 unsigned int channel, 1471 unsigned char *address) 1472 { 1473 int rv = 0; 1474 1475 user = acquire_ipmi_user(user); 1476 if (!user) 1477 return -ENODEV; 1478 1479 if (channel >= IPMI_MAX_CHANNELS) { 1480 rv = -EINVAL; 1481 } else { 1482 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS); 1483 *address = user->intf->addrinfo[channel].address; 1484 } 1485 release_ipmi_user(user); 1486 1487 return rv; 1488 } 1489 EXPORT_SYMBOL(ipmi_get_my_address); 1490 1491 int ipmi_set_my_LUN(struct ipmi_user *user, 1492 unsigned int channel, 1493 unsigned char LUN) 1494 { 1495 int rv = 0; 1496 1497 user = acquire_ipmi_user(user); 1498 if (!user) 1499 return -ENODEV; 1500 1501 if (channel >= IPMI_MAX_CHANNELS) { 1502 rv = -EINVAL; 1503 } else { 1504 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS); 1505 user->intf->addrinfo[channel].lun = LUN & 0x3; 1506 } 1507 release_ipmi_user(user); 1508 1509 return rv; 1510 } 1511 EXPORT_SYMBOL(ipmi_set_my_LUN); 1512 1513 int ipmi_get_my_LUN(struct ipmi_user *user, 1514 unsigned int channel, 1515 unsigned char *address) 1516 { 1517 int rv = 0; 1518 1519 user = acquire_ipmi_user(user); 1520 if (!user) 1521 return -ENODEV; 1522 1523 if (channel >= IPMI_MAX_CHANNELS) { 1524 rv = -EINVAL; 1525 } else { 1526 channel = array_index_nospec(channel, IPMI_MAX_CHANNELS); 1527 *address = user->intf->addrinfo[channel].lun; 1528 } 1529 release_ipmi_user(user); 1530 1531 return rv; 1532 } 1533 EXPORT_SYMBOL(ipmi_get_my_LUN); 1534 1535 int ipmi_get_maintenance_mode(struct ipmi_user *user) 1536 { 1537 int mode; 1538 unsigned long flags; 1539 1540 user = acquire_ipmi_user(user); 1541 if (!user) 1542 return -ENODEV; 1543 1544 spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags); 1545 mode = user->intf->maintenance_mode; 1546 spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags); 1547 release_ipmi_user(user); 1548 1549 return mode; 1550 } 1551 EXPORT_SYMBOL(ipmi_get_maintenance_mode); 1552 1553 static void maintenance_mode_update(struct ipmi_smi *intf) 1554 { 1555 if (intf->handlers->set_maintenance_mode) 1556 /* 1557 * Lower level drivers only care about firmware mode 1558 * as it affects their timing. They don't care about 1559 * reset, which disables all commands for a while. 1560 */ 1561 intf->handlers->set_maintenance_mode( 1562 intf->send_info, 1563 (intf->maintenance_mode_state == 1564 IPMI_MAINTENANCE_MODE_STATE_FIRMWARE)); 1565 } 1566 1567 int ipmi_set_maintenance_mode(struct ipmi_user *user, int mode) 1568 { 1569 int rv = 0; 1570 unsigned long flags; 1571 struct ipmi_smi *intf = user->intf; 1572 1573 user = acquire_ipmi_user(user); 1574 if (!user) 1575 return -ENODEV; 1576 1577 spin_lock_irqsave(&intf->maintenance_mode_lock, flags); 1578 if (intf->maintenance_mode != mode) { 1579 switch (mode) { 1580 case IPMI_MAINTENANCE_MODE_AUTO: 1581 /* Just leave it alone. */ 1582 break; 1583 1584 case IPMI_MAINTENANCE_MODE_OFF: 1585 intf->maintenance_mode_state = 1586 IPMI_MAINTENANCE_MODE_STATE_OFF; 1587 break; 1588 1589 case IPMI_MAINTENANCE_MODE_ON: 1590 intf->maintenance_mode_state = 1591 IPMI_MAINTENANCE_MODE_STATE_FIRMWARE; 1592 break; 1593 1594 default: 1595 rv = -EINVAL; 1596 goto out_unlock; 1597 } 1598 intf->maintenance_mode = mode; 1599 1600 maintenance_mode_update(intf); 1601 } 1602 out_unlock: 1603 spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags); 1604 release_ipmi_user(user); 1605 1606 return rv; 1607 } 1608 EXPORT_SYMBOL(ipmi_set_maintenance_mode); 1609 1610 int ipmi_set_gets_events(struct ipmi_user *user, bool val) 1611 { 1612 struct ipmi_smi *intf = user->intf; 1613 struct ipmi_recv_msg *msg, *msg2; 1614 LIST_HEAD(msgs); 1615 1616 user = acquire_ipmi_user(user); 1617 if (!user) 1618 return -ENODEV; 1619 1620 mutex_lock(&intf->events_mutex); 1621 if (user->gets_events == val) 1622 goto out; 1623 1624 user->gets_events = val; 1625 1626 if (val) { 1627 if (atomic_inc_return(&intf->event_waiters) == 1) 1628 need_waiter(intf); 1629 } else { 1630 atomic_dec(&intf->event_waiters); 1631 } 1632 1633 /* Deliver any queued events. */ 1634 while (user->gets_events && !list_empty(&intf->waiting_events)) { 1635 list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link) 1636 list_move_tail(&msg->link, &msgs); 1637 intf->waiting_events_count = 0; 1638 if (intf->event_msg_printed) { 1639 dev_warn(intf->si_dev, "Event queue no longer full\n"); 1640 intf->event_msg_printed = 0; 1641 } 1642 1643 list_for_each_entry_safe(msg, msg2, &msgs, link) { 1644 ipmi_set_recv_msg_user(msg, user); 1645 deliver_local_response(intf, msg); 1646 } 1647 } 1648 1649 out: 1650 mutex_unlock(&intf->events_mutex); 1651 release_ipmi_user(user); 1652 1653 return 0; 1654 } 1655 EXPORT_SYMBOL(ipmi_set_gets_events); 1656 1657 static struct cmd_rcvr *find_cmd_rcvr(struct ipmi_smi *intf, 1658 unsigned char netfn, 1659 unsigned char cmd, 1660 unsigned char chan) 1661 { 1662 struct cmd_rcvr *rcvr; 1663 1664 list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link, 1665 lockdep_is_held(&intf->cmd_rcvrs_mutex)) { 1666 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd) 1667 && (rcvr->chans & (1 << chan))) 1668 return rcvr; 1669 } 1670 return NULL; 1671 } 1672 1673 static int is_cmd_rcvr_exclusive(struct ipmi_smi *intf, 1674 unsigned char netfn, 1675 unsigned char cmd, 1676 unsigned int chans) 1677 { 1678 struct cmd_rcvr *rcvr; 1679 1680 list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link, 1681 lockdep_is_held(&intf->cmd_rcvrs_mutex)) { 1682 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd) 1683 && (rcvr->chans & chans)) 1684 return 0; 1685 } 1686 return 1; 1687 } 1688 1689 int ipmi_register_for_cmd(struct ipmi_user *user, 1690 unsigned char netfn, 1691 unsigned char cmd, 1692 unsigned int chans) 1693 { 1694 struct ipmi_smi *intf = user->intf; 1695 struct cmd_rcvr *rcvr; 1696 int rv = 0; 1697 1698 user = acquire_ipmi_user(user); 1699 if (!user) 1700 return -ENODEV; 1701 1702 rcvr = kmalloc_obj(*rcvr); 1703 if (!rcvr) { 1704 rv = -ENOMEM; 1705 goto out_release; 1706 } 1707 rcvr->cmd = cmd; 1708 rcvr->netfn = netfn; 1709 rcvr->chans = chans; 1710 rcvr->user = user; 1711 1712 mutex_lock(&intf->cmd_rcvrs_mutex); 1713 /* Make sure the command/netfn is not already registered. */ 1714 if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) { 1715 rv = -EBUSY; 1716 goto out_unlock; 1717 } 1718 1719 smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS); 1720 1721 list_add_rcu(&rcvr->link, &intf->cmd_rcvrs); 1722 1723 out_unlock: 1724 mutex_unlock(&intf->cmd_rcvrs_mutex); 1725 if (rv) 1726 kfree(rcvr); 1727 out_release: 1728 release_ipmi_user(user); 1729 1730 return rv; 1731 } 1732 EXPORT_SYMBOL(ipmi_register_for_cmd); 1733 1734 int ipmi_unregister_for_cmd(struct ipmi_user *user, 1735 unsigned char netfn, 1736 unsigned char cmd, 1737 unsigned int chans) 1738 { 1739 struct ipmi_smi *intf = user->intf; 1740 struct cmd_rcvr *rcvr; 1741 struct cmd_rcvr *rcvrs = NULL; 1742 int i, rv = -ENOENT; 1743 1744 user = acquire_ipmi_user(user); 1745 if (!user) 1746 return -ENODEV; 1747 1748 mutex_lock(&intf->cmd_rcvrs_mutex); 1749 for (i = 0; i < IPMI_NUM_CHANNELS; i++) { 1750 if (((1 << i) & chans) == 0) 1751 continue; 1752 rcvr = find_cmd_rcvr(intf, netfn, cmd, i); 1753 if (rcvr == NULL) 1754 continue; 1755 if (rcvr->user == user) { 1756 rv = 0; 1757 rcvr->chans &= ~chans; 1758 if (rcvr->chans == 0) { 1759 list_del_rcu(&rcvr->link); 1760 rcvr->next = rcvrs; 1761 rcvrs = rcvr; 1762 } 1763 } 1764 } 1765 mutex_unlock(&intf->cmd_rcvrs_mutex); 1766 synchronize_rcu(); 1767 release_ipmi_user(user); 1768 while (rcvrs) { 1769 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS); 1770 rcvr = rcvrs; 1771 rcvrs = rcvr->next; 1772 kfree(rcvr); 1773 } 1774 1775 return rv; 1776 } 1777 EXPORT_SYMBOL(ipmi_unregister_for_cmd); 1778 1779 unsigned char 1780 ipmb_checksum(unsigned char *data, int size) 1781 { 1782 unsigned char csum = 0; 1783 1784 for (; size > 0; size--, data++) 1785 csum += *data; 1786 1787 return -csum; 1788 } 1789 EXPORT_SYMBOL(ipmb_checksum); 1790 1791 static inline void format_ipmb_msg(struct ipmi_smi_msg *smi_msg, 1792 struct kernel_ipmi_msg *msg, 1793 struct ipmi_ipmb_addr *ipmb_addr, 1794 long msgid, 1795 unsigned char ipmb_seq, 1796 int broadcast, 1797 unsigned char source_address, 1798 unsigned char source_lun) 1799 { 1800 int i = broadcast; 1801 1802 /* Format the IPMB header data. */ 1803 smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); 1804 smi_msg->data[1] = IPMI_SEND_MSG_CMD; 1805 smi_msg->data[2] = ipmb_addr->channel; 1806 if (broadcast) 1807 smi_msg->data[3] = 0; 1808 smi_msg->data[i+3] = ipmb_addr->slave_addr; 1809 smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3); 1810 smi_msg->data[i+5] = ipmb_checksum(&smi_msg->data[i + 3], 2); 1811 smi_msg->data[i+6] = source_address; 1812 smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun; 1813 smi_msg->data[i+8] = msg->cmd; 1814 1815 /* Now tack on the data to the message. */ 1816 if (msg->data_len > 0) 1817 memcpy(&smi_msg->data[i + 9], msg->data, msg->data_len); 1818 smi_msg->data_size = msg->data_len + 9; 1819 1820 /* Now calculate the checksum and tack it on. */ 1821 smi_msg->data[i+smi_msg->data_size] 1822 = ipmb_checksum(&smi_msg->data[i + 6], smi_msg->data_size - 6); 1823 1824 /* 1825 * Add on the checksum size and the offset from the 1826 * broadcast. 1827 */ 1828 smi_msg->data_size += 1 + i; 1829 1830 smi_msg->msgid = msgid; 1831 } 1832 1833 static inline void format_lan_msg(struct ipmi_smi_msg *smi_msg, 1834 struct kernel_ipmi_msg *msg, 1835 struct ipmi_lan_addr *lan_addr, 1836 long msgid, 1837 unsigned char ipmb_seq, 1838 unsigned char source_lun) 1839 { 1840 /* Format the IPMB header data. */ 1841 smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); 1842 smi_msg->data[1] = IPMI_SEND_MSG_CMD; 1843 smi_msg->data[2] = lan_addr->channel; 1844 smi_msg->data[3] = lan_addr->session_handle; 1845 smi_msg->data[4] = lan_addr->remote_SWID; 1846 smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3); 1847 smi_msg->data[6] = ipmb_checksum(&smi_msg->data[4], 2); 1848 smi_msg->data[7] = lan_addr->local_SWID; 1849 smi_msg->data[8] = (ipmb_seq << 2) | source_lun; 1850 smi_msg->data[9] = msg->cmd; 1851 1852 /* Now tack on the data to the message. */ 1853 if (msg->data_len > 0) 1854 memcpy(&smi_msg->data[10], msg->data, msg->data_len); 1855 smi_msg->data_size = msg->data_len + 10; 1856 1857 /* Now calculate the checksum and tack it on. */ 1858 smi_msg->data[smi_msg->data_size] 1859 = ipmb_checksum(&smi_msg->data[7], smi_msg->data_size - 7); 1860 1861 /* 1862 * Add on the checksum size and the offset from the 1863 * broadcast. 1864 */ 1865 smi_msg->data_size += 1; 1866 1867 smi_msg->msgid = msgid; 1868 } 1869 1870 static struct ipmi_smi_msg *smi_add_send_msg(struct ipmi_smi *intf, 1871 struct ipmi_smi_msg *smi_msg, 1872 int priority) 1873 { 1874 if (intf->curr_msg) { 1875 if (priority > 0) 1876 list_add_tail(&smi_msg->link, &intf->hp_xmit_msgs); 1877 else 1878 list_add_tail(&smi_msg->link, &intf->xmit_msgs); 1879 smi_msg = NULL; 1880 } else { 1881 intf->curr_msg = smi_msg; 1882 } 1883 1884 return smi_msg; 1885 } 1886 1887 static int smi_send(struct ipmi_smi *intf, 1888 const struct ipmi_smi_handlers *handlers, 1889 struct ipmi_smi_msg *smi_msg, int priority) 1890 { 1891 int run_to_completion = READ_ONCE(intf->run_to_completion); 1892 unsigned long flags = 0; 1893 int rv = 0; 1894 1895 ipmi_lock_xmit_msgs(intf, run_to_completion, &flags); 1896 smi_msg = smi_add_send_msg(intf, smi_msg, priority); 1897 ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags); 1898 1899 if (smi_msg) { 1900 rv = handlers->sender(intf->send_info, smi_msg); 1901 if (rv) { 1902 ipmi_lock_xmit_msgs(intf, run_to_completion, &flags); 1903 intf->curr_msg = NULL; 1904 ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags); 1905 /* 1906 * Something may have been added to the transmit 1907 * queue, so schedule a check for that. 1908 */ 1909 queue_work(system_wq, &intf->smi_work); 1910 } 1911 } 1912 return rv; 1913 } 1914 1915 static bool is_maintenance_mode_cmd(struct kernel_ipmi_msg *msg) 1916 { 1917 return (((msg->netfn == IPMI_NETFN_APP_REQUEST) 1918 && ((msg->cmd == IPMI_COLD_RESET_CMD) 1919 || (msg->cmd == IPMI_WARM_RESET_CMD))) 1920 || (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST)); 1921 } 1922 1923 static int i_ipmi_req_sysintf(struct ipmi_smi *intf, 1924 struct ipmi_addr *addr, 1925 long msgid, 1926 struct kernel_ipmi_msg *msg, 1927 struct ipmi_smi_msg *smi_msg, 1928 struct ipmi_recv_msg *recv_msg, 1929 int retries, 1930 unsigned int retry_time_ms) 1931 { 1932 struct ipmi_system_interface_addr *smi_addr; 1933 1934 if (msg->netfn & 1) 1935 /* Responses are not allowed to the SMI. */ 1936 return -EINVAL; 1937 1938 smi_addr = (struct ipmi_system_interface_addr *) addr; 1939 if (smi_addr->lun > 3) { 1940 ipmi_inc_stat(intf, sent_invalid_commands); 1941 return -EINVAL; 1942 } 1943 1944 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr)); 1945 1946 if ((msg->netfn == IPMI_NETFN_APP_REQUEST) 1947 && ((msg->cmd == IPMI_SEND_MSG_CMD) 1948 || (msg->cmd == IPMI_GET_MSG_CMD) 1949 || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD))) { 1950 /* 1951 * We don't let the user do these, since we manage 1952 * the sequence numbers. 1953 */ 1954 ipmi_inc_stat(intf, sent_invalid_commands); 1955 return -EINVAL; 1956 } 1957 1958 if (is_maintenance_mode_cmd(msg)) { 1959 unsigned long flags; 1960 int newst; 1961 1962 if (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST) 1963 newst = IPMI_MAINTENANCE_MODE_STATE_FIRMWARE; 1964 else 1965 newst = IPMI_MAINTENANCE_MODE_STATE_RESET; 1966 1967 spin_lock_irqsave(&intf->maintenance_mode_lock, flags); 1968 intf->auto_maintenance_timeout = maintenance_mode_timeout_ms; 1969 if (!intf->maintenance_mode 1970 && intf->maintenance_mode_state < newst) { 1971 intf->maintenance_mode_state = newst; 1972 maintenance_mode_update(intf); 1973 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); 1974 } 1975 spin_unlock_irqrestore(&intf->maintenance_mode_lock, 1976 flags); 1977 } 1978 1979 if (msg->data_len + 2 > IPMI_MAX_MSG_LENGTH) { 1980 ipmi_inc_stat(intf, sent_invalid_commands); 1981 return -EMSGSIZE; 1982 } 1983 1984 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3); 1985 smi_msg->data[1] = msg->cmd; 1986 smi_msg->msgid = msgid; 1987 smi_msg->recv_msg = recv_msg; 1988 if (msg->data_len > 0) 1989 memcpy(&smi_msg->data[2], msg->data, msg->data_len); 1990 smi_msg->data_size = msg->data_len + 2; 1991 ipmi_inc_stat(intf, sent_local_commands); 1992 1993 return 0; 1994 } 1995 1996 static int i_ipmi_req_ipmb(struct ipmi_smi *intf, 1997 struct ipmi_addr *addr, 1998 long msgid, 1999 struct kernel_ipmi_msg *msg, 2000 struct ipmi_smi_msg *smi_msg, 2001 struct ipmi_recv_msg *recv_msg, 2002 unsigned char source_address, 2003 unsigned char source_lun, 2004 int retries, 2005 unsigned int retry_time_ms) 2006 { 2007 struct ipmi_ipmb_addr *ipmb_addr; 2008 unsigned char ipmb_seq; 2009 long seqid; 2010 int broadcast = 0; 2011 struct ipmi_channel *chans; 2012 int rv = 0; 2013 2014 if (addr->channel >= IPMI_MAX_CHANNELS) { 2015 ipmi_inc_stat(intf, sent_invalid_commands); 2016 return -EINVAL; 2017 } 2018 2019 chans = READ_ONCE(intf->channel_list)->c; 2020 2021 if (chans[addr->channel].medium != IPMI_CHANNEL_MEDIUM_IPMB) { 2022 ipmi_inc_stat(intf, sent_invalid_commands); 2023 return -EINVAL; 2024 } 2025 2026 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) { 2027 /* 2028 * Broadcasts add a zero at the beginning of the 2029 * message, but otherwise is the same as an IPMB 2030 * address. 2031 */ 2032 addr->addr_type = IPMI_IPMB_ADDR_TYPE; 2033 broadcast = 1; 2034 retries = 0; /* Don't retry broadcasts. */ 2035 } 2036 2037 /* 2038 * 9 for the header and 1 for the checksum, plus 2039 * possibly one for the broadcast. 2040 */ 2041 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) { 2042 ipmi_inc_stat(intf, sent_invalid_commands); 2043 return -EMSGSIZE; 2044 } 2045 2046 ipmb_addr = (struct ipmi_ipmb_addr *) addr; 2047 if (ipmb_addr->lun > 3) { 2048 ipmi_inc_stat(intf, sent_invalid_commands); 2049 return -EINVAL; 2050 } 2051 2052 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr)); 2053 2054 if (recv_msg->msg.netfn & 0x1) { 2055 /* 2056 * It's a response, so use the user's sequence 2057 * from msgid. 2058 */ 2059 ipmi_inc_stat(intf, sent_ipmb_responses); 2060 format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid, 2061 msgid, broadcast, 2062 source_address, source_lun); 2063 2064 /* 2065 * Save the receive message so we can use it 2066 * to deliver the response. 2067 */ 2068 smi_msg->recv_msg = recv_msg; 2069 } else { 2070 mutex_lock(&intf->seq_lock); 2071 2072 if (is_maintenance_mode_cmd(msg)) 2073 intf->ipmb_maintenance_mode_timeout = 2074 maintenance_mode_timeout_ms; 2075 2076 if (intf->ipmb_maintenance_mode_timeout && retry_time_ms == 0) 2077 /* Different default in maintenance mode */ 2078 retry_time_ms = default_maintenance_retry_ms; 2079 2080 /* 2081 * Create a sequence number with a 1 second 2082 * timeout and 4 retries. 2083 */ 2084 rv = intf_next_seq(intf, 2085 recv_msg, 2086 retry_time_ms, 2087 retries, 2088 broadcast, 2089 &ipmb_seq, 2090 &seqid); 2091 if (rv) 2092 /* 2093 * We have used up all the sequence numbers, 2094 * probably, so abort. 2095 */ 2096 goto out_err; 2097 2098 ipmi_inc_stat(intf, sent_ipmb_commands); 2099 2100 /* 2101 * Store the sequence number in the message, 2102 * so that when the send message response 2103 * comes back we can start the timer. 2104 */ 2105 format_ipmb_msg(smi_msg, msg, ipmb_addr, 2106 STORE_SEQ_IN_MSGID(ipmb_seq, seqid), 2107 ipmb_seq, broadcast, 2108 source_address, source_lun); 2109 2110 /* 2111 * Copy the message into the recv message data, so we 2112 * can retransmit it later if necessary. 2113 */ 2114 memcpy(recv_msg->msg_data, smi_msg->data, 2115 smi_msg->data_size); 2116 recv_msg->msg.data = recv_msg->msg_data; 2117 recv_msg->msg.data_len = smi_msg->data_size; 2118 2119 /* 2120 * We don't unlock until here, because we need 2121 * to copy the completed message into the 2122 * recv_msg before we release the lock. 2123 * Otherwise, race conditions may bite us. I 2124 * know that's pretty paranoid, but I prefer 2125 * to be correct. 2126 */ 2127 out_err: 2128 mutex_unlock(&intf->seq_lock); 2129 } 2130 2131 return rv; 2132 } 2133 2134 static int i_ipmi_req_ipmb_direct(struct ipmi_smi *intf, 2135 struct ipmi_addr *addr, 2136 long msgid, 2137 struct kernel_ipmi_msg *msg, 2138 struct ipmi_smi_msg *smi_msg, 2139 struct ipmi_recv_msg *recv_msg, 2140 unsigned char source_lun) 2141 { 2142 struct ipmi_ipmb_direct_addr *daddr; 2143 bool is_cmd = !(recv_msg->msg.netfn & 0x1); 2144 2145 if (!(intf->handlers->flags & IPMI_SMI_CAN_HANDLE_IPMB_DIRECT)) 2146 return -EAFNOSUPPORT; 2147 2148 /* Responses must have a completion code. */ 2149 if (!is_cmd && msg->data_len < 1) { 2150 ipmi_inc_stat(intf, sent_invalid_commands); 2151 return -EINVAL; 2152 } 2153 2154 if ((msg->data_len + 4) > IPMI_MAX_MSG_LENGTH) { 2155 ipmi_inc_stat(intf, sent_invalid_commands); 2156 return -EMSGSIZE; 2157 } 2158 2159 daddr = (struct ipmi_ipmb_direct_addr *) addr; 2160 if (daddr->rq_lun > 3 || daddr->rs_lun > 3) { 2161 ipmi_inc_stat(intf, sent_invalid_commands); 2162 return -EINVAL; 2163 } 2164 2165 smi_msg->type = IPMI_SMI_MSG_TYPE_IPMB_DIRECT; 2166 smi_msg->msgid = msgid; 2167 2168 if (is_cmd) { 2169 smi_msg->data[0] = msg->netfn << 2 | daddr->rs_lun; 2170 smi_msg->data[2] = recv_msg->msgid << 2 | daddr->rq_lun; 2171 } else { 2172 smi_msg->data[0] = msg->netfn << 2 | daddr->rq_lun; 2173 smi_msg->data[2] = recv_msg->msgid << 2 | daddr->rs_lun; 2174 } 2175 smi_msg->data[1] = daddr->slave_addr; 2176 smi_msg->data[3] = msg->cmd; 2177 2178 memcpy(smi_msg->data + 4, msg->data, msg->data_len); 2179 smi_msg->data_size = msg->data_len + 4; 2180 2181 smi_msg->recv_msg = recv_msg; 2182 2183 return 0; 2184 } 2185 2186 static int i_ipmi_req_lan(struct ipmi_smi *intf, 2187 struct ipmi_addr *addr, 2188 long msgid, 2189 struct kernel_ipmi_msg *msg, 2190 struct ipmi_smi_msg *smi_msg, 2191 struct ipmi_recv_msg *recv_msg, 2192 unsigned char source_lun, 2193 int retries, 2194 unsigned int retry_time_ms) 2195 { 2196 struct ipmi_lan_addr *lan_addr; 2197 unsigned char ipmb_seq; 2198 long seqid; 2199 struct ipmi_channel *chans; 2200 int rv = 0; 2201 2202 if (addr->channel >= IPMI_MAX_CHANNELS) { 2203 ipmi_inc_stat(intf, sent_invalid_commands); 2204 return -EINVAL; 2205 } 2206 2207 chans = READ_ONCE(intf->channel_list)->c; 2208 2209 if ((chans[addr->channel].medium 2210 != IPMI_CHANNEL_MEDIUM_8023LAN) 2211 && (chans[addr->channel].medium 2212 != IPMI_CHANNEL_MEDIUM_ASYNC)) { 2213 ipmi_inc_stat(intf, sent_invalid_commands); 2214 return -EINVAL; 2215 } 2216 2217 /* 11 for the header and 1 for the checksum. */ 2218 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) { 2219 ipmi_inc_stat(intf, sent_invalid_commands); 2220 return -EMSGSIZE; 2221 } 2222 2223 lan_addr = (struct ipmi_lan_addr *) addr; 2224 if (lan_addr->lun > 3) { 2225 ipmi_inc_stat(intf, sent_invalid_commands); 2226 return -EINVAL; 2227 } 2228 2229 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr)); 2230 2231 if (recv_msg->msg.netfn & 0x1) { 2232 /* 2233 * It's a response, so use the user's sequence 2234 * from msgid. 2235 */ 2236 ipmi_inc_stat(intf, sent_lan_responses); 2237 format_lan_msg(smi_msg, msg, lan_addr, msgid, 2238 msgid, source_lun); 2239 2240 /* 2241 * Save the receive message so we can use it 2242 * to deliver the response. 2243 */ 2244 smi_msg->recv_msg = recv_msg; 2245 } else { 2246 mutex_lock(&intf->seq_lock); 2247 2248 /* 2249 * Create a sequence number with a 1 second 2250 * timeout and 4 retries. 2251 */ 2252 rv = intf_next_seq(intf, 2253 recv_msg, 2254 retry_time_ms, 2255 retries, 2256 0, 2257 &ipmb_seq, 2258 &seqid); 2259 if (rv) 2260 /* 2261 * We have used up all the sequence numbers, 2262 * probably, so abort. 2263 */ 2264 goto out_err; 2265 2266 ipmi_inc_stat(intf, sent_lan_commands); 2267 2268 /* 2269 * Store the sequence number in the message, 2270 * so that when the send message response 2271 * comes back we can start the timer. 2272 */ 2273 format_lan_msg(smi_msg, msg, lan_addr, 2274 STORE_SEQ_IN_MSGID(ipmb_seq, seqid), 2275 ipmb_seq, source_lun); 2276 2277 /* 2278 * Copy the message into the recv message data, so we 2279 * can retransmit it later if necessary. 2280 */ 2281 memcpy(recv_msg->msg_data, smi_msg->data, 2282 smi_msg->data_size); 2283 recv_msg->msg.data = recv_msg->msg_data; 2284 recv_msg->msg.data_len = smi_msg->data_size; 2285 2286 /* 2287 * We don't unlock until here, because we need 2288 * to copy the completed message into the 2289 * recv_msg before we release the lock. 2290 * Otherwise, race conditions may bite us. I 2291 * know that's pretty paranoid, but I prefer 2292 * to be correct. 2293 */ 2294 out_err: 2295 mutex_unlock(&intf->seq_lock); 2296 } 2297 2298 return rv; 2299 } 2300 2301 /* 2302 * Separate from ipmi_request so that the user does not have to be 2303 * supplied in certain circumstances (mainly at panic time). If 2304 * messages are supplied, they will be freed, even if an error 2305 * occurs. 2306 */ 2307 static int i_ipmi_request(struct ipmi_user *user, 2308 struct ipmi_smi *intf, 2309 struct ipmi_addr *addr, 2310 long msgid, 2311 struct kernel_ipmi_msg *msg, 2312 void *user_msg_data, 2313 void *supplied_smi, 2314 struct ipmi_recv_msg *supplied_recv, 2315 int priority, 2316 unsigned char source_address, 2317 unsigned char source_lun, 2318 int retries, 2319 unsigned int retry_time_ms) 2320 { 2321 struct ipmi_smi_msg *smi_msg; 2322 struct ipmi_recv_msg *recv_msg; 2323 int run_to_completion = READ_ONCE(intf->run_to_completion); 2324 int rv = 0; 2325 bool in_seq_table = false; 2326 2327 if (supplied_recv) { 2328 recv_msg = supplied_recv; 2329 recv_msg->user = user; 2330 if (user) { 2331 atomic_inc(&user->nr_msgs); 2332 /* The put happens when the message is freed. */ 2333 kref_get(&user->refcount); 2334 } 2335 } else { 2336 recv_msg = ipmi_alloc_recv_msg(user); 2337 if (IS_ERR(recv_msg)) 2338 return PTR_ERR(recv_msg); 2339 } 2340 recv_msg->user_msg_data = user_msg_data; 2341 2342 if (supplied_smi) 2343 smi_msg = supplied_smi; 2344 else { 2345 smi_msg = ipmi_alloc_smi_msg(); 2346 if (smi_msg == NULL) { 2347 if (!supplied_recv) 2348 ipmi_free_recv_msg(recv_msg); 2349 else if (recv_msg->user) { 2350 atomic_dec(&recv_msg->user->nr_msgs); 2351 kref_put(&recv_msg->user->refcount, free_ipmi_user); 2352 } 2353 return -ENOMEM; 2354 } 2355 } 2356 2357 if (!run_to_completion) 2358 mutex_lock(&intf->users_mutex); 2359 if (intf->maintenance_mode_state == IPMI_MAINTENANCE_MODE_STATE_RESET) { 2360 /* No messages while the BMC is in reset. */ 2361 rv = -EBUSY; 2362 goto out_err; 2363 } 2364 if (intf->in_shutdown) { 2365 rv = -ENODEV; 2366 goto out_err; 2367 } 2368 2369 recv_msg->msgid = msgid; 2370 /* 2371 * Store the message to send in the receive message so timeout 2372 * responses can get the proper response data. 2373 */ 2374 recv_msg->msg = *msg; 2375 2376 if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) { 2377 rv = i_ipmi_req_sysintf(intf, addr, msgid, msg, smi_msg, 2378 recv_msg, retries, retry_time_ms); 2379 } else if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) { 2380 rv = i_ipmi_req_ipmb(intf, addr, msgid, msg, smi_msg, recv_msg, 2381 source_address, source_lun, 2382 retries, retry_time_ms); 2383 in_seq_table = true; 2384 } else if (is_ipmb_direct_addr(addr)) { 2385 rv = i_ipmi_req_ipmb_direct(intf, addr, msgid, msg, smi_msg, 2386 recv_msg, source_lun); 2387 } else if (is_lan_addr(addr)) { 2388 rv = i_ipmi_req_lan(intf, addr, msgid, msg, smi_msg, recv_msg, 2389 source_lun, retries, retry_time_ms); 2390 in_seq_table = true; 2391 } else { 2392 /* Unknown address type. */ 2393 ipmi_inc_stat(intf, sent_invalid_commands); 2394 rv = -EINVAL; 2395 } 2396 2397 if (!rv) { 2398 dev_dbg(intf->si_dev, "Send: %*ph\n", 2399 smi_msg->data_size, smi_msg->data); 2400 2401 rv = smi_send(intf, intf->handlers, smi_msg, priority); 2402 if (rv != IPMI_CC_NO_ERROR) 2403 /* smi_send() returns an IPMI err, return a Linux one. */ 2404 rv = -EIO; 2405 if (rv && in_seq_table) { 2406 /* 2407 * If it's in the sequence table, it will be 2408 * retried later, so ignore errors. 2409 */ 2410 rv = 0; 2411 /* But we need to fix the timeout. */ 2412 intf_start_seq_timer(intf, smi_msg->msgid); 2413 ipmi_free_smi_msg(smi_msg); 2414 smi_msg = NULL; 2415 } 2416 } 2417 out_err: 2418 if (!run_to_completion) 2419 mutex_unlock(&intf->users_mutex); 2420 2421 if (rv) { 2422 if (!supplied_smi) 2423 ipmi_free_smi_msg(smi_msg); 2424 if (!supplied_recv) 2425 ipmi_free_recv_msg(recv_msg); 2426 else if (recv_msg->user) { 2427 atomic_dec(&recv_msg->user->nr_msgs); 2428 kref_put(&recv_msg->user->refcount, free_ipmi_user); 2429 } 2430 } 2431 return rv; 2432 } 2433 2434 static int check_addr(struct ipmi_smi *intf, 2435 struct ipmi_addr *addr, 2436 unsigned char *saddr, 2437 unsigned char *lun) 2438 { 2439 if (addr->channel >= IPMI_MAX_CHANNELS) 2440 return -EINVAL; 2441 addr->channel = array_index_nospec(addr->channel, IPMI_MAX_CHANNELS); 2442 *lun = intf->addrinfo[addr->channel].lun; 2443 *saddr = intf->addrinfo[addr->channel].address; 2444 return 0; 2445 } 2446 2447 int ipmi_request_settime(struct ipmi_user *user, 2448 struct ipmi_addr *addr, 2449 long msgid, 2450 struct kernel_ipmi_msg *msg, 2451 void *user_msg_data, 2452 int priority, 2453 int retries, 2454 unsigned int retry_time_ms) 2455 { 2456 unsigned char saddr = 0, lun = 0; 2457 int rv; 2458 2459 if (!user) 2460 return -EINVAL; 2461 2462 user = acquire_ipmi_user(user); 2463 if (!user) 2464 return -ENODEV; 2465 2466 rv = check_addr(user->intf, addr, &saddr, &lun); 2467 if (!rv) 2468 rv = i_ipmi_request(user, 2469 user->intf, 2470 addr, 2471 msgid, 2472 msg, 2473 user_msg_data, 2474 NULL, NULL, 2475 priority, 2476 saddr, 2477 lun, 2478 retries, 2479 retry_time_ms); 2480 2481 release_ipmi_user(user); 2482 return rv; 2483 } 2484 EXPORT_SYMBOL(ipmi_request_settime); 2485 2486 int ipmi_request_supply_msgs(struct ipmi_user *user, 2487 struct ipmi_addr *addr, 2488 long msgid, 2489 struct kernel_ipmi_msg *msg, 2490 void *user_msg_data, 2491 void *supplied_smi, 2492 struct ipmi_recv_msg *supplied_recv, 2493 int priority) 2494 { 2495 unsigned char saddr = 0, lun = 0; 2496 int rv; 2497 2498 if (!user) 2499 return -EINVAL; 2500 2501 user = acquire_ipmi_user(user); 2502 if (!user) 2503 return -ENODEV; 2504 2505 rv = check_addr(user->intf, addr, &saddr, &lun); 2506 if (!rv) 2507 rv = i_ipmi_request(user, 2508 user->intf, 2509 addr, 2510 msgid, 2511 msg, 2512 user_msg_data, 2513 supplied_smi, 2514 supplied_recv, 2515 priority, 2516 saddr, 2517 lun, 2518 -1, 0); 2519 2520 release_ipmi_user(user); 2521 return rv; 2522 } 2523 EXPORT_SYMBOL(ipmi_request_supply_msgs); 2524 2525 static void bmc_device_id_handler(struct ipmi_smi *intf, 2526 struct ipmi_recv_msg *msg) 2527 { 2528 int rv; 2529 2530 if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 2531 || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE) 2532 || (msg->msg.cmd != IPMI_GET_DEVICE_ID_CMD)) { 2533 dev_warn(intf->si_dev, 2534 "invalid device_id msg: addr_type=%d netfn=%x cmd=%x\n", 2535 msg->addr.addr_type, msg->msg.netfn, msg->msg.cmd); 2536 return; 2537 } 2538 2539 if (msg->msg.data[0]) { 2540 dev_warn(intf->si_dev, "device id fetch failed: 0x%2.2x\n", 2541 msg->msg.data[0]); 2542 intf->bmc->dyn_id_set = 0; 2543 goto out; 2544 } 2545 2546 rv = ipmi_demangle_device_id(msg->msg.netfn, msg->msg.cmd, 2547 msg->msg.data, msg->msg.data_len, &intf->bmc->fetch_id); 2548 if (rv) { 2549 dev_warn(intf->si_dev, "device id demangle failed: %d\n", rv); 2550 /* record completion code when error */ 2551 intf->bmc->cc = msg->msg.data[0]; 2552 intf->bmc->dyn_id_set = 0; 2553 } else { 2554 /* 2555 * Make sure the id data is available before setting 2556 * dyn_id_set. 2557 */ 2558 smp_wmb(); 2559 intf->bmc->dyn_id_set = 1; 2560 } 2561 out: 2562 wake_up(&intf->waitq); 2563 } 2564 2565 static int 2566 send_get_device_id_cmd(struct ipmi_smi *intf) 2567 { 2568 struct ipmi_system_interface_addr si; 2569 struct kernel_ipmi_msg msg; 2570 2571 si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 2572 si.channel = IPMI_BMC_CHANNEL; 2573 si.lun = 0; 2574 2575 msg.netfn = IPMI_NETFN_APP_REQUEST; 2576 msg.cmd = IPMI_GET_DEVICE_ID_CMD; 2577 msg.data = NULL; 2578 msg.data_len = 0; 2579 2580 return i_ipmi_request(NULL, 2581 intf, 2582 (struct ipmi_addr *) &si, 2583 0, 2584 &msg, 2585 intf, 2586 NULL, 2587 NULL, 2588 0, 2589 intf->addrinfo[0].address, 2590 intf->addrinfo[0].lun, 2591 -1, 0); 2592 } 2593 2594 static int __get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc) 2595 { 2596 int rv; 2597 unsigned int retry_count = 0; 2598 2599 intf->null_user_handler = bmc_device_id_handler; 2600 2601 retry: 2602 bmc->cc = 0; 2603 bmc->dyn_id_set = 2; 2604 2605 rv = send_get_device_id_cmd(intf); 2606 if (rv) 2607 goto out_reset_handler; 2608 2609 wait_event(intf->waitq, bmc->dyn_id_set != 2); 2610 2611 if (!bmc->dyn_id_set) { 2612 if (bmc->cc != IPMI_CC_NO_ERROR && 2613 ++retry_count <= GET_DEVICE_ID_MAX_RETRY) { 2614 msleep(500); 2615 dev_warn(intf->si_dev, 2616 "BMC returned 0x%2.2x, retry get bmc device id\n", 2617 bmc->cc); 2618 goto retry; 2619 } 2620 2621 rv = -EIO; /* Something went wrong in the fetch. */ 2622 } 2623 2624 /* dyn_id_set makes the id data available. */ 2625 smp_rmb(); 2626 2627 out_reset_handler: 2628 intf->null_user_handler = NULL; 2629 2630 return rv; 2631 } 2632 2633 /* 2634 * Fetch the device id for the bmc/interface. You must pass in either 2635 * bmc or intf, this code will get the other one. If the data has 2636 * been recently fetched, this will just use the cached data. Otherwise 2637 * it will run a new fetch. 2638 * 2639 * Except for the first time this is called (in ipmi_add_smi()), 2640 * this will always return good data; 2641 */ 2642 static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, 2643 struct ipmi_device_id *id, 2644 bool *guid_set, guid_t *guid, int intf_num) 2645 { 2646 int rv = 0; 2647 int prev_dyn_id_set, prev_guid_set; 2648 bool intf_set = intf != NULL; 2649 2650 if (!intf) { 2651 mutex_lock(&bmc->dyn_mutex); 2652 retry_bmc_lock: 2653 if (list_empty(&bmc->intfs)) { 2654 mutex_unlock(&bmc->dyn_mutex); 2655 return -ENOENT; 2656 } 2657 intf = list_first_entry(&bmc->intfs, struct ipmi_smi, 2658 bmc_link); 2659 kref_get(&intf->refcount); 2660 mutex_unlock(&bmc->dyn_mutex); 2661 mutex_lock(&intf->bmc_reg_mutex); 2662 mutex_lock(&bmc->dyn_mutex); 2663 if (intf != list_first_entry(&bmc->intfs, struct ipmi_smi, 2664 bmc_link)) { 2665 mutex_unlock(&intf->bmc_reg_mutex); 2666 kref_put(&intf->refcount, intf_free); 2667 goto retry_bmc_lock; 2668 } 2669 } else { 2670 mutex_lock(&intf->bmc_reg_mutex); 2671 bmc = intf->bmc; 2672 mutex_lock(&bmc->dyn_mutex); 2673 kref_get(&intf->refcount); 2674 } 2675 2676 /* If we have a valid and current ID, just return that. */ 2677 if (intf->in_bmc_register || 2678 (bmc->dyn_id_set && time_is_after_jiffies(bmc->dyn_id_expiry))) 2679 goto out_noprocessing; 2680 2681 /* Don't allow sysfs access when in maintenance mode. */ 2682 if (intf->maintenance_mode_state) { 2683 rv = -EBUSY; 2684 goto out_noprocessing; 2685 } 2686 2687 prev_guid_set = bmc->dyn_guid_set; 2688 __get_guid(intf); 2689 2690 prev_dyn_id_set = bmc->dyn_id_set; 2691 rv = __get_device_id(intf, bmc); 2692 if (rv) 2693 goto out; 2694 2695 /* 2696 * The guid, device id, manufacturer id, and product id should 2697 * not change on a BMC. If it does we have to do some dancing. 2698 */ 2699 if (!intf->bmc_registered 2700 || (!prev_guid_set && bmc->dyn_guid_set) 2701 || (!prev_dyn_id_set && bmc->dyn_id_set) 2702 || (prev_guid_set && bmc->dyn_guid_set 2703 && !guid_equal(&bmc->guid, &bmc->fetch_guid)) 2704 || bmc->id.device_id != bmc->fetch_id.device_id 2705 || bmc->id.manufacturer_id != bmc->fetch_id.manufacturer_id 2706 || bmc->id.product_id != bmc->fetch_id.product_id) { 2707 struct ipmi_device_id id = bmc->fetch_id; 2708 int guid_set = bmc->dyn_guid_set; 2709 guid_t guid; 2710 2711 guid = bmc->fetch_guid; 2712 mutex_unlock(&bmc->dyn_mutex); 2713 2714 __ipmi_bmc_unregister(intf); 2715 /* Fill in the temporary BMC for good measure. */ 2716 intf->bmc->id = id; 2717 intf->bmc->dyn_guid_set = guid_set; 2718 intf->bmc->guid = guid; 2719 if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num)) 2720 need_waiter(intf); /* Retry later on an error. */ 2721 else 2722 __scan_channels(intf, &id, false); 2723 2724 2725 if (!intf_set) { 2726 /* 2727 * We weren't given the interface on the 2728 * command line, so restart the operation on 2729 * the next interface for the BMC. 2730 */ 2731 mutex_unlock(&intf->bmc_reg_mutex); 2732 mutex_lock(&bmc->dyn_mutex); 2733 goto retry_bmc_lock; 2734 } 2735 2736 /* We have a new BMC, set it up. */ 2737 bmc = intf->bmc; 2738 mutex_lock(&bmc->dyn_mutex); 2739 goto out_noprocessing; 2740 } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id))) 2741 /* Version info changes, scan the channels again. */ 2742 __scan_channels(intf, &bmc->fetch_id, true); 2743 2744 bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY; 2745 2746 out: 2747 if (rv && prev_dyn_id_set) { 2748 rv = 0; /* Ignore failures if we have previous data. */ 2749 bmc->dyn_id_set = prev_dyn_id_set; 2750 } 2751 if (!rv) { 2752 bmc->id = bmc->fetch_id; 2753 if (bmc->dyn_guid_set) 2754 bmc->guid = bmc->fetch_guid; 2755 else if (prev_guid_set) 2756 /* 2757 * The guid used to be valid and it failed to fetch, 2758 * just use the cached value. 2759 */ 2760 bmc->dyn_guid_set = prev_guid_set; 2761 } 2762 out_noprocessing: 2763 if (!rv) { 2764 if (id) 2765 *id = bmc->id; 2766 2767 if (guid_set) 2768 *guid_set = bmc->dyn_guid_set; 2769 2770 if (guid && bmc->dyn_guid_set) 2771 *guid = bmc->guid; 2772 } 2773 2774 mutex_unlock(&bmc->dyn_mutex); 2775 mutex_unlock(&intf->bmc_reg_mutex); 2776 2777 kref_put(&intf->refcount, intf_free); 2778 return rv; 2779 } 2780 2781 static int bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, 2782 struct ipmi_device_id *id, 2783 bool *guid_set, guid_t *guid) 2784 { 2785 return __bmc_get_device_id(intf, bmc, id, guid_set, guid, -1); 2786 } 2787 2788 static ssize_t device_id_show(struct device *dev, 2789 struct device_attribute *attr, 2790 char *buf) 2791 { 2792 struct bmc_device *bmc = to_bmc_device(dev); 2793 struct ipmi_device_id id; 2794 int rv; 2795 2796 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2797 if (rv) 2798 return rv; 2799 2800 return sysfs_emit(buf, "%u\n", id.device_id); 2801 } 2802 static DEVICE_ATTR_RO(device_id); 2803 2804 static ssize_t provides_device_sdrs_show(struct device *dev, 2805 struct device_attribute *attr, 2806 char *buf) 2807 { 2808 struct bmc_device *bmc = to_bmc_device(dev); 2809 struct ipmi_device_id id; 2810 int rv; 2811 2812 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2813 if (rv) 2814 return rv; 2815 2816 return sysfs_emit(buf, "%u\n", (id.device_revision & 0x80) >> 7); 2817 } 2818 static DEVICE_ATTR_RO(provides_device_sdrs); 2819 2820 static ssize_t revision_show(struct device *dev, struct device_attribute *attr, 2821 char *buf) 2822 { 2823 struct bmc_device *bmc = to_bmc_device(dev); 2824 struct ipmi_device_id id; 2825 int rv; 2826 2827 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2828 if (rv) 2829 return rv; 2830 2831 return sysfs_emit(buf, "%u\n", id.device_revision & 0x0F); 2832 } 2833 static DEVICE_ATTR_RO(revision); 2834 2835 static ssize_t firmware_revision_show(struct device *dev, 2836 struct device_attribute *attr, 2837 char *buf) 2838 { 2839 struct bmc_device *bmc = to_bmc_device(dev); 2840 struct ipmi_device_id id; 2841 int rv; 2842 2843 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2844 if (rv) 2845 return rv; 2846 2847 return sysfs_emit(buf, "%u.%x\n", id.firmware_revision_1, 2848 id.firmware_revision_2); 2849 } 2850 static DEVICE_ATTR_RO(firmware_revision); 2851 2852 static ssize_t ipmi_version_show(struct device *dev, 2853 struct device_attribute *attr, 2854 char *buf) 2855 { 2856 struct bmc_device *bmc = to_bmc_device(dev); 2857 struct ipmi_device_id id; 2858 int rv; 2859 2860 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2861 if (rv) 2862 return rv; 2863 2864 return sysfs_emit(buf, "%u.%u\n", 2865 ipmi_version_major(&id), 2866 ipmi_version_minor(&id)); 2867 } 2868 static DEVICE_ATTR_RO(ipmi_version); 2869 2870 static ssize_t add_dev_support_show(struct device *dev, 2871 struct device_attribute *attr, 2872 char *buf) 2873 { 2874 struct bmc_device *bmc = to_bmc_device(dev); 2875 struct ipmi_device_id id; 2876 int rv; 2877 2878 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2879 if (rv) 2880 return rv; 2881 2882 return sysfs_emit(buf, "0x%02x\n", id.additional_device_support); 2883 } 2884 static DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show, 2885 NULL); 2886 2887 static ssize_t manufacturer_id_show(struct device *dev, 2888 struct device_attribute *attr, 2889 char *buf) 2890 { 2891 struct bmc_device *bmc = to_bmc_device(dev); 2892 struct ipmi_device_id id; 2893 int rv; 2894 2895 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2896 if (rv) 2897 return rv; 2898 2899 return sysfs_emit(buf, "0x%6.6x\n", id.manufacturer_id); 2900 } 2901 static DEVICE_ATTR_RO(manufacturer_id); 2902 2903 static ssize_t product_id_show(struct device *dev, 2904 struct device_attribute *attr, 2905 char *buf) 2906 { 2907 struct bmc_device *bmc = to_bmc_device(dev); 2908 struct ipmi_device_id id; 2909 int rv; 2910 2911 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2912 if (rv) 2913 return rv; 2914 2915 return sysfs_emit(buf, "0x%4.4x\n", id.product_id); 2916 } 2917 static DEVICE_ATTR_RO(product_id); 2918 2919 static ssize_t aux_firmware_rev_show(struct device *dev, 2920 struct device_attribute *attr, 2921 char *buf) 2922 { 2923 struct bmc_device *bmc = to_bmc_device(dev); 2924 struct ipmi_device_id id; 2925 int rv; 2926 2927 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2928 if (rv) 2929 return rv; 2930 2931 return sysfs_emit(buf, "0x%02x 0x%02x 0x%02x 0x%02x\n", 2932 id.aux_firmware_revision[3], 2933 id.aux_firmware_revision[2], 2934 id.aux_firmware_revision[1], 2935 id.aux_firmware_revision[0]); 2936 } 2937 static DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL); 2938 2939 static ssize_t guid_show(struct device *dev, struct device_attribute *attr, 2940 char *buf) 2941 { 2942 struct bmc_device *bmc = to_bmc_device(dev); 2943 bool guid_set; 2944 guid_t guid; 2945 int rv; 2946 2947 rv = bmc_get_device_id(NULL, bmc, NULL, &guid_set, &guid); 2948 if (rv) 2949 return rv; 2950 if (!guid_set) 2951 return -ENOENT; 2952 2953 return sysfs_emit(buf, "%pUl\n", &guid); 2954 } 2955 static DEVICE_ATTR_RO(guid); 2956 2957 static struct attribute *bmc_dev_attrs[] = { 2958 &dev_attr_device_id.attr, 2959 &dev_attr_provides_device_sdrs.attr, 2960 &dev_attr_revision.attr, 2961 &dev_attr_firmware_revision.attr, 2962 &dev_attr_ipmi_version.attr, 2963 &dev_attr_additional_device_support.attr, 2964 &dev_attr_manufacturer_id.attr, 2965 &dev_attr_product_id.attr, 2966 &dev_attr_aux_firmware_revision.attr, 2967 &dev_attr_guid.attr, 2968 NULL 2969 }; 2970 2971 static umode_t bmc_dev_attr_is_visible(struct kobject *kobj, 2972 struct attribute *attr, int idx) 2973 { 2974 struct device *dev = kobj_to_dev(kobj); 2975 struct bmc_device *bmc = to_bmc_device(dev); 2976 umode_t mode = attr->mode; 2977 int rv; 2978 2979 if (attr == &dev_attr_aux_firmware_revision.attr) { 2980 struct ipmi_device_id id; 2981 2982 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL); 2983 return (!rv && id.aux_firmware_revision_set) ? mode : 0; 2984 } 2985 if (attr == &dev_attr_guid.attr) { 2986 bool guid_set; 2987 2988 rv = bmc_get_device_id(NULL, bmc, NULL, &guid_set, NULL); 2989 return (!rv && guid_set) ? mode : 0; 2990 } 2991 return mode; 2992 } 2993 2994 static const struct attribute_group bmc_dev_attr_group = { 2995 .attrs = bmc_dev_attrs, 2996 .is_visible = bmc_dev_attr_is_visible, 2997 }; 2998 2999 static const struct attribute_group *bmc_dev_attr_groups[] = { 3000 &bmc_dev_attr_group, 3001 NULL 3002 }; 3003 3004 static const struct device_type bmc_device_type = { 3005 .groups = bmc_dev_attr_groups, 3006 }; 3007 3008 static int __find_bmc_guid(struct device *dev, const void *data) 3009 { 3010 const guid_t *guid = data; 3011 struct bmc_device *bmc; 3012 int rv; 3013 3014 if (dev->type != &bmc_device_type) 3015 return 0; 3016 3017 bmc = to_bmc_device(dev); 3018 rv = bmc->dyn_guid_set && guid_equal(&bmc->guid, guid); 3019 if (rv) 3020 rv = kref_get_unless_zero(&bmc->usecount); 3021 return rv; 3022 } 3023 3024 /* 3025 * Returns with the bmc's usecount incremented, if it is non-NULL. 3026 */ 3027 static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv, 3028 guid_t *guid) 3029 { 3030 struct device *dev; 3031 struct bmc_device *bmc = NULL; 3032 3033 dev = driver_find_device(drv, NULL, guid, __find_bmc_guid); 3034 if (dev) { 3035 bmc = to_bmc_device(dev); 3036 put_device(dev); 3037 } 3038 return bmc; 3039 } 3040 3041 struct prod_dev_id { 3042 unsigned int product_id; 3043 unsigned char device_id; 3044 }; 3045 3046 static int __find_bmc_prod_dev_id(struct device *dev, const void *data) 3047 { 3048 const struct prod_dev_id *cid = data; 3049 struct bmc_device *bmc; 3050 int rv; 3051 3052 if (dev->type != &bmc_device_type) 3053 return 0; 3054 3055 bmc = to_bmc_device(dev); 3056 rv = (bmc->id.product_id == cid->product_id 3057 && bmc->id.device_id == cid->device_id); 3058 if (rv) 3059 rv = kref_get_unless_zero(&bmc->usecount); 3060 return rv; 3061 } 3062 3063 /* 3064 * Returns with the bmc's usecount incremented, if it is non-NULL. 3065 */ 3066 static struct bmc_device *ipmi_find_bmc_prod_dev_id( 3067 struct device_driver *drv, 3068 unsigned int product_id, unsigned char device_id) 3069 { 3070 struct prod_dev_id id = { 3071 .product_id = product_id, 3072 .device_id = device_id, 3073 }; 3074 struct device *dev; 3075 struct bmc_device *bmc = NULL; 3076 3077 dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id); 3078 if (dev) { 3079 bmc = to_bmc_device(dev); 3080 put_device(dev); 3081 } 3082 return bmc; 3083 } 3084 3085 static DEFINE_IDA(ipmi_bmc_ida); 3086 3087 static void 3088 release_bmc_device(struct device *dev) 3089 { 3090 kfree(to_bmc_device(dev)); 3091 } 3092 3093 static void cleanup_bmc_work(struct work_struct *work) 3094 { 3095 struct bmc_device *bmc = container_of(work, struct bmc_device, 3096 remove_work); 3097 int id = bmc->pdev.id; /* Unregister overwrites id */ 3098 3099 platform_device_unregister(&bmc->pdev); 3100 ida_free(&ipmi_bmc_ida, id); 3101 } 3102 3103 static void 3104 cleanup_bmc_device(struct kref *ref) 3105 { 3106 struct bmc_device *bmc = container_of(ref, struct bmc_device, usecount); 3107 3108 /* 3109 * Remove the platform device in a work queue to avoid issues 3110 * with removing the device attributes while reading a device 3111 * attribute. 3112 */ 3113 queue_work(bmc_remove_work_wq, &bmc->remove_work); 3114 } 3115 3116 /* 3117 * Must be called with intf->bmc_reg_mutex held. 3118 */ 3119 static void __ipmi_bmc_unregister(struct ipmi_smi *intf) 3120 { 3121 struct bmc_device *bmc = intf->bmc; 3122 3123 if (!intf->bmc_registered) 3124 return; 3125 3126 sysfs_remove_link(&intf->si_dev->kobj, "bmc"); 3127 sysfs_remove_link(&bmc->pdev.dev.kobj, intf->my_dev_name); 3128 kfree(intf->my_dev_name); 3129 intf->my_dev_name = NULL; 3130 3131 mutex_lock(&bmc->dyn_mutex); 3132 list_del(&intf->bmc_link); 3133 mutex_unlock(&bmc->dyn_mutex); 3134 intf->bmc = &intf->tmp_bmc; 3135 kref_put(&bmc->usecount, cleanup_bmc_device); 3136 intf->bmc_registered = false; 3137 } 3138 3139 static void ipmi_bmc_unregister(struct ipmi_smi *intf) 3140 { 3141 mutex_lock(&intf->bmc_reg_mutex); 3142 __ipmi_bmc_unregister(intf); 3143 mutex_unlock(&intf->bmc_reg_mutex); 3144 } 3145 3146 /* 3147 * Must be called with intf->bmc_reg_mutex held. 3148 */ 3149 static int __ipmi_bmc_register(struct ipmi_smi *intf, 3150 struct ipmi_device_id *id, 3151 bool guid_set, guid_t *guid, int intf_num) 3152 { 3153 int rv; 3154 struct bmc_device *bmc; 3155 struct bmc_device *old_bmc; 3156 3157 /* 3158 * platform_device_register() can cause bmc_reg_mutex to 3159 * be claimed because of the is_visible functions of 3160 * the attributes. Eliminate possible recursion and 3161 * release the lock. 3162 */ 3163 intf->in_bmc_register = true; 3164 mutex_unlock(&intf->bmc_reg_mutex); 3165 3166 /* 3167 * Try to find if there is an bmc_device struct 3168 * representing the interfaced BMC already 3169 */ 3170 mutex_lock(&ipmidriver_mutex); 3171 if (guid_set) 3172 old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, guid); 3173 else 3174 old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver, 3175 id->product_id, 3176 id->device_id); 3177 3178 /* 3179 * If there is already an bmc_device, free the new one, 3180 * otherwise register the new BMC device 3181 */ 3182 if (old_bmc) { 3183 bmc = old_bmc; 3184 /* 3185 * Note: old_bmc already has usecount incremented by 3186 * the BMC find functions. 3187 */ 3188 intf->bmc = old_bmc; 3189 mutex_lock(&bmc->dyn_mutex); 3190 list_add_tail(&intf->bmc_link, &bmc->intfs); 3191 mutex_unlock(&bmc->dyn_mutex); 3192 3193 dev_info(intf->si_dev, 3194 "interfacing existing BMC (man_id: 0x%6.6x, prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n", 3195 bmc->id.manufacturer_id, 3196 bmc->id.product_id, 3197 bmc->id.device_id); 3198 } else { 3199 bmc = kzalloc_obj(*bmc); 3200 if (!bmc) { 3201 rv = -ENOMEM; 3202 goto out; 3203 } 3204 INIT_LIST_HEAD(&bmc->intfs); 3205 mutex_init(&bmc->dyn_mutex); 3206 INIT_WORK(&bmc->remove_work, cleanup_bmc_work); 3207 3208 bmc->id = *id; 3209 bmc->dyn_id_set = 1; 3210 bmc->dyn_guid_set = guid_set; 3211 bmc->guid = *guid; 3212 bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY; 3213 3214 bmc->pdev.name = "ipmi_bmc"; 3215 3216 rv = ida_alloc(&ipmi_bmc_ida, GFP_KERNEL); 3217 if (rv < 0) { 3218 kfree(bmc); 3219 goto out; 3220 } 3221 3222 bmc->pdev.dev.driver = &ipmidriver.driver; 3223 bmc->pdev.id = rv; 3224 bmc->pdev.dev.release = release_bmc_device; 3225 bmc->pdev.dev.type = &bmc_device_type; 3226 kref_init(&bmc->usecount); 3227 3228 intf->bmc = bmc; 3229 mutex_lock(&bmc->dyn_mutex); 3230 list_add_tail(&intf->bmc_link, &bmc->intfs); 3231 mutex_unlock(&bmc->dyn_mutex); 3232 3233 rv = platform_device_register(&bmc->pdev); 3234 if (rv) { 3235 dev_err(intf->si_dev, 3236 "Unable to register bmc device: %d\n", 3237 rv); 3238 goto out_list_del; 3239 } 3240 3241 dev_info(intf->si_dev, 3242 "Found new BMC (man_id: 0x%6.6x, prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n", 3243 bmc->id.manufacturer_id, 3244 bmc->id.product_id, 3245 bmc->id.device_id); 3246 } 3247 3248 /* 3249 * create symlink from system interface device to bmc device 3250 * and back. 3251 */ 3252 rv = sysfs_create_link(&intf->si_dev->kobj, &bmc->pdev.dev.kobj, "bmc"); 3253 if (rv) { 3254 dev_err(intf->si_dev, "Unable to create bmc symlink: %d\n", rv); 3255 goto out_put_bmc; 3256 } 3257 3258 if (intf_num == -1) 3259 intf_num = intf->intf_num; 3260 intf->my_dev_name = kasprintf(GFP_KERNEL, "ipmi%d", intf_num); 3261 if (!intf->my_dev_name) { 3262 rv = -ENOMEM; 3263 dev_err(intf->si_dev, "Unable to allocate link from BMC: %d\n", 3264 rv); 3265 goto out_unlink1; 3266 } 3267 3268 rv = sysfs_create_link(&bmc->pdev.dev.kobj, &intf->si_dev->kobj, 3269 intf->my_dev_name); 3270 if (rv) { 3271 dev_err(intf->si_dev, "Unable to create symlink to bmc: %d\n", 3272 rv); 3273 goto out_free_my_dev_name; 3274 } 3275 3276 intf->bmc_registered = true; 3277 3278 out: 3279 mutex_unlock(&ipmidriver_mutex); 3280 mutex_lock(&intf->bmc_reg_mutex); 3281 intf->in_bmc_register = false; 3282 return rv; 3283 3284 3285 out_free_my_dev_name: 3286 kfree(intf->my_dev_name); 3287 intf->my_dev_name = NULL; 3288 3289 out_unlink1: 3290 sysfs_remove_link(&intf->si_dev->kobj, "bmc"); 3291 3292 out_put_bmc: 3293 mutex_lock(&bmc->dyn_mutex); 3294 list_del(&intf->bmc_link); 3295 mutex_unlock(&bmc->dyn_mutex); 3296 intf->bmc = &intf->tmp_bmc; 3297 kref_put(&bmc->usecount, cleanup_bmc_device); 3298 goto out; 3299 3300 out_list_del: 3301 mutex_lock(&bmc->dyn_mutex); 3302 list_del(&intf->bmc_link); 3303 mutex_unlock(&bmc->dyn_mutex); 3304 intf->bmc = &intf->tmp_bmc; 3305 ida_free(&ipmi_bmc_ida, bmc->pdev.id); 3306 put_device(&bmc->pdev.dev); 3307 goto out; 3308 } 3309 3310 static int 3311 send_guid_cmd(struct ipmi_smi *intf, int chan) 3312 { 3313 struct kernel_ipmi_msg msg; 3314 struct ipmi_system_interface_addr si; 3315 3316 si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 3317 si.channel = IPMI_BMC_CHANNEL; 3318 si.lun = 0; 3319 3320 msg.netfn = IPMI_NETFN_APP_REQUEST; 3321 msg.cmd = IPMI_GET_DEVICE_GUID_CMD; 3322 msg.data = NULL; 3323 msg.data_len = 0; 3324 return i_ipmi_request(NULL, 3325 intf, 3326 (struct ipmi_addr *) &si, 3327 0, 3328 &msg, 3329 intf, 3330 NULL, 3331 NULL, 3332 0, 3333 intf->addrinfo[0].address, 3334 intf->addrinfo[0].lun, 3335 -1, 0); 3336 } 3337 3338 static void guid_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) 3339 { 3340 struct bmc_device *bmc = intf->bmc; 3341 3342 if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 3343 || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE) 3344 || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD)) 3345 /* Not for me */ 3346 return; 3347 3348 if (msg->msg.data[0] != 0) { 3349 /* Error from getting the GUID, the BMC doesn't have one. */ 3350 bmc->dyn_guid_set = 0; 3351 goto out; 3352 } 3353 3354 if (msg->msg.data_len < UUID_SIZE + 1) { 3355 bmc->dyn_guid_set = 0; 3356 dev_warn(intf->si_dev, 3357 "The GUID response from the BMC was too short, it was %d but should have been %d. Assuming GUID is not available.\n", 3358 msg->msg.data_len, UUID_SIZE + 1); 3359 goto out; 3360 } 3361 3362 import_guid(&bmc->fetch_guid, msg->msg.data + 1); 3363 /* 3364 * Make sure the guid data is available before setting 3365 * dyn_guid_set. 3366 */ 3367 smp_wmb(); 3368 bmc->dyn_guid_set = 1; 3369 out: 3370 wake_up(&intf->waitq); 3371 } 3372 3373 static void __get_guid(struct ipmi_smi *intf) 3374 { 3375 int rv; 3376 struct bmc_device *bmc = intf->bmc; 3377 3378 bmc->dyn_guid_set = 2; 3379 intf->null_user_handler = guid_handler; 3380 rv = send_guid_cmd(intf, 0); 3381 if (rv) 3382 /* Send failed, no GUID available. */ 3383 bmc->dyn_guid_set = 0; 3384 else 3385 wait_event(intf->waitq, bmc->dyn_guid_set != 2); 3386 3387 /* dyn_guid_set makes the guid data available. */ 3388 smp_rmb(); 3389 3390 intf->null_user_handler = NULL; 3391 } 3392 3393 static int 3394 send_channel_info_cmd(struct ipmi_smi *intf, int chan) 3395 { 3396 struct kernel_ipmi_msg msg; 3397 unsigned char data[1]; 3398 struct ipmi_system_interface_addr si; 3399 3400 si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 3401 si.channel = IPMI_BMC_CHANNEL; 3402 si.lun = 0; 3403 3404 msg.netfn = IPMI_NETFN_APP_REQUEST; 3405 msg.cmd = IPMI_GET_CHANNEL_INFO_CMD; 3406 msg.data = data; 3407 msg.data_len = 1; 3408 data[0] = chan; 3409 return i_ipmi_request(NULL, 3410 intf, 3411 (struct ipmi_addr *) &si, 3412 0, 3413 &msg, 3414 intf, 3415 NULL, 3416 NULL, 3417 0, 3418 intf->addrinfo[0].address, 3419 intf->addrinfo[0].lun, 3420 -1, 0); 3421 } 3422 3423 static void 3424 channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) 3425 { 3426 int rv = 0; 3427 int ch; 3428 unsigned int set = intf->curr_working_cset; 3429 struct ipmi_channel *chans; 3430 3431 if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 3432 && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE) 3433 && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD)) { 3434 /* It's the one we want */ 3435 if (msg->msg.data[0] != 0) { 3436 /* Got an error from the channel, just go on. */ 3437 if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) { 3438 /* 3439 * If the MC does not support this 3440 * command, that is legal. We just 3441 * assume it has one IPMB at channel 3442 * zero. 3443 */ 3444 intf->wchannels[set].c[0].medium 3445 = IPMI_CHANNEL_MEDIUM_IPMB; 3446 intf->wchannels[set].c[0].protocol 3447 = IPMI_CHANNEL_PROTOCOL_IPMB; 3448 3449 intf->channel_list = intf->wchannels + set; 3450 intf->channels_ready = true; 3451 wake_up(&intf->waitq); 3452 goto out; 3453 } 3454 goto next_channel; 3455 } 3456 if (msg->msg.data_len < 4) { 3457 /* Message not big enough, just go on. */ 3458 goto next_channel; 3459 } 3460 ch = intf->curr_channel; 3461 chans = intf->wchannels[set].c; 3462 chans[ch].medium = msg->msg.data[2] & 0x7f; 3463 chans[ch].protocol = msg->msg.data[3] & 0x1f; 3464 3465 next_channel: 3466 intf->curr_channel++; 3467 if (intf->curr_channel >= IPMI_MAX_CHANNELS) { 3468 intf->channel_list = intf->wchannels + set; 3469 intf->channels_ready = true; 3470 wake_up(&intf->waitq); 3471 } else { 3472 rv = send_channel_info_cmd(intf, intf->curr_channel); 3473 } 3474 3475 if (rv) { 3476 /* Got an error somehow, just give up. */ 3477 dev_warn(intf->si_dev, 3478 "Error sending channel information for channel %d: %d\n", 3479 intf->curr_channel, rv); 3480 3481 intf->channel_list = intf->wchannels + set; 3482 intf->channels_ready = true; 3483 wake_up(&intf->waitq); 3484 } 3485 } 3486 out: 3487 return; 3488 } 3489 3490 /* 3491 * Must be holding intf->bmc_reg_mutex to call this. 3492 */ 3493 static int __scan_channels(struct ipmi_smi *intf, 3494 struct ipmi_device_id *id, 3495 bool rescan) 3496 { 3497 int rv; 3498 3499 if (rescan) { 3500 /* Clear channels_ready to force channels rescan. */ 3501 intf->channels_ready = false; 3502 } 3503 3504 /* Skip channel scan if channels are already marked ready */ 3505 if (intf->channels_ready) 3506 return 0; 3507 3508 if (ipmi_version_major(id) > 1 3509 || (ipmi_version_major(id) == 1 3510 && ipmi_version_minor(id) >= 5)) { 3511 unsigned int set; 3512 3513 /* 3514 * Start scanning the channels to see what is 3515 * available. 3516 */ 3517 set = !intf->curr_working_cset; 3518 intf->curr_working_cset = set; 3519 memset(&intf->wchannels[set], 0, 3520 sizeof(struct ipmi_channel_set)); 3521 3522 intf->null_user_handler = channel_handler; 3523 intf->curr_channel = 0; 3524 rv = send_channel_info_cmd(intf, 0); 3525 if (rv) { 3526 dev_warn(intf->si_dev, 3527 "Error sending channel information for channel 0, %d\n", 3528 rv); 3529 intf->null_user_handler = NULL; 3530 return -EIO; 3531 } 3532 3533 /* Wait for the channel info to be read. */ 3534 wait_event(intf->waitq, intf->channels_ready); 3535 intf->null_user_handler = NULL; 3536 } else { 3537 unsigned int set = intf->curr_working_cset; 3538 3539 /* Assume a single IPMB channel at zero. */ 3540 intf->wchannels[set].c[0].medium = IPMI_CHANNEL_MEDIUM_IPMB; 3541 intf->wchannels[set].c[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB; 3542 intf->channel_list = intf->wchannels + set; 3543 intf->channels_ready = true; 3544 } 3545 3546 return 0; 3547 } 3548 3549 static void ipmi_poll(struct ipmi_smi *intf) 3550 { 3551 if (intf->handlers->poll) 3552 intf->handlers->poll(intf->send_info); 3553 /* In case something came in */ 3554 handle_new_recv_msgs(intf); 3555 } 3556 3557 void ipmi_poll_interface(struct ipmi_user *user) 3558 { 3559 ipmi_poll(user->intf); 3560 } 3561 EXPORT_SYMBOL(ipmi_poll_interface); 3562 3563 static ssize_t nr_users_show(struct device *dev, 3564 struct device_attribute *attr, 3565 char *buf) 3566 { 3567 struct ipmi_smi *intf = container_of(attr, 3568 struct ipmi_smi, nr_users_devattr); 3569 3570 return sysfs_emit(buf, "%d\n", atomic_read(&intf->nr_users)); 3571 } 3572 static DEVICE_ATTR_RO(nr_users); 3573 3574 static ssize_t nr_msgs_show(struct device *dev, 3575 struct device_attribute *attr, 3576 char *buf) 3577 { 3578 struct ipmi_smi *intf = container_of(attr, 3579 struct ipmi_smi, nr_msgs_devattr); 3580 struct ipmi_user *user; 3581 unsigned int count = 0; 3582 3583 mutex_lock(&intf->users_mutex); 3584 list_for_each_entry(user, &intf->users, link) 3585 count += atomic_read(&user->nr_msgs); 3586 mutex_unlock(&intf->users_mutex); 3587 3588 return sysfs_emit(buf, "%u\n", count); 3589 } 3590 static DEVICE_ATTR_RO(nr_msgs); 3591 3592 static ssize_t maintenance_mode_show(struct device *dev, 3593 struct device_attribute *attr, 3594 char *buf) 3595 { 3596 struct ipmi_smi *intf = container_of(attr, 3597 struct ipmi_smi, 3598 maintenance_mode_devattr); 3599 3600 return sysfs_emit(buf, "%u %d\n", intf->maintenance_mode_state, 3601 intf->auto_maintenance_timeout); 3602 } 3603 static DEVICE_ATTR_RO(maintenance_mode); 3604 3605 static void redo_bmc_reg(struct work_struct *work) 3606 { 3607 struct ipmi_smi *intf = container_of(work, struct ipmi_smi, 3608 bmc_reg_work); 3609 3610 if (!intf->in_shutdown) 3611 bmc_get_device_id(intf, NULL, NULL, NULL, NULL); 3612 3613 kref_put(&intf->refcount, intf_free); 3614 } 3615 3616 int ipmi_add_smi(struct module *owner, 3617 const struct ipmi_smi_handlers *handlers, 3618 void *send_info, 3619 struct device *si_dev, 3620 unsigned char slave_addr) 3621 { 3622 int i, j; 3623 int rv; 3624 struct ipmi_smi *intf, *tintf; 3625 struct list_head *link; 3626 struct ipmi_device_id id; 3627 3628 /* 3629 * Make sure the driver is actually initialized, this handles 3630 * problems with initialization order. 3631 */ 3632 rv = ipmi_init_msghandler(); 3633 if (rv) 3634 return rv; 3635 3636 intf = kzalloc_obj(*intf); 3637 if (!intf) 3638 return -ENOMEM; 3639 3640 intf->owner = owner; 3641 intf->bmc = &intf->tmp_bmc; 3642 INIT_LIST_HEAD(&intf->bmc->intfs); 3643 mutex_init(&intf->bmc->dyn_mutex); 3644 INIT_LIST_HEAD(&intf->bmc_link); 3645 mutex_init(&intf->bmc_reg_mutex); 3646 intf->intf_num = -1; /* Mark it invalid for now. */ 3647 kref_init(&intf->refcount); 3648 INIT_WORK(&intf->bmc_reg_work, redo_bmc_reg); 3649 intf->si_dev = si_dev; 3650 for (j = 0; j < IPMI_MAX_CHANNELS; j++) { 3651 intf->addrinfo[j].address = IPMI_BMC_SLAVE_ADDR; 3652 intf->addrinfo[j].lun = 2; 3653 } 3654 if (slave_addr != 0) 3655 intf->addrinfo[0].address = slave_addr; 3656 INIT_LIST_HEAD(&intf->user_msgs); 3657 mutex_init(&intf->user_msgs_mutex); 3658 INIT_LIST_HEAD(&intf->users); 3659 mutex_init(&intf->users_mutex); 3660 atomic_set(&intf->nr_users, 0); 3661 intf->handlers = handlers; 3662 intf->send_info = send_info; 3663 mutex_init(&intf->seq_lock); 3664 for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) { 3665 intf->seq_table[j].inuse = 0; 3666 intf->seq_table[j].seqid = 0; 3667 } 3668 intf->curr_seq = 0; 3669 spin_lock_init(&intf->waiting_rcv_msgs_lock); 3670 INIT_LIST_HEAD(&intf->waiting_rcv_msgs); 3671 INIT_WORK(&intf->smi_work, smi_work); 3672 atomic_set(&intf->watchdog_pretimeouts_to_deliver, 0); 3673 spin_lock_init(&intf->xmit_msgs_lock); 3674 INIT_LIST_HEAD(&intf->xmit_msgs); 3675 INIT_LIST_HEAD(&intf->hp_xmit_msgs); 3676 mutex_init(&intf->events_mutex); 3677 spin_lock_init(&intf->watch_lock); 3678 atomic_set(&intf->event_waiters, 0); 3679 intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME; 3680 INIT_LIST_HEAD(&intf->waiting_events); 3681 intf->waiting_events_count = 0; 3682 mutex_init(&intf->cmd_rcvrs_mutex); 3683 spin_lock_init(&intf->maintenance_mode_lock); 3684 INIT_LIST_HEAD(&intf->cmd_rcvrs); 3685 init_waitqueue_head(&intf->waitq); 3686 for (i = 0; i < IPMI_NUM_STATS; i++) 3687 atomic_set(&intf->stats[i], 0); 3688 3689 /* 3690 * Grab the watchers mutex so we can deliver the new interface 3691 * without races. 3692 */ 3693 mutex_lock(&smi_watchers_mutex); 3694 mutex_lock(&ipmi_interfaces_mutex); 3695 /* Look for a hole in the numbers. */ 3696 i = 0; 3697 link = &ipmi_interfaces; 3698 list_for_each_entry(tintf, &ipmi_interfaces, link) { 3699 if (tintf->intf_num != i) { 3700 link = &tintf->link; 3701 break; 3702 } 3703 i++; 3704 } 3705 /* Add the new interface in numeric order. */ 3706 if (i == 0) 3707 list_add(&intf->link, &ipmi_interfaces); 3708 else 3709 list_add_tail(&intf->link, link); 3710 3711 rv = handlers->start_processing(send_info, intf); 3712 if (rv) 3713 goto out_err; 3714 3715 rv = __bmc_get_device_id(intf, NULL, &id, NULL, NULL, i); 3716 if (rv) { 3717 dev_err(si_dev, "Unable to get the device id: %d\n", rv); 3718 goto out_err_started; 3719 } 3720 3721 mutex_lock(&intf->bmc_reg_mutex); 3722 rv = __scan_channels(intf, &id, false); 3723 mutex_unlock(&intf->bmc_reg_mutex); 3724 if (rv) 3725 goto out_err_bmc_reg; 3726 3727 intf->nr_users_devattr = dev_attr_nr_users; 3728 sysfs_attr_init(&intf->nr_users_devattr.attr); 3729 rv = device_create_file(intf->si_dev, &intf->nr_users_devattr); 3730 if (rv) 3731 goto out_err_bmc_reg; 3732 3733 intf->nr_msgs_devattr = dev_attr_nr_msgs; 3734 sysfs_attr_init(&intf->nr_msgs_devattr.attr); 3735 rv = device_create_file(intf->si_dev, &intf->nr_msgs_devattr); 3736 if (rv) { 3737 device_remove_file(intf->si_dev, &intf->nr_users_devattr); 3738 goto out_err_bmc_reg; 3739 } 3740 3741 intf->maintenance_mode_devattr = dev_attr_maintenance_mode; 3742 sysfs_attr_init(&intf->maintenance_mode_devattr.attr); 3743 rv = device_create_file(intf->si_dev, &intf->maintenance_mode_devattr); 3744 if (rv) { 3745 device_remove_file(intf->si_dev, &intf->nr_msgs_devattr); 3746 device_remove_file(intf->si_dev, &intf->nr_users_devattr); 3747 goto out_err_bmc_reg; 3748 } 3749 3750 intf->intf_num = i; 3751 mutex_unlock(&ipmi_interfaces_mutex); 3752 3753 /* After this point the interface is legal to use. */ 3754 call_smi_watchers(i, intf->si_dev); 3755 3756 mutex_unlock(&smi_watchers_mutex); 3757 3758 return 0; 3759 3760 out_err_bmc_reg: 3761 ipmi_bmc_unregister(intf); 3762 out_err_started: 3763 intf->in_shutdown = true; 3764 if (intf->handlers->shutdown) 3765 intf->handlers->shutdown(intf->send_info); 3766 out_err: 3767 list_del(&intf->link); 3768 mutex_unlock(&ipmi_interfaces_mutex); 3769 mutex_unlock(&smi_watchers_mutex); 3770 cancel_work_sync(&intf->smi_work); 3771 kref_put(&intf->refcount, intf_free); 3772 3773 return rv; 3774 } 3775 EXPORT_SYMBOL(ipmi_add_smi); 3776 3777 static void deliver_smi_err_response(struct ipmi_smi *intf, 3778 struct ipmi_smi_msg *msg, 3779 unsigned char err) 3780 { 3781 int rv; 3782 msg->rsp[0] = msg->data[0] | 4; 3783 msg->rsp[1] = msg->data[1]; 3784 msg->rsp[2] = err; 3785 msg->rsp_size = 3; 3786 3787 /* This will never requeue, but it may ask us to free the message. */ 3788 rv = handle_one_recv_msg(intf, msg); 3789 if (rv == 0) 3790 ipmi_free_smi_msg(msg); 3791 } 3792 3793 static void cleanup_smi_msgs(struct ipmi_smi *intf) 3794 { 3795 int i; 3796 struct seq_table *ent; 3797 struct ipmi_smi_msg *msg; 3798 struct list_head *entry; 3799 LIST_HEAD(tmplist); 3800 3801 /* Clear out our transmit queues and hold the messages. */ 3802 list_splice_tail(&intf->hp_xmit_msgs, &tmplist); 3803 list_splice_tail(&intf->xmit_msgs, &tmplist); 3804 3805 /* Current message first, to preserve order */ 3806 while (intf->curr_msg && !list_empty(&intf->waiting_rcv_msgs)) { 3807 /* Wait for the message to clear out. */ 3808 schedule_timeout(1); 3809 } 3810 3811 /* No need for locks, the interface is down. */ 3812 3813 /* 3814 * Return errors for all pending messages in queue and in the 3815 * tables waiting for remote responses. 3816 */ 3817 while (!list_empty(&tmplist)) { 3818 entry = tmplist.next; 3819 list_del(entry); 3820 msg = list_entry(entry, struct ipmi_smi_msg, link); 3821 deliver_smi_err_response(intf, msg, IPMI_ERR_UNSPECIFIED); 3822 } 3823 3824 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) { 3825 ent = &intf->seq_table[i]; 3826 if (!ent->inuse) 3827 continue; 3828 deliver_err_response(intf, ent->recv_msg, IPMI_ERR_UNSPECIFIED); 3829 } 3830 } 3831 3832 void ipmi_unregister_smi(struct ipmi_smi *intf) 3833 { 3834 struct ipmi_smi_watcher *w; 3835 int intf_num; 3836 3837 if (!intf) 3838 return; 3839 3840 intf_num = intf->intf_num; 3841 mutex_lock(&ipmi_interfaces_mutex); 3842 cancel_work_sync(&intf->smi_work); 3843 /* smi_work() can no longer be in progress after this. */ 3844 3845 intf->intf_num = -1; 3846 intf->in_shutdown = true; 3847 list_del(&intf->link); 3848 mutex_unlock(&ipmi_interfaces_mutex); 3849 3850 /* 3851 * At this point no users can be added to the interface and no 3852 * new messages can be sent. 3853 */ 3854 3855 if (intf->handlers->shutdown) 3856 intf->handlers->shutdown(intf->send_info); 3857 3858 device_remove_file(intf->si_dev, &intf->maintenance_mode_devattr); 3859 device_remove_file(intf->si_dev, &intf->nr_msgs_devattr); 3860 device_remove_file(intf->si_dev, &intf->nr_users_devattr); 3861 3862 /* 3863 * Call all the watcher interfaces to tell them that 3864 * an interface is going away. 3865 */ 3866 mutex_lock(&smi_watchers_mutex); 3867 list_for_each_entry(w, &smi_watchers, link) 3868 w->smi_gone(intf_num); 3869 mutex_unlock(&smi_watchers_mutex); 3870 3871 mutex_lock(&intf->users_mutex); 3872 while (!list_empty(&intf->users)) { 3873 struct ipmi_user *user = list_first_entry(&intf->users, 3874 struct ipmi_user, link); 3875 3876 _ipmi_destroy_user(user); 3877 } 3878 mutex_unlock(&intf->users_mutex); 3879 3880 cleanup_smi_msgs(intf); 3881 3882 ipmi_bmc_unregister(intf); 3883 3884 kref_put(&intf->refcount, intf_free); 3885 } 3886 EXPORT_SYMBOL(ipmi_unregister_smi); 3887 3888 static int handle_ipmb_get_msg_rsp(struct ipmi_smi *intf, 3889 struct ipmi_smi_msg *msg) 3890 { 3891 struct ipmi_ipmb_addr ipmb_addr; 3892 struct ipmi_recv_msg *recv_msg; 3893 3894 /* 3895 * This is 11, not 10, because the response must contain a 3896 * completion code. 3897 */ 3898 if (msg->rsp_size < 11) { 3899 /* Message not big enough, just ignore it. */ 3900 ipmi_inc_stat(intf, invalid_ipmb_responses); 3901 return 0; 3902 } 3903 3904 if (msg->rsp[2] != 0) { 3905 /* An error getting the response, just ignore it. */ 3906 return 0; 3907 } 3908 3909 ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE; 3910 ipmb_addr.slave_addr = msg->rsp[6]; 3911 ipmb_addr.channel = msg->rsp[3] & 0x0f; 3912 ipmb_addr.lun = msg->rsp[7] & 3; 3913 3914 /* 3915 * It's a response from a remote entity. Look up the sequence 3916 * number and handle the response. 3917 */ 3918 if (intf_find_seq(intf, 3919 msg->rsp[7] >> 2, 3920 msg->rsp[3] & 0x0f, 3921 msg->rsp[8], 3922 (msg->rsp[4] >> 2) & (~1), 3923 (struct ipmi_addr *) &ipmb_addr, 3924 &recv_msg)) { 3925 /* 3926 * We were unable to find the sequence number, 3927 * so just nuke the message. 3928 */ 3929 ipmi_inc_stat(intf, unhandled_ipmb_responses); 3930 return 0; 3931 } 3932 3933 memcpy(recv_msg->msg_data, &msg->rsp[9], msg->rsp_size - 9); 3934 /* 3935 * The other fields matched, so no need to set them, except 3936 * for netfn, which needs to be the response that was 3937 * returned, not the request value. 3938 */ 3939 recv_msg->msg.netfn = msg->rsp[4] >> 2; 3940 recv_msg->msg.data = recv_msg->msg_data; 3941 recv_msg->msg.data_len = msg->rsp_size - 10; 3942 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 3943 if (deliver_response(intf, recv_msg)) 3944 ipmi_inc_stat(intf, unhandled_ipmb_responses); 3945 else 3946 ipmi_inc_stat(intf, handled_ipmb_responses); 3947 3948 return 0; 3949 } 3950 3951 static int handle_ipmb_get_msg_cmd(struct ipmi_smi *intf, 3952 struct ipmi_smi_msg *msg) 3953 { 3954 struct cmd_rcvr *rcvr; 3955 int rv = 0; 3956 unsigned char netfn; 3957 unsigned char cmd; 3958 unsigned char chan; 3959 struct ipmi_user *user = NULL; 3960 struct ipmi_ipmb_addr *ipmb_addr; 3961 struct ipmi_recv_msg *recv_msg = NULL; 3962 3963 if (msg->rsp_size < 10) { 3964 /* Message not big enough, just ignore it. */ 3965 ipmi_inc_stat(intf, invalid_commands); 3966 return 0; 3967 } 3968 3969 if (msg->rsp[2] != 0) { 3970 /* An error getting the response, just ignore it. */ 3971 return 0; 3972 } 3973 3974 netfn = msg->rsp[4] >> 2; 3975 cmd = msg->rsp[8]; 3976 chan = msg->rsp[3] & 0xf; 3977 3978 rcu_read_lock(); 3979 rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); 3980 if (rcvr) { 3981 user = rcvr->user; 3982 recv_msg = ipmi_alloc_recv_msg(user); 3983 } 3984 rcu_read_unlock(); 3985 3986 if (user == NULL) { 3987 /* We didn't find a user, deliver an error response. */ 3988 ipmi_inc_stat(intf, unhandled_commands); 3989 3990 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); 3991 msg->data[1] = IPMI_SEND_MSG_CMD; 3992 msg->data[2] = msg->rsp[3]; 3993 msg->data[3] = msg->rsp[6]; 3994 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3); 3995 msg->data[5] = ipmb_checksum(&msg->data[3], 2); 3996 msg->data[6] = intf->addrinfo[msg->rsp[3] & 0xf].address; 3997 /* rqseq/lun */ 3998 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3); 3999 msg->data[8] = msg->rsp[8]; /* cmd */ 4000 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE; 4001 msg->data[10] = ipmb_checksum(&msg->data[6], 4); 4002 msg->data_size = 11; 4003 4004 dev_dbg(intf->si_dev, "Invalid command: %*ph\n", 4005 msg->data_size, msg->data); 4006 4007 if (smi_send(intf, intf->handlers, msg, 0) == IPMI_CC_NO_ERROR) 4008 /* 4009 * We used the message, so return the value that 4010 * causes it to not be freed or queued. 4011 */ 4012 rv = -1; 4013 } else if (!IS_ERR(recv_msg)) { 4014 /* Extract the source address from the data. */ 4015 ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr; 4016 ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE; 4017 ipmb_addr->slave_addr = msg->rsp[6]; 4018 ipmb_addr->lun = msg->rsp[7] & 3; 4019 ipmb_addr->channel = msg->rsp[3] & 0xf; 4020 4021 /* 4022 * Extract the rest of the message information 4023 * from the IPMB header. 4024 */ 4025 recv_msg->recv_type = IPMI_CMD_RECV_TYPE; 4026 recv_msg->msgid = msg->rsp[7] >> 2; 4027 recv_msg->msg.netfn = msg->rsp[4] >> 2; 4028 recv_msg->msg.cmd = msg->rsp[8]; 4029 recv_msg->msg.data = recv_msg->msg_data; 4030 4031 /* 4032 * We chop off 10, not 9 bytes because the checksum 4033 * at the end also needs to be removed. 4034 */ 4035 recv_msg->msg.data_len = msg->rsp_size - 10; 4036 memcpy(recv_msg->msg_data, &msg->rsp[9], 4037 msg->rsp_size - 10); 4038 if (deliver_response(intf, recv_msg)) 4039 ipmi_inc_stat(intf, unhandled_commands); 4040 else 4041 ipmi_inc_stat(intf, handled_commands); 4042 } else { 4043 /* 4044 * We couldn't allocate memory for the message, so 4045 * requeue it for handling later. 4046 */ 4047 rv = 1; 4048 } 4049 4050 return rv; 4051 } 4052 4053 static int handle_ipmb_direct_rcv_cmd(struct ipmi_smi *intf, 4054 struct ipmi_smi_msg *msg) 4055 { 4056 struct cmd_rcvr *rcvr; 4057 int rv = 0; 4058 struct ipmi_user *user = NULL; 4059 struct ipmi_ipmb_direct_addr *daddr; 4060 struct ipmi_recv_msg *recv_msg = NULL; 4061 unsigned char netfn = msg->rsp[0] >> 2; 4062 unsigned char cmd = msg->rsp[3]; 4063 4064 rcu_read_lock(); 4065 /* We always use channel 0 for direct messages. */ 4066 rcvr = find_cmd_rcvr(intf, netfn, cmd, 0); 4067 if (rcvr) { 4068 user = rcvr->user; 4069 recv_msg = ipmi_alloc_recv_msg(user); 4070 } 4071 rcu_read_unlock(); 4072 4073 if (user == NULL) { 4074 /* We didn't find a user, deliver an error response. */ 4075 ipmi_inc_stat(intf, unhandled_commands); 4076 4077 msg->data[0] = (netfn + 1) << 2; 4078 msg->data[0] |= msg->rsp[2] & 0x3; /* rqLUN */ 4079 msg->data[1] = msg->rsp[1]; /* Addr */ 4080 msg->data[2] = msg->rsp[2] & ~0x3; /* rqSeq */ 4081 msg->data[2] |= msg->rsp[0] & 0x3; /* rsLUN */ 4082 msg->data[3] = cmd; 4083 msg->data[4] = IPMI_INVALID_CMD_COMPLETION_CODE; 4084 msg->data_size = 5; 4085 4086 if (smi_send(intf, intf->handlers, msg, 0) == IPMI_CC_NO_ERROR) 4087 /* 4088 * We used the message, so return the value that 4089 * causes it to not be freed or queued. 4090 */ 4091 rv = -1; 4092 } else if (!IS_ERR(recv_msg)) { 4093 /* Extract the source address from the data. */ 4094 daddr = (struct ipmi_ipmb_direct_addr *)&recv_msg->addr; 4095 daddr->addr_type = IPMI_IPMB_DIRECT_ADDR_TYPE; 4096 daddr->channel = 0; 4097 daddr->slave_addr = msg->rsp[1]; 4098 daddr->rs_lun = msg->rsp[0] & 3; 4099 daddr->rq_lun = msg->rsp[2] & 3; 4100 4101 /* 4102 * Extract the rest of the message information 4103 * from the IPMB header. 4104 */ 4105 recv_msg->recv_type = IPMI_CMD_RECV_TYPE; 4106 recv_msg->msgid = (msg->rsp[2] >> 2); 4107 recv_msg->msg.netfn = msg->rsp[0] >> 2; 4108 recv_msg->msg.cmd = msg->rsp[3]; 4109 recv_msg->msg.data = recv_msg->msg_data; 4110 4111 recv_msg->msg.data_len = msg->rsp_size - 4; 4112 memcpy(recv_msg->msg_data, msg->rsp + 4, 4113 msg->rsp_size - 4); 4114 if (deliver_response(intf, recv_msg)) 4115 ipmi_inc_stat(intf, unhandled_commands); 4116 else 4117 ipmi_inc_stat(intf, handled_commands); 4118 } else { 4119 /* 4120 * We couldn't allocate memory for the message, so 4121 * requeue it for handling later. 4122 */ 4123 rv = 1; 4124 } 4125 4126 return rv; 4127 } 4128 4129 static int handle_ipmb_direct_rcv_rsp(struct ipmi_smi *intf, 4130 struct ipmi_smi_msg *msg) 4131 { 4132 struct ipmi_recv_msg *recv_msg; 4133 struct ipmi_ipmb_direct_addr *daddr; 4134 4135 recv_msg = msg->recv_msg; 4136 if (recv_msg == NULL) { 4137 dev_warn(intf->si_dev, 4138 "IPMI direct message received with no owner. This could be because of a malformed message, or because of a hardware error. Contact your hardware vendor for assistance.\n"); 4139 return 0; 4140 } 4141 4142 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 4143 recv_msg->msgid = msg->msgid; 4144 daddr = (struct ipmi_ipmb_direct_addr *) &recv_msg->addr; 4145 daddr->addr_type = IPMI_IPMB_DIRECT_ADDR_TYPE; 4146 daddr->channel = 0; 4147 daddr->slave_addr = msg->rsp[1]; 4148 daddr->rq_lun = msg->rsp[0] & 3; 4149 daddr->rs_lun = msg->rsp[2] & 3; 4150 recv_msg->msg.netfn = msg->rsp[0] >> 2; 4151 recv_msg->msg.cmd = msg->rsp[3]; 4152 memcpy(recv_msg->msg_data, &msg->rsp[4], msg->rsp_size - 4); 4153 recv_msg->msg.data = recv_msg->msg_data; 4154 recv_msg->msg.data_len = msg->rsp_size - 4; 4155 deliver_local_response(intf, recv_msg); 4156 4157 return 0; 4158 } 4159 4160 static int handle_lan_get_msg_rsp(struct ipmi_smi *intf, 4161 struct ipmi_smi_msg *msg) 4162 { 4163 struct ipmi_lan_addr lan_addr; 4164 struct ipmi_recv_msg *recv_msg; 4165 4166 4167 /* 4168 * This is 13, not 12, because the response must contain a 4169 * completion code. 4170 */ 4171 if (msg->rsp_size < 13) { 4172 /* Message not big enough, just ignore it. */ 4173 ipmi_inc_stat(intf, invalid_lan_responses); 4174 return 0; 4175 } 4176 4177 if (msg->rsp[2] != 0) { 4178 /* An error getting the response, just ignore it. */ 4179 return 0; 4180 } 4181 4182 lan_addr.addr_type = IPMI_LAN_ADDR_TYPE; 4183 lan_addr.session_handle = msg->rsp[4]; 4184 lan_addr.remote_SWID = msg->rsp[8]; 4185 lan_addr.local_SWID = msg->rsp[5]; 4186 lan_addr.channel = msg->rsp[3] & 0x0f; 4187 lan_addr.privilege = msg->rsp[3] >> 4; 4188 lan_addr.lun = msg->rsp[9] & 3; 4189 4190 /* 4191 * It's a response from a remote entity. Look up the sequence 4192 * number and handle the response. 4193 */ 4194 if (intf_find_seq(intf, 4195 msg->rsp[9] >> 2, 4196 msg->rsp[3] & 0x0f, 4197 msg->rsp[10], 4198 (msg->rsp[6] >> 2) & (~1), 4199 (struct ipmi_addr *) &lan_addr, 4200 &recv_msg)) { 4201 /* 4202 * We were unable to find the sequence number, 4203 * so just nuke the message. 4204 */ 4205 ipmi_inc_stat(intf, unhandled_lan_responses); 4206 return 0; 4207 } 4208 4209 memcpy(recv_msg->msg_data, &msg->rsp[11], msg->rsp_size - 11); 4210 /* 4211 * The other fields matched, so no need to set them, except 4212 * for netfn, which needs to be the response that was 4213 * returned, not the request value. 4214 */ 4215 recv_msg->msg.netfn = msg->rsp[6] >> 2; 4216 recv_msg->msg.data = recv_msg->msg_data; 4217 recv_msg->msg.data_len = msg->rsp_size - 12; 4218 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 4219 if (deliver_response(intf, recv_msg)) 4220 ipmi_inc_stat(intf, unhandled_lan_responses); 4221 else 4222 ipmi_inc_stat(intf, handled_lan_responses); 4223 4224 return 0; 4225 } 4226 4227 static int handle_lan_get_msg_cmd(struct ipmi_smi *intf, 4228 struct ipmi_smi_msg *msg) 4229 { 4230 struct cmd_rcvr *rcvr; 4231 int rv = 0; /* Free by default */ 4232 unsigned char netfn; 4233 unsigned char cmd; 4234 unsigned char chan; 4235 struct ipmi_user *user = NULL; 4236 struct ipmi_lan_addr *lan_addr; 4237 struct ipmi_recv_msg *recv_msg = NULL; 4238 4239 if (msg->rsp_size < 12) { 4240 /* Message not big enough, just ignore it. */ 4241 ipmi_inc_stat(intf, invalid_commands); 4242 return 0; 4243 } 4244 4245 if (msg->rsp[2] != 0) { 4246 /* An error getting the response, just ignore it. */ 4247 return 0; 4248 } 4249 4250 netfn = msg->rsp[6] >> 2; 4251 cmd = msg->rsp[10]; 4252 chan = msg->rsp[3] & 0xf; 4253 4254 rcu_read_lock(); 4255 rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); 4256 if (rcvr) { 4257 user = rcvr->user; 4258 recv_msg = ipmi_alloc_recv_msg(user); 4259 } 4260 rcu_read_unlock(); 4261 4262 if (user == NULL) { 4263 /* We didn't find a user, just give up and return an error. */ 4264 ipmi_inc_stat(intf, unhandled_commands); 4265 4266 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); 4267 msg->data[1] = IPMI_SEND_MSG_CMD; 4268 msg->data[2] = chan; 4269 msg->data[3] = msg->rsp[4]; /* handle */ 4270 msg->data[4] = msg->rsp[8]; /* rsSWID */ 4271 msg->data[5] = ((netfn + 1) << 2) | (msg->rsp[9] & 0x3); 4272 msg->data[6] = ipmb_checksum(&msg->data[3], 3); 4273 msg->data[7] = msg->rsp[5]; /* rqSWID */ 4274 /* rqseq/lun */ 4275 msg->data[8] = (msg->rsp[9] & 0xfc) | (msg->rsp[6] & 0x3); 4276 msg->data[9] = cmd; 4277 msg->data[10] = IPMI_INVALID_CMD_COMPLETION_CODE; 4278 msg->data[11] = ipmb_checksum(&msg->data[7], 4); 4279 msg->data_size = 12; 4280 4281 dev_dbg(intf->si_dev, "Invalid command: %*ph\n", 4282 msg->data_size, msg->data); 4283 4284 if (smi_send(intf, intf->handlers, msg, 0) == IPMI_CC_NO_ERROR) 4285 /* 4286 * We used the message, so return the value that 4287 * causes it to not be freed or queued. 4288 */ 4289 rv = -1; 4290 } else if (!IS_ERR(recv_msg)) { 4291 /* Extract the source address from the data. */ 4292 lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr; 4293 lan_addr->addr_type = IPMI_LAN_ADDR_TYPE; 4294 lan_addr->session_handle = msg->rsp[4]; 4295 lan_addr->remote_SWID = msg->rsp[8]; 4296 lan_addr->local_SWID = msg->rsp[5]; 4297 lan_addr->lun = msg->rsp[9] & 3; 4298 lan_addr->channel = msg->rsp[3] & 0xf; 4299 lan_addr->privilege = msg->rsp[3] >> 4; 4300 4301 /* 4302 * Extract the rest of the message information 4303 * from the IPMB header. 4304 */ 4305 recv_msg->recv_type = IPMI_CMD_RECV_TYPE; 4306 recv_msg->msgid = msg->rsp[9] >> 2; 4307 recv_msg->msg.netfn = msg->rsp[6] >> 2; 4308 recv_msg->msg.cmd = msg->rsp[10]; 4309 recv_msg->msg.data = recv_msg->msg_data; 4310 4311 /* 4312 * We chop off 12, not 11 bytes because the checksum 4313 * at the end also needs to be removed. 4314 */ 4315 recv_msg->msg.data_len = msg->rsp_size - 12; 4316 memcpy(recv_msg->msg_data, &msg->rsp[11], 4317 msg->rsp_size - 12); 4318 if (deliver_response(intf, recv_msg)) 4319 ipmi_inc_stat(intf, unhandled_commands); 4320 else 4321 ipmi_inc_stat(intf, handled_commands); 4322 } else { 4323 /* 4324 * We couldn't allocate memory for the message, so 4325 * requeue it for handling later. 4326 */ 4327 rv = 1; 4328 } 4329 4330 return rv; 4331 } 4332 4333 /* 4334 * This routine will handle "Get Message" command responses with 4335 * channels that use an OEM Medium. The message format belongs to 4336 * the OEM. See IPMI 2.0 specification, Chapter 6 and 4337 * Chapter 22, sections 22.6 and 22.24 for more details. 4338 */ 4339 static int handle_oem_get_msg_cmd(struct ipmi_smi *intf, 4340 struct ipmi_smi_msg *msg) 4341 { 4342 struct cmd_rcvr *rcvr; 4343 int rv = 0; 4344 unsigned char netfn; 4345 unsigned char cmd; 4346 unsigned char chan; 4347 struct ipmi_user *user = NULL; 4348 struct ipmi_system_interface_addr *smi_addr; 4349 struct ipmi_recv_msg *recv_msg = NULL; 4350 4351 /* 4352 * We expect the OEM SW to perform error checking 4353 * so we just do some basic sanity checks 4354 */ 4355 if (msg->rsp_size < 4) { 4356 /* Message not big enough, just ignore it. */ 4357 ipmi_inc_stat(intf, invalid_commands); 4358 return 0; 4359 } 4360 4361 if (msg->rsp[2] != 0) { 4362 /* An error getting the response, just ignore it. */ 4363 return 0; 4364 } 4365 4366 /* 4367 * This is an OEM Message so the OEM needs to know how 4368 * handle the message. We do no interpretation. 4369 */ 4370 netfn = msg->rsp[0] >> 2; 4371 cmd = msg->rsp[1]; 4372 chan = msg->rsp[3] & 0xf; 4373 4374 rcu_read_lock(); 4375 rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); 4376 if (rcvr) { 4377 user = rcvr->user; 4378 recv_msg = ipmi_alloc_recv_msg(user); 4379 } 4380 rcu_read_unlock(); 4381 4382 if (user == NULL) { 4383 /* We didn't find a user, just give up. */ 4384 ipmi_inc_stat(intf, unhandled_commands); 4385 4386 /* 4387 * Don't do anything with these messages, just allow 4388 * them to be freed. 4389 */ 4390 4391 rv = 0; 4392 } else if (!IS_ERR(recv_msg)) { 4393 /* 4394 * OEM Messages are expected to be delivered via 4395 * the system interface to SMS software. We might 4396 * need to visit this again depending on OEM 4397 * requirements 4398 */ 4399 smi_addr = ((struct ipmi_system_interface_addr *) 4400 &recv_msg->addr); 4401 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 4402 smi_addr->channel = IPMI_BMC_CHANNEL; 4403 smi_addr->lun = msg->rsp[0] & 3; 4404 4405 recv_msg->user_msg_data = NULL; 4406 recv_msg->recv_type = IPMI_OEM_RECV_TYPE; 4407 recv_msg->msg.netfn = msg->rsp[0] >> 2; 4408 recv_msg->msg.cmd = msg->rsp[1]; 4409 recv_msg->msg.data = recv_msg->msg_data; 4410 4411 /* 4412 * The message starts at byte 4 which follows the 4413 * Channel Byte in the "GET MESSAGE" command 4414 */ 4415 recv_msg->msg.data_len = msg->rsp_size - 4; 4416 memcpy(recv_msg->msg_data, &msg->rsp[4], 4417 msg->rsp_size - 4); 4418 if (deliver_response(intf, recv_msg)) 4419 ipmi_inc_stat(intf, unhandled_commands); 4420 else 4421 ipmi_inc_stat(intf, handled_commands); 4422 } else { 4423 /* 4424 * We couldn't allocate memory for the message, so 4425 * requeue it for handling later. 4426 */ 4427 rv = 1; 4428 } 4429 4430 return rv; 4431 } 4432 4433 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg, 4434 struct ipmi_smi_msg *msg) 4435 { 4436 struct ipmi_system_interface_addr *smi_addr; 4437 4438 recv_msg->msgid = 0; 4439 smi_addr = (struct ipmi_system_interface_addr *) &recv_msg->addr; 4440 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 4441 smi_addr->channel = IPMI_BMC_CHANNEL; 4442 smi_addr->lun = msg->rsp[0] & 3; 4443 recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE; 4444 recv_msg->msg.netfn = msg->rsp[0] >> 2; 4445 recv_msg->msg.cmd = msg->rsp[1]; 4446 memcpy(recv_msg->msg_data, &msg->rsp[3], msg->rsp_size - 3); 4447 recv_msg->msg.data = recv_msg->msg_data; 4448 recv_msg->msg.data_len = msg->rsp_size - 3; 4449 } 4450 4451 static int handle_read_event_rsp(struct ipmi_smi *intf, 4452 struct ipmi_smi_msg *msg) 4453 { 4454 struct ipmi_recv_msg *recv_msg, *recv_msg2; 4455 LIST_HEAD(msgs); 4456 struct ipmi_user *user; 4457 int rv = 0, deliver_count = 0; 4458 4459 if (msg->rsp_size < 19) { 4460 /* Message is too small to be an IPMB event. */ 4461 ipmi_inc_stat(intf, invalid_events); 4462 return 0; 4463 } 4464 4465 if (msg->rsp[2] != 0) { 4466 /* An error getting the event, just ignore it. */ 4467 return 0; 4468 } 4469 4470 mutex_lock(&intf->events_mutex); 4471 4472 ipmi_inc_stat(intf, events); 4473 4474 /* 4475 * Allocate and fill in one message for every user that is 4476 * getting events. 4477 */ 4478 mutex_lock(&intf->users_mutex); 4479 list_for_each_entry(user, &intf->users, link) { 4480 if (!user->gets_events) 4481 continue; 4482 4483 recv_msg = ipmi_alloc_recv_msg(user); 4484 if (IS_ERR(recv_msg)) { 4485 mutex_unlock(&intf->users_mutex); 4486 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, 4487 link) { 4488 list_del(&recv_msg->link); 4489 ipmi_free_recv_msg(recv_msg); 4490 } 4491 /* 4492 * We couldn't allocate memory for the 4493 * message, so requeue it for handling 4494 * later. 4495 */ 4496 rv = 1; 4497 goto out; 4498 } 4499 4500 deliver_count++; 4501 4502 copy_event_into_recv_msg(recv_msg, msg); 4503 list_add_tail(&recv_msg->link, &msgs); 4504 } 4505 mutex_unlock(&intf->users_mutex); 4506 4507 if (deliver_count) { 4508 /* Now deliver all the messages. */ 4509 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) { 4510 list_del(&recv_msg->link); 4511 deliver_local_response(intf, recv_msg); 4512 } 4513 } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) { 4514 /* 4515 * No one to receive the message, put it in queue if there's 4516 * not already too many things in the queue. 4517 */ 4518 recv_msg = ipmi_alloc_recv_msg(NULL); 4519 if (IS_ERR(recv_msg)) { 4520 /* 4521 * We couldn't allocate memory for the 4522 * message, so requeue it for handling 4523 * later. 4524 */ 4525 rv = 1; 4526 goto out; 4527 } 4528 4529 copy_event_into_recv_msg(recv_msg, msg); 4530 list_add_tail(&recv_msg->link, &intf->waiting_events); 4531 intf->waiting_events_count++; 4532 } else if (!intf->event_msg_printed) { 4533 /* 4534 * There's too many things in the queue, discard this 4535 * message. 4536 */ 4537 dev_warn(intf->si_dev, 4538 "Event queue full, discarding incoming events\n"); 4539 intf->event_msg_printed = 1; 4540 } 4541 4542 out: 4543 mutex_unlock(&intf->events_mutex); 4544 4545 return rv; 4546 } 4547 4548 static int handle_bmc_rsp(struct ipmi_smi *intf, 4549 struct ipmi_smi_msg *msg) 4550 { 4551 struct ipmi_recv_msg *recv_msg; 4552 struct ipmi_system_interface_addr *smi_addr; 4553 4554 recv_msg = msg->recv_msg; 4555 if (recv_msg == NULL) { 4556 dev_warn(intf->si_dev, 4557 "IPMI SMI message received with no owner. This could be because of a malformed message, or because of a hardware error. Contact your hardware vendor for assistance.\n"); 4558 return 0; 4559 } 4560 4561 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE; 4562 recv_msg->msgid = msg->msgid; 4563 smi_addr = ((struct ipmi_system_interface_addr *) 4564 &recv_msg->addr); 4565 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 4566 smi_addr->channel = IPMI_BMC_CHANNEL; 4567 smi_addr->lun = msg->rsp[0] & 3; 4568 recv_msg->msg.netfn = msg->rsp[0] >> 2; 4569 recv_msg->msg.cmd = msg->rsp[1]; 4570 memcpy(recv_msg->msg_data, &msg->rsp[2], msg->rsp_size - 2); 4571 recv_msg->msg.data = recv_msg->msg_data; 4572 recv_msg->msg.data_len = msg->rsp_size - 2; 4573 deliver_local_response(intf, recv_msg); 4574 4575 return 0; 4576 } 4577 4578 /* 4579 * Handle a received message. Return 1 if the message should be requeued, 4580 * 0 if the message should be freed, or -1 if the message should not 4581 * be freed or requeued. 4582 */ 4583 static int handle_one_recv_msg(struct ipmi_smi *intf, 4584 struct ipmi_smi_msg *msg) 4585 { 4586 int requeue = 0; 4587 int chan; 4588 unsigned char cc; 4589 bool is_cmd = !((msg->rsp[0] >> 2) & 1); 4590 4591 dev_dbg(intf->si_dev, "Recv: %*ph\n", msg->rsp_size, msg->rsp); 4592 4593 if (msg->rsp_size < 2) { 4594 /* Message is too small to be correct. */ 4595 dev_warn_ratelimited(intf->si_dev, 4596 "BMC returned too small a message for netfn %x cmd %x, got %d bytes\n", 4597 (msg->data[0] >> 2) | 1, 4598 msg->data[1], msg->rsp_size); 4599 4600 return_unspecified: 4601 /* Generate an error response for the message. */ 4602 msg->rsp[0] = msg->data[0] | (1 << 2); 4603 msg->rsp[1] = msg->data[1]; 4604 msg->rsp[2] = IPMI_ERR_UNSPECIFIED; 4605 msg->rsp_size = 3; 4606 } else if (msg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) { 4607 /* commands must have at least 4 bytes, responses 5. */ 4608 if (is_cmd && (msg->rsp_size < 4)) { 4609 ipmi_inc_stat(intf, invalid_commands); 4610 goto out; 4611 } 4612 if (!is_cmd && (msg->rsp_size < 5)) { 4613 ipmi_inc_stat(intf, invalid_ipmb_responses); 4614 /* Construct a valid error response. */ 4615 msg->rsp[0] = msg->data[0] & 0xfc; /* NetFN */ 4616 msg->rsp[0] |= (1 << 2); /* Make it a response */ 4617 msg->rsp[0] |= msg->data[2] & 3; /* rqLUN */ 4618 msg->rsp[1] = msg->data[1]; /* Addr */ 4619 msg->rsp[2] = msg->data[2] & 0xfc; /* rqSeq */ 4620 msg->rsp[2] |= msg->data[0] & 0x3; /* rsLUN */ 4621 msg->rsp[3] = msg->data[3]; /* Cmd */ 4622 msg->rsp[4] = IPMI_ERR_UNSPECIFIED; 4623 msg->rsp_size = 5; 4624 } 4625 } else if ((msg->data_size >= 2) 4626 && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2)) 4627 && (msg->data[1] == IPMI_SEND_MSG_CMD) 4628 && (msg->recv_msg == NULL)) { 4629 4630 if (intf->in_shutdown || intf->run_to_completion) 4631 goto out; 4632 4633 /* 4634 * This is the local response to a command send, start 4635 * the timer for these. The recv_msg will not be 4636 * NULL if this is a response send, and we will let 4637 * response sends just go through. 4638 */ 4639 4640 /* 4641 * Check for errors, if we get certain errors (ones 4642 * that mean basically we can try again later), we 4643 * ignore them and start the timer. Otherwise we 4644 * report the error immediately. 4645 */ 4646 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0) 4647 && (msg->rsp[2] != IPMI_NODE_BUSY_ERR) 4648 && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR) 4649 && (msg->rsp[2] != IPMI_BUS_ERR) 4650 && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) { 4651 int ch = msg->rsp[3] & 0xf; 4652 struct ipmi_channel *chans; 4653 4654 /* Got an error sending the message, handle it. */ 4655 4656 chans = READ_ONCE(intf->channel_list)->c; 4657 if ((chans[ch].medium == IPMI_CHANNEL_MEDIUM_8023LAN) 4658 || (chans[ch].medium == IPMI_CHANNEL_MEDIUM_ASYNC)) 4659 ipmi_inc_stat(intf, sent_lan_command_errs); 4660 else 4661 ipmi_inc_stat(intf, sent_ipmb_command_errs); 4662 intf_err_seq(intf, msg->msgid, msg->rsp[2]); 4663 } else 4664 /* The message was sent, start the timer. */ 4665 intf_start_seq_timer(intf, msg->msgid); 4666 requeue = 0; 4667 goto out; 4668 } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1)) 4669 || (msg->rsp[1] != msg->data[1])) { 4670 /* 4671 * The NetFN and Command in the response is not even 4672 * marginally correct. 4673 */ 4674 dev_warn_ratelimited(intf->si_dev, 4675 "BMC returned incorrect response, expected netfn %x cmd %x, got netfn %x cmd %x\n", 4676 (msg->data[0] >> 2) | 1, msg->data[1], 4677 msg->rsp[0] >> 2, msg->rsp[1]); 4678 4679 goto return_unspecified; 4680 } 4681 4682 if (msg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) { 4683 if ((msg->data[0] >> 2) & 1) { 4684 /* It's a response to a sent response. */ 4685 chan = 0; 4686 cc = msg->rsp[4]; 4687 goto process_response_response; 4688 } 4689 if (is_cmd) 4690 requeue = handle_ipmb_direct_rcv_cmd(intf, msg); 4691 else 4692 requeue = handle_ipmb_direct_rcv_rsp(intf, msg); 4693 } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2)) 4694 && (msg->rsp[1] == IPMI_SEND_MSG_CMD) 4695 && (msg->recv_msg != NULL)) { 4696 /* 4697 * It's a response to a response we sent. For this we 4698 * deliver a send message response to the user. 4699 */ 4700 struct ipmi_recv_msg *recv_msg; 4701 4702 if (intf->run_to_completion) 4703 goto out; 4704 4705 chan = msg->data[2] & 0x0f; 4706 if (chan >= IPMI_MAX_CHANNELS) 4707 /* Invalid channel number */ 4708 goto out; 4709 cc = msg->rsp[2]; 4710 4711 process_response_response: 4712 recv_msg = msg->recv_msg; 4713 4714 requeue = 0; 4715 if (!recv_msg) 4716 goto out; 4717 4718 recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE; 4719 recv_msg->msg.data = recv_msg->msg_data; 4720 recv_msg->msg_data[0] = cc; 4721 recv_msg->msg.data_len = 1; 4722 deliver_local_response(intf, recv_msg); 4723 } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2)) 4724 && (msg->rsp[1] == IPMI_GET_MSG_CMD)) { 4725 struct ipmi_channel *chans; 4726 4727 if (intf->run_to_completion) 4728 goto out; 4729 4730 /* It's from the receive queue. */ 4731 chan = msg->rsp[3] & 0xf; 4732 if (chan >= IPMI_MAX_CHANNELS) { 4733 /* Invalid channel number */ 4734 requeue = 0; 4735 goto out; 4736 } 4737 4738 /* 4739 * We need to make sure the channels have been initialized. 4740 * The channel_handler routine will set the "curr_channel" 4741 * equal to or greater than IPMI_MAX_CHANNELS when all the 4742 * channels for this interface have been initialized. 4743 */ 4744 if (!intf->channels_ready) { 4745 requeue = 0; /* Throw the message away */ 4746 goto out; 4747 } 4748 4749 chans = READ_ONCE(intf->channel_list)->c; 4750 4751 switch (chans[chan].medium) { 4752 case IPMI_CHANNEL_MEDIUM_IPMB: 4753 if (msg->rsp[4] & 0x04) { 4754 /* 4755 * It's a response, so find the 4756 * requesting message and send it up. 4757 */ 4758 requeue = handle_ipmb_get_msg_rsp(intf, msg); 4759 } else { 4760 /* 4761 * It's a command to the SMS from some other 4762 * entity. Handle that. 4763 */ 4764 requeue = handle_ipmb_get_msg_cmd(intf, msg); 4765 } 4766 break; 4767 4768 case IPMI_CHANNEL_MEDIUM_8023LAN: 4769 case IPMI_CHANNEL_MEDIUM_ASYNC: 4770 if (msg->rsp[6] & 0x04) { 4771 /* 4772 * It's a response, so find the 4773 * requesting message and send it up. 4774 */ 4775 requeue = handle_lan_get_msg_rsp(intf, msg); 4776 } else { 4777 /* 4778 * It's a command to the SMS from some other 4779 * entity. Handle that. 4780 */ 4781 requeue = handle_lan_get_msg_cmd(intf, msg); 4782 } 4783 break; 4784 4785 default: 4786 /* Check for OEM Channels. Clients had better 4787 register for these commands. */ 4788 if ((chans[chan].medium >= IPMI_CHANNEL_MEDIUM_OEM_MIN) 4789 && (chans[chan].medium 4790 <= IPMI_CHANNEL_MEDIUM_OEM_MAX)) { 4791 requeue = handle_oem_get_msg_cmd(intf, msg); 4792 } else { 4793 /* 4794 * We don't handle the channel type, so just 4795 * free the message. 4796 */ 4797 requeue = 0; 4798 } 4799 } 4800 4801 } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2)) 4802 && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD)) { 4803 /* It's an asynchronous event. */ 4804 if (intf->run_to_completion) 4805 goto out; 4806 4807 requeue = handle_read_event_rsp(intf, msg); 4808 } else { 4809 /* It's a response from the local BMC. */ 4810 requeue = handle_bmc_rsp(intf, msg); 4811 } 4812 4813 out: 4814 return requeue; 4815 } 4816 4817 /* 4818 * If there are messages in the queue or pretimeouts, handle them. 4819 */ 4820 static void handle_new_recv_msgs(struct ipmi_smi *intf) 4821 { 4822 struct ipmi_smi_msg *smi_msg; 4823 unsigned long flags = 0; 4824 int rv; 4825 int run_to_completion = READ_ONCE(intf->run_to_completion); 4826 4827 /* See if any waiting messages need to be processed. */ 4828 if (!run_to_completion) 4829 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags); 4830 while (!list_empty(&intf->waiting_rcv_msgs)) { 4831 smi_msg = list_entry(intf->waiting_rcv_msgs.next, 4832 struct ipmi_smi_msg, link); 4833 list_del(&smi_msg->link); 4834 if (!run_to_completion) 4835 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, 4836 flags); 4837 rv = handle_one_recv_msg(intf, smi_msg); 4838 if (!run_to_completion) 4839 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags); 4840 if (rv > 0) { 4841 /* 4842 * To preserve message order, quit if we 4843 * can't handle a message. Add the message 4844 * back at the head, this is safe because this 4845 * workqueue is the only thing that pulls the 4846 * messages. 4847 */ 4848 list_add(&smi_msg->link, &intf->waiting_rcv_msgs); 4849 break; 4850 } else { 4851 if (rv == 0) 4852 /* Message handled */ 4853 ipmi_free_smi_msg(smi_msg); 4854 /* If rv < 0, fatal error, del but don't free. */ 4855 } 4856 } 4857 if (!run_to_completion) 4858 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, flags); 4859 } 4860 4861 static void smi_work(struct work_struct *t) 4862 { 4863 unsigned long flags = 0; /* keep us warning-free. */ 4864 struct ipmi_smi *intf = from_work(intf, t, smi_work); 4865 int run_to_completion = READ_ONCE(intf->run_to_completion); 4866 struct ipmi_smi_msg *newmsg = NULL; 4867 struct ipmi_recv_msg *msg, *msg2; 4868 int cc; 4869 4870 /* 4871 * Start the next message if available. 4872 * 4873 * Do this here, not in the actual receiver, because we may deadlock 4874 * because the lower layer is allowed to hold locks while calling 4875 * message delivery. 4876 */ 4877 restart: 4878 ipmi_lock_xmit_msgs(intf, run_to_completion, &flags); 4879 if (intf->curr_msg == NULL && !intf->in_shutdown) { 4880 struct list_head *entry = NULL; 4881 4882 /* Pick the high priority queue first. */ 4883 if (!list_empty(&intf->hp_xmit_msgs)) 4884 entry = intf->hp_xmit_msgs.next; 4885 else if (!list_empty(&intf->xmit_msgs)) 4886 entry = intf->xmit_msgs.next; 4887 4888 if (entry) { 4889 list_del(entry); 4890 newmsg = list_entry(entry, struct ipmi_smi_msg, link); 4891 intf->curr_msg = newmsg; 4892 } 4893 } 4894 ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags); 4895 4896 if (newmsg) { 4897 cc = intf->handlers->sender(intf->send_info, newmsg); 4898 if (cc) { 4899 if (newmsg->recv_msg) 4900 deliver_err_response(intf, 4901 newmsg->recv_msg, cc); 4902 ipmi_lock_xmit_msgs(intf, run_to_completion, &flags); 4903 intf->curr_msg = NULL; 4904 ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags); 4905 ipmi_free_smi_msg(newmsg); 4906 newmsg = NULL; 4907 goto restart; 4908 } 4909 } 4910 4911 handle_new_recv_msgs(intf); 4912 4913 /* Nothing below applies during panic time. */ 4914 if (run_to_completion) 4915 return; 4916 4917 /* 4918 * If the pretimout count is non-zero, decrement one from it and 4919 * deliver pretimeouts to all the users. 4920 */ 4921 if (atomic_add_unless(&intf->watchdog_pretimeouts_to_deliver, -1, 0)) { 4922 struct ipmi_user *user; 4923 4924 mutex_lock(&intf->users_mutex); 4925 list_for_each_entry(user, &intf->users, link) { 4926 if (user->handler->ipmi_watchdog_pretimeout) 4927 user->handler->ipmi_watchdog_pretimeout( 4928 user->handler_data); 4929 } 4930 mutex_unlock(&intf->users_mutex); 4931 } 4932 4933 /* 4934 * Freeing the message can cause a user to be released, which 4935 * can then cause the interface to be freed. Make sure that 4936 * doesn't happen until we are ready. 4937 */ 4938 kref_get(&intf->refcount); 4939 4940 mutex_lock(&intf->user_msgs_mutex); 4941 list_for_each_entry_safe(msg, msg2, &intf->user_msgs, link) { 4942 struct ipmi_user *user = msg->user; 4943 4944 list_del(&msg->link); 4945 4946 if (refcount_read(&user->destroyed) == 0) 4947 ipmi_free_recv_msg(msg); 4948 else 4949 user->handler->ipmi_recv_hndl(msg, user->handler_data); 4950 } 4951 mutex_unlock(&intf->user_msgs_mutex); 4952 4953 kref_put(&intf->refcount, intf_free); 4954 } 4955 4956 /* Handle a new message from the lower layer. */ 4957 void ipmi_smi_msg_received(struct ipmi_smi *intf, 4958 struct ipmi_smi_msg *msg) 4959 { 4960 unsigned long flags = 0; /* keep us warning-free. */ 4961 int run_to_completion = READ_ONCE(intf->run_to_completion); 4962 4963 /* 4964 * To preserve message order, we keep a queue and deliver from 4965 * a workqueue. 4966 */ 4967 if (!run_to_completion) 4968 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags); 4969 list_add_tail(&msg->link, &intf->waiting_rcv_msgs); 4970 if (!run_to_completion) 4971 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, 4972 flags); 4973 4974 ipmi_lock_xmit_msgs(intf, run_to_completion, &flags); 4975 /* 4976 * We can get an asynchronous event or receive message in addition 4977 * to commands we send. 4978 */ 4979 if (msg == intf->curr_msg) 4980 intf->curr_msg = NULL; 4981 ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags); 4982 4983 if (run_to_completion) 4984 smi_work(&intf->smi_work); 4985 else 4986 queue_work(system_percpu_wq, &intf->smi_work); 4987 } 4988 EXPORT_SYMBOL(ipmi_smi_msg_received); 4989 4990 void ipmi_smi_watchdog_pretimeout(struct ipmi_smi *intf) 4991 { 4992 if (intf->in_shutdown) 4993 return; 4994 4995 atomic_set(&intf->watchdog_pretimeouts_to_deliver, 1); 4996 queue_work(system_percpu_wq, &intf->smi_work); 4997 } 4998 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout); 4999 5000 static struct ipmi_smi_msg * 5001 smi_from_recv_msg(struct ipmi_smi *intf, struct ipmi_recv_msg *recv_msg, 5002 unsigned char seq, long seqid) 5003 { 5004 struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg(); 5005 if (!smi_msg) 5006 /* 5007 * If we can't allocate the message, then just return, we 5008 * get 4 retries, so this should be ok. 5009 */ 5010 return NULL; 5011 5012 memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len); 5013 smi_msg->data_size = recv_msg->msg.data_len; 5014 smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid); 5015 5016 dev_dbg(intf->si_dev, "Resend: %*ph\n", 5017 smi_msg->data_size, smi_msg->data); 5018 5019 return smi_msg; 5020 } 5021 5022 static void check_msg_timeout(struct ipmi_smi *intf, struct seq_table *ent, 5023 struct list_head *timeouts, 5024 unsigned long timeout_period, 5025 int slot, bool *need_timer) 5026 { 5027 struct ipmi_recv_msg *msg; 5028 5029 if (intf->in_shutdown) 5030 return; 5031 5032 if (!ent->inuse) 5033 return; 5034 5035 if (timeout_period < ent->timeout) { 5036 ent->timeout -= timeout_period; 5037 *need_timer = true; 5038 return; 5039 } 5040 5041 if (ent->retries_left == 0) { 5042 /* The message has used all its retries. */ 5043 ent->inuse = 0; 5044 smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES); 5045 msg = ent->recv_msg; 5046 list_add_tail(&msg->link, timeouts); 5047 if (ent->broadcast) 5048 ipmi_inc_stat(intf, timed_out_ipmb_broadcasts); 5049 else if (is_lan_addr(&ent->recv_msg->addr)) 5050 ipmi_inc_stat(intf, timed_out_lan_commands); 5051 else 5052 ipmi_inc_stat(intf, timed_out_ipmb_commands); 5053 } else { 5054 struct ipmi_smi_msg *smi_msg; 5055 /* More retries, send again. */ 5056 5057 *need_timer = true; 5058 5059 /* 5060 * Start with the max timer, set to normal timer after 5061 * the message is sent. 5062 */ 5063 ent->timeout = MAX_MSG_TIMEOUT; 5064 ent->retries_left--; 5065 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot, 5066 ent->seqid); 5067 if (!smi_msg) { 5068 if (is_lan_addr(&ent->recv_msg->addr)) 5069 ipmi_inc_stat(intf, 5070 dropped_rexmit_lan_commands); 5071 else 5072 ipmi_inc_stat(intf, 5073 dropped_rexmit_ipmb_commands); 5074 return; 5075 } 5076 5077 mutex_unlock(&intf->seq_lock); 5078 5079 /* 5080 * Send the new message. We send with a zero 5081 * priority. It timed out, I doubt time is that 5082 * critical now, and high priority messages are really 5083 * only for messages to the local MC, which don't get 5084 * resent. 5085 */ 5086 if (intf->handlers) { 5087 if (is_lan_addr(&ent->recv_msg->addr)) 5088 ipmi_inc_stat(intf, 5089 retransmitted_lan_commands); 5090 else 5091 ipmi_inc_stat(intf, 5092 retransmitted_ipmb_commands); 5093 5094 /* If this fails we'll retry later or timeout. */ 5095 if (smi_send(intf, intf->handlers, smi_msg, 0) != IPMI_CC_NO_ERROR) { 5096 /* But fix the timeout. */ 5097 intf_start_seq_timer(intf, smi_msg->msgid); 5098 ipmi_free_smi_msg(smi_msg); 5099 } 5100 } else 5101 ipmi_free_smi_msg(smi_msg); 5102 5103 mutex_lock(&intf->seq_lock); 5104 } 5105 } 5106 5107 static bool ipmi_timeout_handler(struct ipmi_smi *intf, 5108 unsigned long timeout_period) 5109 { 5110 LIST_HEAD(timeouts); 5111 struct ipmi_recv_msg *msg, *msg2; 5112 unsigned long flags; 5113 int i; 5114 bool need_timer = false; 5115 5116 if (!intf->bmc_registered) { 5117 kref_get(&intf->refcount); 5118 if (!schedule_work(&intf->bmc_reg_work)) { 5119 kref_put(&intf->refcount, intf_free); 5120 need_timer = true; 5121 } 5122 } 5123 5124 /* 5125 * Go through the seq table and find any messages that 5126 * have timed out, putting them in the timeouts 5127 * list. 5128 */ 5129 mutex_lock(&intf->seq_lock); 5130 if (intf->ipmb_maintenance_mode_timeout) { 5131 if (intf->ipmb_maintenance_mode_timeout <= timeout_period) 5132 intf->ipmb_maintenance_mode_timeout = 0; 5133 else 5134 intf->ipmb_maintenance_mode_timeout -= timeout_period; 5135 } 5136 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) 5137 check_msg_timeout(intf, &intf->seq_table[i], 5138 &timeouts, timeout_period, i, 5139 &need_timer); 5140 mutex_unlock(&intf->seq_lock); 5141 5142 list_for_each_entry_safe(msg, msg2, &timeouts, link) 5143 deliver_err_response(intf, msg, IPMI_TIMEOUT_COMPLETION_CODE); 5144 5145 /* 5146 * Maintenance mode handling. Check the timeout 5147 * optimistically before we claim the lock. It may 5148 * mean a timeout gets missed occasionally, but that 5149 * only means the timeout gets extended by one period 5150 * in that case. No big deal, and it avoids the lock 5151 * most of the time. 5152 */ 5153 if (intf->auto_maintenance_timeout > 0) { 5154 spin_lock_irqsave(&intf->maintenance_mode_lock, flags); 5155 if (intf->auto_maintenance_timeout > 0) { 5156 intf->auto_maintenance_timeout 5157 -= timeout_period; 5158 if (!intf->maintenance_mode 5159 && (intf->auto_maintenance_timeout <= 0)) { 5160 intf->maintenance_mode_state = 5161 IPMI_MAINTENANCE_MODE_STATE_OFF; 5162 intf->auto_maintenance_timeout = 0; 5163 maintenance_mode_update(intf); 5164 } 5165 } 5166 spin_unlock_irqrestore(&intf->maintenance_mode_lock, 5167 flags); 5168 } 5169 5170 queue_work(system_percpu_wq, &intf->smi_work); 5171 5172 return need_timer; 5173 } 5174 5175 static void ipmi_request_event(struct ipmi_smi *intf) 5176 { 5177 /* No event requests when in maintenance mode. */ 5178 if (intf->maintenance_mode_state) 5179 return; 5180 5181 if (!intf->in_shutdown) 5182 intf->handlers->request_events(intf->send_info); 5183 } 5184 5185 static atomic_t stop_operation; 5186 5187 static void ipmi_timeout_work(struct work_struct *work) 5188 { 5189 if (atomic_read(&stop_operation)) 5190 return; 5191 5192 struct ipmi_smi *intf; 5193 bool need_timer = false; 5194 5195 if (atomic_read(&stop_operation)) 5196 return; 5197 5198 mutex_lock(&ipmi_interfaces_mutex); 5199 list_for_each_entry(intf, &ipmi_interfaces, link) { 5200 if (atomic_read(&intf->event_waiters)) { 5201 intf->ticks_to_req_ev--; 5202 if (intf->ticks_to_req_ev == 0) { 5203 ipmi_request_event(intf); 5204 intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME; 5205 } 5206 need_timer = true; 5207 } 5208 if (intf->maintenance_mode_state) 5209 need_timer = true; 5210 5211 need_timer |= ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME); 5212 } 5213 mutex_unlock(&ipmi_interfaces_mutex); 5214 5215 if (need_timer) 5216 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); 5217 } 5218 5219 static DECLARE_WORK(ipmi_timer_work, ipmi_timeout_work); 5220 5221 static void ipmi_timeout(struct timer_list *unused) 5222 { 5223 if (atomic_read(&stop_operation)) 5224 return; 5225 5226 queue_work(system_percpu_wq, &ipmi_timer_work); 5227 } 5228 5229 static void need_waiter(struct ipmi_smi *intf) 5230 { 5231 /* Racy, but worst case we start the timer twice. */ 5232 if (!timer_pending(&ipmi_timer)) 5233 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); 5234 } 5235 5236 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0); 5237 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0); 5238 5239 static void free_smi_msg(struct ipmi_smi_msg *msg) 5240 { 5241 atomic_dec(&smi_msg_inuse_count); 5242 /* Try to keep as much stuff out of the panic path as possible. */ 5243 if (!oops_in_progress) 5244 kfree(msg); 5245 } 5246 5247 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void) 5248 { 5249 struct ipmi_smi_msg *rv; 5250 rv = kmalloc_obj(struct ipmi_smi_msg, GFP_ATOMIC); 5251 if (rv) { 5252 rv->done = free_smi_msg; 5253 rv->recv_msg = NULL; 5254 rv->type = IPMI_SMI_MSG_TYPE_NORMAL; 5255 atomic_inc(&smi_msg_inuse_count); 5256 } 5257 return rv; 5258 } 5259 EXPORT_SYMBOL(ipmi_alloc_smi_msg); 5260 5261 static void free_recv_msg(struct ipmi_recv_msg *msg) 5262 { 5263 atomic_dec(&recv_msg_inuse_count); 5264 /* Try to keep as much stuff out of the panic path as possible. */ 5265 if (!oops_in_progress) 5266 kfree(msg); 5267 } 5268 5269 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(struct ipmi_user *user) 5270 { 5271 struct ipmi_recv_msg *rv; 5272 5273 if (user) { 5274 if (atomic_add_return(1, &user->nr_msgs) > max_msgs_per_user) { 5275 atomic_dec(&user->nr_msgs); 5276 return ERR_PTR(-EBUSY); 5277 } 5278 } 5279 5280 rv = kmalloc_obj(struct ipmi_recv_msg, GFP_ATOMIC); 5281 if (!rv) { 5282 if (user) 5283 atomic_dec(&user->nr_msgs); 5284 return ERR_PTR(-ENOMEM); 5285 } 5286 5287 rv->user = user; 5288 rv->done = free_recv_msg; 5289 if (user) 5290 kref_get(&user->refcount); 5291 atomic_inc(&recv_msg_inuse_count); 5292 return rv; 5293 } 5294 5295 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg) 5296 { 5297 if (msg->user && !oops_in_progress) { 5298 atomic_dec(&msg->user->nr_msgs); 5299 kref_put(&msg->user->refcount, free_ipmi_user); 5300 } 5301 msg->done(msg); 5302 } 5303 EXPORT_SYMBOL(ipmi_free_recv_msg); 5304 5305 static void ipmi_set_recv_msg_user(struct ipmi_recv_msg *msg, 5306 struct ipmi_user *user) 5307 { 5308 WARN_ON_ONCE(msg->user); /* User should not be set. */ 5309 msg->user = user; 5310 atomic_inc(&user->nr_msgs); 5311 kref_get(&user->refcount); 5312 } 5313 5314 static atomic_t panic_done_count = ATOMIC_INIT(0); 5315 5316 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg) 5317 { 5318 atomic_dec(&panic_done_count); 5319 } 5320 5321 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg) 5322 { 5323 atomic_dec(&panic_done_count); 5324 } 5325 5326 /* 5327 * Inside a panic, send a message and wait for a response. 5328 */ 5329 static void _ipmi_panic_request_and_wait(struct ipmi_smi *intf, 5330 struct ipmi_addr *addr, 5331 struct kernel_ipmi_msg *msg) 5332 { 5333 struct ipmi_smi_msg smi_msg; 5334 struct ipmi_recv_msg recv_msg; 5335 int rv; 5336 5337 smi_msg.done = dummy_smi_done_handler; 5338 recv_msg.done = dummy_recv_done_handler; 5339 atomic_add(2, &panic_done_count); 5340 rv = i_ipmi_request(NULL, 5341 intf, 5342 addr, 5343 0, 5344 msg, 5345 intf, 5346 &smi_msg, 5347 &recv_msg, 5348 0, 5349 intf->addrinfo[0].address, 5350 intf->addrinfo[0].lun, 5351 0, 1); /* Don't retry, and don't wait. */ 5352 if (rv) 5353 atomic_sub(2, &panic_done_count); 5354 else if (intf->handlers->flush_messages) 5355 intf->handlers->flush_messages(intf->send_info); 5356 5357 while (atomic_read(&panic_done_count) != 0) 5358 ipmi_poll(intf); 5359 } 5360 5361 void ipmi_panic_request_and_wait(struct ipmi_user *user, 5362 struct ipmi_addr *addr, 5363 struct kernel_ipmi_msg *msg) 5364 { 5365 user->intf->run_to_completion = 1; 5366 _ipmi_panic_request_and_wait(user->intf, addr, msg); 5367 } 5368 EXPORT_SYMBOL(ipmi_panic_request_and_wait); 5369 5370 static void event_receiver_fetcher(struct ipmi_smi *intf, 5371 struct ipmi_recv_msg *msg) 5372 { 5373 if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 5374 && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE) 5375 && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD) 5376 && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) { 5377 /* A get event receiver command, save it. */ 5378 intf->event_receiver = msg->msg.data[1]; 5379 intf->event_receiver_lun = msg->msg.data[2] & 0x3; 5380 } 5381 } 5382 5383 static void device_id_fetcher(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) 5384 { 5385 if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) 5386 && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE) 5387 && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD) 5388 && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) { 5389 /* 5390 * A get device id command, save if we are an event 5391 * receiver or generator. 5392 */ 5393 intf->local_sel_device = (msg->msg.data[6] >> 2) & 1; 5394 intf->local_event_generator = (msg->msg.data[6] >> 5) & 1; 5395 } 5396 } 5397 5398 static void send_panic_events(struct ipmi_smi *intf, char *str) 5399 { 5400 struct kernel_ipmi_msg msg; 5401 unsigned char data[16]; 5402 struct ipmi_system_interface_addr *si; 5403 struct ipmi_addr addr; 5404 char *p = str; 5405 struct ipmi_ipmb_addr *ipmb; 5406 int j; 5407 5408 if (ipmi_send_panic_event == IPMI_SEND_PANIC_EVENT_NONE) 5409 return; 5410 5411 si = (struct ipmi_system_interface_addr *) &addr; 5412 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 5413 si->channel = IPMI_BMC_CHANNEL; 5414 si->lun = 0; 5415 5416 /* Fill in an event telling that we have failed. */ 5417 msg.netfn = 0x04; /* Sensor or Event. */ 5418 msg.cmd = 2; /* Platform event command. */ 5419 msg.data = data; 5420 msg.data_len = 8; 5421 data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */ 5422 data[1] = 0x03; /* This is for IPMI 1.0. */ 5423 data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */ 5424 data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */ 5425 data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */ 5426 5427 /* 5428 * Put a few breadcrumbs in. Hopefully later we can add more things 5429 * to make the panic events more useful. 5430 */ 5431 if (str) { 5432 data[3] = str[0]; 5433 data[6] = str[1]; 5434 data[7] = str[2]; 5435 } 5436 5437 /* Send the event announcing the panic. */ 5438 _ipmi_panic_request_and_wait(intf, &addr, &msg); 5439 5440 /* 5441 * On every interface, dump a bunch of OEM event holding the 5442 * string. 5443 */ 5444 if (ipmi_send_panic_event != IPMI_SEND_PANIC_EVENT_STRING || !str) 5445 return; 5446 5447 /* 5448 * intf_num is used as an marker to tell if the 5449 * interface is valid. Thus we need a read barrier to 5450 * make sure data fetched before checking intf_num 5451 * won't be used. 5452 */ 5453 smp_rmb(); 5454 5455 /* 5456 * First job here is to figure out where to send the 5457 * OEM events. There's no way in IPMI to send OEM 5458 * events using an event send command, so we have to 5459 * find the SEL to put them in and stick them in 5460 * there. 5461 */ 5462 5463 /* Get capabilities from the get device id. */ 5464 intf->local_sel_device = 0; 5465 intf->local_event_generator = 0; 5466 intf->event_receiver = 0; 5467 5468 /* Request the device info from the local MC. */ 5469 msg.netfn = IPMI_NETFN_APP_REQUEST; 5470 msg.cmd = IPMI_GET_DEVICE_ID_CMD; 5471 msg.data = NULL; 5472 msg.data_len = 0; 5473 intf->null_user_handler = device_id_fetcher; 5474 _ipmi_panic_request_and_wait(intf, &addr, &msg); 5475 5476 if (intf->local_event_generator) { 5477 /* Request the event receiver from the local MC. */ 5478 msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST; 5479 msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD; 5480 msg.data = NULL; 5481 msg.data_len = 0; 5482 intf->null_user_handler = event_receiver_fetcher; 5483 _ipmi_panic_request_and_wait(intf, &addr, &msg); 5484 } 5485 intf->null_user_handler = NULL; 5486 5487 /* 5488 * Validate the event receiver. The low bit must not 5489 * be 1 (it must be a valid IPMB address), it cannot 5490 * be zero, and it must not be my address. 5491 */ 5492 if (((intf->event_receiver & 1) == 0) 5493 && (intf->event_receiver != 0) 5494 && (intf->event_receiver != intf->addrinfo[0].address)) { 5495 /* 5496 * The event receiver is valid, send an IPMB 5497 * message. 5498 */ 5499 ipmb = (struct ipmi_ipmb_addr *) &addr; 5500 ipmb->addr_type = IPMI_IPMB_ADDR_TYPE; 5501 ipmb->channel = 0; /* FIXME - is this right? */ 5502 ipmb->lun = intf->event_receiver_lun; 5503 ipmb->slave_addr = intf->event_receiver; 5504 } else if (intf->local_sel_device) { 5505 /* 5506 * The event receiver was not valid (or was 5507 * me), but I am an SEL device, just dump it 5508 * in my SEL. 5509 */ 5510 si = (struct ipmi_system_interface_addr *) &addr; 5511 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; 5512 si->channel = IPMI_BMC_CHANNEL; 5513 si->lun = 0; 5514 } else 5515 return; /* No where to send the event. */ 5516 5517 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */ 5518 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD; 5519 msg.data = data; 5520 msg.data_len = 16; 5521 5522 j = 0; 5523 while (*p) { 5524 int size = strnlen(p, 11); 5525 5526 data[0] = 0; 5527 data[1] = 0; 5528 data[2] = 0xf0; /* OEM event without timestamp. */ 5529 data[3] = intf->addrinfo[0].address; 5530 data[4] = j++; /* sequence # */ 5531 5532 memcpy_and_pad(data+5, 11, p, size, '\0'); 5533 p += size; 5534 5535 _ipmi_panic_request_and_wait(intf, &addr, &msg); 5536 } 5537 } 5538 5539 static int has_panicked; 5540 5541 static int panic_event(struct notifier_block *this, 5542 unsigned long event, 5543 void *ptr) 5544 { 5545 struct ipmi_smi *intf; 5546 struct ipmi_user *user; 5547 5548 if (has_panicked) 5549 return NOTIFY_DONE; 5550 has_panicked = 1; 5551 5552 /* For every registered interface, set it to run to completion. */ 5553 list_for_each_entry(intf, &ipmi_interfaces, link) { 5554 if (!intf->handlers || intf->intf_num == -1) 5555 /* Interface is not ready. */ 5556 continue; 5557 5558 if (!intf->handlers->poll) 5559 continue; 5560 5561 /* 5562 * If we were interrupted while locking xmit_msgs_lock or 5563 * waiting_rcv_msgs_lock, the corresponding list may be 5564 * corrupted. In this case, drop items on the list for 5565 * the safety. 5566 */ 5567 if (!spin_trylock(&intf->xmit_msgs_lock)) { 5568 INIT_LIST_HEAD(&intf->xmit_msgs); 5569 INIT_LIST_HEAD(&intf->hp_xmit_msgs); 5570 } else 5571 spin_unlock(&intf->xmit_msgs_lock); 5572 5573 if (!spin_trylock(&intf->waiting_rcv_msgs_lock)) 5574 INIT_LIST_HEAD(&intf->waiting_rcv_msgs); 5575 else 5576 spin_unlock(&intf->waiting_rcv_msgs_lock); 5577 5578 intf->run_to_completion = 1; 5579 if (intf->handlers->set_run_to_completion) 5580 intf->handlers->set_run_to_completion(intf->send_info, 5581 1); 5582 5583 list_for_each_entry(user, &intf->users, link) { 5584 if (user->handler->ipmi_panic_handler) 5585 user->handler->ipmi_panic_handler( 5586 user->handler_data); 5587 } 5588 5589 send_panic_events(intf, ptr); 5590 } 5591 5592 return NOTIFY_DONE; 5593 } 5594 5595 /* Must be called with ipmi_interfaces_mutex held. */ 5596 static int ipmi_register_driver(void) 5597 { 5598 int rv; 5599 5600 if (drvregistered) 5601 return 0; 5602 5603 rv = driver_register(&ipmidriver.driver); 5604 if (rv) 5605 pr_err("Could not register IPMI driver\n"); 5606 else 5607 drvregistered = true; 5608 return rv; 5609 } 5610 5611 static struct notifier_block panic_block = { 5612 .notifier_call = panic_event, 5613 .next = NULL, 5614 .priority = 200 /* priority: INT_MAX >= x >= 0 */ 5615 }; 5616 5617 static int ipmi_init_msghandler(void) 5618 { 5619 int rv; 5620 5621 mutex_lock(&ipmi_interfaces_mutex); 5622 rv = ipmi_register_driver(); 5623 if (rv) 5624 goto out; 5625 if (initialized) 5626 goto out; 5627 5628 bmc_remove_work_wq = create_singlethread_workqueue("ipmi-msghandler-remove-wq"); 5629 if (!bmc_remove_work_wq) { 5630 pr_err("unable to create ipmi-msghandler-remove-wq workqueue"); 5631 rv = -ENOMEM; 5632 goto out; 5633 } 5634 5635 timer_setup(&ipmi_timer, ipmi_timeout, 0); 5636 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); 5637 5638 atomic_notifier_chain_register(&panic_notifier_list, &panic_block); 5639 5640 initialized = true; 5641 5642 out: 5643 mutex_unlock(&ipmi_interfaces_mutex); 5644 return rv; 5645 } 5646 5647 static int __init ipmi_init_msghandler_mod(void) 5648 { 5649 int rv; 5650 5651 pr_info("version " IPMI_DRIVER_VERSION "\n"); 5652 5653 mutex_lock(&ipmi_interfaces_mutex); 5654 rv = ipmi_register_driver(); 5655 mutex_unlock(&ipmi_interfaces_mutex); 5656 5657 return rv; 5658 } 5659 5660 static void __exit cleanup_ipmi(void) 5661 { 5662 int count; 5663 5664 if (initialized) { 5665 destroy_workqueue(bmc_remove_work_wq); 5666 5667 atomic_notifier_chain_unregister(&panic_notifier_list, 5668 &panic_block); 5669 5670 /* 5671 * This can't be called if any interfaces exist, so no worry 5672 * about shutting down the interfaces. 5673 */ 5674 5675 /* 5676 * Tell the timer to stop, then wait for it to stop. This 5677 * avoids problems with race conditions removing the timer 5678 * here. 5679 */ 5680 atomic_set(&stop_operation, 1); 5681 timer_delete_sync(&ipmi_timer); 5682 cancel_work_sync(&ipmi_timer_work); 5683 5684 initialized = false; 5685 5686 /* Check for buffer leaks. */ 5687 count = atomic_read(&smi_msg_inuse_count); 5688 if (count != 0) 5689 pr_warn("SMI message count %d at exit\n", count); 5690 count = atomic_read(&recv_msg_inuse_count); 5691 if (count != 0) 5692 pr_warn("recv message count %d at exit\n", count); 5693 } 5694 if (drvregistered) 5695 driver_unregister(&ipmidriver.driver); 5696 } 5697 module_exit(cleanup_ipmi); 5698 5699 module_init(ipmi_init_msghandler_mod); 5700 MODULE_LICENSE("GPL"); 5701 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>"); 5702 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI interface."); 5703 MODULE_VERSION(IPMI_DRIVER_VERSION); 5704 MODULE_SOFTDEP("post: ipmi_devintf"); 5705