1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * ipmi_si.c
4  *
5  * The interface to the IPMI driver for the system interfaces (KCS, SMIC,
6  * BT).
7  *
8  * Author: MontaVista Software, Inc.
9  *         Corey Minyard <minyard@mvista.com>
10  *         source@mvista.com
11  *
12  * Copyright 2002 MontaVista Software Inc.
13  * Copyright 2006 IBM Corp., Christian Krafft <krafft@de.ibm.com>
14  */
15 
16 /*
17  * This file holds the "policy" for the interface to the SMI state
18  * machine.  It does the configuration, handles timers and interrupts,
19  * and drives the real SMI state machine.
20  */
21 
22 #define pr_fmt(fmt) "ipmi_si: " fmt
23 
24 #include <linux/module.h>
25 #include <linux/moduleparam.h>
26 #include <linux/sched.h>
27 #include <linux/seq_file.h>
28 #include <linux/timer.h>
29 #include <linux/errno.h>
30 #include <linux/spinlock.h>
31 #include <linux/slab.h>
32 #include <linux/delay.h>
33 #include <linux/list.h>
34 #include <linux/notifier.h>
35 #include <linux/mutex.h>
36 #include <linux/kthread.h>
37 #include <asm/irq.h>
38 #include <linux/interrupt.h>
39 #include <linux/rcupdate.h>
40 #include <linux/ipmi.h>
41 #include <linux/ipmi_smi.h>
42 #include "ipmi_si.h"
43 #include "ipmi_si_sm.h"
44 #include <linux/string.h>
45 #include <linux/ctype.h>
46 
47 /* Measure times between events in the driver. */
48 #undef DEBUG_TIMING
49 
50 /* Call every 10 ms. */
51 #define SI_TIMEOUT_TIME_USEC	10000
52 #define SI_USEC_PER_JIFFY	(1000000/HZ)
53 #define SI_TIMEOUT_JIFFIES	(SI_TIMEOUT_TIME_USEC/SI_USEC_PER_JIFFY)
54 #define SI_SHORT_TIMEOUT_USEC  250 /* .25ms when the SM request a
55 				      short timeout */
56 
57 enum si_intf_state {
58 	SI_NORMAL,
59 	SI_GETTING_FLAGS,
60 	SI_GETTING_EVENTS,
61 	SI_CLEARING_FLAGS,
62 	SI_GETTING_MESSAGES,
63 	SI_CHECKING_ENABLES,
64 	SI_SETTING_ENABLES
65 	/* FIXME - add watchdog stuff. */
66 };
67 
68 /* Some BT-specific defines we need here. */
69 #define IPMI_BT_INTMASK_REG		2
70 #define IPMI_BT_INTMASK_CLEAR_IRQ_BIT	2
71 #define IPMI_BT_INTMASK_ENABLE_IRQ_BIT	1
72 
73 /* 'invalid' to allow a firmware-specified interface to be disabled */
74 const char *const si_to_str[] = { "invalid", "kcs", "smic", "bt", NULL };
75 
76 const struct ipmi_match_info ipmi_kcs_si_info = { .type = SI_KCS };
77 const struct ipmi_match_info ipmi_smic_si_info = { .type = SI_SMIC };
78 const struct ipmi_match_info ipmi_bt_si_info = { .type = SI_BT };
79 
80 static bool initialized;
81 
82 /*
83  * Indexes into stats[] in smi_info below.
84  */
85 enum si_stat_indexes {
86 	/*
87 	 * Number of times the driver requested a timer while an operation
88 	 * was in progress.
89 	 */
90 	SI_STAT_short_timeouts = 0,
91 
92 	/*
93 	 * Number of times the driver requested a timer while nothing was in
94 	 * progress.
95 	 */
96 	SI_STAT_long_timeouts,
97 
98 	/* Number of times the interface was idle while being polled. */
99 	SI_STAT_idles,
100 
101 	/* Number of interrupts the driver handled. */
102 	SI_STAT_interrupts,
103 
104 	/* Number of time the driver got an ATTN from the hardware. */
105 	SI_STAT_attentions,
106 
107 	/* Number of times the driver requested flags from the hardware. */
108 	SI_STAT_flag_fetches,
109 
110 	/* Number of times the hardware didn't follow the state machine. */
111 	SI_STAT_hosed_count,
112 
113 	/* Number of completed messages. */
114 	SI_STAT_complete_transactions,
115 
116 	/* Number of IPMI events received from the hardware. */
117 	SI_STAT_events,
118 
119 	/* Number of watchdog pretimeouts. */
120 	SI_STAT_watchdog_pretimeouts,
121 
122 	/* Number of asynchronous messages received. */
123 	SI_STAT_incoming_messages,
124 
125 
126 	/* This *must* remain last, add new values above this. */
127 	SI_NUM_STATS
128 };
129 
130 struct smi_info {
131 	int                    si_num;
132 	struct ipmi_smi        *intf;
133 	struct si_sm_data      *si_sm;
134 	const struct si_sm_handlers *handlers;
135 	spinlock_t             si_lock;
136 	struct ipmi_smi_msg    *waiting_msg;
137 	struct ipmi_smi_msg    *curr_msg;
138 	enum si_intf_state     si_state;
139 
140 	/*
141 	 * Used to handle the various types of I/O that can occur with
142 	 * IPMI
143 	 */
144 	struct si_sm_io io;
145 
146 	/*
147 	 * Per-OEM handler, called from handle_flags().  Returns 1
148 	 * when handle_flags() needs to be re-run or 0 indicating it
149 	 * set si_state itself.
150 	 */
151 	int (*oem_data_avail_handler)(struct smi_info *smi_info);
152 
153 	/*
154 	 * Flags from the last GET_MSG_FLAGS command, used when an ATTN
155 	 * is set to hold the flags until we are done handling everything
156 	 * from the flags.
157 	 */
158 #define RECEIVE_MSG_AVAIL	0x01
159 #define EVENT_MSG_BUFFER_FULL	0x02
160 #define WDT_PRE_TIMEOUT_INT	0x08
161 #define OEM0_DATA_AVAIL     0x20
162 #define OEM1_DATA_AVAIL     0x40
163 #define OEM2_DATA_AVAIL     0x80
164 #define OEM_DATA_AVAIL      (OEM0_DATA_AVAIL | \
165 			     OEM1_DATA_AVAIL | \
166 			     OEM2_DATA_AVAIL)
167 	unsigned char       msg_flags;
168 
169 	/* Does the BMC have an event buffer? */
170 	bool		    has_event_buffer;
171 
172 	/*
173 	 * If set to true, this will request events the next time the
174 	 * state machine is idle.
175 	 */
176 	atomic_t            req_events;
177 
178 	/*
179 	 * If true, run the state machine to completion on every send
180 	 * call.  Generally used after a panic to make sure stuff goes
181 	 * out.
182 	 */
183 	bool                run_to_completion;
184 
185 	/* The timer for this si. */
186 	struct timer_list   si_timer;
187 
188 	/* This flag is set, if the timer can be set */
189 	bool		    timer_can_start;
190 
191 	/* This flag is set, if the timer is running (timer_pending() isn't enough) */
192 	bool		    timer_running;
193 
194 	/* The time (in jiffies) the last timeout occurred at. */
195 	unsigned long       last_timeout_jiffies;
196 
197 	/* Are we waiting for the events, pretimeouts, received msgs? */
198 	atomic_t            need_watch;
199 
200 	/*
201 	 * The driver will disable interrupts when it gets into a
202 	 * situation where it cannot handle messages due to lack of
203 	 * memory.  Once that situation clears up, it will re-enable
204 	 * interrupts.
205 	 */
206 	bool interrupt_disabled;
207 
208 	/*
209 	 * Does the BMC support events?
210 	 */
211 	bool supports_event_msg_buff;
212 
213 	/*
214 	 * Can we disable interrupts the global enables receive irq
215 	 * bit?  There are currently two forms of brokenness, some
216 	 * systems cannot disable the bit (which is technically within
217 	 * the spec but a bad idea) and some systems have the bit
218 	 * forced to zero even though interrupts work (which is
219 	 * clearly outside the spec).  The next bool tells which form
220 	 * of brokenness is present.
221 	 */
222 	bool cannot_disable_irq;
223 
224 	/*
225 	 * Some systems are broken and cannot set the irq enable
226 	 * bit, even if they support interrupts.
227 	 */
228 	bool irq_enable_broken;
229 
230 	/* Is the driver in maintenance mode? */
231 	bool in_maintenance_mode;
232 
233 	/*
234 	 * Did we get an attention that we did not handle?
235 	 */
236 	bool got_attn;
237 
238 	/* From the get device id response... */
239 	struct ipmi_device_id device_id;
240 
241 	/* Have we added the device group to the device? */
242 	bool dev_group_added;
243 
244 	/* Counters and things for the proc filesystem. */
245 	atomic_t stats[SI_NUM_STATS];
246 
247 	struct task_struct *thread;
248 
249 	struct list_head link;
250 };
251 
252 #define smi_inc_stat(smi, stat) \
253 	atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
254 #define smi_get_stat(smi, stat) \
255 	((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
256 
257 #define IPMI_MAX_INTFS 4
258 static int force_kipmid[IPMI_MAX_INTFS];
259 static int num_force_kipmid;
260 
261 static unsigned int kipmid_max_busy_us[IPMI_MAX_INTFS];
262 static int num_max_busy_us;
263 
264 static bool unload_when_empty = true;
265 
266 static int try_smi_init(struct smi_info *smi);
267 static void cleanup_one_si(struct smi_info *smi_info);
268 static void cleanup_ipmi_si(void);
269 
270 #ifdef DEBUG_TIMING
271 void debug_timestamp(struct smi_info *smi_info, char *msg)
272 {
273 	struct timespec64 t;
274 
275 	ktime_get_ts64(&t);
276 	dev_dbg(smi_info->io.dev, "**%s: %lld.%9.9ld\n",
277 		msg, t.tv_sec, t.tv_nsec);
278 }
279 #else
280 #define debug_timestamp(smi_info, x)
281 #endif
282 
283 static ATOMIC_NOTIFIER_HEAD(xaction_notifier_list);
284 static int register_xaction_notifier(struct notifier_block *nb)
285 {
286 	return atomic_notifier_chain_register(&xaction_notifier_list, nb);
287 }
288 
289 static void deliver_recv_msg(struct smi_info *smi_info,
290 			     struct ipmi_smi_msg *msg)
291 {
292 	/* Deliver the message to the upper layer. */
293 	ipmi_smi_msg_received(smi_info->intf, msg);
294 }
295 
296 static void return_hosed_msg(struct smi_info *smi_info, int cCode)
297 {
298 	struct ipmi_smi_msg *msg = smi_info->curr_msg;
299 
300 	if (cCode < 0 || cCode > IPMI_ERR_UNSPECIFIED)
301 		cCode = IPMI_ERR_UNSPECIFIED;
302 	/* else use it as is */
303 
304 	/* Make it a response */
305 	msg->rsp[0] = msg->data[0] | 4;
306 	msg->rsp[1] = msg->data[1];
307 	msg->rsp[2] = cCode;
308 	msg->rsp_size = 3;
309 
310 	smi_info->curr_msg = NULL;
311 	deliver_recv_msg(smi_info, msg);
312 }
313 
314 static enum si_sm_result start_next_msg(struct smi_info *smi_info)
315 {
316 	int              rv;
317 
318 	if (!smi_info->waiting_msg) {
319 		smi_info->curr_msg = NULL;
320 		rv = SI_SM_IDLE;
321 	} else {
322 		int err;
323 
324 		smi_info->curr_msg = smi_info->waiting_msg;
325 		smi_info->waiting_msg = NULL;
326 		debug_timestamp(smi_info, "Start2");
327 		err = atomic_notifier_call_chain(&xaction_notifier_list,
328 				0, smi_info);
329 		if (err & NOTIFY_STOP_MASK) {
330 			rv = SI_SM_CALL_WITHOUT_DELAY;
331 			goto out;
332 		}
333 		err = smi_info->handlers->start_transaction(
334 			smi_info->si_sm,
335 			smi_info->curr_msg->data,
336 			smi_info->curr_msg->data_size);
337 		if (err)
338 			return_hosed_msg(smi_info, err);
339 
340 		rv = SI_SM_CALL_WITHOUT_DELAY;
341 	}
342 out:
343 	return rv;
344 }
345 
346 static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
347 {
348 	if (!smi_info->timer_can_start)
349 		return;
350 	smi_info->last_timeout_jiffies = jiffies;
351 	mod_timer(&smi_info->si_timer, new_val);
352 	smi_info->timer_running = true;
353 }
354 
355 /*
356  * Start a new message and (re)start the timer and thread.
357  */
358 static void start_new_msg(struct smi_info *smi_info, unsigned char *msg,
359 			  unsigned int size)
360 {
361 	smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
362 
363 	if (smi_info->thread)
364 		wake_up_process(smi_info->thread);
365 
366 	smi_info->handlers->start_transaction(smi_info->si_sm, msg, size);
367 }
368 
369 static void start_check_enables(struct smi_info *smi_info)
370 {
371 	unsigned char msg[2];
372 
373 	msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
374 	msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
375 
376 	start_new_msg(smi_info, msg, 2);
377 	smi_info->si_state = SI_CHECKING_ENABLES;
378 }
379 
380 static void start_clear_flags(struct smi_info *smi_info)
381 {
382 	unsigned char msg[3];
383 
384 	/* Make sure the watchdog pre-timeout flag is not set at startup. */
385 	msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
386 	msg[1] = IPMI_CLEAR_MSG_FLAGS_CMD;
387 	msg[2] = WDT_PRE_TIMEOUT_INT;
388 
389 	start_new_msg(smi_info, msg, 3);
390 	smi_info->si_state = SI_CLEARING_FLAGS;
391 }
392 
393 static void start_getting_msg_queue(struct smi_info *smi_info)
394 {
395 	smi_info->curr_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
396 	smi_info->curr_msg->data[1] = IPMI_GET_MSG_CMD;
397 	smi_info->curr_msg->data_size = 2;
398 
399 	start_new_msg(smi_info, smi_info->curr_msg->data,
400 		      smi_info->curr_msg->data_size);
401 	smi_info->si_state = SI_GETTING_MESSAGES;
402 }
403 
404 static void start_getting_events(struct smi_info *smi_info)
405 {
406 	smi_info->curr_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
407 	smi_info->curr_msg->data[1] = IPMI_READ_EVENT_MSG_BUFFER_CMD;
408 	smi_info->curr_msg->data_size = 2;
409 
410 	start_new_msg(smi_info, smi_info->curr_msg->data,
411 		      smi_info->curr_msg->data_size);
412 	smi_info->si_state = SI_GETTING_EVENTS;
413 }
414 
415 /*
416  * When we have a situtaion where we run out of memory and cannot
417  * allocate messages, we just leave them in the BMC and run the system
418  * polled until we can allocate some memory.  Once we have some
419  * memory, we will re-enable the interrupt.
420  *
421  * Note that we cannot just use disable_irq(), since the interrupt may
422  * be shared.
423  */
424 static inline bool disable_si_irq(struct smi_info *smi_info)
425 {
426 	if ((smi_info->io.irq) && (!smi_info->interrupt_disabled)) {
427 		smi_info->interrupt_disabled = true;
428 		start_check_enables(smi_info);
429 		return true;
430 	}
431 	return false;
432 }
433 
434 static inline bool enable_si_irq(struct smi_info *smi_info)
435 {
436 	if ((smi_info->io.irq) && (smi_info->interrupt_disabled)) {
437 		smi_info->interrupt_disabled = false;
438 		start_check_enables(smi_info);
439 		return true;
440 	}
441 	return false;
442 }
443 
444 /*
445  * Allocate a message.  If unable to allocate, start the interrupt
446  * disable process and return NULL.  If able to allocate but
447  * interrupts are disabled, free the message and return NULL after
448  * starting the interrupt enable process.
449  */
450 static struct ipmi_smi_msg *alloc_msg_handle_irq(struct smi_info *smi_info)
451 {
452 	struct ipmi_smi_msg *msg;
453 
454 	msg = ipmi_alloc_smi_msg();
455 	if (!msg) {
456 		if (!disable_si_irq(smi_info))
457 			smi_info->si_state = SI_NORMAL;
458 	} else if (enable_si_irq(smi_info)) {
459 		ipmi_free_smi_msg(msg);
460 		msg = NULL;
461 	}
462 	return msg;
463 }
464 
465 static void handle_flags(struct smi_info *smi_info)
466 {
467 retry:
468 	if (smi_info->msg_flags & WDT_PRE_TIMEOUT_INT) {
469 		/* Watchdog pre-timeout */
470 		smi_inc_stat(smi_info, watchdog_pretimeouts);
471 
472 		start_clear_flags(smi_info);
473 		smi_info->msg_flags &= ~WDT_PRE_TIMEOUT_INT;
474 		ipmi_smi_watchdog_pretimeout(smi_info->intf);
475 	} else if (smi_info->msg_flags & RECEIVE_MSG_AVAIL) {
476 		/* Messages available. */
477 		smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
478 		if (!smi_info->curr_msg)
479 			return;
480 
481 		start_getting_msg_queue(smi_info);
482 	} else if (smi_info->msg_flags & EVENT_MSG_BUFFER_FULL) {
483 		/* Events available. */
484 		smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
485 		if (!smi_info->curr_msg)
486 			return;
487 
488 		start_getting_events(smi_info);
489 	} else if (smi_info->msg_flags & OEM_DATA_AVAIL &&
490 		   smi_info->oem_data_avail_handler) {
491 		if (smi_info->oem_data_avail_handler(smi_info))
492 			goto retry;
493 	} else
494 		smi_info->si_state = SI_NORMAL;
495 }
496 
497 /*
498  * Global enables we care about.
499  */
500 #define GLOBAL_ENABLES_MASK (IPMI_BMC_EVT_MSG_BUFF | IPMI_BMC_RCV_MSG_INTR | \
501 			     IPMI_BMC_EVT_MSG_INTR)
502 
503 static u8 current_global_enables(struct smi_info *smi_info, u8 base,
504 				 bool *irq_on)
505 {
506 	u8 enables = 0;
507 
508 	if (smi_info->supports_event_msg_buff)
509 		enables |= IPMI_BMC_EVT_MSG_BUFF;
510 
511 	if (((smi_info->io.irq && !smi_info->interrupt_disabled) ||
512 	     smi_info->cannot_disable_irq) &&
513 	    !smi_info->irq_enable_broken)
514 		enables |= IPMI_BMC_RCV_MSG_INTR;
515 
516 	if (smi_info->supports_event_msg_buff &&
517 	    smi_info->io.irq && !smi_info->interrupt_disabled &&
518 	    !smi_info->irq_enable_broken)
519 		enables |= IPMI_BMC_EVT_MSG_INTR;
520 
521 	*irq_on = enables & (IPMI_BMC_EVT_MSG_INTR | IPMI_BMC_RCV_MSG_INTR);
522 
523 	return enables;
524 }
525 
526 static void check_bt_irq(struct smi_info *smi_info, bool irq_on)
527 {
528 	u8 irqstate = smi_info->io.inputb(&smi_info->io, IPMI_BT_INTMASK_REG);
529 
530 	irqstate &= IPMI_BT_INTMASK_ENABLE_IRQ_BIT;
531 
532 	if ((bool)irqstate == irq_on)
533 		return;
534 
535 	if (irq_on)
536 		smi_info->io.outputb(&smi_info->io, IPMI_BT_INTMASK_REG,
537 				     IPMI_BT_INTMASK_ENABLE_IRQ_BIT);
538 	else
539 		smi_info->io.outputb(&smi_info->io, IPMI_BT_INTMASK_REG, 0);
540 }
541 
542 static void handle_transaction_done(struct smi_info *smi_info)
543 {
544 	struct ipmi_smi_msg *msg;
545 
546 	debug_timestamp(smi_info, "Done");
547 	switch (smi_info->si_state) {
548 	case SI_NORMAL:
549 		if (!smi_info->curr_msg)
550 			break;
551 
552 		smi_info->curr_msg->rsp_size
553 			= smi_info->handlers->get_result(
554 				smi_info->si_sm,
555 				smi_info->curr_msg->rsp,
556 				IPMI_MAX_MSG_LENGTH);
557 
558 		/*
559 		 * Do this here becase deliver_recv_msg() releases the
560 		 * lock, and a new message can be put in during the
561 		 * time the lock is released.
562 		 */
563 		msg = smi_info->curr_msg;
564 		smi_info->curr_msg = NULL;
565 		deliver_recv_msg(smi_info, msg);
566 		break;
567 
568 	case SI_GETTING_FLAGS:
569 	{
570 		unsigned char msg[4];
571 		unsigned int  len;
572 
573 		/* We got the flags from the SMI, now handle them. */
574 		len = smi_info->handlers->get_result(smi_info->si_sm, msg, 4);
575 		if (msg[2] != 0) {
576 			/* Error fetching flags, just give up for now. */
577 			smi_info->si_state = SI_NORMAL;
578 		} else if (len < 4) {
579 			/*
580 			 * Hmm, no flags.  That's technically illegal, but
581 			 * don't use uninitialized data.
582 			 */
583 			smi_info->si_state = SI_NORMAL;
584 		} else {
585 			smi_info->msg_flags = msg[3];
586 			handle_flags(smi_info);
587 		}
588 		break;
589 	}
590 
591 	case SI_CLEARING_FLAGS:
592 	{
593 		unsigned char msg[3];
594 
595 		/* We cleared the flags. */
596 		smi_info->handlers->get_result(smi_info->si_sm, msg, 3);
597 		if (msg[2] != 0) {
598 			/* Error clearing flags */
599 			dev_warn_ratelimited(smi_info->io.dev,
600 				 "Error clearing flags: %2.2x\n", msg[2]);
601 		}
602 		smi_info->si_state = SI_NORMAL;
603 		break;
604 	}
605 
606 	case SI_GETTING_EVENTS:
607 	{
608 		smi_info->curr_msg->rsp_size
609 			= smi_info->handlers->get_result(
610 				smi_info->si_sm,
611 				smi_info->curr_msg->rsp,
612 				IPMI_MAX_MSG_LENGTH);
613 
614 		/*
615 		 * Do this here becase deliver_recv_msg() releases the
616 		 * lock, and a new message can be put in during the
617 		 * time the lock is released.
618 		 */
619 		msg = smi_info->curr_msg;
620 		smi_info->curr_msg = NULL;
621 		if (msg->rsp[2] != 0) {
622 			/* Error getting event, probably done. */
623 			msg->done(msg);
624 
625 			/* Take off the event flag. */
626 			smi_info->msg_flags &= ~EVENT_MSG_BUFFER_FULL;
627 			handle_flags(smi_info);
628 		} else {
629 			smi_inc_stat(smi_info, events);
630 
631 			/*
632 			 * Do this before we deliver the message
633 			 * because delivering the message releases the
634 			 * lock and something else can mess with the
635 			 * state.
636 			 */
637 			handle_flags(smi_info);
638 
639 			deliver_recv_msg(smi_info, msg);
640 		}
641 		break;
642 	}
643 
644 	case SI_GETTING_MESSAGES:
645 	{
646 		smi_info->curr_msg->rsp_size
647 			= smi_info->handlers->get_result(
648 				smi_info->si_sm,
649 				smi_info->curr_msg->rsp,
650 				IPMI_MAX_MSG_LENGTH);
651 
652 		/*
653 		 * Do this here becase deliver_recv_msg() releases the
654 		 * lock, and a new message can be put in during the
655 		 * time the lock is released.
656 		 */
657 		msg = smi_info->curr_msg;
658 		smi_info->curr_msg = NULL;
659 		if (msg->rsp[2] != 0) {
660 			/* Error getting event, probably done. */
661 			msg->done(msg);
662 
663 			/* Take off the msg flag. */
664 			smi_info->msg_flags &= ~RECEIVE_MSG_AVAIL;
665 			handle_flags(smi_info);
666 		} else {
667 			smi_inc_stat(smi_info, incoming_messages);
668 
669 			/*
670 			 * Do this before we deliver the message
671 			 * because delivering the message releases the
672 			 * lock and something else can mess with the
673 			 * state.
674 			 */
675 			handle_flags(smi_info);
676 
677 			deliver_recv_msg(smi_info, msg);
678 		}
679 		break;
680 	}
681 
682 	case SI_CHECKING_ENABLES:
683 	{
684 		unsigned char msg[4];
685 		u8 enables;
686 		bool irq_on;
687 
688 		/* We got the flags from the SMI, now handle them. */
689 		smi_info->handlers->get_result(smi_info->si_sm, msg, 4);
690 		if (msg[2] != 0) {
691 			dev_warn_ratelimited(smi_info->io.dev,
692 				"Couldn't get irq info: %x,\n"
693 				"Maybe ok, but ipmi might run very slowly.\n",
694 				msg[2]);
695 			smi_info->si_state = SI_NORMAL;
696 			break;
697 		}
698 		enables = current_global_enables(smi_info, 0, &irq_on);
699 		if (smi_info->io.si_info->type == SI_BT)
700 			/* BT has its own interrupt enable bit. */
701 			check_bt_irq(smi_info, irq_on);
702 		if (enables != (msg[3] & GLOBAL_ENABLES_MASK)) {
703 			/* Enables are not correct, fix them. */
704 			msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
705 			msg[1] = IPMI_SET_BMC_GLOBAL_ENABLES_CMD;
706 			msg[2] = enables | (msg[3] & ~GLOBAL_ENABLES_MASK);
707 			smi_info->handlers->start_transaction(
708 				smi_info->si_sm, msg, 3);
709 			smi_info->si_state = SI_SETTING_ENABLES;
710 		} else if (smi_info->supports_event_msg_buff) {
711 			smi_info->curr_msg = ipmi_alloc_smi_msg();
712 			if (!smi_info->curr_msg) {
713 				smi_info->si_state = SI_NORMAL;
714 				break;
715 			}
716 			start_getting_events(smi_info);
717 		} else {
718 			smi_info->si_state = SI_NORMAL;
719 		}
720 		break;
721 	}
722 
723 	case SI_SETTING_ENABLES:
724 	{
725 		unsigned char msg[4];
726 
727 		smi_info->handlers->get_result(smi_info->si_sm, msg, 4);
728 		if (msg[2] != 0)
729 			dev_warn_ratelimited(smi_info->io.dev,
730 				 "Could not set the global enables: 0x%x.\n",
731 				 msg[2]);
732 
733 		if (smi_info->supports_event_msg_buff) {
734 			smi_info->curr_msg = ipmi_alloc_smi_msg();
735 			if (!smi_info->curr_msg) {
736 				smi_info->si_state = SI_NORMAL;
737 				break;
738 			}
739 			start_getting_events(smi_info);
740 		} else {
741 			smi_info->si_state = SI_NORMAL;
742 		}
743 		break;
744 	}
745 	}
746 }
747 
748 /*
749  * Called on timeouts and events.  Timeouts should pass the elapsed
750  * time, interrupts should pass in zero.  Must be called with
751  * si_lock held and interrupts disabled.
752  */
753 static enum si_sm_result smi_event_handler(struct smi_info *smi_info,
754 					   int time)
755 {
756 	enum si_sm_result si_sm_result;
757 
758 restart:
759 	/*
760 	 * There used to be a loop here that waited a little while
761 	 * (around 25us) before giving up.  That turned out to be
762 	 * pointless, the minimum delays I was seeing were in the 300us
763 	 * range, which is far too long to wait in an interrupt.  So
764 	 * we just run until the state machine tells us something
765 	 * happened or it needs a delay.
766 	 */
767 	si_sm_result = smi_info->handlers->event(smi_info->si_sm, time);
768 	time = 0;
769 	while (si_sm_result == SI_SM_CALL_WITHOUT_DELAY)
770 		si_sm_result = smi_info->handlers->event(smi_info->si_sm, 0);
771 
772 	if (si_sm_result == SI_SM_TRANSACTION_COMPLETE) {
773 		smi_inc_stat(smi_info, complete_transactions);
774 
775 		handle_transaction_done(smi_info);
776 		goto restart;
777 	} else if (si_sm_result == SI_SM_HOSED) {
778 		smi_inc_stat(smi_info, hosed_count);
779 
780 		/*
781 		 * Do the before return_hosed_msg, because that
782 		 * releases the lock.
783 		 */
784 		smi_info->si_state = SI_NORMAL;
785 		if (smi_info->curr_msg != NULL) {
786 			/*
787 			 * If we were handling a user message, format
788 			 * a response to send to the upper layer to
789 			 * tell it about the error.
790 			 */
791 			return_hosed_msg(smi_info, IPMI_ERR_UNSPECIFIED);
792 		}
793 		goto restart;
794 	}
795 
796 	/*
797 	 * We prefer handling attn over new messages.  But don't do
798 	 * this if there is not yet an upper layer to handle anything.
799 	 */
800 	if (si_sm_result == SI_SM_ATTN || smi_info->got_attn) {
801 		unsigned char msg[2];
802 
803 		if (smi_info->si_state != SI_NORMAL) {
804 			/*
805 			 * We got an ATTN, but we are doing something else.
806 			 * Handle the ATTN later.
807 			 */
808 			smi_info->got_attn = true;
809 		} else {
810 			smi_info->got_attn = false;
811 			smi_inc_stat(smi_info, attentions);
812 
813 			/*
814 			 * Got a attn, send down a get message flags to see
815 			 * what's causing it.  It would be better to handle
816 			 * this in the upper layer, but due to the way
817 			 * interrupts work with the SMI, that's not really
818 			 * possible.
819 			 */
820 			msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
821 			msg[1] = IPMI_GET_MSG_FLAGS_CMD;
822 
823 			start_new_msg(smi_info, msg, 2);
824 			smi_info->si_state = SI_GETTING_FLAGS;
825 			goto restart;
826 		}
827 	}
828 
829 	/* If we are currently idle, try to start the next message. */
830 	if (si_sm_result == SI_SM_IDLE) {
831 		smi_inc_stat(smi_info, idles);
832 
833 		si_sm_result = start_next_msg(smi_info);
834 		if (si_sm_result != SI_SM_IDLE)
835 			goto restart;
836 	}
837 
838 	if ((si_sm_result == SI_SM_IDLE)
839 	    && (atomic_read(&smi_info->req_events))) {
840 		/*
841 		 * We are idle and the upper layer requested that I fetch
842 		 * events, so do so.
843 		 */
844 		atomic_set(&smi_info->req_events, 0);
845 
846 		/*
847 		 * Take this opportunity to check the interrupt and
848 		 * message enable state for the BMC.  The BMC can be
849 		 * asynchronously reset, and may thus get interrupts
850 		 * disable and messages disabled.
851 		 */
852 		if (smi_info->supports_event_msg_buff || smi_info->io.irq) {
853 			start_check_enables(smi_info);
854 		} else {
855 			smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
856 			if (!smi_info->curr_msg)
857 				goto out;
858 
859 			start_getting_events(smi_info);
860 		}
861 		goto restart;
862 	}
863 
864 	if (si_sm_result == SI_SM_IDLE && smi_info->timer_running) {
865 		/* Ok it if fails, the timer will just go off. */
866 		if (timer_delete(&smi_info->si_timer))
867 			smi_info->timer_running = false;
868 	}
869 
870 out:
871 	return si_sm_result;
872 }
873 
874 static void check_start_timer_thread(struct smi_info *smi_info)
875 {
876 	if (smi_info->si_state == SI_NORMAL && smi_info->curr_msg == NULL) {
877 		smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
878 
879 		if (smi_info->thread)
880 			wake_up_process(smi_info->thread);
881 
882 		start_next_msg(smi_info);
883 		smi_event_handler(smi_info, 0);
884 	}
885 }
886 
887 static void flush_messages(void *send_info)
888 {
889 	struct smi_info *smi_info = send_info;
890 	enum si_sm_result result;
891 
892 	/*
893 	 * Currently, this function is called only in run-to-completion
894 	 * mode.  This means we are single-threaded, no need for locks.
895 	 */
896 	result = smi_event_handler(smi_info, 0);
897 	while (result != SI_SM_IDLE) {
898 		udelay(SI_SHORT_TIMEOUT_USEC);
899 		result = smi_event_handler(smi_info, SI_SHORT_TIMEOUT_USEC);
900 	}
901 }
902 
903 static void sender(void                *send_info,
904 		   struct ipmi_smi_msg *msg)
905 {
906 	struct smi_info   *smi_info = send_info;
907 	unsigned long     flags;
908 
909 	debug_timestamp(smi_info, "Enqueue");
910 
911 	if (smi_info->run_to_completion) {
912 		/*
913 		 * If we are running to completion, start it.  Upper
914 		 * layer will call flush_messages to clear it out.
915 		 */
916 		smi_info->waiting_msg = msg;
917 		return;
918 	}
919 
920 	spin_lock_irqsave(&smi_info->si_lock, flags);
921 	/*
922 	 * The following two lines don't need to be under the lock for
923 	 * the lock's sake, but they do need SMP memory barriers to
924 	 * avoid getting things out of order.  We are already claiming
925 	 * the lock, anyway, so just do it under the lock to avoid the
926 	 * ordering problem.
927 	 */
928 	BUG_ON(smi_info->waiting_msg);
929 	smi_info->waiting_msg = msg;
930 	check_start_timer_thread(smi_info);
931 	spin_unlock_irqrestore(&smi_info->si_lock, flags);
932 }
933 
934 static void set_run_to_completion(void *send_info, bool i_run_to_completion)
935 {
936 	struct smi_info   *smi_info = send_info;
937 
938 	smi_info->run_to_completion = i_run_to_completion;
939 	if (i_run_to_completion)
940 		flush_messages(smi_info);
941 }
942 
943 /*
944  * Use -1 as a special constant to tell that we are spinning in kipmid
945  * looking for something and not delaying between checks
946  */
947 #define IPMI_TIME_NOT_BUSY ns_to_ktime(-1ull)
948 static inline bool ipmi_thread_busy_wait(enum si_sm_result smi_result,
949 					 const struct smi_info *smi_info,
950 					 ktime_t *busy_until)
951 {
952 	unsigned int max_busy_us = 0;
953 
954 	if (smi_info->si_num < num_max_busy_us)
955 		max_busy_us = kipmid_max_busy_us[smi_info->si_num];
956 	if (max_busy_us == 0 || smi_result != SI_SM_CALL_WITH_DELAY)
957 		*busy_until = IPMI_TIME_NOT_BUSY;
958 	else if (*busy_until == IPMI_TIME_NOT_BUSY) {
959 		*busy_until = ktime_get() + max_busy_us * NSEC_PER_USEC;
960 	} else {
961 		if (unlikely(ktime_get() > *busy_until)) {
962 			*busy_until = IPMI_TIME_NOT_BUSY;
963 			return false;
964 		}
965 	}
966 	return true;
967 }
968 
969 
970 /*
971  * A busy-waiting loop for speeding up IPMI operation.
972  *
973  * Lousy hardware makes this hard.  This is only enabled for systems
974  * that are not BT and do not have interrupts.  It starts spinning
975  * when an operation is complete or until max_busy tells it to stop
976  * (if that is enabled).  See the paragraph on kimid_max_busy_us in
977  * Documentation/driver-api/ipmi.rst for details.
978  */
979 static int ipmi_thread(void *data)
980 {
981 	struct smi_info *smi_info = data;
982 	unsigned long flags;
983 	enum si_sm_result smi_result;
984 	ktime_t busy_until = IPMI_TIME_NOT_BUSY;
985 
986 	set_user_nice(current, MAX_NICE);
987 	while (!kthread_should_stop()) {
988 		int busy_wait;
989 
990 		spin_lock_irqsave(&(smi_info->si_lock), flags);
991 		smi_result = smi_event_handler(smi_info, 0);
992 
993 		/*
994 		 * If the driver is doing something, there is a possible
995 		 * race with the timer.  If the timer handler see idle,
996 		 * and the thread here sees something else, the timer
997 		 * handler won't restart the timer even though it is
998 		 * required.  So start it here if necessary.
999 		 */
1000 		if (smi_result != SI_SM_IDLE && !smi_info->timer_running)
1001 			smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
1002 
1003 		spin_unlock_irqrestore(&(smi_info->si_lock), flags);
1004 		busy_wait = ipmi_thread_busy_wait(smi_result, smi_info,
1005 						  &busy_until);
1006 		if (smi_result == SI_SM_CALL_WITHOUT_DELAY) {
1007 			; /* do nothing */
1008 		} else if (smi_result == SI_SM_CALL_WITH_DELAY && busy_wait) {
1009 			/*
1010 			 * In maintenance mode we run as fast as
1011 			 * possible to allow firmware updates to
1012 			 * complete as fast as possible, but normally
1013 			 * don't bang on the scheduler.
1014 			 */
1015 			if (smi_info->in_maintenance_mode)
1016 				schedule();
1017 			else
1018 				usleep_range(100, 200);
1019 		} else if (smi_result == SI_SM_IDLE) {
1020 			if (atomic_read(&smi_info->need_watch)) {
1021 				schedule_timeout_interruptible(100);
1022 			} else {
1023 				/* Wait to be woken up when we are needed. */
1024 				__set_current_state(TASK_INTERRUPTIBLE);
1025 				schedule();
1026 			}
1027 		} else {
1028 			schedule_timeout_interruptible(1);
1029 		}
1030 	}
1031 	return 0;
1032 }
1033 
1034 
1035 static void poll(void *send_info)
1036 {
1037 	struct smi_info *smi_info = send_info;
1038 	unsigned long flags = 0;
1039 	bool run_to_completion = smi_info->run_to_completion;
1040 
1041 	/*
1042 	 * Make sure there is some delay in the poll loop so we can
1043 	 * drive time forward and timeout things.
1044 	 */
1045 	udelay(10);
1046 	if (!run_to_completion)
1047 		spin_lock_irqsave(&smi_info->si_lock, flags);
1048 	smi_event_handler(smi_info, 10);
1049 	if (!run_to_completion)
1050 		spin_unlock_irqrestore(&smi_info->si_lock, flags);
1051 }
1052 
1053 static void request_events(void *send_info)
1054 {
1055 	struct smi_info *smi_info = send_info;
1056 
1057 	if (!smi_info->has_event_buffer)
1058 		return;
1059 
1060 	atomic_set(&smi_info->req_events, 1);
1061 }
1062 
1063 static void set_need_watch(void *send_info, unsigned int watch_mask)
1064 {
1065 	struct smi_info *smi_info = send_info;
1066 	unsigned long flags;
1067 	int enable;
1068 
1069 	enable = !!watch_mask;
1070 
1071 	atomic_set(&smi_info->need_watch, enable);
1072 	spin_lock_irqsave(&smi_info->si_lock, flags);
1073 	check_start_timer_thread(smi_info);
1074 	spin_unlock_irqrestore(&smi_info->si_lock, flags);
1075 }
1076 
1077 static void smi_timeout(struct timer_list *t)
1078 {
1079 	struct smi_info   *smi_info = timer_container_of(smi_info, t,
1080 							 si_timer);
1081 	enum si_sm_result smi_result;
1082 	unsigned long     flags;
1083 	unsigned long     jiffies_now;
1084 	long              time_diff;
1085 	long		  timeout;
1086 
1087 	spin_lock_irqsave(&(smi_info->si_lock), flags);
1088 	debug_timestamp(smi_info, "Timer");
1089 
1090 	jiffies_now = jiffies;
1091 	time_diff = (((long)jiffies_now - (long)smi_info->last_timeout_jiffies)
1092 		     * SI_USEC_PER_JIFFY);
1093 	smi_result = smi_event_handler(smi_info, time_diff);
1094 
1095 	if ((smi_info->io.irq) && (!smi_info->interrupt_disabled)) {
1096 		/* Running with interrupts, only do long timeouts. */
1097 		timeout = jiffies + SI_TIMEOUT_JIFFIES;
1098 		smi_inc_stat(smi_info, long_timeouts);
1099 		goto do_mod_timer;
1100 	}
1101 
1102 	/*
1103 	 * If the state machine asks for a short delay, then shorten
1104 	 * the timer timeout.
1105 	 */
1106 	if (smi_result == SI_SM_CALL_WITH_DELAY) {
1107 		smi_inc_stat(smi_info, short_timeouts);
1108 		timeout = jiffies + 1;
1109 	} else {
1110 		smi_inc_stat(smi_info, long_timeouts);
1111 		timeout = jiffies + SI_TIMEOUT_JIFFIES;
1112 	}
1113 
1114 do_mod_timer:
1115 	if (smi_result != SI_SM_IDLE)
1116 		smi_mod_timer(smi_info, timeout);
1117 	else
1118 		smi_info->timer_running = false;
1119 	spin_unlock_irqrestore(&(smi_info->si_lock), flags);
1120 }
1121 
1122 irqreturn_t ipmi_si_irq_handler(int irq, void *data)
1123 {
1124 	struct smi_info *smi_info = data;
1125 	unsigned long   flags;
1126 
1127 	if (smi_info->io.si_info->type == SI_BT)
1128 		/* We need to clear the IRQ flag for the BT interface. */
1129 		smi_info->io.outputb(&smi_info->io, IPMI_BT_INTMASK_REG,
1130 				     IPMI_BT_INTMASK_CLEAR_IRQ_BIT
1131 				     | IPMI_BT_INTMASK_ENABLE_IRQ_BIT);
1132 
1133 	spin_lock_irqsave(&(smi_info->si_lock), flags);
1134 
1135 	smi_inc_stat(smi_info, interrupts);
1136 
1137 	debug_timestamp(smi_info, "Interrupt");
1138 
1139 	smi_event_handler(smi_info, 0);
1140 	spin_unlock_irqrestore(&(smi_info->si_lock), flags);
1141 	return IRQ_HANDLED;
1142 }
1143 
1144 static int smi_start_processing(void            *send_info,
1145 				struct ipmi_smi *intf)
1146 {
1147 	struct smi_info *new_smi = send_info;
1148 	int             enable = 0;
1149 
1150 	new_smi->intf = intf;
1151 
1152 	/* Set up the timer that drives the interface. */
1153 	timer_setup(&new_smi->si_timer, smi_timeout, 0);
1154 	new_smi->timer_can_start = true;
1155 	smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
1156 
1157 	/* Try to claim any interrupts. */
1158 	if (new_smi->io.irq_setup) {
1159 		new_smi->io.irq_handler_data = new_smi;
1160 		new_smi->io.irq_setup(&new_smi->io);
1161 	}
1162 
1163 	/*
1164 	 * Check if the user forcefully enabled the daemon.
1165 	 */
1166 	if (new_smi->si_num < num_force_kipmid)
1167 		enable = force_kipmid[new_smi->si_num];
1168 	/*
1169 	 * The BT interface is efficient enough to not need a thread,
1170 	 * and there is no need for a thread if we have interrupts.
1171 	 */
1172 	else if (new_smi->io.si_info->type != SI_BT && !new_smi->io.irq)
1173 		enable = 1;
1174 
1175 	if (enable) {
1176 		new_smi->thread = kthread_run(ipmi_thread, new_smi,
1177 					      "kipmi%d", new_smi->si_num);
1178 		if (IS_ERR(new_smi->thread)) {
1179 			dev_notice(new_smi->io.dev,
1180 				   "Could not start kernel thread due to error %ld, only using timers to drive the interface\n",
1181 				   PTR_ERR(new_smi->thread));
1182 			new_smi->thread = NULL;
1183 		}
1184 	}
1185 
1186 	return 0;
1187 }
1188 
1189 static int get_smi_info(void *send_info, struct ipmi_smi_info *data)
1190 {
1191 	struct smi_info *smi = send_info;
1192 
1193 	data->addr_src = smi->io.addr_source;
1194 	data->dev = smi->io.dev;
1195 	data->addr_info = smi->io.addr_info;
1196 	get_device(smi->io.dev);
1197 
1198 	return 0;
1199 }
1200 
1201 static void set_maintenance_mode(void *send_info, bool enable)
1202 {
1203 	struct smi_info   *smi_info = send_info;
1204 
1205 	if (!enable)
1206 		atomic_set(&smi_info->req_events, 0);
1207 	smi_info->in_maintenance_mode = enable;
1208 }
1209 
1210 static void shutdown_smi(void *send_info);
1211 static const struct ipmi_smi_handlers handlers = {
1212 	.owner                  = THIS_MODULE,
1213 	.start_processing       = smi_start_processing,
1214 	.shutdown               = shutdown_smi,
1215 	.get_smi_info		= get_smi_info,
1216 	.sender			= sender,
1217 	.request_events		= request_events,
1218 	.set_need_watch		= set_need_watch,
1219 	.set_maintenance_mode   = set_maintenance_mode,
1220 	.set_run_to_completion  = set_run_to_completion,
1221 	.flush_messages		= flush_messages,
1222 	.poll			= poll,
1223 };
1224 
1225 static LIST_HEAD(smi_infos);
1226 static DEFINE_MUTEX(smi_infos_lock);
1227 static int smi_num; /* Used to sequence the SMIs */
1228 
1229 static const char * const addr_space_to_str[] = { "i/o", "mem" };
1230 
1231 module_param_array(force_kipmid, int, &num_force_kipmid, 0);
1232 MODULE_PARM_DESC(force_kipmid,
1233 		 "Force the kipmi daemon to be enabled (1) or disabled(0).  Normally the IPMI driver auto-detects this, but the value may be overridden by this parm.");
1234 module_param(unload_when_empty, bool, 0);
1235 MODULE_PARM_DESC(unload_when_empty,
1236 		 "Unload the module if no interfaces are specified or found, default is 1.  Setting to 0 is useful for hot add of devices using hotmod.");
1237 module_param_array(kipmid_max_busy_us, uint, &num_max_busy_us, 0644);
1238 MODULE_PARM_DESC(kipmid_max_busy_us,
1239 		 "Max time (in microseconds) to busy-wait for IPMI data before sleeping. 0 (default) means to wait forever. Set to 100-500 if kipmid is using up a lot of CPU time.");
1240 
1241 void ipmi_irq_finish_setup(struct si_sm_io *io)
1242 {
1243 	if (io->si_info->type == SI_BT)
1244 		/* Enable the interrupt in the BT interface. */
1245 		io->outputb(io, IPMI_BT_INTMASK_REG,
1246 			    IPMI_BT_INTMASK_ENABLE_IRQ_BIT);
1247 }
1248 
1249 void ipmi_irq_start_cleanup(struct si_sm_io *io)
1250 {
1251 	if (io->si_info->type == SI_BT)
1252 		/* Disable the interrupt in the BT interface. */
1253 		io->outputb(io, IPMI_BT_INTMASK_REG, 0);
1254 }
1255 
1256 static void std_irq_cleanup(struct si_sm_io *io)
1257 {
1258 	ipmi_irq_start_cleanup(io);
1259 	free_irq(io->irq, io->irq_handler_data);
1260 }
1261 
1262 int ipmi_std_irq_setup(struct si_sm_io *io)
1263 {
1264 	int rv;
1265 
1266 	if (!io->irq)
1267 		return 0;
1268 
1269 	rv = request_irq(io->irq,
1270 			 ipmi_si_irq_handler,
1271 			 IRQF_SHARED,
1272 			 SI_DEVICE_NAME,
1273 			 io->irq_handler_data);
1274 	if (rv) {
1275 		dev_warn(io->dev, "%s unable to claim interrupt %d, running polled\n",
1276 			 SI_DEVICE_NAME, io->irq);
1277 		io->irq = 0;
1278 	} else {
1279 		io->irq_cleanup = std_irq_cleanup;
1280 		ipmi_irq_finish_setup(io);
1281 		dev_info(io->dev, "Using irq %d\n", io->irq);
1282 	}
1283 
1284 	return rv;
1285 }
1286 
1287 static int wait_for_msg_done(struct smi_info *smi_info)
1288 {
1289 	enum si_sm_result     smi_result;
1290 
1291 	smi_result = smi_info->handlers->event(smi_info->si_sm, 0);
1292 	for (;;) {
1293 		if (smi_result == SI_SM_CALL_WITH_DELAY ||
1294 		    smi_result == SI_SM_CALL_WITH_TICK_DELAY) {
1295 			schedule_timeout_uninterruptible(1);
1296 			smi_result = smi_info->handlers->event(
1297 				smi_info->si_sm, jiffies_to_usecs(1));
1298 		} else if (smi_result == SI_SM_CALL_WITHOUT_DELAY) {
1299 			smi_result = smi_info->handlers->event(
1300 				smi_info->si_sm, 0);
1301 		} else
1302 			break;
1303 	}
1304 	if (smi_result == SI_SM_HOSED)
1305 		/*
1306 		 * We couldn't get the state machine to run, so whatever's at
1307 		 * the port is probably not an IPMI SMI interface.
1308 		 */
1309 		return -ENODEV;
1310 
1311 	return 0;
1312 }
1313 
1314 static int try_get_dev_id(struct smi_info *smi_info)
1315 {
1316 	unsigned char         msg[2];
1317 	unsigned char         *resp;
1318 	unsigned long         resp_len;
1319 	int                   rv = 0;
1320 	unsigned int          retry_count = 0;
1321 
1322 	resp = kmalloc(IPMI_MAX_MSG_LENGTH, GFP_KERNEL);
1323 	if (!resp)
1324 		return -ENOMEM;
1325 
1326 	/*
1327 	 * Do a Get Device ID command, since it comes back with some
1328 	 * useful info.
1329 	 */
1330 	msg[0] = IPMI_NETFN_APP_REQUEST << 2;
1331 	msg[1] = IPMI_GET_DEVICE_ID_CMD;
1332 
1333 retry:
1334 	smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
1335 
1336 	rv = wait_for_msg_done(smi_info);
1337 	if (rv)
1338 		goto out;
1339 
1340 	resp_len = smi_info->handlers->get_result(smi_info->si_sm,
1341 						  resp, IPMI_MAX_MSG_LENGTH);
1342 
1343 	/* Check and record info from the get device id, in case we need it. */
1344 	rv = ipmi_demangle_device_id(resp[0] >> 2, resp[1],
1345 			resp + 2, resp_len - 2, &smi_info->device_id);
1346 	if (rv) {
1347 		/* record completion code */
1348 		unsigned char cc = *(resp + 2);
1349 
1350 		if (cc != IPMI_CC_NO_ERROR &&
1351 		    ++retry_count <= GET_DEVICE_ID_MAX_RETRY) {
1352 			dev_warn_ratelimited(smi_info->io.dev,
1353 			    "BMC returned 0x%2.2x, retry get bmc device id\n",
1354 			    cc);
1355 			goto retry;
1356 		}
1357 	}
1358 
1359 out:
1360 	kfree(resp);
1361 	return rv;
1362 }
1363 
1364 static int get_global_enables(struct smi_info *smi_info, u8 *enables)
1365 {
1366 	unsigned char         msg[3];
1367 	unsigned char         *resp;
1368 	unsigned long         resp_len;
1369 	int                   rv;
1370 
1371 	resp = kmalloc(IPMI_MAX_MSG_LENGTH, GFP_KERNEL);
1372 	if (!resp)
1373 		return -ENOMEM;
1374 
1375 	msg[0] = IPMI_NETFN_APP_REQUEST << 2;
1376 	msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
1377 	smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
1378 
1379 	rv = wait_for_msg_done(smi_info);
1380 	if (rv) {
1381 		dev_warn(smi_info->io.dev,
1382 			 "Error getting response from get global enables command: %d\n",
1383 			 rv);
1384 		goto out;
1385 	}
1386 
1387 	resp_len = smi_info->handlers->get_result(smi_info->si_sm,
1388 						  resp, IPMI_MAX_MSG_LENGTH);
1389 
1390 	if (resp_len < 4 ||
1391 			resp[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2 ||
1392 			resp[1] != IPMI_GET_BMC_GLOBAL_ENABLES_CMD   ||
1393 			resp[2] != 0) {
1394 		dev_warn(smi_info->io.dev,
1395 			 "Invalid return from get global enables command: %ld %x %x %x\n",
1396 			 resp_len, resp[0], resp[1], resp[2]);
1397 		rv = -EINVAL;
1398 		goto out;
1399 	} else {
1400 		*enables = resp[3];
1401 	}
1402 
1403 out:
1404 	kfree(resp);
1405 	return rv;
1406 }
1407 
1408 /*
1409  * Returns 1 if it gets an error from the command.
1410  */
1411 static int set_global_enables(struct smi_info *smi_info, u8 enables)
1412 {
1413 	unsigned char         msg[3];
1414 	unsigned char         *resp;
1415 	unsigned long         resp_len;
1416 	int                   rv;
1417 
1418 	resp = kmalloc(IPMI_MAX_MSG_LENGTH, GFP_KERNEL);
1419 	if (!resp)
1420 		return -ENOMEM;
1421 
1422 	msg[0] = IPMI_NETFN_APP_REQUEST << 2;
1423 	msg[1] = IPMI_SET_BMC_GLOBAL_ENABLES_CMD;
1424 	msg[2] = enables;
1425 	smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3);
1426 
1427 	rv = wait_for_msg_done(smi_info);
1428 	if (rv) {
1429 		dev_warn(smi_info->io.dev,
1430 			 "Error getting response from set global enables command: %d\n",
1431 			 rv);
1432 		goto out;
1433 	}
1434 
1435 	resp_len = smi_info->handlers->get_result(smi_info->si_sm,
1436 						  resp, IPMI_MAX_MSG_LENGTH);
1437 
1438 	if (resp_len < 3 ||
1439 			resp[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2 ||
1440 			resp[1] != IPMI_SET_BMC_GLOBAL_ENABLES_CMD) {
1441 		dev_warn(smi_info->io.dev,
1442 			 "Invalid return from set global enables command: %ld %x %x\n",
1443 			 resp_len, resp[0], resp[1]);
1444 		rv = -EINVAL;
1445 		goto out;
1446 	}
1447 
1448 	if (resp[2] != 0)
1449 		rv = 1;
1450 
1451 out:
1452 	kfree(resp);
1453 	return rv;
1454 }
1455 
1456 /*
1457  * Some BMCs do not support clearing the receive irq bit in the global
1458  * enables (even if they don't support interrupts on the BMC).  Check
1459  * for this and handle it properly.
1460  */
1461 static void check_clr_rcv_irq(struct smi_info *smi_info)
1462 {
1463 	u8 enables = 0;
1464 	int rv;
1465 
1466 	rv = get_global_enables(smi_info, &enables);
1467 	if (!rv) {
1468 		if ((enables & IPMI_BMC_RCV_MSG_INTR) == 0)
1469 			/* Already clear, should work ok. */
1470 			return;
1471 
1472 		enables &= ~IPMI_BMC_RCV_MSG_INTR;
1473 		rv = set_global_enables(smi_info, enables);
1474 	}
1475 
1476 	if (rv < 0) {
1477 		dev_err(smi_info->io.dev,
1478 			"Cannot check clearing the rcv irq: %d\n", rv);
1479 		return;
1480 	}
1481 
1482 	if (rv) {
1483 		/*
1484 		 * An error when setting the event buffer bit means
1485 		 * clearing the bit is not supported.
1486 		 */
1487 		dev_warn(smi_info->io.dev,
1488 			 "The BMC does not support clearing the recv irq bit, compensating, but the BMC needs to be fixed.\n");
1489 		smi_info->cannot_disable_irq = true;
1490 	}
1491 }
1492 
1493 /*
1494  * Some BMCs do not support setting the interrupt bits in the global
1495  * enables even if they support interrupts.  Clearly bad, but we can
1496  * compensate.
1497  */
1498 static void check_set_rcv_irq(struct smi_info *smi_info)
1499 {
1500 	u8 enables = 0;
1501 	int rv;
1502 
1503 	if (!smi_info->io.irq)
1504 		return;
1505 
1506 	rv = get_global_enables(smi_info, &enables);
1507 	if (!rv) {
1508 		enables |= IPMI_BMC_RCV_MSG_INTR;
1509 		rv = set_global_enables(smi_info, enables);
1510 	}
1511 
1512 	if (rv < 0) {
1513 		dev_err(smi_info->io.dev,
1514 			"Cannot check setting the rcv irq: %d\n", rv);
1515 		return;
1516 	}
1517 
1518 	if (rv) {
1519 		/*
1520 		 * An error when setting the event buffer bit means
1521 		 * setting the bit is not supported.
1522 		 */
1523 		dev_warn(smi_info->io.dev,
1524 			 "The BMC does not support setting the recv irq bit, compensating, but the BMC needs to be fixed.\n");
1525 		smi_info->cannot_disable_irq = true;
1526 		smi_info->irq_enable_broken = true;
1527 	}
1528 }
1529 
1530 static int try_enable_event_buffer(struct smi_info *smi_info)
1531 {
1532 	unsigned char         msg[3];
1533 	unsigned char         *resp;
1534 	unsigned long         resp_len;
1535 	int                   rv = 0;
1536 
1537 	resp = kmalloc(IPMI_MAX_MSG_LENGTH, GFP_KERNEL);
1538 	if (!resp)
1539 		return -ENOMEM;
1540 
1541 	msg[0] = IPMI_NETFN_APP_REQUEST << 2;
1542 	msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
1543 	smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
1544 
1545 	rv = wait_for_msg_done(smi_info);
1546 	if (rv) {
1547 		pr_warn("Error getting response from get global enables command, the event buffer is not enabled\n");
1548 		goto out;
1549 	}
1550 
1551 	resp_len = smi_info->handlers->get_result(smi_info->si_sm,
1552 						  resp, IPMI_MAX_MSG_LENGTH);
1553 
1554 	if (resp_len < 4 ||
1555 			resp[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2 ||
1556 			resp[1] != IPMI_GET_BMC_GLOBAL_ENABLES_CMD   ||
1557 			resp[2] != 0) {
1558 		pr_warn("Invalid return from get global enables command, cannot enable the event buffer\n");
1559 		rv = -EINVAL;
1560 		goto out;
1561 	}
1562 
1563 	if (resp[3] & IPMI_BMC_EVT_MSG_BUFF) {
1564 		/* buffer is already enabled, nothing to do. */
1565 		smi_info->supports_event_msg_buff = true;
1566 		goto out;
1567 	}
1568 
1569 	msg[0] = IPMI_NETFN_APP_REQUEST << 2;
1570 	msg[1] = IPMI_SET_BMC_GLOBAL_ENABLES_CMD;
1571 	msg[2] = resp[3] | IPMI_BMC_EVT_MSG_BUFF;
1572 	smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3);
1573 
1574 	rv = wait_for_msg_done(smi_info);
1575 	if (rv) {
1576 		pr_warn("Error getting response from set global, enables command, the event buffer is not enabled\n");
1577 		goto out;
1578 	}
1579 
1580 	resp_len = smi_info->handlers->get_result(smi_info->si_sm,
1581 						  resp, IPMI_MAX_MSG_LENGTH);
1582 
1583 	if (resp_len < 3 ||
1584 			resp[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2 ||
1585 			resp[1] != IPMI_SET_BMC_GLOBAL_ENABLES_CMD) {
1586 		pr_warn("Invalid return from get global, enables command, not enable the event buffer\n");
1587 		rv = -EINVAL;
1588 		goto out;
1589 	}
1590 
1591 	if (resp[2] != 0)
1592 		/*
1593 		 * An error when setting the event buffer bit means
1594 		 * that the event buffer is not supported.
1595 		 */
1596 		rv = -ENOENT;
1597 	else
1598 		smi_info->supports_event_msg_buff = true;
1599 
1600 out:
1601 	kfree(resp);
1602 	return rv;
1603 }
1604 
1605 #define IPMI_SI_ATTR(name) \
1606 static ssize_t name##_show(struct device *dev,			\
1607 			   struct device_attribute *attr,		\
1608 			   char *buf)					\
1609 {									\
1610 	struct smi_info *smi_info = dev_get_drvdata(dev);		\
1611 									\
1612 	return sysfs_emit(buf, "%u\n", smi_get_stat(smi_info, name));	\
1613 }									\
1614 static DEVICE_ATTR_RO(name)
1615 
1616 static ssize_t type_show(struct device *dev,
1617 			 struct device_attribute *attr,
1618 			 char *buf)
1619 {
1620 	struct smi_info *smi_info = dev_get_drvdata(dev);
1621 
1622 	return sysfs_emit(buf, "%s\n", si_to_str[smi_info->io.si_info->type]);
1623 }
1624 static DEVICE_ATTR_RO(type);
1625 
1626 static ssize_t interrupts_enabled_show(struct device *dev,
1627 				       struct device_attribute *attr,
1628 				       char *buf)
1629 {
1630 	struct smi_info *smi_info = dev_get_drvdata(dev);
1631 	int enabled = smi_info->io.irq && !smi_info->interrupt_disabled;
1632 
1633 	return sysfs_emit(buf, "%d\n", enabled);
1634 }
1635 static DEVICE_ATTR_RO(interrupts_enabled);
1636 
1637 IPMI_SI_ATTR(short_timeouts);
1638 IPMI_SI_ATTR(long_timeouts);
1639 IPMI_SI_ATTR(idles);
1640 IPMI_SI_ATTR(interrupts);
1641 IPMI_SI_ATTR(attentions);
1642 IPMI_SI_ATTR(flag_fetches);
1643 IPMI_SI_ATTR(hosed_count);
1644 IPMI_SI_ATTR(complete_transactions);
1645 IPMI_SI_ATTR(events);
1646 IPMI_SI_ATTR(watchdog_pretimeouts);
1647 IPMI_SI_ATTR(incoming_messages);
1648 
1649 static ssize_t params_show(struct device *dev,
1650 			   struct device_attribute *attr,
1651 			   char *buf)
1652 {
1653 	struct smi_info *smi_info = dev_get_drvdata(dev);
1654 
1655 	return sysfs_emit(buf,
1656 			"%s,%s,0x%lx,rsp=%d,rsi=%d,rsh=%d,irq=%d,ipmb=%d\n",
1657 			si_to_str[smi_info->io.si_info->type],
1658 			addr_space_to_str[smi_info->io.addr_space],
1659 			smi_info->io.addr_data,
1660 			smi_info->io.regspacing,
1661 			smi_info->io.regsize,
1662 			smi_info->io.regshift,
1663 			smi_info->io.irq,
1664 			smi_info->io.slave_addr);
1665 }
1666 static DEVICE_ATTR_RO(params);
1667 
1668 static struct attribute *ipmi_si_dev_attrs[] = {
1669 	&dev_attr_type.attr,
1670 	&dev_attr_interrupts_enabled.attr,
1671 	&dev_attr_short_timeouts.attr,
1672 	&dev_attr_long_timeouts.attr,
1673 	&dev_attr_idles.attr,
1674 	&dev_attr_interrupts.attr,
1675 	&dev_attr_attentions.attr,
1676 	&dev_attr_flag_fetches.attr,
1677 	&dev_attr_hosed_count.attr,
1678 	&dev_attr_complete_transactions.attr,
1679 	&dev_attr_events.attr,
1680 	&dev_attr_watchdog_pretimeouts.attr,
1681 	&dev_attr_incoming_messages.attr,
1682 	&dev_attr_params.attr,
1683 	NULL
1684 };
1685 
1686 static const struct attribute_group ipmi_si_dev_attr_group = {
1687 	.attrs		= ipmi_si_dev_attrs,
1688 };
1689 
1690 /*
1691  * oem_data_avail_to_receive_msg_avail
1692  * @info - smi_info structure with msg_flags set
1693  *
1694  * Converts flags from OEM_DATA_AVAIL to RECEIVE_MSG_AVAIL
1695  * Returns 1 indicating need to re-run handle_flags().
1696  */
1697 static int oem_data_avail_to_receive_msg_avail(struct smi_info *smi_info)
1698 {
1699 	smi_info->msg_flags = ((smi_info->msg_flags & ~OEM_DATA_AVAIL) |
1700 			       RECEIVE_MSG_AVAIL);
1701 	return 1;
1702 }
1703 
1704 /*
1705  * setup_dell_poweredge_oem_data_handler
1706  * @info - smi_info.device_id must be populated
1707  *
1708  * Systems that match, but have firmware version < 1.40 may assert
1709  * OEM0_DATA_AVAIL on their own, without being told via Set Flags that
1710  * it's safe to do so.  Such systems will de-assert OEM1_DATA_AVAIL
1711  * upon receipt of IPMI_GET_MSG_CMD, so we should treat these flags
1712  * as RECEIVE_MSG_AVAIL instead.
1713  *
1714  * As Dell has no plans to release IPMI 1.5 firmware that *ever*
1715  * assert the OEM[012] bits, and if it did, the driver would have to
1716  * change to handle that properly, we don't actually check for the
1717  * firmware version.
1718  * Device ID = 0x20                BMC on PowerEdge 8G servers
1719  * Device Revision = 0x80
1720  * Firmware Revision1 = 0x01       BMC version 1.40
1721  * Firmware Revision2 = 0x40       BCD encoded
1722  * IPMI Version = 0x51             IPMI 1.5
1723  * Manufacturer ID = A2 02 00      Dell IANA
1724  *
1725  * Additionally, PowerEdge systems with IPMI < 1.5 may also assert
1726  * OEM0_DATA_AVAIL and needs to be treated as RECEIVE_MSG_AVAIL.
1727  *
1728  */
1729 #define DELL_POWEREDGE_8G_BMC_DEVICE_ID  0x20
1730 #define DELL_POWEREDGE_8G_BMC_DEVICE_REV 0x80
1731 #define DELL_POWEREDGE_8G_BMC_IPMI_VERSION 0x51
1732 #define DELL_IANA_MFR_ID 0x0002a2
1733 static void setup_dell_poweredge_oem_data_handler(struct smi_info *smi_info)
1734 {
1735 	struct ipmi_device_id *id = &smi_info->device_id;
1736 	if (id->manufacturer_id == DELL_IANA_MFR_ID) {
1737 		if (id->device_id       == DELL_POWEREDGE_8G_BMC_DEVICE_ID  &&
1738 		    id->device_revision == DELL_POWEREDGE_8G_BMC_DEVICE_REV &&
1739 		    id->ipmi_version   == DELL_POWEREDGE_8G_BMC_IPMI_VERSION) {
1740 			smi_info->oem_data_avail_handler =
1741 				oem_data_avail_to_receive_msg_avail;
1742 		} else if (ipmi_version_major(id) < 1 ||
1743 			   (ipmi_version_major(id) == 1 &&
1744 			    ipmi_version_minor(id) < 5)) {
1745 			smi_info->oem_data_avail_handler =
1746 				oem_data_avail_to_receive_msg_avail;
1747 		}
1748 	}
1749 }
1750 
1751 #define CANNOT_RETURN_REQUESTED_LENGTH 0xCA
1752 static void return_hosed_msg_badsize(struct smi_info *smi_info)
1753 {
1754 	struct ipmi_smi_msg *msg = smi_info->curr_msg;
1755 
1756 	/* Make it a response */
1757 	msg->rsp[0] = msg->data[0] | 4;
1758 	msg->rsp[1] = msg->data[1];
1759 	msg->rsp[2] = CANNOT_RETURN_REQUESTED_LENGTH;
1760 	msg->rsp_size = 3;
1761 	smi_info->curr_msg = NULL;
1762 	deliver_recv_msg(smi_info, msg);
1763 }
1764 
1765 /*
1766  * dell_poweredge_bt_xaction_handler
1767  * @info - smi_info.device_id must be populated
1768  *
1769  * Dell PowerEdge servers with the BT interface (x6xx and 1750) will
1770  * not respond to a Get SDR command if the length of the data
1771  * requested is exactly 0x3A, which leads to command timeouts and no
1772  * data returned.  This intercepts such commands, and causes userspace
1773  * callers to try again with a different-sized buffer, which succeeds.
1774  */
1775 
1776 #define STORAGE_NETFN 0x0A
1777 #define STORAGE_CMD_GET_SDR 0x23
1778 static int dell_poweredge_bt_xaction_handler(struct notifier_block *self,
1779 					     unsigned long unused,
1780 					     void *in)
1781 {
1782 	struct smi_info *smi_info = in;
1783 	unsigned char *data = smi_info->curr_msg->data;
1784 	unsigned int size   = smi_info->curr_msg->data_size;
1785 	if (size >= 8 &&
1786 	    (data[0]>>2) == STORAGE_NETFN &&
1787 	    data[1] == STORAGE_CMD_GET_SDR &&
1788 	    data[7] == 0x3A) {
1789 		return_hosed_msg_badsize(smi_info);
1790 		return NOTIFY_STOP;
1791 	}
1792 	return NOTIFY_DONE;
1793 }
1794 
1795 static struct notifier_block dell_poweredge_bt_xaction_notifier = {
1796 	.notifier_call	= dell_poweredge_bt_xaction_handler,
1797 };
1798 
1799 /*
1800  * setup_dell_poweredge_bt_xaction_handler
1801  * @info - smi_info.device_id must be filled in already
1802  *
1803  * Fills in smi_info.device_id.start_transaction_pre_hook
1804  * when we know what function to use there.
1805  */
1806 static void
1807 setup_dell_poweredge_bt_xaction_handler(struct smi_info *smi_info)
1808 {
1809 	struct ipmi_device_id *id = &smi_info->device_id;
1810 	if (id->manufacturer_id == DELL_IANA_MFR_ID &&
1811 	    smi_info->io.si_info->type == SI_BT)
1812 		register_xaction_notifier(&dell_poweredge_bt_xaction_notifier);
1813 }
1814 
1815 /*
1816  * setup_oem_data_handler
1817  * @info - smi_info.device_id must be filled in already
1818  *
1819  * Fills in smi_info.device_id.oem_data_available_handler
1820  * when we know what function to use there.
1821  */
1822 
1823 static void setup_oem_data_handler(struct smi_info *smi_info)
1824 {
1825 	setup_dell_poweredge_oem_data_handler(smi_info);
1826 }
1827 
1828 static void setup_xaction_handlers(struct smi_info *smi_info)
1829 {
1830 	setup_dell_poweredge_bt_xaction_handler(smi_info);
1831 }
1832 
1833 static void check_for_broken_irqs(struct smi_info *smi_info)
1834 {
1835 	check_clr_rcv_irq(smi_info);
1836 	check_set_rcv_irq(smi_info);
1837 }
1838 
1839 static inline void stop_timer_and_thread(struct smi_info *smi_info)
1840 {
1841 	if (smi_info->thread != NULL) {
1842 		kthread_stop(smi_info->thread);
1843 		smi_info->thread = NULL;
1844 	}
1845 
1846 	smi_info->timer_can_start = false;
1847 	timer_delete_sync(&smi_info->si_timer);
1848 }
1849 
1850 static struct smi_info *find_dup_si(struct smi_info *info)
1851 {
1852 	struct smi_info *e;
1853 
1854 	list_for_each_entry(e, &smi_infos, link) {
1855 		if (e->io.addr_space != info->io.addr_space)
1856 			continue;
1857 		if (e->io.addr_data == info->io.addr_data) {
1858 			/*
1859 			 * This is a cheap hack, ACPI doesn't have a defined
1860 			 * slave address but SMBIOS does.  Pick it up from
1861 			 * any source that has it available.
1862 			 */
1863 			if (info->io.slave_addr && !e->io.slave_addr)
1864 				e->io.slave_addr = info->io.slave_addr;
1865 			return e;
1866 		}
1867 	}
1868 
1869 	return NULL;
1870 }
1871 
1872 int ipmi_si_add_smi(struct si_sm_io *io)
1873 {
1874 	int rv = 0;
1875 	struct smi_info *new_smi, *dup;
1876 
1877 	/*
1878 	 * If the user gave us a hard-coded device at the same
1879 	 * address, they presumably want us to use it and not what is
1880 	 * in the firmware.
1881 	 */
1882 	if (io->addr_source != SI_HARDCODED && io->addr_source != SI_HOTMOD &&
1883 	    ipmi_si_hardcode_match(io->addr_space, io->addr_data)) {
1884 		dev_info(io->dev,
1885 			 "Hard-coded device at this address already exists");
1886 		return -ENODEV;
1887 	}
1888 
1889 	if (!io->io_setup) {
1890 		if (IS_ENABLED(CONFIG_HAS_IOPORT) &&
1891 		    io->addr_space == IPMI_IO_ADDR_SPACE) {
1892 			io->io_setup = ipmi_si_port_setup;
1893 		} else if (io->addr_space == IPMI_MEM_ADDR_SPACE) {
1894 			io->io_setup = ipmi_si_mem_setup;
1895 		} else {
1896 			return -EINVAL;
1897 		}
1898 	}
1899 
1900 	new_smi = kzalloc(sizeof(*new_smi), GFP_KERNEL);
1901 	if (!new_smi)
1902 		return -ENOMEM;
1903 	spin_lock_init(&new_smi->si_lock);
1904 
1905 	new_smi->io = *io;
1906 
1907 	mutex_lock(&smi_infos_lock);
1908 	dup = find_dup_si(new_smi);
1909 	if (dup) {
1910 		if (new_smi->io.addr_source == SI_ACPI &&
1911 		    dup->io.addr_source == SI_SMBIOS) {
1912 			/* We prefer ACPI over SMBIOS. */
1913 			dev_info(dup->io.dev,
1914 				 "Removing SMBIOS-specified %s state machine in favor of ACPI\n",
1915 				 si_to_str[new_smi->io.si_info->type]);
1916 			cleanup_one_si(dup);
1917 		} else {
1918 			dev_info(new_smi->io.dev,
1919 				 "%s-specified %s state machine: duplicate\n",
1920 				 ipmi_addr_src_to_str(new_smi->io.addr_source),
1921 				 si_to_str[new_smi->io.si_info->type]);
1922 			rv = -EBUSY;
1923 			kfree(new_smi);
1924 			goto out_err;
1925 		}
1926 	}
1927 
1928 	pr_info("Adding %s-specified %s state machine\n",
1929 		ipmi_addr_src_to_str(new_smi->io.addr_source),
1930 		si_to_str[new_smi->io.si_info->type]);
1931 
1932 	list_add_tail(&new_smi->link, &smi_infos);
1933 
1934 	if (initialized)
1935 		rv = try_smi_init(new_smi);
1936 out_err:
1937 	mutex_unlock(&smi_infos_lock);
1938 	return rv;
1939 }
1940 
1941 /*
1942  * Try to start up an interface.  Must be called with smi_infos_lock
1943  * held, primarily to keep smi_num consistent, we only one to do these
1944  * one at a time.
1945  */
1946 static int try_smi_init(struct smi_info *new_smi)
1947 {
1948 	int rv = 0;
1949 	int i;
1950 
1951 	pr_info("Trying %s-specified %s state machine at %s address 0x%lx, slave address 0x%x, irq %d\n",
1952 		ipmi_addr_src_to_str(new_smi->io.addr_source),
1953 		si_to_str[new_smi->io.si_info->type],
1954 		addr_space_to_str[new_smi->io.addr_space],
1955 		new_smi->io.addr_data,
1956 		new_smi->io.slave_addr, new_smi->io.irq);
1957 
1958 	switch (new_smi->io.si_info->type) {
1959 	case SI_KCS:
1960 		new_smi->handlers = &kcs_smi_handlers;
1961 		break;
1962 
1963 	case SI_SMIC:
1964 		new_smi->handlers = &smic_smi_handlers;
1965 		break;
1966 
1967 	case SI_BT:
1968 		new_smi->handlers = &bt_smi_handlers;
1969 		break;
1970 
1971 	default:
1972 		/* No support for anything else yet. */
1973 		rv = -EIO;
1974 		goto out_err;
1975 	}
1976 
1977 	new_smi->si_num = smi_num;
1978 
1979 	/* Do this early so it's available for logs. */
1980 	if (!new_smi->io.dev) {
1981 		pr_err("IPMI interface added with no device\n");
1982 		rv = -EIO;
1983 		goto out_err;
1984 	}
1985 
1986 	/* Allocate the state machine's data and initialize it. */
1987 	new_smi->si_sm = kmalloc(new_smi->handlers->size(), GFP_KERNEL);
1988 	if (!new_smi->si_sm) {
1989 		rv = -ENOMEM;
1990 		goto out_err;
1991 	}
1992 	new_smi->io.io_size = new_smi->handlers->init_data(new_smi->si_sm,
1993 							   &new_smi->io);
1994 
1995 	/* Now that we know the I/O size, we can set up the I/O. */
1996 	rv = new_smi->io.io_setup(&new_smi->io);
1997 	if (rv) {
1998 		dev_err(new_smi->io.dev, "Could not set up I/O space\n");
1999 		goto out_err;
2000 	}
2001 
2002 	/* Do low-level detection first. */
2003 	if (new_smi->handlers->detect(new_smi->si_sm)) {
2004 		if (new_smi->io.addr_source)
2005 			dev_err(new_smi->io.dev,
2006 				"Interface detection failed\n");
2007 		rv = -ENODEV;
2008 		goto out_err;
2009 	}
2010 
2011 	/*
2012 	 * Attempt a get device id command.  If it fails, we probably
2013 	 * don't have a BMC here.
2014 	 */
2015 	rv = try_get_dev_id(new_smi);
2016 	if (rv) {
2017 		if (new_smi->io.addr_source)
2018 			dev_err(new_smi->io.dev,
2019 			       "There appears to be no BMC at this location\n");
2020 		goto out_err;
2021 	}
2022 
2023 	setup_oem_data_handler(new_smi);
2024 	setup_xaction_handlers(new_smi);
2025 	check_for_broken_irqs(new_smi);
2026 
2027 	new_smi->waiting_msg = NULL;
2028 	new_smi->curr_msg = NULL;
2029 	atomic_set(&new_smi->req_events, 0);
2030 	new_smi->run_to_completion = false;
2031 	for (i = 0; i < SI_NUM_STATS; i++)
2032 		atomic_set(&new_smi->stats[i], 0);
2033 
2034 	new_smi->interrupt_disabled = true;
2035 	atomic_set(&new_smi->need_watch, 0);
2036 
2037 	rv = try_enable_event_buffer(new_smi);
2038 	if (rv == 0)
2039 		new_smi->has_event_buffer = true;
2040 
2041 	/*
2042 	 * Start clearing the flags before we enable interrupts or the
2043 	 * timer to avoid racing with the timer.
2044 	 */
2045 	start_clear_flags(new_smi);
2046 
2047 	/*
2048 	 * IRQ is defined to be set when non-zero.  req_events will
2049 	 * cause a global flags check that will enable interrupts.
2050 	 */
2051 	if (new_smi->io.irq) {
2052 		new_smi->interrupt_disabled = false;
2053 		atomic_set(&new_smi->req_events, 1);
2054 	}
2055 
2056 	dev_set_drvdata(new_smi->io.dev, new_smi);
2057 	rv = device_add_group(new_smi->io.dev, &ipmi_si_dev_attr_group);
2058 	if (rv) {
2059 		dev_err(new_smi->io.dev,
2060 			"Unable to add device attributes: error %d\n",
2061 			rv);
2062 		goto out_err;
2063 	}
2064 	new_smi->dev_group_added = true;
2065 
2066 	rv = ipmi_register_smi(&handlers,
2067 			       new_smi,
2068 			       new_smi->io.dev,
2069 			       new_smi->io.slave_addr);
2070 	if (rv) {
2071 		dev_err(new_smi->io.dev,
2072 			"Unable to register device: error %d\n",
2073 			rv);
2074 		goto out_err;
2075 	}
2076 
2077 	/* Don't increment till we know we have succeeded. */
2078 	smi_num++;
2079 
2080 	dev_info(new_smi->io.dev, "IPMI %s interface initialized\n",
2081 		 si_to_str[new_smi->io.si_info->type]);
2082 
2083 	WARN_ON(new_smi->io.dev->init_name != NULL);
2084 
2085  out_err:
2086 	if (rv && new_smi->io.io_cleanup) {
2087 		new_smi->io.io_cleanup(&new_smi->io);
2088 		new_smi->io.io_cleanup = NULL;
2089 	}
2090 
2091 	if (rv && new_smi->si_sm) {
2092 		kfree(new_smi->si_sm);
2093 		new_smi->si_sm = NULL;
2094 	}
2095 
2096 	return rv;
2097 }
2098 
2099 /*
2100  * Devices in the same address space at the same address are the same.
2101  */
2102 static bool __init ipmi_smi_info_same(struct smi_info *e1, struct smi_info *e2)
2103 {
2104 	return (e1->io.addr_space == e2->io.addr_space &&
2105 		e1->io.addr_data == e2->io.addr_data);
2106 }
2107 
2108 static int __init init_ipmi_si(void)
2109 {
2110 	struct smi_info *e, *e2;
2111 	enum ipmi_addr_src type = SI_INVALID;
2112 
2113 	if (initialized)
2114 		return 0;
2115 
2116 	ipmi_hardcode_init();
2117 
2118 	pr_info("IPMI System Interface driver\n");
2119 
2120 	ipmi_si_platform_init();
2121 
2122 	ipmi_si_pci_init();
2123 
2124 	ipmi_si_parisc_init();
2125 
2126 	mutex_lock(&smi_infos_lock);
2127 
2128 	/*
2129 	 * Scan through all the devices.  We prefer devices with
2130 	 * interrupts, so go through those first in case there are any
2131 	 * duplicates that don't have the interrupt set.
2132 	 */
2133 	list_for_each_entry(e, &smi_infos, link) {
2134 		bool dup = false;
2135 
2136 		/* Register ones with interrupts first. */
2137 		if (!e->io.irq)
2138 			continue;
2139 
2140 		/*
2141 		 * Go through the ones we have already seen to see if this
2142 		 * is a dup.
2143 		 */
2144 		list_for_each_entry(e2, &smi_infos, link) {
2145 			if (e2 == e)
2146 				break;
2147 			if (e2->io.irq && ipmi_smi_info_same(e, e2)) {
2148 				dup = true;
2149 				break;
2150 			}
2151 		}
2152 		if (!dup)
2153 			try_smi_init(e);
2154 	}
2155 
2156 	/*
2157 	 * Now try devices without interrupts.
2158 	 */
2159 	list_for_each_entry(e, &smi_infos, link) {
2160 		bool dup = false;
2161 
2162 		if (e->io.irq)
2163 			continue;
2164 
2165 		/*
2166 		 * Go through the ones we have already seen to see if
2167 		 * this is a dup.  We have already looked at the ones
2168 		 * with interrupts.
2169 		 */
2170 		list_for_each_entry(e2, &smi_infos, link) {
2171 			if (!e2->io.irq)
2172 				continue;
2173 			if (ipmi_smi_info_same(e, e2)) {
2174 				dup = true;
2175 				break;
2176 			}
2177 		}
2178 		list_for_each_entry(e2, &smi_infos, link) {
2179 			if (e2 == e)
2180 				break;
2181 			if (ipmi_smi_info_same(e, e2)) {
2182 				dup = true;
2183 				break;
2184 			}
2185 		}
2186 		if (!dup)
2187 			try_smi_init(e);
2188 	}
2189 
2190 	initialized = true;
2191 	mutex_unlock(&smi_infos_lock);
2192 
2193 	if (type)
2194 		return 0;
2195 
2196 	mutex_lock(&smi_infos_lock);
2197 	if (unload_when_empty && list_empty(&smi_infos)) {
2198 		mutex_unlock(&smi_infos_lock);
2199 		cleanup_ipmi_si();
2200 		pr_warn("Unable to find any System Interface(s)\n");
2201 		return -ENODEV;
2202 	} else {
2203 		mutex_unlock(&smi_infos_lock);
2204 		return 0;
2205 	}
2206 }
2207 module_init(init_ipmi_si);
2208 
2209 static void wait_msg_processed(struct smi_info *smi_info)
2210 {
2211 	unsigned long jiffies_now;
2212 	long time_diff;
2213 
2214 	while (smi_info->curr_msg || (smi_info->si_state != SI_NORMAL)) {
2215 		jiffies_now = jiffies;
2216 		time_diff = (((long)jiffies_now - (long)smi_info->last_timeout_jiffies)
2217 		     * SI_USEC_PER_JIFFY);
2218 		smi_event_handler(smi_info, time_diff);
2219 		schedule_timeout_uninterruptible(1);
2220 	}
2221 }
2222 
2223 static void shutdown_smi(void *send_info)
2224 {
2225 	struct smi_info *smi_info = send_info;
2226 
2227 	if (smi_info->dev_group_added) {
2228 		device_remove_group(smi_info->io.dev, &ipmi_si_dev_attr_group);
2229 		smi_info->dev_group_added = false;
2230 	}
2231 	if (smi_info->io.dev)
2232 		dev_set_drvdata(smi_info->io.dev, NULL);
2233 
2234 	/*
2235 	 * Make sure that interrupts, the timer and the thread are
2236 	 * stopped and will not run again.
2237 	 */
2238 	smi_info->interrupt_disabled = true;
2239 	if (smi_info->io.irq_cleanup) {
2240 		smi_info->io.irq_cleanup(&smi_info->io);
2241 		smi_info->io.irq_cleanup = NULL;
2242 	}
2243 	stop_timer_and_thread(smi_info);
2244 
2245 	/*
2246 	 * Wait until we know that we are out of any interrupt
2247 	 * handlers might have been running before we freed the
2248 	 * interrupt.
2249 	 */
2250 	synchronize_rcu();
2251 
2252 	/*
2253 	 * Timeouts are stopped, now make sure the interrupts are off
2254 	 * in the BMC.  Note that timers and CPU interrupts are off,
2255 	 * so no need for locks.
2256 	 */
2257 	wait_msg_processed(smi_info);
2258 
2259 	if (smi_info->handlers)
2260 		disable_si_irq(smi_info);
2261 
2262 	wait_msg_processed(smi_info);
2263 
2264 	if (smi_info->handlers)
2265 		smi_info->handlers->cleanup(smi_info->si_sm);
2266 
2267 	if (smi_info->io.io_cleanup) {
2268 		smi_info->io.io_cleanup(&smi_info->io);
2269 		smi_info->io.io_cleanup = NULL;
2270 	}
2271 
2272 	kfree(smi_info->si_sm);
2273 	smi_info->si_sm = NULL;
2274 
2275 	smi_info->intf = NULL;
2276 }
2277 
2278 /*
2279  * Must be called with smi_infos_lock held, to serialize the
2280  * smi_info->intf check.
2281  */
2282 static void cleanup_one_si(struct smi_info *smi_info)
2283 {
2284 	if (!smi_info)
2285 		return;
2286 
2287 	list_del(&smi_info->link);
2288 	ipmi_unregister_smi(smi_info->intf);
2289 	kfree(smi_info);
2290 }
2291 
2292 void ipmi_si_remove_by_dev(struct device *dev)
2293 {
2294 	struct smi_info *e;
2295 
2296 	mutex_lock(&smi_infos_lock);
2297 	list_for_each_entry(e, &smi_infos, link) {
2298 		if (e->io.dev == dev) {
2299 			cleanup_one_si(e);
2300 			break;
2301 		}
2302 	}
2303 	mutex_unlock(&smi_infos_lock);
2304 }
2305 
2306 struct device *ipmi_si_remove_by_data(int addr_space, enum si_type si_type,
2307 				      unsigned long addr)
2308 {
2309 	/* remove */
2310 	struct smi_info *e, *tmp_e;
2311 	struct device *dev = NULL;
2312 
2313 	mutex_lock(&smi_infos_lock);
2314 	list_for_each_entry_safe(e, tmp_e, &smi_infos, link) {
2315 		if (e->io.addr_space != addr_space)
2316 			continue;
2317 		if (e->io.si_info->type != si_type)
2318 			continue;
2319 		if (e->io.addr_data == addr) {
2320 			dev = get_device(e->io.dev);
2321 			cleanup_one_si(e);
2322 		}
2323 	}
2324 	mutex_unlock(&smi_infos_lock);
2325 
2326 	return dev;
2327 }
2328 
2329 static void cleanup_ipmi_si(void)
2330 {
2331 	struct smi_info *e, *tmp_e;
2332 
2333 	if (!initialized)
2334 		return;
2335 
2336 	ipmi_si_pci_shutdown();
2337 
2338 	ipmi_si_parisc_shutdown();
2339 
2340 	ipmi_si_platform_shutdown();
2341 
2342 	mutex_lock(&smi_infos_lock);
2343 	list_for_each_entry_safe(e, tmp_e, &smi_infos, link)
2344 		cleanup_one_si(e);
2345 	mutex_unlock(&smi_infos_lock);
2346 
2347 	ipmi_si_hardcode_exit();
2348 	ipmi_si_hotmod_exit();
2349 }
2350 module_exit(cleanup_ipmi_si);
2351 
2352 MODULE_ALIAS("platform:dmi-ipmi-si");
2353 MODULE_LICENSE("GPL");
2354 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
2355 MODULE_DESCRIPTION("Interface to the IPMI driver for the KCS, SMIC, and BT system interfaces.");
2356