forked from ~ljy/RK356X_SDK_RELEASE

blame | history | patch | commit | commitdiff
hc
2023-12-09 b22da3d8526a935aa31e086e63f60ff3246cb61c 
 kernel/drivers/char/ipmi/ipmi_msghandler.c
....@@ -11,6 +11,9 @@
1111  * Copyright 2002 MontaVista Software Inc.
1212  */
1313 
14
+#define pr_fmt(fmt) "IPMI message handler: " fmt
15
+#define dev_fmt(fmt) pr_fmt(fmt)
16
+
1417 #include <linux/module.h>
1518 #include <linux/errno.h>
1619 #include <linux/poll.h>
....@@ -31,37 +34,17 @@
3134 #include <linux/uuid.h>
3235 #include <linux/nospec.h>
3336 #include <linux/vmalloc.h>
34
-
35
-#define PFX "IPMI message handler: "
37
+#include <linux/delay.h>
3638 
3739 #define IPMI_DRIVER_VERSION "39.2"
3840 
3941 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);
4042 static int ipmi_init_msghandler(void);
41
-static void smi_recv_tasklet(unsigned long);
43
+static void smi_recv_tasklet(struct tasklet_struct *t);
4244 static void handle_new_recv_msgs(struct ipmi_smi *intf);
4345 static void need_waiter(struct ipmi_smi *intf);
4446 static int handle_one_recv_msg(struct ipmi_smi *intf,
4547 			       struct ipmi_smi_msg *msg);
46
-
47
-#ifdef DEBUG
48
-static void ipmi_debug_msg(const char *title, unsigned char *data,
49
-			   unsigned int len)
50
-{
51
-	int i, pos;
52
-	char buf[100];
53
-
54
-	pos = snprintf(buf, sizeof(buf), "%s: ", title);
55
-	for (i = 0; i < len; i++)
56
-		pos += snprintf(buf + pos, sizeof(buf) - pos,
57
-				" %2.2x", data[i]);
58
-	pr_debug("%s\n", buf);
59
-}
60
-#else
61
-static void ipmi_debug_msg(const char *title, unsigned char *data,
62
-			   unsigned int len)
63
-{ }
64
-#endif
6548 
6649 static bool initialized;
6750 static bool drvregistered;
....@@ -78,6 +61,7 @@
7861 #else
7962 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT_NONE
8063 #endif
64
+
8165 static enum ipmi_panic_event_op ipmi_send_panic_event = IPMI_PANIC_DEFAULT;
8266 
8367 static int panic_op_write_handler(const char *val,
....@@ -107,19 +91,19 @@
10791 {
10892 	switch (ipmi_send_panic_event) {
10993 	case IPMI_SEND_PANIC_EVENT_NONE:
110
-		strcpy(buffer, "none");
94
+		strcpy(buffer, "none\n");
11195 		break;
11296 
11397 	case IPMI_SEND_PANIC_EVENT:
114
-		strcpy(buffer, "event");
98
+		strcpy(buffer, "event\n");
11599 		break;
116100 
117101 	case IPMI_SEND_PANIC_EVENT_STRING:
118
-		strcpy(buffer, "string");
102
+		strcpy(buffer, "string\n");
119103 		break;
120104 
121105 	default:
122
-		strcpy(buffer, "???");
106
+		strcpy(buffer, "???\n");
123107 		break;
124108 	}
125109 
....@@ -337,6 +321,7 @@
337321 	int                    dyn_guid_set;
338322 	struct kref	       usecount;
339323 	struct work_struct     remove_work;
324
+	unsigned char	       cc; /* completion code */
340325 };
341326 #define to_bmc_device(x) container_of((x), struct bmc_device, pdev.dev)
342327 
....@@ -536,9 +521,27 @@
536521 	unsigned int     waiting_events_count; /* How many events in queue? */
537522 	char             delivering_events;
538523 	char             event_msg_printed;
524
+
525
+	/* How many users are waiting for events? */
539526 	atomic_t         event_waiters;
540527 	unsigned int     ticks_to_req_ev;
541
-	int              last_needs_timer;
528
+
529
+	spinlock_t       watch_lock; /* For dealing with watch stuff below. */
530
+
531
+	/* How many users are waiting for commands? */
532
+	unsigned int     command_waiters;
533
+
534
+	/* How many users are waiting for watchdogs? */
535
+	unsigned int     watchdog_waiters;
536
+
537
+	/* How many users are waiting for message responses? */
538
+	unsigned int     response_waiters;
539
+
540
+	/*
541
+	 * Tells what the lower layer has last been asked to watch for,
542
+	 * messages and/or watchdogs.  Protected by watch_lock.
543
+	 */
544
+	unsigned int     last_watch_mask;
542545 
543546 	/*
544547 	 * The event receiver for my BMC, only really used at panic
....@@ -621,7 +624,9 @@
621624 
622625 static LIST_HEAD(ipmi_interfaces);
623626 static DEFINE_MUTEX(ipmi_interfaces_mutex);
624
-struct srcu_struct ipmi_interfaces_srcu;
627
+#define ipmi_interfaces_mutex_held() \
628
+	lockdep_is_held(&ipmi_interfaces_mutex)
629
+static struct srcu_struct ipmi_interfaces_srcu;
625630 
626631 /*
627632  * List of watchers that want to know when smi's are added and deleted.
....@@ -890,12 +895,14 @@
890895 			rv = -EINVAL;
891896 		}
892897 		ipmi_free_recv_msg(msg);
893
-	} else if (!oops_in_progress) {
898
+	} else if (oops_in_progress) {
894899 		/*
895900 		 * If we are running in the panic context, calling the
896901 		 * receive handler doesn't much meaning and has a deadlock
897902 		 * risk.  At this moment, simply skip it in that case.
898903 		 */
904
+		ipmi_free_recv_msg(msg);
905
+	} else {
899906 		int index;
900907 		struct ipmi_user *user = acquire_ipmi_user(msg->user, &index);
901908 
....@@ -930,6 +937,64 @@
930937 	msg->msg.data_len = 1;
931938 	msg->msg.data = msg->msg_data;
932939 	deliver_local_response(intf, msg);
940
+}
941
+
942
+static void smi_add_watch(struct ipmi_smi *intf, unsigned int flags)
943
+{
944
+	unsigned long iflags;
945
+
946
+	if (!intf->handlers->set_need_watch)
947
+		return;
948
+
949
+	spin_lock_irqsave(&intf->watch_lock, iflags);
950
+	if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES)
951
+		intf->response_waiters++;
952
+
953
+	if (flags & IPMI_WATCH_MASK_CHECK_WATCHDOG)
954
+		intf->watchdog_waiters++;
955
+
956
+	if (flags & IPMI_WATCH_MASK_CHECK_COMMANDS)
957
+		intf->command_waiters++;
958
+
959
+	if ((intf->last_watch_mask & flags) != flags) {
960
+		intf->last_watch_mask |= flags;
961
+		intf->handlers->set_need_watch(intf->send_info,
962
+					       intf->last_watch_mask);
963
+	}
964
+	spin_unlock_irqrestore(&intf->watch_lock, iflags);
965
+}
966
+
967
+static void smi_remove_watch(struct ipmi_smi *intf, unsigned int flags)
968
+{
969
+	unsigned long iflags;
970
+
971
+	if (!intf->handlers->set_need_watch)
972
+		return;
973
+
974
+	spin_lock_irqsave(&intf->watch_lock, iflags);
975
+	if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES)
976
+		intf->response_waiters--;
977
+
978
+	if (flags & IPMI_WATCH_MASK_CHECK_WATCHDOG)
979
+		intf->watchdog_waiters--;
980
+
981
+	if (flags & IPMI_WATCH_MASK_CHECK_COMMANDS)
982
+		intf->command_waiters--;
983
+
984
+	flags = 0;
985
+	if (intf->response_waiters)
986
+		flags |= IPMI_WATCH_MASK_CHECK_MESSAGES;
987
+	if (intf->watchdog_waiters)
988
+		flags |= IPMI_WATCH_MASK_CHECK_WATCHDOG;
989
+	if (intf->command_waiters)
990
+		flags |= IPMI_WATCH_MASK_CHECK_COMMANDS;
991
+
992
+	if (intf->last_watch_mask != flags) {
993
+		intf->last_watch_mask = flags;
994
+		intf->handlers->set_need_watch(intf->send_info,
995
+					       intf->last_watch_mask);
996
+	}
997
+	spin_unlock_irqrestore(&intf->watch_lock, iflags);
933998 }
934999 
9351000 /*
....@@ -975,6 +1040,7 @@
9751040 		*seq = i;
9761041 		*seqid = intf->seq_table[i].seqid;
9771042 		intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
1043
+		smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);
9781044 		need_waiter(intf);
9791045 	} else {
9801046 		rv = -EAGAIN;
....@@ -1013,6 +1079,7 @@
10131079 				&& (ipmi_addr_equal(addr, &msg->addr))) {
10141080 			*recv_msg = msg;
10151081 			intf->seq_table[seq].inuse = 0;
1082
+			smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);
10161083 			rv = 0;
10171084 		}
10181085 	}
....@@ -1074,6 +1141,7 @@
10741141 		struct seq_table *ent = &intf->seq_table[seq];
10751142 
10761143 		ent->inuse = 0;
1144
+		smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);
10771145 		msg = ent->recv_msg;
10781146 		rv = 0;
10791147 	}
....@@ -1084,7 +1152,6 @@
10841152 
10851153 	return rv;
10861154 }
1087
-
10881155 
10891156 static void free_user_work(struct work_struct *work)
10901157 {
....@@ -1162,11 +1229,9 @@
11621229 	spin_lock_irqsave(&intf->seq_lock, flags);
11631230 	list_add_rcu(&new_user->link, &intf->users);
11641231 	spin_unlock_irqrestore(&intf->seq_lock, flags);
1165
-	if (handler->ipmi_watchdog_pretimeout) {
1232
+	if (handler->ipmi_watchdog_pretimeout)
11661233 		/* User wants pretimeouts, so make sure to watch for them. */
1167
-		if (atomic_inc_return(&intf->event_waiters) == 1)
1168
-			need_waiter(intf);
1169
-	}
1234
+		smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG);
11701235 	srcu_read_unlock(&ipmi_interfaces_srcu, index);
11711236 	*user = new_user;
11721237 	return 0;
....@@ -1238,7 +1303,7 @@
12381303 		user->handler->shutdown(user->handler_data);
12391304 
12401305 	if (user->handler->ipmi_watchdog_pretimeout)
1241
-		atomic_dec(&intf->event_waiters);
1306
+		smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG);
12421307 
12431308 	if (user->gets_events)
12441309 		atomic_dec(&intf->event_waiters);
....@@ -1251,6 +1316,7 @@
12511316 		if (intf->seq_table[i].inuse
12521317 		    && (intf->seq_table[i].recv_msg->user == user)) {
12531318 			intf->seq_table[i].inuse = 0;
1319
+			smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);
12541320 			ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
12551321 		}
12561322 	}
....@@ -1263,7 +1329,8 @@
12631329 	 * synchronize_srcu()) then free everything in that list.
12641330 	 */
12651331 	mutex_lock(&intf->cmd_rcvrs_mutex);
1266
-	list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1332
+	list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link,
1333
+				lockdep_is_held(&intf->cmd_rcvrs_mutex)) {
12671334 		if (rcvr->user == user) {
12681335 			list_del_rcu(&rcvr->link);
12691336 			rcvr->next = rcvrs;
....@@ -1509,8 +1576,7 @@
15091576 			list_move_tail(&msg->link, &msgs);
15101577 		intf->waiting_events_count = 0;
15111578 		if (intf->event_msg_printed) {
1512
-			dev_warn(intf->si_dev,
1513
-				 PFX "Event queue no longer full\n");
1579
+			dev_warn(intf->si_dev, "Event queue no longer full\n");
15141580 			intf->event_msg_printed = 0;
15151581 		}
15161582 
....@@ -1542,7 +1608,8 @@
15421608 {
15431609 	struct cmd_rcvr *rcvr;
15441610 
1545
-	list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1611
+	list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link,
1612
+				lockdep_is_held(&intf->cmd_rcvrs_mutex)) {
15461613 		if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
15471614 					&& (rcvr->chans & (1 << chan)))
15481615 			return rcvr;
....@@ -1557,7 +1624,8 @@
15571624 {
15581625 	struct cmd_rcvr *rcvr;
15591626 
1560
-	list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1627
+	list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link,
1628
+				lockdep_is_held(&intf->cmd_rcvrs_mutex)) {
15611629 		if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
15621630 					&& (rcvr->chans & chans))
15631631 			return 0;
....@@ -1595,8 +1663,7 @@
15951663 		goto out_unlock;
15961664 	}
15971665 
1598
-	if (atomic_inc_return(&intf->event_waiters) == 1)
1599
-		need_waiter(intf);
1666
+	smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS);
16001667 
16011668 	list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
16021669 
....@@ -1646,7 +1713,7 @@
16461713 	synchronize_rcu();
16471714 	release_ipmi_user(user, index);
16481715 	while (rcvrs) {
1649
-		atomic_dec(&intf->event_waiters);
1716
+		smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS);
16501717 		rcvr = rcvrs;
16511718 		rcvrs = rcvr->next;
16521719 		kfree(rcvr);
....@@ -1763,22 +1830,19 @@
17631830 	return smi_msg;
17641831 }
17651832 
1766
-
17671833 static void smi_send(struct ipmi_smi *intf,
17681834 		     const struct ipmi_smi_handlers *handlers,
17691835 		     struct ipmi_smi_msg *smi_msg, int priority)
17701836 {
17711837 	int run_to_completion = intf->run_to_completion;
1838
+	unsigned long flags = 0;
17721839 
1773
-	if (run_to_completion) {
1774
-		smi_msg = smi_add_send_msg(intf, smi_msg, priority);
1775
-	} else {
1776
-		unsigned long flags;
1777
-
1840
+	if (!run_to_completion)
17781841 		spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
1779
-		smi_msg = smi_add_send_msg(intf, smi_msg, priority);
1842
+	smi_msg = smi_add_send_msg(intf, smi_msg, priority);
1843
+
1844
+	if (!run_to_completion)
17801845 		spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
1781
-	}
17821846 
17831847 	if (smi_msg)
17841848 		handlers->sender(intf->send_info, smi_msg);
....@@ -2158,7 +2222,8 @@
21582222 	else {
21592223 		smi_msg = ipmi_alloc_smi_msg();
21602224 		if (smi_msg == NULL) {
2161
-			ipmi_free_recv_msg(recv_msg);
2225
+			if (!supplied_recv)
2226
+				ipmi_free_recv_msg(recv_msg);
21622227 			rv = -ENOMEM;
21632228 			goto out;
21642229 		}
....@@ -2202,7 +2267,7 @@
22022267 		ipmi_free_smi_msg(smi_msg);
22032268 		ipmi_free_recv_msg(recv_msg);
22042269 	} else {
2205
-		ipmi_debug_msg("Send", smi_msg->data, smi_msg->data_size);
2270
+		pr_debug("Send: %*ph\n", smi_msg->data_size, smi_msg->data);
22062271 
22072272 		smi_send(intf, intf->handlers, smi_msg, priority);
22082273 	}
....@@ -2312,16 +2377,17 @@
23122377 			|| (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)
23132378 			|| (msg->msg.cmd != IPMI_GET_DEVICE_ID_CMD)) {
23142379 		dev_warn(intf->si_dev,
2315
-			 PFX "invalid device_id msg: addr_type=%d netfn=%x cmd=%x\n",
2316
-			msg->addr.addr_type, msg->msg.netfn, msg->msg.cmd);
2380
+			 "invalid device_id msg: addr_type=%d netfn=%x cmd=%x\n",
2381
+			 msg->addr.addr_type, msg->msg.netfn, msg->msg.cmd);
23172382 		return;
23182383 	}
23192384 
23202385 	rv = ipmi_demangle_device_id(msg->msg.netfn, msg->msg.cmd,
23212386 			msg->msg.data, msg->msg.data_len, &intf->bmc->fetch_id);
23222387 	if (rv) {
2323
-		dev_warn(intf->si_dev,
2324
-			 PFX "device id demangle failed: %d\n", rv);
2388
+		dev_warn(intf->si_dev, "device id demangle failed: %d\n", rv);
2389
+		/* record completion code when error */
2390
+		intf->bmc->cc = msg->msg.data[0];
23252391 		intf->bmc->dyn_id_set = 0;
23262392 	} else {
23272393 		/*
....@@ -2367,23 +2433,39 @@
23672433 static int __get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc)
23682434 {
23692435 	int rv;
2370
-
2371
-	bmc->dyn_id_set = 2;
2436
+	unsigned int retry_count = 0;
23722437 
23732438 	intf->null_user_handler = bmc_device_id_handler;
23742439 
2440
+retry:
2441
+	bmc->cc = 0;
2442
+	bmc->dyn_id_set = 2;
2443
+
23752444 	rv = send_get_device_id_cmd(intf);
23762445 	if (rv)
2377
-		return rv;
2446
+		goto out_reset_handler;
23782447 
23792448 	wait_event(intf->waitq, bmc->dyn_id_set != 2);
23802449 
2381
-	if (!bmc->dyn_id_set)
2450
+	if (!bmc->dyn_id_set) {
2451
+		if ((bmc->cc == IPMI_DEVICE_IN_FW_UPDATE_ERR
2452
+		     || bmc->cc ==  IPMI_DEVICE_IN_INIT_ERR
2453
+		     || bmc->cc ==  IPMI_NOT_IN_MY_STATE_ERR)
2454
+		     && ++retry_count <= GET_DEVICE_ID_MAX_RETRY) {
2455
+			msleep(500);
2456
+			dev_warn(intf->si_dev,
2457
+			    "BMC returned 0x%2.2x, retry get bmc device id\n",
2458
+			    bmc->cc);
2459
+			goto retry;
2460
+		}
2461
+
23822462 		rv = -EIO; /* Something went wrong in the fetch. */
2463
+	}
23832464 
23842465 	/* dyn_id_set makes the id data available. */
23852466 	smp_rmb();
23862467 
2468
+out_reset_handler:
23872469 	intf->null_user_handler = NULL;
23882470 
23892471 	return rv;
....@@ -2703,7 +2785,7 @@
27032785 	if (!guid_set)
27042786 		return -ENOENT;
27052787 
2706
-	return snprintf(buf, 38, "%pUl\n", guid.b);
2788
+	return snprintf(buf, UUID_STRING_LEN + 1 + 1, "%pUl\n", &guid);
27072789 }
27082790 static DEVICE_ATTR_RO(guid);
27092791 
....@@ -2758,9 +2840,9 @@
27582840 	.groups		= bmc_dev_attr_groups,
27592841 };
27602842 
2761
-static int __find_bmc_guid(struct device *dev, void *data)
2843
+static int __find_bmc_guid(struct device *dev, const void *data)
27622844 {
2763
-	guid_t *guid = data;
2845
+	const guid_t *guid = data;
27642846 	struct bmc_device *bmc;
27652847 	int rv;
27662848 
....@@ -2796,9 +2878,9 @@
27962878 	unsigned char device_id;
27972879 };
27982880 
2799
-static int __find_bmc_prod_dev_id(struct device *dev, void *data)
2881
+static int __find_bmc_prod_dev_id(struct device *dev, const void *data)
28002882 {
2801
-	struct prod_dev_id *cid = data;
2883
+	const struct prod_dev_id *cid = data;
28022884 	struct bmc_device *bmc;
28032885 	int rv;
28042886 
....@@ -2944,8 +3026,7 @@
29443026 		mutex_unlock(&bmc->dyn_mutex);
29453027 
29463028 		dev_info(intf->si_dev,
2947
-			 "ipmi: interfacing existing BMC (man_id: 0x%6.6x,"
2948
-			 " prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
3029
+			 "interfacing existing BMC (man_id: 0x%6.6x, prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
29493030 			 bmc->id.manufacturer_id,
29503031 			 bmc->id.product_id,
29513032 			 bmc->id.device_id);
....@@ -2987,7 +3068,7 @@
29873068 		rv = platform_device_register(&bmc->pdev);
29883069 		if (rv) {
29893070 			dev_err(intf->si_dev,
2990
-				PFX " Unable to register bmc device: %d\n",
3071
+				"Unable to register bmc device: %d\n",
29913072 				rv);
29923073 			goto out_list_del;
29933074 		}
....@@ -3005,8 +3086,7 @@
30053086 	 */
30063087 	rv = sysfs_create_link(&intf->si_dev->kobj, &bmc->pdev.dev.kobj, "bmc");
30073088 	if (rv) {
3008
-		dev_err(intf->si_dev,
3009
-			PFX "Unable to create bmc symlink: %d\n", rv);
3089
+		dev_err(intf->si_dev, "Unable to create bmc symlink: %d\n", rv);
30103090 		goto out_put_bmc;
30113091 	}
30123092 
....@@ -3015,18 +3095,16 @@
30153095 	intf->my_dev_name = kasprintf(GFP_KERNEL, "ipmi%d", intf_num);
30163096 	if (!intf->my_dev_name) {
30173097 		rv = -ENOMEM;
3018
-		dev_err(intf->si_dev,
3019
-			PFX "Unable to allocate link from BMC: %d\n", rv);
3098
+		dev_err(intf->si_dev, "Unable to allocate link from BMC: %d\n",
3099
+			rv);
30203100 		goto out_unlink1;
30213101 	}
30223102 
30233103 	rv = sysfs_create_link(&bmc->pdev.dev.kobj, &intf->si_dev->kobj,
30243104 			       intf->my_dev_name);
30253105 	if (rv) {
3026
-		kfree(intf->my_dev_name);
3027
-		intf->my_dev_name = NULL;
3028
-		dev_err(intf->si_dev,
3029
-			PFX "Unable to create symlink to bmc: %d\n", rv);
3106
+		dev_err(intf->si_dev, "Unable to create symlink to bmc: %d\n",
3107
+			rv);
30303108 		goto out_free_my_dev_name;
30313109 	}
30323110 
....@@ -3107,15 +3185,15 @@
31073185 		goto out;
31083186 	}
31093187 
3110
-	if (msg->msg.data_len < 17) {
3188
+	if (msg->msg.data_len < UUID_SIZE + 1) {
31113189 		bmc->dyn_guid_set = 0;
31123190 		dev_warn(intf->si_dev,
3113
-			 PFX "The GUID response from the BMC was too short, it was %d but should have been 17.  Assuming GUID is not available.\n",
3114
-			 msg->msg.data_len);
3191
+			 "The GUID response from the BMC was too short, it was %d but should have been %d.  Assuming GUID is not available.\n",
3192
+			 msg->msg.data_len, UUID_SIZE + 1);
31153193 		goto out;
31163194 	}
31173195 
3118
-	memcpy(bmc->fetch_guid.b, msg->msg.data + 1, 16);
3196
+	import_guid(&bmc->fetch_guid, msg->msg.data + 1);
31193197 	/*
31203198 	 * Make sure the guid data is available before setting
31213199 	 * dyn_guid_set.
....@@ -3190,7 +3268,6 @@
31903268 		/* It's the one we want */
31913269 		if (msg->msg.data[0] != 0) {
31923270 			/* Got an error from the channel, just go on. */
3193
-
31943271 			if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) {
31953272 				/*
31963273 				 * If the MC does not support this
....@@ -3234,7 +3311,7 @@
32343311 		if (rv) {
32353312 			/* Got an error somehow, just give up. */
32363313 			dev_warn(intf->si_dev,
3237
-				 PFX "Error sending channel information for channel %d: %d\n",
3314
+				 "Error sending channel information for channel %d: %d\n",
32383315 				 intf->curr_channel, rv);
32393316 
32403317 			intf->channel_list = intf->wchannels + set;
....@@ -3274,6 +3351,7 @@
32743351 			dev_warn(intf->si_dev,
32753352 				 "Error sending channel information for channel 0, %d\n",
32763353 				 rv);
3354
+			intf->null_user_handler = NULL;
32773355 			return -EIO;
32783356 		}
32793357 
....@@ -3375,14 +3453,14 @@
33753453 	intf->curr_seq = 0;
33763454 	spin_lock_init(&intf->waiting_rcv_msgs_lock);
33773455 	INIT_LIST_HEAD(&intf->waiting_rcv_msgs);
3378
-	tasklet_init(&intf->recv_tasklet,
3379
-		     smi_recv_tasklet,
3380
-		     (unsigned long) intf);
3456
+	tasklet_setup(&intf->recv_tasklet,
3457
+		     smi_recv_tasklet);
33813458 	atomic_set(&intf->watchdog_pretimeouts_to_deliver, 0);
33823459 	spin_lock_init(&intf->xmit_msgs_lock);
33833460 	INIT_LIST_HEAD(&intf->xmit_msgs);
33843461 	INIT_LIST_HEAD(&intf->hp_xmit_msgs);
33853462 	spin_lock_init(&intf->events_lock);
3463
+	spin_lock_init(&intf->watch_lock);
33863464 	atomic_set(&intf->event_waiters, 0);
33873465 	intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
33883466 	INIT_LIST_HEAD(&intf->waiting_events);
....@@ -3398,7 +3476,8 @@
33983476 	/* Look for a hole in the numbers. */
33993477 	i = 0;
34003478 	link = &ipmi_interfaces;
3401
-	list_for_each_entry_rcu(tintf, &ipmi_interfaces, link) {
3479
+	list_for_each_entry_rcu(tintf, &ipmi_interfaces, link,
3480
+				ipmi_interfaces_mutex_held()) {
34023481 		if (tintf->intf_num != i) {
34033482 			link = &tintf->link;
34043483 			break;
....@@ -3671,7 +3750,7 @@
36713750 		msg->data[10] = ipmb_checksum(&msg->data[6], 4);
36723751 		msg->data_size = 11;
36733752 
3674
-		ipmi_debug_msg("Invalid command:", msg->data, msg->data_size);
3753
+		pr_debug("Invalid command: %*ph\n", msg->data_size, msg->data);
36753754 
36763755 		rcu_read_lock();
36773756 		if (!intf->in_shutdown) {
....@@ -4107,7 +4186,7 @@
41074186 		 * message.
41084187 		 */
41094188 		dev_warn(intf->si_dev,
4110
-			 PFX "Event queue full, discarding incoming events\n");
4189
+			 "Event queue full, discarding incoming events\n");
41114190 		intf->event_msg_printed = 1;
41124191 	}
41134192 
....@@ -4126,7 +4205,7 @@
41264205 	recv_msg = (struct ipmi_recv_msg *) msg->user_data;
41274206 	if (recv_msg == NULL) {
41284207 		dev_warn(intf->si_dev,
4129
-			 "IPMI message received with no owner. This could be because of a malformed message, or because of a hardware error.  Contact your hardware vender for assistance\n");
4208
+			 "IPMI message received with no owner. This could be because of a malformed message, or because of a hardware error.  Contact your hardware vendor for assistance.\n");
41304209 		return 0;
41314210 	}
41324211 
....@@ -4158,11 +4237,57 @@
41584237 	int requeue;
41594238 	int chan;
41604239 
4161
-	ipmi_debug_msg("Recv:", msg->rsp, msg->rsp_size);
4162
-	if (msg->rsp_size < 2) {
4240
+	pr_debug("Recv: %*ph\n", msg->rsp_size, msg->rsp);
4241
+
4242
+	if ((msg->data_size >= 2)
4243
+	    && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
4244
+	    && (msg->data[1] == IPMI_SEND_MSG_CMD)
4245
+	    && (msg->user_data == NULL)) {
4246
+
4247
+		if (intf->in_shutdown)
4248
+			goto free_msg;
4249
+
4250
+		/*
4251
+		 * This is the local response to a command send, start
4252
+		 * the timer for these.  The user_data will not be
4253
+		 * NULL if this is a response send, and we will let
4254
+		 * response sends just go through.
4255
+		 */
4256
+
4257
+		/*
4258
+		 * Check for errors, if we get certain errors (ones
4259
+		 * that mean basically we can try again later), we
4260
+		 * ignore them and start the timer.  Otherwise we
4261
+		 * report the error immediately.
4262
+		 */
4263
+		if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
4264
+		    && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
4265
+		    && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
4266
+		    && (msg->rsp[2] != IPMI_BUS_ERR)
4267
+		    && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
4268
+			int ch = msg->rsp[3] & 0xf;
4269
+			struct ipmi_channel *chans;
4270
+
4271
+			/* Got an error sending the message, handle it. */
4272
+
4273
+			chans = READ_ONCE(intf->channel_list)->c;
4274
+			if ((chans[ch].medium == IPMI_CHANNEL_MEDIUM_8023LAN)
4275
+			    || (chans[ch].medium == IPMI_CHANNEL_MEDIUM_ASYNC))
4276
+				ipmi_inc_stat(intf, sent_lan_command_errs);
4277
+			else
4278
+				ipmi_inc_stat(intf, sent_ipmb_command_errs);
4279
+			intf_err_seq(intf, msg->msgid, msg->rsp[2]);
4280
+		} else
4281
+			/* The message was sent, start the timer. */
4282
+			intf_start_seq_timer(intf, msg->msgid);
4283
+free_msg:
4284
+		requeue = 0;
4285
+		goto out;
4286
+
4287
+	} else if (msg->rsp_size < 2) {
41634288 		/* Message is too small to be correct. */
41644289 		dev_warn(intf->si_dev,
4165
-			 PFX "BMC returned to small a message for netfn %x cmd %x, got %d bytes\n",
4290
+			 "BMC returned too small a message for netfn %x cmd %x, got %d bytes\n",
41664291 			 (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size);
41674292 
41684293 		/* Generate an error response for the message. */
....@@ -4177,7 +4302,7 @@
41774302 		 * marginally correct.
41784303 		 */
41794304 		dev_warn(intf->si_dev,
4180
-			 PFX "BMC returned incorrect response, expected netfn %x cmd %x, got netfn %x cmd %x\n",
4305
+			 "BMC returned incorrect response, expected netfn %x cmd %x, got netfn %x cmd %x\n",
41814306 			 (msg->data[0] >> 2) | 1, msg->data[1],
41824307 			 msg->rsp[0] >> 2, msg->rsp[1]);
41834308 
....@@ -4364,10 +4489,10 @@
43644489 	}
43654490 }
43664491 
4367
-static void smi_recv_tasklet(unsigned long val)
4492
+static void smi_recv_tasklet(struct tasklet_struct *t)
43684493 {
43694494 	unsigned long flags = 0; /* keep us warning-free. */
4370
-	struct ipmi_smi *intf = (struct ipmi_smi *) val;
4495
+	struct ipmi_smi *intf = from_tasklet(intf, t, recv_tasklet);
43714496 	int run_to_completion = intf->run_to_completion;
43724497 	struct ipmi_smi_msg *newmsg = NULL;
43734498 
....@@ -4398,6 +4523,7 @@
43984523 			intf->curr_msg = newmsg;
43994524 		}
44004525 	}
4526
+
44014527 	if (!run_to_completion)
44024528 		spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
44034529 	if (newmsg)
....@@ -4415,62 +4541,16 @@
44154541 	unsigned long flags = 0; /* keep us warning-free. */
44164542 	int run_to_completion = intf->run_to_completion;
44174543 
4418
-	if ((msg->data_size >= 2)
4419
-	    && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
4420
-	    && (msg->data[1] == IPMI_SEND_MSG_CMD)
4421
-	    && (msg->user_data == NULL)) {
4422
-
4423
-		if (intf->in_shutdown)
4424
-			goto free_msg;
4425
-
4426
-		/*
4427
-		 * This is the local response to a command send, start
4428
-		 * the timer for these.  The user_data will not be
4429
-		 * NULL if this is a response send, and we will let
4430
-		 * response sends just go through.
4431
-		 */
4432
-
4433
-		/*
4434
-		 * Check for errors, if we get certain errors (ones
4435
-		 * that mean basically we can try again later), we
4436
-		 * ignore them and start the timer.  Otherwise we
4437
-		 * report the error immediately.
4438
-		 */
4439
-		if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
4440
-		    && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
4441
-		    && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
4442
-		    && (msg->rsp[2] != IPMI_BUS_ERR)
4443
-		    && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
4444
-			int ch = msg->rsp[3] & 0xf;
4445
-			struct ipmi_channel *chans;
4446
-
4447
-			/* Got an error sending the message, handle it. */
4448
-
4449
-			chans = READ_ONCE(intf->channel_list)->c;
4450
-			if ((chans[ch].medium == IPMI_CHANNEL_MEDIUM_8023LAN)
4451
-			    || (chans[ch].medium == IPMI_CHANNEL_MEDIUM_ASYNC))
4452
-				ipmi_inc_stat(intf, sent_lan_command_errs);
4453
-			else
4454
-				ipmi_inc_stat(intf, sent_ipmb_command_errs);
4455
-			intf_err_seq(intf, msg->msgid, msg->rsp[2]);
4456
-		} else
4457
-			/* The message was sent, start the timer. */
4458
-			intf_start_seq_timer(intf, msg->msgid);
4459
-
4460
-free_msg:
4461
-		ipmi_free_smi_msg(msg);
4462
-	} else {
4463
-		/*
4464
-		 * To preserve message order, we keep a queue and deliver from
4465
-		 * a tasklet.
4466
-		 */
4467
-		if (!run_to_completion)
4468
-			spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
4469
-		list_add_tail(&msg->link, &intf->waiting_rcv_msgs);
4470
-		if (!run_to_completion)
4471
-			spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
4472
-					       flags);
4473
-	}
4544
+	/*
4545
+	 * To preserve message order, we keep a queue and deliver from
4546
+	 * a tasklet.
4547
+	 */
4548
+	if (!run_to_completion)
4549
+		spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
4550
+	list_add_tail(&msg->link, &intf->waiting_rcv_msgs);
4551
+	if (!run_to_completion)
4552
+		spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
4553
+				       flags);
44744554 
44754555 	if (!run_to_completion)
44764556 		spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
....@@ -4484,7 +4564,7 @@
44844564 		spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
44854565 
44864566 	if (run_to_completion)
4487
-		smi_recv_tasklet((unsigned long) intf);
4567
+		smi_recv_tasklet(&intf->recv_tasklet);
44884568 	else
44894569 		tasklet_schedule(&intf->recv_tasklet);
44904570 }
....@@ -4516,7 +4596,7 @@
45164596 	smi_msg->data_size = recv_msg->msg.data_len;
45174597 	smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);
45184598 
4519
-	ipmi_debug_msg("Resend: ", smi_msg->data, smi_msg->data_size);
4599
+	pr_debug("Resend: %*ph\n", smi_msg->data_size, smi_msg->data);
45204600 
45214601 	return smi_msg;
45224602 }
....@@ -4525,7 +4605,7 @@
45254605 			      struct list_head *timeouts,
45264606 			      unsigned long timeout_period,
45274607 			      int slot, unsigned long *flags,
4528
-			      unsigned int *waiting_msgs)
4608
+			      bool *need_timer)
45294609 {
45304610 	struct ipmi_recv_msg *msg;
45314611 
....@@ -4537,13 +4617,14 @@
45374617 
45384618 	if (timeout_period < ent->timeout) {
45394619 		ent->timeout -= timeout_period;
4540
-		(*waiting_msgs)++;
4620
+		*need_timer = true;
45414621 		return;
45424622 	}
45434623 
45444624 	if (ent->retries_left == 0) {
45454625 		/* The message has used all its retries. */
45464626 		ent->inuse = 0;
4627
+		smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);
45474628 		msg = ent->recv_msg;
45484629 		list_add_tail(&msg->link, timeouts);
45494630 		if (ent->broadcast)
....@@ -4556,7 +4637,7 @@
45564637 		struct ipmi_smi_msg *smi_msg;
45574638 		/* More retries, send again. */
45584639 
4559
-		(*waiting_msgs)++;
4640
+		*need_timer = true;
45604641 
45614642 		/*
45624643 		 * Start with the max timer, set to normal timer after
....@@ -4601,20 +4682,20 @@
46014682 	}
46024683 }
46034684 
4604
-static unsigned int ipmi_timeout_handler(struct ipmi_smi *intf,
4605
-					 unsigned long timeout_period)
4685
+static bool ipmi_timeout_handler(struct ipmi_smi *intf,
4686
+				 unsigned long timeout_period)
46064687 {
46074688 	struct list_head     timeouts;
46084689 	struct ipmi_recv_msg *msg, *msg2;
46094690 	unsigned long        flags;
46104691 	int                  i;
4611
-	unsigned int         waiting_msgs = 0;
4692
+	bool                 need_timer = false;
46124693 
46134694 	if (!intf->bmc_registered) {
46144695 		kref_get(&intf->refcount);
46154696 		if (!schedule_work(&intf->bmc_reg_work)) {
46164697 			kref_put(&intf->refcount, intf_free);
4617
-			waiting_msgs++;
4698
+			need_timer = true;
46184699 		}
46194700 	}
46204701 
....@@ -4634,7 +4715,7 @@
46344715 	for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
46354716 		check_msg_timeout(intf, &intf->seq_table[i],
46364717 				  &timeouts, timeout_period, i,
4637
-				  &flags, &waiting_msgs);
4718
+				  &flags, &need_timer);
46384719 	spin_unlock_irqrestore(&intf->seq_lock, flags);
46394720 
46404721 	list_for_each_entry_safe(msg, msg2, &timeouts, link)
....@@ -4665,7 +4746,7 @@
46654746 
46664747 	tasklet_schedule(&intf->recv_tasklet);
46674748 
4668
-	return waiting_msgs;
4749
+	return need_timer;
46694750 }
46704751 
46714752 static void ipmi_request_event(struct ipmi_smi *intf)
....@@ -4685,37 +4766,28 @@
46854766 static void ipmi_timeout(struct timer_list *unused)
46864767 {
46874768 	struct ipmi_smi *intf;
4688
-	int nt = 0, index;
4769
+	bool need_timer = false;
4770
+	int index;
46894771 
46904772 	if (atomic_read(&stop_operation))
46914773 		return;
46924774 
46934775 	index = srcu_read_lock(&ipmi_interfaces_srcu);
46944776 	list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4695
-		int lnt = 0;
4696
-
46974777 		if (atomic_read(&intf->event_waiters)) {
46984778 			intf->ticks_to_req_ev--;
46994779 			if (intf->ticks_to_req_ev == 0) {
47004780 				ipmi_request_event(intf);
47014781 				intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
47024782 			}
4703
-			lnt++;
4783
+			need_timer = true;
47044784 		}
47054785 
4706
-		lnt += ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME);
4707
-
4708
-		lnt = !!lnt;
4709
-		if (lnt != intf->last_needs_timer &&
4710
-					intf->handlers->set_need_watch)
4711
-			intf->handlers->set_need_watch(intf->send_info, lnt);
4712
-		intf->last_needs_timer = lnt;
4713
-
4714
-		nt += lnt;
4786
+		need_timer |= ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME);
47154787 	}
47164788 	srcu_read_unlock(&ipmi_interfaces_srcu, index);
47174789 
4718
-	if (nt)
4790
+	if (need_timer)
47194791 		mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
47204792 }
47214793 
....@@ -4732,7 +4804,9 @@
47324804 static void free_smi_msg(struct ipmi_smi_msg *msg)
47334805 {
47344806 	atomic_dec(&smi_msg_inuse_count);
4735
-	kfree(msg);
4807
+	/* Try to keep as much stuff out of the panic path as possible. */
4808
+	if (!oops_in_progress)
4809
+		kfree(msg);
47364810 }
47374811 
47384812 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)
....@@ -4751,7 +4825,9 @@
47514825 static void free_recv_msg(struct ipmi_recv_msg *msg)
47524826 {
47534827 	atomic_dec(&recv_msg_inuse_count);
4754
-	kfree(msg);
4828
+	/* Try to keep as much stuff out of the panic path as possible. */
4829
+	if (!oops_in_progress)
4830
+		kfree(msg);
47554831 }
47564832 
47574833 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
....@@ -4769,7 +4845,7 @@
47694845 
47704846 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg)
47714847 {
4772
-	if (msg->user)
4848
+	if (msg->user && !oops_in_progress)
47734849 		kref_put(&msg->user->refcount, free_user);
47744850 	msg->done(msg);
47754851 }
....@@ -5144,7 +5220,7 @@
51445220 		 * avoids problems with race conditions removing the timer
51455221 		 * here.
51465222 		 */
5147
-		atomic_inc(&stop_operation);
5223
+		atomic_set(&stop_operation, 1);
51485224 		del_timer_sync(&ipmi_timer);
51495225 
51505226 		initialized = false;
....@@ -5152,10 +5228,11 @@
51525228 		/* Check for buffer leaks. */
51535229 		count = atomic_read(&smi_msg_inuse_count);
51545230 		if (count != 0)
5155
-			pr_warn(PFX "SMI message count %d at exit\n", count);
5231
+			pr_warn("SMI message count %d at exit\n", count);
51565232 		count = atomic_read(&recv_msg_inuse_count);
51575233 		if (count != 0)
5158
-			pr_warn(PFX "recv message count %d at exit\n", count);
5234
+			pr_warn("recv message count %d at exit\n", count);
5235
+
51595236 		cleanup_srcu_struct(&ipmi_interfaces_srcu);
51605237 	}
51615238 	if (drvregistered)