/src/wireshark/epan/dissectors/packet-ipmi.c

Source
/* packet-ipmi.c
 * Routines for IPMI dissection
 * Copyright 2002-2008, Alexey Neyman, Pigeon Point Systems <avn@pigeonpoint.com>
 *
 * Wireshark - Network traffic analyzer
 * By Gerald Combs <gerald@wireshark.org>
 * Copyright 1998 Gerald Combs
 *
 * SPDX-License-Identifier: GPL-2.0-or-later
 */

#include "config.h"
#define WS_LOG_DOMAIN "packet-ipmi"
#include <wireshark.h>

#include <epan/packet.h>
#include <epan/conversation.h>
#include <epan/prefs.h>
#include <epan/addr_resolv.h>

#include "packet-ipmi.h"

static dissector_handle_t ipmi_i2c_handle;

void proto_register_ipmi(void);
void proto_reg_handoff_ipmi(void);

/*
 * See the IPMI specifications at
 *
 *  http://www.intel.com/design/servers/ipmi/
 */

/* Top-level search structure: list of registered handlers for a given netFn */
struct ipmi_netfn_root {
  ipmi_netfn_t *list;
  const char *desc;
  uint32_t siglen;
};

enum {
  MSGFMT_NONE = 0,
  MSGFMT_IPMB,
  MSGFMT_LAN,
  MSGFMT_GUESS
};

struct ipmi_parse_typelen {
  void (*get_len)(unsigned *, unsigned *, tvbuff_t *, unsigned, unsigned, bool);
  void (*parse)(char *, tvbuff_t *, unsigned, unsigned);
  const char *desc;
};

/* IPMI parsing context */
typedef struct {
  ipmi_header_t hdr;
  unsigned      hdr_len;
  unsigned      flags;
  uint8_t     cks1;
  uint8_t     cks2;
} ipmi_context_t;

/* Temporary request-response matching data. */
typedef struct {
  /* Request header */
  ipmi_header_t hdr;
  /* Frame number where the request resides */
  uint32_t      frame_num;
  /* Nest level of the request in the frame */
  uint8_t     nest_level;
} ipmi_request_t;

/* List of request-response matching data */
typedef wmem_list_t ipmi_request_list_t;

#define NSAVED_DATA 2

/* Per-command data */
typedef struct {
  uint32_t    matched_frame_num;
  uint32_t    saved_data[NSAVED_DATA];
} ipmi_cmd_data_t;

/* Per-frame data */
typedef struct {
  ipmi_cmd_data_t * cmd_data[3];
  nstime_t      ts;
} ipmi_frame_data_t;

/* RB tree of frame data */
typedef wmem_tree_t ipmi_frame_tree_t;

/* cached dissector data */
typedef struct {
  /* tree of cached frame data */
  ipmi_frame_tree_t *   frame_tree;
  /* list of cached requests */
  ipmi_request_list_t * request_list;
  /* currently dissected frame number */
  uint32_t          curr_frame_num;
  /* currently dissected frame */
  ipmi_frame_data_t *   curr_frame;
  /* current nesting level */
  uint8_t         curr_level;
  /* subsequent nesting level */
  uint8_t         next_level;
  /* top level message channel */
  uint8_t         curr_channel;
  /* top level message direction */
  uint8_t         curr_dir;
  /* pointer to current command */
  const ipmi_header_t *   curr_hdr;
  /* current completion code */
  uint8_t         curr_ccode;
} ipmi_packet_data_t;

/* Maximum nest level where it worth caching data */
#define MAX_NEST_LEVEL  3

int proto_ipmi;
static int proto_ipmb;
static int proto_kcs;
static int proto_tmode;

/* WARNING: Setting this to true might result in the entire dissector being
   disabled by default or removed completely. */
static bool dissect_bus_commands;
static bool fru_langcode_is_english = true;
static unsigned response_after_req = 5000;
static unsigned response_before_req;
static int message_format = MSGFMT_GUESS;
static int selected_oem = IPMI_OEM_NONE;

static int hf_ipmi_command_data;
static int hf_ipmi_session_handle;
static int hf_ipmi_header_trg;
static int hf_ipmi_header_trg_lun;
static int hf_ipmi_header_netfn;
static int hf_ipmi_header_crc;
static int hf_ipmi_header_src;
static int hf_ipmi_header_src_lun;
static int hf_ipmi_header_bridged;
static int hf_ipmi_header_sequence;
static int hf_ipmi_header_command;
static int hf_ipmi_header_completion;
static int hf_ipmi_header_sig;
static int hf_ipmi_data_crc;
static int hf_ipmi_response_to;
static int hf_ipmi_response_in;
static int hf_ipmi_response_time;

static int ett_ipmi;
static int ett_header;
static int ett_header_byte_1;
static int ett_header_byte_4;
static int ett_data;
static int ett_typelen;

static expert_field ei_impi_parser_not_implemented;

static struct ipmi_netfn_root ipmi_cmd_tab[IPMI_NETFN_MAX];

static ipmi_packet_data_t *
get_packet_data(packet_info * pinfo)
{
  ipmi_packet_data_t * data;

  /* get conversation data */
  conversation_t * conv = find_or_create_conversation(pinfo);

  /* get protocol-specific data */
  data = (ipmi_packet_data_t *)
      conversation_get_proto_data(conv, proto_ipmi);

  if (!data) {
    /* allocate per-packet data */
    data = wmem_new0(wmem_file_scope(), ipmi_packet_data_t);

    /* allocate request list and frame tree */
    data->frame_tree = wmem_tree_new(wmem_file_scope());
    data->request_list = wmem_list_new(wmem_file_scope());

    /* add protocol data */
    conversation_add_proto_data(conv, proto_ipmi, data);
  }

  /* check if packet has changed */
  if (pinfo->num != data->curr_frame_num) {
    data->curr_level = 0;
    data->next_level = 0;
  }

  return data;
}

static ipmi_frame_data_t *
get_frame_data(ipmi_packet_data_t * data, uint32_t frame_num)
{
  ipmi_frame_data_t * frame = (ipmi_frame_data_t *)
      wmem_tree_lookup32(data->frame_tree, frame_num);

  if (frame == NULL) {
    frame = wmem_new0(wmem_file_scope(), ipmi_frame_data_t);

    wmem_tree_insert32(data->frame_tree, frame_num, frame);
  }
  return frame;
}

static ipmi_request_t *
get_matched_request(ipmi_packet_data_t * data, const ipmi_header_t * rs_hdr,
    unsigned flags)
{
  wmem_list_frame_t * iter = wmem_list_head(data->request_list);
  ipmi_header_t rq_hdr;

  /* reset message context */
  rq_hdr.context = 0;

  /* copy channel */
  rq_hdr.channel = data->curr_channel;

  /* toggle packet direction */
  rq_hdr.dir = rs_hdr->dir ^ 1;

  rq_hdr.session = rs_hdr->session;

  /* swap responder address/lun */
  rq_hdr.rs_sa = rs_hdr->rq_sa;
  rq_hdr.rs_lun = rs_hdr->rq_lun;

  /* remove reply flag */
  rq_hdr.netfn = rs_hdr->netfn & ~1;

  /* swap requester address/lun */
  rq_hdr.rq_sa = rs_hdr->rs_sa;
  rq_hdr.rq_lun = rs_hdr->rs_lun;

  /* copy sequence */
  rq_hdr.rq_seq = rs_hdr->rq_seq;

  /* copy command */
  rq_hdr.cmd = rs_hdr->cmd;

  /* TODO: copy prefix bytes */

  ws_debug("%d, %d: rq_hdr : {"
      "\tchannel=%d"
      "\tdir=%d"
      "\trs_sa=%x"
      "\trs_lun=%d"
      "\tnetfn=%x"
      "\trq_sa=%x"
      "\trq_lun=%d"
      "\trq_seq=%x"
      "\tcmd=%x }",
      data->curr_frame_num, data->curr_level,
      rq_hdr.channel, rq_hdr.dir, rq_hdr.rs_sa, rq_hdr.rs_lun,
      rq_hdr.netfn, rq_hdr.rq_sa, rq_hdr.rq_lun, rq_hdr.rq_seq,
      rq_hdr.cmd);

  while (iter) {
    ipmi_request_t * rq = (ipmi_request_t *) wmem_list_frame_data(iter);

    /* check if in Get Message context */
    if (rs_hdr->context == IPMI_E_GETMSG && !(flags & IPMI_D_TRG_SA)) {
      /* diregard rsSA */
      rq_hdr.rq_sa = rq->hdr.rq_sa;
    }

    /* compare command headers */
    if (!memcmp(&rq_hdr, &rq->hdr, sizeof(rq_hdr))) {
      return rq;
    }

    /* proceed to next request */
    iter = wmem_list_frame_next(iter);
  }

  return NULL;
}

static void
remove_old_requests(ipmi_packet_data_t * data, const nstime_t * curr_time)
{
  wmem_list_frame_t * iter = wmem_list_head(data->request_list);

  while (iter) {
    ipmi_request_t * rq = (ipmi_request_t *) wmem_list_frame_data(iter);
    ipmi_frame_data_t * frame = get_frame_data(data, rq->frame_num);
    nstime_t delta;

    /* calculate time delta */
    nstime_delta(&delta, curr_time, &frame->ts);

    if (nstime_to_msec(&delta) > response_after_req) {
      wmem_list_frame_t * del = iter;

      /* proceed to next request */
      iter = wmem_list_frame_next(iter);

      /* free request data */
      wmem_free(wmem_file_scope(), rq);

      /* remove list item */
      wmem_list_remove_frame(data->request_list, del);
    } else {
      break;
    }
  }
}

static void
match_request_response(ipmi_packet_data_t * data, const ipmi_header_t * hdr,
    unsigned flags)
{
  /* get current frame */
  ipmi_frame_data_t * rs_frame = data->curr_frame;

  /* get current command data */
  ipmi_cmd_data_t * rs_data = rs_frame->cmd_data[data->curr_level];

  /* check if parse response for the first time */
  if (!rs_data) {
    ipmi_request_t * rq;

    /* allocate command data */
    rs_data = wmem_new0(wmem_file_scope(), ipmi_cmd_data_t);

    /* search for matching request */
    rq = get_matched_request(data, hdr, flags);

    /* check if matching request is found */
    if (rq) {
      /* get request frame data */
      ipmi_frame_data_t * rq_frame =
          get_frame_data(data, rq->frame_num);

      /* get command data */
      ipmi_cmd_data_t * rq_data = rq_frame->cmd_data[rq->nest_level];

      /* save matched frame numbers */
      rq_data->matched_frame_num = data->curr_frame_num;
      rs_data->matched_frame_num = rq->frame_num;

      /* copy saved command data information */
      rs_data->saved_data[0] = rq_data->saved_data[0];
      rs_data->saved_data[1] = rq_data->saved_data[1];

      /* remove request from the list */
      wmem_list_remove(data->request_list, rq);

      /* delete request data */
      wmem_free(wmem_file_scope(), rq);
    }

    /* save command data pointer in frame */
    rs_frame->cmd_data[data->curr_level] = rs_data;
  }
}

static void
add_request(ipmi_packet_data_t * data, const ipmi_header_t * hdr)
{
  /* get current frame */
  ipmi_frame_data_t * rq_frame = data->curr_frame;

  /* get current command data */
  ipmi_cmd_data_t * rq_data = rq_frame->cmd_data[data->curr_level];

  /* check if parse response for the first time */
  if (!rq_data) {
    ipmi_request_t * rq;

    /* allocate command data */
    rq_data = wmem_new0(wmem_file_scope(), ipmi_cmd_data_t);

    /* set command data pointer */
    rq_frame->cmd_data[data->curr_level] = rq_data;

    /* allocate request data */
    rq = wmem_new0(wmem_file_scope(), ipmi_request_t);

    /* copy request header */
    memcpy(&rq->hdr, hdr, sizeof(rq->hdr));

    /* override context, channel and direction */
    rq->hdr.context = 0;
    rq->hdr.channel = data->curr_channel;
    rq->hdr.dir = data->curr_dir;

    /* set request frame number */
    rq->frame_num = data->curr_frame_num;

    /* set command nest level */
    rq->nest_level = data->curr_level;

    /* append request to list */
    wmem_list_append(data->request_list, rq);

  ws_debug("%d, %d: rq_hdr : {"
      "\tchannel=%d"
      "\tdir=%d"
      "\trs_sa=%x"
      "\trs_lun=%d"
      "\tnetfn=%x"
      "\trq_sa=%x"
      "\trq_lun=%d"
      "\trq_seq=%x"
      "\tcmd=%x }",
      data->curr_frame_num, data->curr_level,
      rq->hdr.channel, rq->hdr.dir, rq->hdr.rs_sa, rq->hdr.rs_lun,
      rq->hdr.netfn, rq->hdr.rq_sa, rq->hdr.rq_lun, rq->hdr.rq_seq,
      rq->hdr.cmd);
  }
}

static void
add_command_info(packet_info *pinfo, const ipmi_cmd_t * cmd,
    bool resp, uint8_t cc_val, const char * cc_str, bool broadcast)
{
  if (resp) {
    col_add_fstr(pinfo->cinfo, COL_INFO, "Rsp, %s, %s (%02xh)",
        cmd->desc, cc_str, cc_val);
  } else {
    col_add_fstr(pinfo->cinfo, COL_INFO, "Req, %s%s",
        broadcast ? "Broadcast " : "", cmd->desc);
  }
}

static int
dissect_ipmi_cmd(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
    int hf_parent_item, int ett_tree, const ipmi_context_t * ctx)
{
  ipmi_packet_data_t * data;
  ipmi_netfn_t * cmd_list;
  const ipmi_cmd_t * cmd;
  proto_item * ti;
  proto_tree * cmd_tree = NULL, * tmp_tree;
  uint8_t prev_level, cc_val;
  unsigned offset, siglen, is_resp;
  const char * cc_str, * netfn_str;

  if (!dissect_bus_commands) {
    ti = proto_tree_add_item(tree, hf_parent_item, tvb, 0, -1, ENC_NA);
    cmd_tree = proto_item_add_subtree(ti, ett_tree);
    proto_tree_add_item(cmd_tree, hf_ipmi_command_data, tvb, 0, -1, ENC_NA);
    return 0;
  }

  /* get packet data */
  data = get_packet_data(pinfo);
  if (!data) {
    return 0;
  }

  /* get prefix length */
  siglen = ipmi_getsiglen(ctx->hdr.netfn);

  /* get response flag */
  is_resp = ctx->hdr.netfn & 1;

  /* check message length */
  if (tvb_captured_length(tvb) < ctx->hdr_len + siglen + is_resp
      + !(ctx->flags & IPMI_D_NO_CKS)) {
    /* don bother with anything */
    return call_data_dissector(tvb, pinfo, tree);
  }

  /* save nest level */
  prev_level = data->curr_level;

  /* assign next nest level */
  data->curr_level = data->next_level;

  /* increment next nest level */
  data->next_level++;

  /* check for the first invocation */
  if (!data->curr_level) {
    /* get current frame data */
    data->curr_frame = get_frame_data(data, pinfo->num);
    data->curr_frame_num = pinfo->num;

    /* copy frame timestamp */
    memcpy(&data->curr_frame->ts, &pinfo->abs_ts, sizeof(nstime_t));

    /* cache channel and direction */
    data->curr_channel = ctx->hdr.channel;
    data->curr_dir = ctx->hdr.dir;

    /* remove requests which are too old */
    remove_old_requests(data, &pinfo->abs_ts);
  }

  if (data->curr_level < MAX_NEST_LEVEL) {
    if (ctx->hdr.netfn & 1) {
      /* perform request/response matching */
      match_request_response(data, &ctx->hdr, ctx->flags);
    } else {
      /* add request to the list for later matching */
      add_request(data, &ctx->hdr);
    }
  }

  /* get command list by network function code */
  cmd_list = ipmi_getnetfn(ctx->hdr.netfn,
      tvb_get_ptr(tvb, ctx->hdr_len + is_resp, siglen));

  /* get command descriptor */
  cmd = ipmi_getcmd(cmd_list, ctx->hdr.cmd);

  /* check if response */
  if (is_resp) {
    /* get completion code */
    cc_val = tvb_get_uint8(tvb, ctx->hdr_len);

    /* get completion code desc */
    cc_str = ipmi_get_completion_code(cc_val, cmd);
  } else {
    cc_val = 0;
    cc_str = NULL;
  }

  /* check if not inside a message */
  if (!data->curr_level) {
    /* add packet info */
    add_command_info(pinfo, cmd, is_resp, cc_val, cc_str,
        ctx->flags & IPMI_D_BROADCAST ? true : false);
  }

  if (tree) {
    /* add parent node */
    if (!data->curr_level) {
      ti = proto_tree_add_item(tree, hf_parent_item, tvb, 0, -1, ENC_NA);
      cmd_tree = proto_item_add_subtree(ti, ett_tree);
    } else {
      char str[ITEM_LABEL_LENGTH];

      if (is_resp) {
        snprintf(str, ITEM_LABEL_LENGTH, "Rsp, %s, %s",
            cmd->desc, cc_str);
      } else {
        snprintf(str, ITEM_LABEL_LENGTH, "Req, %s", cmd->desc);
      }
      if (proto_registrar_get_ftype(hf_parent_item) == FT_STRING) {
        ti = proto_tree_add_string(tree, hf_parent_item, tvb, 0, -1, str);
        cmd_tree = proto_item_add_subtree(ti, ett_tree);
      }
      else
        cmd_tree = proto_tree_add_subtree(tree, tvb, 0, -1, ett_tree, NULL, str);
    }

    if (data->curr_level < MAX_NEST_LEVEL) {
      /* check if response */
      if (ctx->hdr.netfn & 1) {
        /* get current command data */
        ipmi_cmd_data_t * rs_data =
            data->curr_frame->cmd_data[data->curr_level];

        if (rs_data->matched_frame_num) {
          nstime_t ns;

          /* add "Request to:" field */
          ti = proto_tree_add_uint(cmd_tree, hf_ipmi_response_to,
              tvb, 0, 0, rs_data->matched_frame_num);

          /* mark field as a generated one */
          proto_item_set_generated(ti);

          /* calculate delta time */
          nstime_delta(&ns, &pinfo->abs_ts,
              &get_frame_data(data,
                  rs_data->matched_frame_num)->ts);

          /* add "Response time" field */
          ti = proto_tree_add_time(cmd_tree, hf_ipmi_response_time,
              tvb, 0, 0, &ns);

          /* mark field as a generated one */
          proto_item_set_generated(ti);
          }
      } else {
        /* get current command data */
        ipmi_cmd_data_t * rq_data =
            data->curr_frame->cmd_data[data->curr_level];

        if (rq_data->matched_frame_num) {
          /* add "Response in:" field  */
          ti = proto_tree_add_uint(cmd_tree, hf_ipmi_response_in,
              tvb, 0, 0, rq_data->matched_frame_num);

          /* mark field as a generated one */
          proto_item_set_generated(ti);
        }
      }
    }

    /* set starting offset */
    offset = 0;

    /* check if message is broadcast */
    if (ctx->flags & IPMI_D_BROADCAST) {
      /* skip first byte */
      offset++;
    }

    /* check if session handle is specified */
    if (ctx->flags & IPMI_D_SESSION_HANDLE) {
      /* add session handle field */
      proto_tree_add_item(cmd_tree, hf_ipmi_session_handle,
          tvb, offset++, 1, ENC_LITTLE_ENDIAN);
    }

    /* check if responder address is specified */
    if (ctx->flags & IPMI_D_TRG_SA) {
      /* add response address field */
      proto_tree_add_item(cmd_tree, hf_ipmi_header_trg, tvb,
          offset++, 1, ENC_LITTLE_ENDIAN);
    }

    /* get NetFn string */
    netfn_str = ipmi_getnetfnname(pinfo->pool, ctx->hdr.netfn, cmd_list);

    /* Network function + target LUN */
    tmp_tree = proto_tree_add_subtree_format(cmd_tree, tvb, offset, 1,
        ett_header_byte_1, NULL, "Target LUN: 0x%02x, NetFN: %s %s (0x%02x)",
        ctx->hdr.rs_lun, netfn_str,
        is_resp ? "Response" : "Request", ctx->hdr.netfn);

    /* add Net Fn */
    proto_tree_add_uint_format(tmp_tree, hf_ipmi_header_netfn, tvb,
        offset, 1, ctx->hdr.netfn << 2,
        "NetFn: %s %s (0x%02x)", netfn_str,
        is_resp ? "Response" : "Request", ctx->hdr.netfn);

    proto_tree_add_item(tmp_tree, hf_ipmi_header_trg_lun, tvb,
        offset++, 1, ENC_LITTLE_ENDIAN);

    /* check if cks1 is specified */
    if (!(ctx->flags & IPMI_D_NO_CKS)) {
      uint8_t cks = tvb_get_uint8(tvb, offset);

      /* Header checksum */
      if (ctx->cks1) {
        uint8_t correct = cks - ctx->cks1;

        proto_tree_add_uint_format_value(cmd_tree, hf_ipmi_header_crc,
            tvb, offset++, 1, cks,
            "0x%02x (incorrect, expected 0x%02x)", cks, correct);
      } else {
        proto_tree_add_uint_format_value(cmd_tree, hf_ipmi_header_crc,
            tvb, offset++, 1, cks,
            "0x%02x (correct)", cks);
      }
    }

    /* check if request address is specified */
    if (!(ctx->flags & IPMI_D_NO_RQ_SA)) {
      /* add request address field */
      proto_tree_add_item(cmd_tree, hf_ipmi_header_src, tvb,
          offset++, 1, ENC_LITTLE_ENDIAN);
    }

    /* check if request sequence is specified */
    if (!(ctx->flags & IPMI_D_NO_SEQ)) {
      /* Sequence number + source LUN */
      tmp_tree = proto_tree_add_subtree_format(cmd_tree, tvb, offset, 1,
          ett_header_byte_4, NULL, "%s: 0x%02x, SeqNo: 0x%02x",
          (ctx->flags & IPMI_D_TMODE) ? "Bridged" : "Source LUN",
              ctx->hdr.rq_lun, ctx->hdr.rq_seq);

      if (ctx->flags & IPMI_D_TMODE) {
        proto_tree_add_item(tmp_tree, hf_ipmi_header_bridged,
            tvb, offset, 1, ENC_LITTLE_ENDIAN);
      } else {
        proto_tree_add_item(tmp_tree, hf_ipmi_header_src_lun,
            tvb, offset, 1, ENC_LITTLE_ENDIAN);
      }

      /* print seq no */
      proto_tree_add_item(tmp_tree, hf_ipmi_header_sequence, tvb,
          offset++, 1, ENC_LITTLE_ENDIAN);
    }

    /* command code */
    proto_tree_add_uint_format_value(cmd_tree, hf_ipmi_header_command,
        tvb, offset++, 1, ctx->hdr.cmd, "%s (0x%02x)",
        cmd->desc, ctx->hdr.cmd);

    if (is_resp) {
      /* completion code */
      proto_tree_add_uint_format_value(cmd_tree,
          hf_ipmi_header_completion, tvb, offset++, 1,
          cc_val, "%s (0x%02x)", cc_str, cc_val);
    }

    if (siglen) {
      /* command prefix (if present) */
      ti = proto_tree_add_item(cmd_tree, hf_ipmi_header_sig, tvb,
          offset, siglen, ENC_NA);
      proto_item_append_text(ti, " (%s)", netfn_str);
    }
  }

  if (tree || (cmd->flags & CMD_CALLRQ)) {
    /* calculate message data length */
    unsigned data_len = tvb_captured_length(tvb)
        - ctx->hdr_len
        - siglen
        - (is_resp ? 1 : 0)
        - !(ctx->flags & IPMI_D_NO_CKS);

    /* create data subset */
    tvbuff_t * data_tvb = tvb_new_subset_length(tvb,
        ctx->hdr_len + siglen + (is_resp ? 1 : 0), data_len);

    /* Select sub-handler */
    ipmi_cmd_handler_t hnd = is_resp ? cmd->parse_resp : cmd->parse_req;

    if (hnd && tvb_captured_length(data_tvb)) {
      /* create data field */
      tmp_tree = proto_tree_add_subtree(cmd_tree, data_tvb, 0, -1, ett_data, NULL, "Data");

      /* save current command */
      data->curr_hdr = &ctx->hdr;

      /* save current completion code */
      data->curr_ccode = cc_val;

      /* call command parser */
      hnd(data_tvb, pinfo, tmp_tree);
    }
  }

  /* check if cks2 is specified */
  if (tree && !(ctx->flags & IPMI_D_NO_CKS)) {
    uint8_t cks;

    /* get cks2 offset */
    offset = tvb_captured_length(tvb) - 1;

    /* get cks2 */
    cks = tvb_get_uint8(tvb, offset);

    /* Header checksum */
    if (ctx->cks2) {
      uint8_t correct = cks - ctx->cks2;

      proto_tree_add_uint_format_value(cmd_tree, hf_ipmi_data_crc,
          tvb, offset, 1, cks,
          "0x%02x (incorrect, expected 0x%02x)", cks, correct);
    } else {
      proto_tree_add_uint_format_value(cmd_tree, hf_ipmi_data_crc,
          tvb, offset, 1, cks,
          "0x%02x (correct)", cks);
    }
  }

  /* decrement next nest level */
  data->next_level = data->curr_level;

  /* restore previous nest level */
  data->curr_level = prev_level;

  return tvb_captured_length(tvb);
}

/* Get currently parsed message header */
const ipmi_header_t * ipmi_get_hdr(packet_info * pinfo)
{
  ipmi_packet_data_t * data = get_packet_data(pinfo);
  return data->curr_hdr;
}

/* Get completion code for currently parsed message */
uint8_t ipmi_get_ccode(packet_info * pinfo)
{
  ipmi_packet_data_t * data = get_packet_data(pinfo);
  return data->curr_ccode;
}

/* Save request data for later use in response */
void ipmi_set_data(packet_info *pinfo, unsigned idx, uint32_t value)
{
  ipmi_packet_data_t * data = get_packet_data(pinfo);

  /* check bounds */
  if (data->curr_level >= MAX_NEST_LEVEL || idx >= NSAVED_DATA || !data->curr_frame ) {
    return;
  }

  /* save data */
  data->curr_frame->cmd_data[data->curr_level]->saved_data[idx] = value;
}

/* Get saved request data */
bool ipmi_get_data(packet_info *pinfo, unsigned idx, uint32_t * value)
{
  ipmi_packet_data_t * data = get_packet_data(pinfo);

  /* check bounds */
  if (data->curr_level >= MAX_NEST_LEVEL || idx >= NSAVED_DATA || !data->curr_frame ) {
    return false;
  }

  /* get data */
  *value = data->curr_frame->cmd_data[data->curr_level]->saved_data[idx];
  return true;
}

/* ----------------------------------------------------------------
   Support for Type/Length fields parsing.
---------------------------------------------------------------- */

static void
get_len_binary(unsigned *clen, unsigned *blen, tvbuff_t *tvb _U_, unsigned offs _U_,
    unsigned len, bool len_is_bytes _U_)
{
  *clen = len * 3;
  *blen = len;
}

static void
parse_binary(char *p, tvbuff_t *tvb, unsigned offs, unsigned len)
{
  static const char hex[] = "0123456789ABCDEF";
  uint8_t v;
  unsigned i;

  for (i = 0; i < len / 3; i++) {
    v = tvb_get_uint8(tvb, offs + i);
    *p++ = hex[v >> 4];
    *p++ = hex[v & 0xf];
    *p++ = ' ';
  }

  if (i) {
    *--p = '\0';
  }
}

static const struct ipmi_parse_typelen ptl_binary = {
  get_len_binary, parse_binary, "Binary"
};

static void
get_len_bcdplus(unsigned *clen, unsigned *blen, tvbuff_t *tvb _U_, unsigned offs _U_,
    unsigned len, bool len_is_bytes)
{
  if (len_is_bytes) {
    *clen = len * 2;
    *blen = len;
  } else {
    *blen = (len + 1) / 2;
    *clen = len;
  }
}

static void
parse_bcdplus(char *p, tvbuff_t *tvb, unsigned offs, unsigned len)
{
  static const char bcd[] = "0123456789 -.:,_";
  unsigned i, msk = 0xf0, shft = 4;
  uint8_t v;

  for (i = 0; i < len; i++) {
    v = (tvb_get_uint8(tvb, offs + i / 2) & msk) >> shft;
    *p++ = bcd[v];
    msk ^= 0xff;
    shft = 4 - shft;
  }
}

static const struct ipmi_parse_typelen ptl_bcdplus = {
  get_len_bcdplus, parse_bcdplus, "BCD+"
};

static void
get_len_6bit_ascii(unsigned *clen, unsigned *blen, tvbuff_t *tvb _U_, unsigned offs _U_,
    unsigned len, bool len_is_bytes)
{
  if (len_is_bytes) {
    *clen = len * 4 / 3;
    *blen = len;
  } else {
    *blen = (len * 3 + 3) / 4;
    *clen = len;
  }
}

static void
parse_6bit_ascii(char *p, tvbuff_t *tvb, unsigned offs, unsigned len)
{
  uint32_t v;
  unsigned i;

  /* First, handle "full" triplets of bytes, 4 characters each */
  for (i = 0; i < len / 4; i++) {
    v = tvb_get_letoh24(tvb, offs + i * 3);
    p[0] = ' ' + (v & 0x3f);
    p[1] = ' ' + ((v >> 6) & 0x3f);
    p[2] = ' ' + ((v >> 12) & 0x3f);
    p[3] = ' ' + ((v >> 18) & 0x3f);
    p += 4;
  }

  /* Do we have any characters left? */
  offs += len / 4;
  len &= 0x3;
  switch (len) {
  case 3:
    v = (tvb_get_uint8(tvb, offs + 2) << 4) | (tvb_get_uint8(tvb, offs + 1) >> 4);
    p[2] = ' ' + (v & 0x3f);
    /* Fall thru */
  case 2:
    v = (tvb_get_uint8(tvb, offs + 1) << 2) | (tvb_get_uint8(tvb, offs) >> 6);
    p[1] = ' ' + (v & 0x3f);
    /* Fall thru */
  case 1:
    v = tvb_get_uint8(tvb, offs) & 0x3f;
    p[0] = ' ' + (v & 0x3f);
  }
}

static const struct ipmi_parse_typelen ptl_6bit_ascii = {
  get_len_6bit_ascii, parse_6bit_ascii, "6-bit ASCII"
};

static void
get_len_8bit_ascii(unsigned *clen, unsigned *blen, tvbuff_t *tvb, unsigned offs,
    unsigned len, bool len_is_bytes _U_)
{
  unsigned i;
  uint8_t ch;

  *blen = len;  /* One byte is one character */
  *clen = 0;
  for (i = 0; i < len; i++) {
    ch = tvb_get_uint8(tvb, offs + i);
    *clen += (ch >= 0x20 && ch <= 0x7f) ? 1 : 4;
  }
}

static void
parse_8bit_ascii(char *p, tvbuff_t *tvb, unsigned offs, unsigned len)
{
  uint8_t ch;
  char *pmax;

  pmax = p + len;
  while (p < pmax) {
    ch = tvb_get_uint8(tvb, offs++);
    if (ch >= 0x20 && ch <= 0x7f) {
      *p++ = ch;
    } else {
      snprintf(p, 5, "\\x%02x", ch);
      p += 4;
    }
  }
}

static const struct ipmi_parse_typelen ptl_8bit_ascii = {
  get_len_8bit_ascii, parse_8bit_ascii, "ASCII+Latin1"
};

static void
get_len_unicode(unsigned *clen, unsigned *blen, tvbuff_t *tvb _U_, unsigned offs _U_,
    unsigned len _U_, bool len_is_bytes)
{
  if (len_is_bytes) {
    *clen = len * 3; /* Each 2 bytes result in 6 chars printed: \Uxxxx */
    *blen = len;
  } else {
    *clen = len * 6;
    *blen = len * 2;
  }
}

static void
parse_unicode(char *p, tvbuff_t *tvb, unsigned offs, unsigned len)
{
  char *pmax = p + len;
  uint8_t ch0, ch1;

  while (p < pmax) {
    ch0 = tvb_get_uint8(tvb, offs++);
    ch1 = tvb_get_uint8(tvb, offs++);
    snprintf(p, 7, "\\U%02x%02x", ch0, ch1);
    p += 6;
  }
}

static const struct ipmi_parse_typelen ptl_unicode = {
  get_len_unicode, parse_unicode, "Unicode"
};

void
ipmi_add_typelen(packet_info *pinfo, proto_tree *tree, int hf_string, int hf_type, int hf_length, tvbuff_t *tvb,
    unsigned offs, bool is_fru)
{
  static const struct ipmi_parse_typelen * const fru_eng[4] = {
    &ptl_binary, &ptl_bcdplus, &ptl_6bit_ascii, &ptl_8bit_ascii
  };
  static const struct ipmi_parse_typelen * const fru_noneng[4] = {
    &ptl_binary, &ptl_bcdplus, &ptl_6bit_ascii, &ptl_unicode
  };
  static const struct ipmi_parse_typelen * const ipmi[4] = {
    &ptl_unicode, &ptl_bcdplus, &ptl_6bit_ascii, &ptl_8bit_ascii
  };
  const struct ipmi_parse_typelen *ptr;
  proto_tree *s_tree;
  unsigned type, msk, clen, blen, len;
  const char *unit;
  char *str;
  uint8_t typelen;

  typelen = tvb_get_uint8(tvb, offs);
  type = typelen >> 6;
  if (is_fru) {
    msk = 0x3f;
    ptr = (fru_langcode_is_english ? fru_eng : fru_noneng)[type];
    unit = "bytes";
  } else {
    msk = 0x1f;
    ptr = ipmi[type];
    unit = "characters";
  }

  len = typelen & msk;
  ptr->get_len(&clen, &blen, tvb, offs + 1, len, is_fru);

  str = (char *)wmem_alloc(pinfo->pool, clen + 1);
  ptr->parse(str, tvb, offs + 1, clen);
  str[clen] = '\0';

  s_tree = proto_tree_add_subtree_format(tree, tvb, offs, 1, ett_typelen, NULL,
      "%s Type/Length byte: %s, %d %s", (proto_registrar_get_nth(hf_string))->name, ptr->desc, len, unit);
  proto_tree_add_uint_format_value(s_tree, hf_type, tvb, offs, 1, type, "%s (0x%02x)",
      ptr->desc, type);
  proto_tree_add_uint_format_value(s_tree, hf_length, tvb, offs, 1, len, "%d %s",
      len, unit);

  proto_tree_add_string_format_value(tree, hf_string, tvb, offs + 1, blen, str,
      "[%s] '%s'", ptr->desc, str);
}

/* ----------------------------------------------------------------
   Timestamp, IPMI-style.
---------------------------------------------------------------- */
void
ipmi_add_timestamp(packet_info *pinfo, proto_tree *tree, int hf, tvbuff_t *tvb, unsigned offset)
{
  uint32_t ts = tvb_get_letohl(tvb, offset);

  if (ts == 0xffffffff) {
    proto_tree_add_uint_format_value(tree, hf, tvb, offset, 4,
        ts, "Unspecified/Invalid");
  } else if (ts <= 0x20000000) {
    proto_tree_add_uint_format_value(tree, hf, tvb, offset, 4,
        ts, "%s since SEL device's initialization",
        unsigned_time_secs_to_str(pinfo->pool, ts));
  } else {
    proto_tree_add_uint_format_value(tree, hf, tvb, offset, 4,
        ts, "%s", abs_time_secs_to_str(pinfo->pool, ts, ABSOLUTE_TIME_UTC, true));
  }
}

/* ----------------------------------------------------------------
   GUID, IPMI-style.
---------------------------------------------------------------- */

void
ipmi_add_guid(proto_tree *tree, int hf, tvbuff_t *tvb, unsigned offset)
{
  e_guid_t guid;
  int i;

  guid.data1 = tvb_get_letohl(tvb, offset + 12);
  guid.data2 = tvb_get_letohs(tvb, offset + 10);
  guid.data3 = tvb_get_letohs(tvb, offset + 8);
  for (i = 0; i < 8; i++) {
    guid.data4[i] = tvb_get_uint8(tvb, offset + 7 - i);
  }
  proto_tree_add_guid(tree, hf, tvb, offset, 16, &guid);
}

/* ----------------------------------------------------------------
   Routines for registering/looking up command parsers.
---------------------------------------------------------------- */

static void
ipmi_netfn_setdesc(uint32_t netfn, const char *desc, uint32_t siglen)
{
  struct ipmi_netfn_root *inr;

  inr = &ipmi_cmd_tab[netfn >> 1];
  inr->desc = desc;
  inr->siglen = siglen;
}

void
ipmi_register_netfn_cmdtab(uint32_t netfn, unsigned oem_selector,
    const uint8_t *sig, uint32_t siglen, const char *desc,
    const ipmi_cmd_t *cmdtab, uint32_t cmdtablen)
{
  struct ipmi_netfn_root *inr;
  ipmi_netfn_t *inh;

  netfn >>= 1;  /* Requests and responses grouped together */
  if (netfn >= IPMI_NETFN_MAX) {
    return;
  }

  inr = &ipmi_cmd_tab[netfn];
  if (inr->siglen != siglen) {
    return;
  }

  inh = wmem_new(wmem_epan_scope(), struct ipmi_netfn_handler);
  inh->desc = desc;
  inh->oem_selector = oem_selector;
  inh->sig = sig;
  inh->cmdtab = cmdtab;
  inh->cmdtablen = cmdtablen;

  inh->next = inr->list;
  inr->list = inh;
}

uint32_t
ipmi_getsiglen(uint32_t netfn)
{
  return ipmi_cmd_tab[netfn >> 1].siglen;
}

const char *
ipmi_getnetfnname(wmem_allocator_t *pool, uint32_t netfn, ipmi_netfn_t *nf)
{
  const char *dn, *db;

  dn = ipmi_cmd_tab[netfn >> 1].desc ?
    ipmi_cmd_tab[netfn >> 1].desc : "Reserved";
  db = nf ? nf->desc : NULL;
  if (db) {
    return wmem_strdup_printf(pool, "%s (%s)", db, dn);
  } else {
    return dn;
  }
}

ipmi_netfn_t *
ipmi_getnetfn(uint32_t netfn, const uint8_t *sig)
{
  struct ipmi_netfn_root *inr;
  ipmi_netfn_t *inh;

  inr = &ipmi_cmd_tab[netfn >> 1];
  for (inh = inr->list; inh; inh = inh->next) {
    if ((inh->oem_selector == (unsigned)selected_oem || inh->oem_selector == IPMI_OEM_NONE)
        && (!inr->siglen || !memcmp(sig, inh->sig, inr->siglen))) {
      return inh;
    }
  }

  /* Either unknown netFn or signature does not match */
  return NULL;
}

const ipmi_cmd_t *
ipmi_getcmd(ipmi_netfn_t *nf, uint32_t cmd)
{
  static const ipmi_cmd_t ipmi_cmd_unknown = {
    0x00,   /* Code */
    ipmi_notimpl, /* request */
    ipmi_notimpl, /* response */
    NULL,   /* command codes */
    NULL,   /* subfunctions */
    "Unknown command",
    0   /* flag */
  };
  const ipmi_cmd_t *ic;
  size_t i, len;

  if (nf) {
    len = nf->cmdtablen;
    for (ic = nf->cmdtab, i = 0; i < len; i++, ic++) {
      if (ic->cmd == cmd) {
        return ic;
      }
    }
  }

  return &ipmi_cmd_unknown;
}

/* ----------------------------------------------------------------
   Various utility functions.
---------------------------------------------------------------- */

void
ipmi_notimpl(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree)
{
  proto_tree_add_expert_remaining(tree, pinfo, &ei_impi_parser_not_implemented, tvb, 0);
}

void
ipmi_fmt_10ms_1based(char *s, uint32_t v)
{
  snprintf(s, ITEM_LABEL_LENGTH, "%d.%03d seconds", v / 100, (v % 100) * 10);
}

void
ipmi_fmt_500ms_0based(char *s, uint32_t v)
{
  ipmi_fmt_500ms_1based(s, ++v);
}

void
ipmi_fmt_500ms_1based(char *s, uint32_t v)
{
  snprintf(s, ITEM_LABEL_LENGTH, "%d.%03d seconds", v / 2, (v % 2) * 500);
}

void
ipmi_fmt_1s_0based(char *s, uint32_t v)
{
  ipmi_fmt_1s_1based(s, ++v);
}

void
ipmi_fmt_1s_1based(char *s, uint32_t v)
{
  snprintf(s, ITEM_LABEL_LENGTH, "%d seconds", v);
}

void
ipmi_fmt_2s_0based(char *s, uint32_t v)
{
  snprintf(s, ITEM_LABEL_LENGTH, "%d seconds", (v + 1) * 2);
}

void
ipmi_fmt_5s_1based(char *s, uint32_t v)
{
  snprintf(s, ITEM_LABEL_LENGTH, "%d seconds", v * 5);
}

void
ipmi_fmt_version(char *s, uint32_t v)
{
  snprintf(s, ITEM_LABEL_LENGTH, "%d.%d", v & 0x0f, (v >> 4) & 0x0f);
}

void
ipmi_fmt_channel(char *s, uint32_t v)
{
  static const value_string chan_vals[] = {
    { 0x00, "Primary IPMB (IPMB-0)" },
    { 0x07, "IPMB-L" },
    { 0x0e, "Current channel" },
    { 0x0f, "System Interface" },
    { 0, NULL }
  };
  char* tmp_str;

  tmp_str = val_to_str(NULL, v, chan_vals, "Channel #%d");
  snprintf(s, ITEM_LABEL_LENGTH, "%s (0x%02x)", tmp_str, v);
  wmem_free(NULL, tmp_str);
}

void
ipmi_fmt_udpport(char *s, uint32_t v)
{
  char* port_str = udp_port_to_display(NULL, v);
  snprintf(s, ITEM_LABEL_LENGTH, "%s (%d)", port_str, v);
  wmem_free(NULL, port_str);
}

void
ipmi_fmt_percent(char *s, uint32_t v)
{
  snprintf(s, ITEM_LABEL_LENGTH, "%d%%", v);
}

const char *
ipmi_get_completion_code(uint8_t completion, const ipmi_cmd_t *cmd)
{
  static const value_string std_completion_codes[] = {
    { 0x00, "Command Completed Normally" },
    { 0xc0, "Node Busy" },
    { 0xc1, "Invalid Command" },
    { 0xc2, "Command invalid for given LUN" },
    { 0xc3, "Timeout while processing command, response unavailable" },
    { 0xc4, "Out of space" },
    { 0xc5, "Reservation Canceled or Invalid Reservation ID" },
    { 0xc6, "Request data truncated" },
    { 0xc7, "Request data length invalid" },
    { 0xc8, "Request data field length limit exceeded" },
    { 0xc9, "Parameter out of range" },
    { 0xca, "Cannot return number of requested data bytes" },
    { 0xcb, "Requested Sensor, data, or record not present" },
    { 0xcc, "Invalid data field in Request" },
    { 0xcd, "Command illegal for specified sensor or record type" },
    { 0xce, "Command response could not be provided" },
    { 0xcf, "Cannot execute duplicated request" },
    { 0xd0, "Command response could not be provided: SDR Repository in update mode" },
    { 0xd1, "Command response could not be provided: device in firmware update mode" },
    { 0xd2, "Command response could not be provided: BMC initialization or initialization agent in progress" },
    { 0xd3, "Destination unavailable" },
    { 0xd4, "Cannot execute command: insufficient privilege level or other security-based restriction" },
    { 0xd5, "Cannot execute command: command, or request parameter(s), not supported in present state" },
    { 0xd6, "Cannot execute command: parameter is illegal because subfunction is disabled or unavailable" },
    { 0xff, "Unspecified error" },

    { 0, NULL }
  };
  const char *res;

  if (completion >= 0x01 && completion <= 0x7e) {
    return "Device specific (OEM) completion code";
  }

  if (completion >= 0x80 && completion <= 0xbe) {
    if (cmd && cmd->cs_cc && (res = try_val_to_str(completion, cmd->cs_cc)) != NULL) {
      return res;
    }
    return "Standard command-specific code";
  }

  return val_to_str_const(completion, std_completion_codes, "Unknown");
}

static int
dissect_tmode(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
{
  ipmi_dissect_arg_t * arg = (ipmi_dissect_arg_t *) data;
  ipmi_context_t ctx;
  unsigned tvb_len = tvb_captured_length(tvb);
  uint8_t tmp;

  /* TMode message is at least 3 bytes length */
  if (tvb_len < 3) {
    return 0;
  }

  memset(&ctx, 0, sizeof(ctx));

  /* get Net Fn/RS LUN field */
  tmp = tvb_get_uint8(tvb, 0);

  /* set Net Fn */
  ctx.hdr.netfn = tmp >> 2;

  /*
   * NOTE: request/response matching code swaps RQ LUN with RS LUN
   * fields in IPMB-like manner in order to find corresponding request
   * so, we set both RS LUN and RQ LUN here for correct
   * request/response matching
   */
  ctx.hdr.rq_lun = tmp & 3;
  ctx.hdr.rs_lun = tmp & 3;

  /* get RQ Seq field */
  ctx.hdr.rq_seq = tvb_get_uint8(tvb, 1) >> 2;

  /*
   * NOTE: bridge field is ignored in request/response matching
   */

  /* get command code */
  ctx.hdr.cmd = tvb_get_uint8(tvb, 2);

  /* set dissect flags */
  ctx.flags = IPMI_D_TMODE|IPMI_D_NO_CKS|IPMI_D_NO_RQ_SA;

  /* set header length */
  ctx.hdr_len = 3;

  /* copy channel number and direction */
  ctx.hdr.context = arg ? arg->context : IPMI_E_NONE;
  ctx.hdr.channel = arg ? arg->channel : 0;
  ctx.hdr.dir = arg ? arg->flags >> 7 : ctx.hdr.netfn & 1;

  if (ctx.hdr.context == IPMI_E_NONE) {
    /* set source column */
    col_set_str(pinfo->cinfo, COL_DEF_SRC,
        ctx.hdr.dir ? "Console" : "BMC");

    /* set destination column */
    col_set_str(pinfo->cinfo, COL_DEF_DST,
        ctx.hdr.dir ? "BMC" : "Console");
  }

  /* dissect IPMI command */
  return dissect_ipmi_cmd(tvb, pinfo, tree, proto_tmode, ett_ipmi, &ctx);
}

static int
dissect_kcs(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
{
  ipmi_dissect_arg_t * arg = (ipmi_dissect_arg_t *) data;
  ipmi_context_t ctx;
  unsigned tvb_len = tvb_captured_length(tvb);
  uint8_t tmp;

  /* KCS message is at least 2 bytes length */
  if (tvb_len < 2) {
    return 0;
  }

  memset(&ctx, 0, sizeof(ctx));

  /* get Net Fn/RS LUN field */
  tmp = tvb_get_uint8(tvb, 0);

  /* set Net Fn */
  ctx.hdr.netfn = tmp >> 2;

  /*
   * NOTE: request/response matching code swaps RQ LUN with RS LUN
   * fields in IPMB-like manner in order to find corresponding request
   * so, we set both RS LUN and RQ LUN here for correct
   * request/response matching
   */
  ctx.hdr.rq_lun = tmp & 3;
  ctx.hdr.rs_lun = tmp & 3;

  /* get command code */
  ctx.hdr.cmd = tvb_get_uint8(tvb, 1);

  /* set dissect flags */
  ctx.flags = IPMI_D_NO_CKS|IPMI_D_NO_RQ_SA|IPMI_D_NO_SEQ;

  /* set header length */
  ctx.hdr_len = 2;

  /* copy channel number and direction */
  ctx.hdr.context = arg ? arg->context : 0;
  ctx.hdr.channel = arg ? arg->channel : 0;
  ctx.hdr.dir = arg ? arg->flags >> 7 : ctx.hdr.netfn & 1;

  if (ctx.hdr.context == IPMI_E_NONE) {
    /* set source column */
    col_set_str(pinfo->cinfo, COL_DEF_SRC, ctx.hdr.dir ? "HOST" : "BMC");

    /* set destination column */
    col_set_str(pinfo->cinfo, COL_DEF_DST, ctx.hdr.dir ? "BMC" : "HOST");
  }

  /* dissect IPMI command */
  return dissect_ipmi_cmd(tvb, pinfo, tree, proto_kcs, ett_ipmi, &ctx);
}

static uint8_t calc_cks(uint8_t start, tvbuff_t * tvb, unsigned off, unsigned len)
{
  while (len--) {
    start += tvb_get_uint8(tvb, off++);
  }

  return start;
}

static bool guess_imb_format(tvbuff_t *tvb, uint8_t env,
    uint8_t channel, unsigned * imb_flags, uint8_t * cks1, uint8_t * cks2)
{
  bool check_bc = false;
  bool check_sh = false;
  bool check_sa = false;
  unsigned tvb_len;
  unsigned sh_len;
  unsigned sa_len;
  unsigned rs_sa;

  if (message_format == MSGFMT_NONE) {
    return false;
  } else if (message_format == MSGFMT_IPMB) {
    *imb_flags = IPMI_D_TRG_SA;
  } else if (message_format == MSGFMT_LAN) {
    *imb_flags = IPMI_D_TRG_SA|IPMI_D_SESSION_HANDLE;
  /* channel 0 is primary IPMB */
  } else if (!channel) {
    /* check for broadcast if not in send message command */
    if (env == IPMI_E_NONE) {
      /* check broadcast */
      check_bc = 1;

      /* slave address must be present */
      *imb_flags = IPMI_D_TRG_SA;
    /* check if in send message command */
    } else if (env != IPMI_E_GETMSG) {
      /* slave address must be present */
      *imb_flags = IPMI_D_TRG_SA;
    } else /* IPMI_E_GETMSG */ {
      *imb_flags = 0;
    }
  /* channel 15 is System Interface */
  } else if (channel == 15) {
    /* slave address must be present */
    *imb_flags = IPMI_D_TRG_SA;

    /* check if in get message command */
    if (env == IPMI_E_GETMSG) {
      /* session handle must be present */
      *imb_flags |= IPMI_D_SESSION_HANDLE;
    }
  /* for other channels */
  } else {
    if (env == IPMI_E_NONE) {
      /* check broadcast */
      check_bc = 1;

      /* slave address must be present */
      *imb_flags = IPMI_D_TRG_SA;
    } else if (env == IPMI_E_SENDMSG_RQ) {
      /* check session handle */
      check_sh = 1;

      /* slave address must be present */
      *imb_flags = IPMI_D_TRG_SA;
    } else if (env == IPMI_E_SENDMSG_RS) {
      /* slave address must be present */
      *imb_flags = IPMI_D_TRG_SA;
    } else /* IPMI_E_GETMSG */ {
      /* check session handle */
      check_sh = 1;

      /* check slave address presence */
      check_sa = 1;

      /* no pre-requisites */
      *imb_flags = 0;
    }
  }

  /* get message length */
  tvb_len = tvb_captured_length(tvb);

  /*
   * broadcast message starts with null,
   * does not contain session handle
   * but contains responder address
   */
  if (check_bc
      && tvb_len >= 8
      && !tvb_get_uint8(tvb, 0)
      && !calc_cks(0, tvb, 1, 3)
      && !calc_cks(0, tvb, 4, tvb_len - 4)) {
    *imb_flags = IPMI_D_BROADCAST|IPMI_D_TRG_SA;
    *cks1 = 0;
    *cks2 = 0;
    return true;
  }

  /*
   * message with the starts with session handle
   * and contain responder address
   */
  if (check_sh
      && tvb_len >= 8
      && !calc_cks(0, tvb, 1, 3)
      && !calc_cks(0, tvb, 4, tvb_len - 4)) {
    *imb_flags = IPMI_D_SESSION_HANDLE|IPMI_D_TRG_SA;
    *cks1 = 0;
    *cks2 = 0;
    return true;
  }

  /*
   * message with responder address
   */
  if (check_sa
      && tvb_len >= 7
      && !calc_cks(0, tvb, 0, 3)
      && !calc_cks(0, tvb, 3, tvb_len - 3)) {
    *imb_flags = IPMI_D_TRG_SA;
    *cks1 = 0;
    *cks2 = 0;
    return true;
  }


  if (*imb_flags & IPMI_D_SESSION_HANDLE) {
    sh_len = 1;
    sa_len = 1;
    rs_sa = 0;
  } else if (*imb_flags & IPMI_D_TRG_SA) {
    sh_len = 0;
    sa_len = 1;
    rs_sa = 0;
  } else {
    sh_len = 0;
    sa_len = 0;
    rs_sa = 0x20;
  }

  /* check message length */
  if (tvb_len < 6 + sh_len + sa_len) {
    return false;
  }

  /* calculate checksum deltas */
  *cks1 = calc_cks(rs_sa, tvb, sh_len, sa_len + 2);
  *cks2 = calc_cks(0, tvb, sh_len + sa_len + 2,
      tvb_len - sh_len - sa_len - 2);

  return true;
}

int
do_dissect_ipmb(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
    int hf_parent_item, int ett_tree, ipmi_dissect_arg_t * arg)
{
  ipmi_context_t ctx;
  unsigned offset = 0;
  uint8_t tmp;

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "IPMB");

  memset(&ctx, 0, sizeof(ctx));

  /* copy message context and channel */
  ctx.hdr.context = arg ? arg->context : 0;
  ctx.hdr.channel = arg ? arg->channel : 0;

  /* guess IPMB message format */
  if (!guess_imb_format(tvb, ctx.hdr.context, ctx.hdr.channel,
      &ctx.flags, &ctx.cks1, &ctx.cks2)) {
    return 0;
  }

  /* check if message is broadcast */
  if (ctx.flags & IPMI_D_BROADCAST) {
    /* skip first byte */
    offset++;
  }

  /* check is session handle is specified */
  if (ctx.flags & IPMI_D_SESSION_HANDLE) {
    ctx.hdr.session = tvb_get_uint8(tvb, offset++);
  }

  /* check is response address is specified */
  if (ctx.flags & IPMI_D_TRG_SA) {
    ctx.hdr.rs_sa = tvb_get_uint8(tvb, offset++);
  } else {
    ctx.hdr.rs_sa = 0x20;
  }

  /* get Net Fn/RS LUN field */
  tmp = tvb_get_uint8(tvb, offset++);

  /* set Net Fn  and RS LUN */
  ctx.hdr.netfn = tmp >> 2;
  ctx.hdr.rs_lun = tmp & 3;

  /* skip cks1 */
  offset++;

  /* get RQ SA */
  ctx.hdr.rq_sa = tvb_get_uint8(tvb, offset++);

  /* get RQ Seq/RQ LUN field */
  tmp = tvb_get_uint8(tvb, offset++);

  /* set RQ Seq  and RQ LUN */
  ctx.hdr.rq_seq = tmp >> 2;
  ctx.hdr.rq_lun = tmp & 3;

  /* get command code */
  ctx.hdr.cmd = tvb_get_uint8(tvb, offset++);

  /* set header length */
  ctx.hdr_len = offset;

  /* copy direction */
  ctx.hdr.dir = arg ? arg->flags >> 7 : ctx.hdr.netfn & 1;

  if (ctx.hdr.context == IPMI_E_NONE) {
    unsigned red = arg ? (arg->flags & 0x40) : 0;

    if (!ctx.hdr.channel) {
      col_add_fstr(pinfo->cinfo, COL_DEF_SRC,
          "0x%02x(%s)", ctx.hdr.rq_sa, red ? "IPMB-B" : "IPMB-A");
    } else {
      col_add_fstr(pinfo->cinfo, COL_DEF_SRC,
          "0x%02x", ctx.hdr.rq_sa);
    }

    col_add_fstr(pinfo->cinfo, COL_DEF_DST, "0x%02x", ctx.hdr.rs_sa);
  }

  /* dissect IPMI command */
  return dissect_ipmi_cmd(tvb, pinfo, tree, hf_parent_item, ett_tree, &ctx);
}

static int
dissect_ipmi(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
{
  return do_dissect_ipmb(tvb, pinfo, tree, proto_ipmb, ett_ipmi,
      (ipmi_dissect_arg_t *) data);
}

static int
dissect_i2c_ipmi(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
{
  if (pinfo->pseudo_header->i2c.flags & 0x00000001) {
    /* Master-receive transactions are not possible on IPMB */
    return 0;
  }

  return do_dissect_ipmb(tvb, pinfo, tree, proto_ipmb, ett_ipmi,
      (ipmi_dissect_arg_t *) data);
}


/* Register IPMB protocol.
 */
void
proto_register_ipmi(void)
{
  static hf_register_info hf[] = {
    { &hf_ipmi_command_data, { "Bus command data", "ipmi.bus_command_data", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
    { &hf_ipmi_session_handle, { "Session handle", "ipmi.session_handle", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }},
    { &hf_ipmi_header_trg, { "Target Address", "ipmi.header.target", FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL }},
    { &hf_ipmi_header_trg_lun, { "Target LUN", "ipmi.header.trg_lun", FT_UINT8, BASE_HEX, NULL, 0x03, NULL, HFILL }},
    { &hf_ipmi_header_netfn, { "NetFN", "ipmi.header.netfn", FT_UINT8, BASE_HEX, NULL, 0xfc, NULL, HFILL }},
    { &hf_ipmi_header_crc, { "Header Checksum", "ipmi.header.crc", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }},
    { &hf_ipmi_header_src, { "Source Address", "ipmi.header.source", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }},
    { &hf_ipmi_header_src_lun, { "Source LUN", "ipmi.header.src_lun", FT_UINT8, BASE_HEX, NULL, 0x03, NULL, HFILL }},
    { &hf_ipmi_header_bridged, { "Bridged", "ipmi.header.bridged", FT_UINT8, BASE_HEX, NULL, 0x03, NULL, HFILL }},
    { &hf_ipmi_header_sequence, { "Sequence Number", "ipmi.header.sequence", FT_UINT8, BASE_HEX, NULL, 0xfc, NULL, HFILL }},
    { &hf_ipmi_header_command, { "Command", "ipmi.header.command", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }},
    { &hf_ipmi_header_completion, { "Completion Code", "ipmi.header.completion", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }},
    { &hf_ipmi_header_sig, { "Signature", "ipmi.header.signature", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
    { &hf_ipmi_data_crc, { "Data checksum", "ipmi.data.crc", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }},
    { &hf_ipmi_response_to, { "Response to", "ipmi.response_to", FT_FRAMENUM, BASE_NONE, FRAMENUM_TYPE(FT_FRAMENUM_REQUEST), 0, NULL, HFILL }},
    { &hf_ipmi_response_in, { "Response in", "ipmi.response_in", FT_FRAMENUM, BASE_NONE, FRAMENUM_TYPE(FT_FRAMENUM_RESPONSE), 0, NULL, HFILL }},
    { &hf_ipmi_response_time, { "Responded in", "ipmi.response_time", FT_RELATIVE_TIME, BASE_NONE, NULL, 0, NULL, HFILL }}
  };
  static int *ett[] = {
    &ett_ipmi,
    &ett_header,
    &ett_header_byte_1,
    &ett_header_byte_4,
    &ett_data,
    &ett_typelen
  };
  static const enum_val_t msgfmt_vals[] = {
    { "none", "None", MSGFMT_NONE },
    { "ipmb", "IPMB", MSGFMT_IPMB },
    { "lan", "Session-based (LAN, ...)", MSGFMT_LAN },
    { "guess", "Use heuristics", MSGFMT_GUESS },
    { NULL, NULL, 0 }
  };
  static const enum_val_t oemsel_vals[] = {
    { "none", "None", IPMI_OEM_NONE },
    { "pps", "Pigeon Point Systems", IPMI_OEM_PPS },
    { NULL, NULL, 0 }
  };

  static ei_register_info ei[] = {
    { &ei_impi_parser_not_implemented, { "ipmi.parser_not_implemented", PI_UNDECODED, PI_WARN, "[PARSER NOT IMPLEMENTED]", EXPFILL }},
  };

  module_t *module;
  expert_module_t* expert_ipmi;
  uint32_t i;

  proto_ipmi = proto_register_protocol("Intelligent Platform Management Interface",
                          "IPMI",
                          "ipmi");

  proto_ipmb = proto_register_protocol("Intelligent Platform Management Bus",
                          "IPMB",
                          "ipmb");
  proto_kcs = proto_register_protocol("Keyboard Controller Style Interface",
                          "KCS",
                          "kcs");
  proto_tmode = proto_register_protocol("Serial Terminal Mode Interface",
                          "TMode",
                          "tmode");

  proto_register_field_array(proto_ipmi, hf, array_length(hf));
  proto_register_subtree_array(ett, array_length(ett));

  expert_ipmi = expert_register_protocol(proto_ipmi);
  expert_register_field_array(expert_ipmi, ei, array_length(ei));

  ipmi_netfn_setdesc(IPMI_CHASSIS_REQ, "Chassis", 0);
  ipmi_netfn_setdesc(IPMI_BRIDGE_REQ, "Bridge", 0);
  ipmi_netfn_setdesc(IPMI_SE_REQ, "Sensor/Event", 0);
  ipmi_netfn_setdesc(IPMI_APP_REQ, "Application", 0);
  ipmi_netfn_setdesc(IPMI_UPDATE_REQ, "Firmware Update", 0);
  ipmi_netfn_setdesc(IPMI_STORAGE_REQ, "Storage", 0);
  ipmi_netfn_setdesc(IPMI_TRANSPORT_REQ, "Transport", 0);
  ipmi_netfn_setdesc(IPMI_GROUP_REQ, "Group", 1);
  ipmi_netfn_setdesc(IPMI_OEM_REQ, "OEM/Group", 3);
  for (i = 0x30; i < 0x40; i += 2) {
    ipmi_netfn_setdesc(i, "OEM", 0);
  }

  register_dissector("ipmi", dissect_ipmi, proto_ipmi);
  ipmi_i2c_handle = register_dissector("ipmi.i2c",  dissect_i2c_ipmi, proto_ipmi );
  register_dissector("ipmb", dissect_ipmi, proto_ipmb);
  register_dissector("kcs", dissect_kcs, proto_kcs);
  register_dissector("tmode", dissect_tmode, proto_tmode);

  module = prefs_register_protocol(proto_ipmi, NULL);
  prefs_register_bool_preference(module, "dissect_bus_commands", "Dissect bus commands",
      "Dissect IPMB commands",
      &dissect_bus_commands);
  prefs_register_bool_preference(module, "fru_langcode_is_english", "FRU Language Code is English",
      "FRU Language Code is English; strings are ASCII+LATIN1 (vs. Unicode)",
      &fru_langcode_is_english);
  prefs_register_uint_preference(module, "response_after_req", "Maximum delay of response message",
      "Do not search for responses coming after this timeout (milliseconds)",
      10, &response_after_req);
  prefs_register_uint_preference(module, "response_before_req", "Response ahead of request",
      "Allow for responses before requests (milliseconds)",
      10, &response_before_req);
  prefs_register_enum_preference(module, "msgfmt", "Format of embedded messages",
      "Format of messages embedded into Send/Get/Forward Message",
      &message_format, msgfmt_vals, false);
  prefs_register_enum_preference(module, "selected_oem", "OEM commands parsed as",
      "Selects which OEM format is used for commands that IPMI does not define",
      &selected_oem, oemsel_vals, false);
}

void proto_reg_handoff_ipmi(void)
{
  dissector_add_for_decode_as("i2c.message", ipmi_i2c_handle );
}

/*
 * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 *
 * Local variables:
 * c-basic-offset: 8
 * tab-width: 8
 * indent-tabs-mode: t
 * End:
 *
 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
 * :indentSize=8:tabSize=8:noTabs=false:
 */

Coverage Report

Created: 2026-06-30 07:22