1 // SPDX-License-Identifier: GPL-2.0 2 3 /* 4 * IPMB driver to receive a request and send a response 5 * 6 * Copyright (C) 2019 Mellanox Techologies, Ltd. 7 * 8 * This was inspired by Brendan Higgins' ipmi-bmc-bt-i2c driver. 9 */ 10 11 #include <linux/acpi.h> 12 #include <linux/errno.h> 13 #include <linux/i2c.h> 14 #include <linux/miscdevice.h> 15 #include <linux/module.h> 16 #include <linux/mutex.h> 17 #include <linux/poll.h> 18 #include <linux/slab.h> 19 #include <linux/spinlock.h> 20 #include <linux/wait.h> 21 22 #define MAX_MSG_LEN 128 23 #define IPMB_REQUEST_LEN_MIN 7 24 #define NETFN_RSP_BIT_MASK 0x4 25 #define REQUEST_QUEUE_MAX_LEN 256 26 27 #define IPMB_MSG_LEN_IDX 0 28 #define RQ_SA_8BIT_IDX 1 29 #define NETFN_LUN_IDX 2 30 31 #define GET_7BIT_ADDR(addr_8bit) (addr_8bit >> 1) 32 #define GET_8BIT_ADDR(addr_7bit) ((addr_7bit << 1) & 0xff) 33 34 #define IPMB_MSG_PAYLOAD_LEN_MAX (MAX_MSG_LEN - IPMB_REQUEST_LEN_MIN - 1) 35 36 #define SMBUS_MSG_HEADER_LENGTH 2 37 #define SMBUS_MSG_IDX_OFFSET (SMBUS_MSG_HEADER_LENGTH + 1) 38 39 struct ipmb_msg { 40 u8 len; 41 u8 rs_sa; 42 u8 netfn_rs_lun; 43 u8 checksum1; 44 u8 rq_sa; 45 u8 rq_seq_rq_lun; 46 u8 cmd; 47 u8 payload[IPMB_MSG_PAYLOAD_LEN_MAX]; 48 /* checksum2 is included in payload */ 49 } __packed; 50 51 struct ipmb_request_elem { 52 struct list_head list; 53 struct ipmb_msg request; 54 }; 55 56 struct ipmb_dev { 57 struct i2c_client *client; 58 struct miscdevice miscdev; 59 struct ipmb_msg request; 60 struct list_head request_queue; 61 atomic_t request_queue_len; 62 size_t msg_idx; 63 spinlock_t lock; 64 wait_queue_head_t wait_queue; 65 struct mutex file_mutex; 66 }; 67 68 static inline struct ipmb_dev *to_ipmb_dev(struct file *file) 69 { 70 return container_of(file->private_data, struct ipmb_dev, miscdev); 71 } 72 73 static ssize_t ipmb_read(struct file *file, char __user *buf, size_t count, 74 loff_t *ppos) 75 { 76 struct ipmb_dev *ipmb_dev = to_ipmb_dev(file); 77 struct ipmb_request_elem *queue_elem; 78 struct ipmb_msg msg; 79 ssize_t ret = 0; 80 81 memset(&msg, 0, sizeof(msg)); 82 83 spin_lock_irq(&ipmb_dev->lock); 84 85 while (list_empty(&ipmb_dev->request_queue)) { 86 spin_unlock_irq(&ipmb_dev->lock); 87 88 if (file->f_flags & O_NONBLOCK) 89 return -EAGAIN; 90 91 ret = wait_event_interruptible(ipmb_dev->wait_queue, 92 !list_empty(&ipmb_dev->request_queue)); 93 if (ret) 94 return ret; 95 96 spin_lock_irq(&ipmb_dev->lock); 97 } 98 99 queue_elem = list_first_entry(&ipmb_dev->request_queue, 100 struct ipmb_request_elem, list); 101 memcpy(&msg, &queue_elem->request, sizeof(msg)); 102 list_del(&queue_elem->list); 103 kfree(queue_elem); 104 atomic_dec(&ipmb_dev->request_queue_len); 105 106 spin_unlock_irq(&ipmb_dev->lock); 107 108 count = min_t(size_t, count, msg.len + 1); 109 if (copy_to_user(buf, &msg, count)) 110 ret = -EFAULT; 111 112 return ret < 0 ? ret : count; 113 } 114 115 static ssize_t ipmb_write(struct file *file, const char __user *buf, 116 size_t count, loff_t *ppos) 117 { 118 struct ipmb_dev *ipmb_dev = to_ipmb_dev(file); 119 u8 rq_sa, netf_rq_lun, msg_len; 120 union i2c_smbus_data data; 121 u8 msg[MAX_MSG_LEN]; 122 ssize_t ret; 123 124 if (count > sizeof(msg)) 125 return -EINVAL; 126 127 if (copy_from_user(&msg, buf, count)) 128 return -EFAULT; 129 130 if (count < msg[0]) 131 return -EINVAL; 132 133 rq_sa = GET_7BIT_ADDR(msg[RQ_SA_8BIT_IDX]); 134 netf_rq_lun = msg[NETFN_LUN_IDX]; 135 136 if (!(netf_rq_lun & NETFN_RSP_BIT_MASK)) 137 return -EINVAL; 138 139 /* 140 * subtract rq_sa and netf_rq_lun from the length of the msg passed to 141 * i2c_smbus_xfer 142 */ 143 msg_len = msg[IPMB_MSG_LEN_IDX] - SMBUS_MSG_HEADER_LENGTH; 144 if (msg_len > I2C_SMBUS_BLOCK_MAX) 145 msg_len = I2C_SMBUS_BLOCK_MAX; 146 147 data.block[0] = msg_len; 148 memcpy(&data.block[1], msg + SMBUS_MSG_IDX_OFFSET, msg_len); 149 ret = i2c_smbus_xfer(ipmb_dev->client->adapter, rq_sa, 150 ipmb_dev->client->flags, 151 I2C_SMBUS_WRITE, netf_rq_lun, 152 I2C_SMBUS_BLOCK_DATA, &data); 153 154 return ret ? : count; 155 } 156 157 static unsigned int ipmb_poll(struct file *file, poll_table *wait) 158 { 159 struct ipmb_dev *ipmb_dev = to_ipmb_dev(file); 160 unsigned int mask = POLLOUT; 161 162 mutex_lock(&ipmb_dev->file_mutex); 163 poll_wait(file, &ipmb_dev->wait_queue, wait); 164 165 if (atomic_read(&ipmb_dev->request_queue_len)) 166 mask |= POLLIN; 167 mutex_unlock(&ipmb_dev->file_mutex); 168 169 return mask; 170 } 171 172 static const struct file_operations ipmb_fops = { 173 .owner = THIS_MODULE, 174 .read = ipmb_read, 175 .write = ipmb_write, 176 .poll = ipmb_poll, 177 }; 178 179 /* Called with ipmb_dev->lock held. */ 180 static void ipmb_handle_request(struct ipmb_dev *ipmb_dev) 181 { 182 struct ipmb_request_elem *queue_elem; 183 184 if (atomic_read(&ipmb_dev->request_queue_len) >= 185 REQUEST_QUEUE_MAX_LEN) 186 return; 187 188 queue_elem = kmalloc(sizeof(*queue_elem), GFP_ATOMIC); 189 if (!queue_elem) 190 return; 191 192 memcpy(&queue_elem->request, &ipmb_dev->request, 193 sizeof(struct ipmb_msg)); 194 list_add(&queue_elem->list, &ipmb_dev->request_queue); 195 atomic_inc(&ipmb_dev->request_queue_len); 196 wake_up_all(&ipmb_dev->wait_queue); 197 } 198 199 static u8 ipmb_verify_checksum1(struct ipmb_dev *ipmb_dev, u8 rs_sa) 200 { 201 /* The 8 lsb of the sum is 0 when the checksum is valid */ 202 return (rs_sa + ipmb_dev->request.netfn_rs_lun + 203 ipmb_dev->request.checksum1); 204 } 205 206 static bool is_ipmb_request(struct ipmb_dev *ipmb_dev, u8 rs_sa) 207 { 208 if (ipmb_dev->msg_idx >= IPMB_REQUEST_LEN_MIN) { 209 if (ipmb_verify_checksum1(ipmb_dev, rs_sa)) 210 return false; 211 212 /* 213 * Check whether this is an IPMB request or 214 * response. 215 * The 6 MSB of netfn_rs_lun are dedicated to the netfn 216 * while the remaining bits are dedicated to the lun. 217 * If the LSB of the netfn is cleared, it is associated 218 * with an IPMB request. 219 * If the LSB of the netfn is set, it is associated with 220 * an IPMB response. 221 */ 222 if (!(ipmb_dev->request.netfn_rs_lun & NETFN_RSP_BIT_MASK)) 223 return true; 224 } 225 return false; 226 } 227 228 /* 229 * The IPMB protocol only supports I2C Writes so there is no need 230 * to support I2C_SLAVE_READ* events. 231 * This i2c callback function only monitors IPMB request messages 232 * and adds them in a queue, so that they can be handled by 233 * receive_ipmb_request. 234 */ 235 static int ipmb_slave_cb(struct i2c_client *client, 236 enum i2c_slave_event event, u8 *val) 237 { 238 struct ipmb_dev *ipmb_dev = i2c_get_clientdata(client); 239 u8 *buf = (u8 *)&ipmb_dev->request; 240 unsigned long flags; 241 242 spin_lock_irqsave(&ipmb_dev->lock, flags); 243 switch (event) { 244 case I2C_SLAVE_WRITE_REQUESTED: 245 memset(&ipmb_dev->request, 0, sizeof(ipmb_dev->request)); 246 ipmb_dev->msg_idx = 0; 247 248 /* 249 * At index 0, ipmb_msg stores the length of msg, 250 * skip it for now. 251 * The len will be populated once the whole 252 * buf is populated. 253 * 254 * The I2C bus driver's responsibility is to pass the 255 * data bytes to the backend driver; it does not 256 * forward the i2c slave address. 257 * Since the first byte in the IPMB message is the 258 * address of the responder, it is the responsibility 259 * of the IPMB driver to format the message properly. 260 * So this driver prepends the address of the responder 261 * to the received i2c data before the request message 262 * is handled in userland. 263 */ 264 buf[++ipmb_dev->msg_idx] = GET_8BIT_ADDR(client->addr); 265 break; 266 267 case I2C_SLAVE_WRITE_RECEIVED: 268 if (ipmb_dev->msg_idx >= sizeof(struct ipmb_msg)) 269 break; 270 271 buf[++ipmb_dev->msg_idx] = *val; 272 break; 273 274 case I2C_SLAVE_STOP: 275 ipmb_dev->request.len = ipmb_dev->msg_idx; 276 277 if (is_ipmb_request(ipmb_dev, GET_8BIT_ADDR(client->addr))) 278 ipmb_handle_request(ipmb_dev); 279 break; 280 281 default: 282 break; 283 } 284 spin_unlock_irqrestore(&ipmb_dev->lock, flags); 285 286 return 0; 287 } 288 289 static int ipmb_probe(struct i2c_client *client, 290 const struct i2c_device_id *id) 291 { 292 struct ipmb_dev *ipmb_dev; 293 int ret; 294 295 ipmb_dev = devm_kzalloc(&client->dev, sizeof(*ipmb_dev), 296 GFP_KERNEL); 297 if (!ipmb_dev) 298 return -ENOMEM; 299 300 spin_lock_init(&ipmb_dev->lock); 301 init_waitqueue_head(&ipmb_dev->wait_queue); 302 atomic_set(&ipmb_dev->request_queue_len, 0); 303 INIT_LIST_HEAD(&ipmb_dev->request_queue); 304 305 mutex_init(&ipmb_dev->file_mutex); 306 307 ipmb_dev->miscdev.minor = MISC_DYNAMIC_MINOR; 308 309 ipmb_dev->miscdev.name = devm_kasprintf(&client->dev, GFP_KERNEL, 310 "%s%d", "ipmb-", 311 client->adapter->nr); 312 ipmb_dev->miscdev.fops = &ipmb_fops; 313 ipmb_dev->miscdev.parent = &client->dev; 314 ret = misc_register(&ipmb_dev->miscdev); 315 if (ret) 316 return ret; 317 318 ipmb_dev->client = client; 319 i2c_set_clientdata(client, ipmb_dev); 320 ret = i2c_slave_register(client, ipmb_slave_cb); 321 if (ret) { 322 misc_deregister(&ipmb_dev->miscdev); 323 return ret; 324 } 325 326 return 0; 327 } 328 329 static int ipmb_remove(struct i2c_client *client) 330 { 331 struct ipmb_dev *ipmb_dev = i2c_get_clientdata(client); 332 333 i2c_slave_unregister(client); 334 misc_deregister(&ipmb_dev->miscdev); 335 336 return 0; 337 } 338 339 static const struct i2c_device_id ipmb_id[] = { 340 { "ipmb-dev", 0 }, 341 {}, 342 }; 343 MODULE_DEVICE_TABLE(i2c, ipmb_id); 344 345 static const struct acpi_device_id acpi_ipmb_id[] = { 346 { "IPMB0001", 0 }, 347 {}, 348 }; 349 MODULE_DEVICE_TABLE(acpi, acpi_ipmb_id); 350 351 static struct i2c_driver ipmb_driver = { 352 .driver = { 353 .name = "ipmb-dev", 354 .acpi_match_table = ACPI_PTR(acpi_ipmb_id), 355 }, 356 .probe = ipmb_probe, 357 .remove = ipmb_remove, 358 .id_table = ipmb_id, 359 }; 360 module_i2c_driver(ipmb_driver); 361 362 MODULE_AUTHOR("Mellanox Technologies"); 363 MODULE_DESCRIPTION("IPMB driver"); 364 MODULE_LICENSE("GPL v2"); 365