1 // SPDX-License-Identifier: GPL-2.0 2 3 /* 4 * IPMB driver to receive a request and send a response 5 * 6 * Copyright (C) 2019 Mellanox Techologies, Ltd. 7 * 8 * This was inspired by Brendan Higgins' ipmi-bmc-bt-i2c driver. 9 */ 10 11 #include <linux/acpi.h> 12 #include <linux/errno.h> 13 #include <linux/i2c.h> 14 #include <linux/miscdevice.h> 15 #include <linux/module.h> 16 #include <linux/mutex.h> 17 #include <linux/poll.h> 18 #include <linux/slab.h> 19 #include <linux/spinlock.h> 20 #include <linux/wait.h> 21 22 #define MAX_MSG_LEN 240 23 #define IPMB_REQUEST_LEN_MIN 7 24 #define NETFN_RSP_BIT_MASK 0x4 25 #define REQUEST_QUEUE_MAX_LEN 256 26 27 #define IPMB_MSG_LEN_IDX 0 28 #define RQ_SA_8BIT_IDX 1 29 #define NETFN_LUN_IDX 2 30 31 #define GET_7BIT_ADDR(addr_8bit) (addr_8bit >> 1) 32 #define GET_8BIT_ADDR(addr_7bit) ((addr_7bit << 1) & 0xff) 33 34 #define IPMB_MSG_PAYLOAD_LEN_MAX (MAX_MSG_LEN - IPMB_REQUEST_LEN_MIN - 1) 35 36 #define SMBUS_MSG_HEADER_LENGTH 2 37 #define SMBUS_MSG_IDX_OFFSET (SMBUS_MSG_HEADER_LENGTH + 1) 38 39 struct ipmb_msg { 40 u8 len; 41 u8 rs_sa; 42 u8 netfn_rs_lun; 43 u8 checksum1; 44 u8 rq_sa; 45 u8 rq_seq_rq_lun; 46 u8 cmd; 47 u8 payload[IPMB_MSG_PAYLOAD_LEN_MAX]; 48 /* checksum2 is included in payload */ 49 } __packed; 50 51 struct ipmb_request_elem { 52 struct list_head list; 53 struct ipmb_msg request; 54 }; 55 56 struct ipmb_dev { 57 struct i2c_client *client; 58 struct miscdevice miscdev; 59 struct ipmb_msg request; 60 struct list_head request_queue; 61 atomic_t request_queue_len; 62 size_t msg_idx; 63 spinlock_t lock; 64 wait_queue_head_t wait_queue; 65 struct mutex file_mutex; 66 bool is_i2c_protocol; 67 }; 68 69 static inline struct ipmb_dev *to_ipmb_dev(struct file *file) 70 { 71 return container_of(file->private_data, struct ipmb_dev, miscdev); 72 } 73 74 static ssize_t ipmb_read(struct file *file, char __user *buf, size_t count, 75 loff_t *ppos) 76 { 77 struct ipmb_dev *ipmb_dev = to_ipmb_dev(file); 78 struct ipmb_request_elem *queue_elem; 79 struct ipmb_msg msg; 80 ssize_t ret = 0; 81 82 memset(&msg, 0, sizeof(msg)); 83 84 spin_lock_irq(&ipmb_dev->lock); 85 86 while (list_empty(&ipmb_dev->request_queue)) { 87 spin_unlock_irq(&ipmb_dev->lock); 88 89 if (file->f_flags & O_NONBLOCK) 90 return -EAGAIN; 91 92 ret = wait_event_interruptible(ipmb_dev->wait_queue, 93 !list_empty(&ipmb_dev->request_queue)); 94 if (ret) 95 return ret; 96 97 spin_lock_irq(&ipmb_dev->lock); 98 } 99 100 queue_elem = list_first_entry(&ipmb_dev->request_queue, 101 struct ipmb_request_elem, list); 102 memcpy(&msg, &queue_elem->request, sizeof(msg)); 103 list_del(&queue_elem->list); 104 kfree(queue_elem); 105 atomic_dec(&ipmb_dev->request_queue_len); 106 107 spin_unlock_irq(&ipmb_dev->lock); 108 109 count = min_t(size_t, count, msg.len + 1); 110 if (copy_to_user(buf, &msg, count)) 111 ret = -EFAULT; 112 113 return ret < 0 ? ret : count; 114 } 115 116 static int ipmb_i2c_write(struct i2c_client *client, u8 *msg, u8 addr) 117 { 118 struct i2c_msg i2c_msg; 119 120 /* 121 * subtract 1 byte (rq_sa) from the length of the msg passed to 122 * raw i2c_transfer 123 */ 124 i2c_msg.len = msg[IPMB_MSG_LEN_IDX] - 1; 125 126 /* Assign message to buffer except first 2 bytes (length and address) */ 127 i2c_msg.buf = msg + 2; 128 129 i2c_msg.addr = addr; 130 i2c_msg.flags = client->flags & I2C_CLIENT_PEC; 131 132 return i2c_transfer(client->adapter, &i2c_msg, 1); 133 } 134 135 static ssize_t ipmb_write(struct file *file, const char __user *buf, 136 size_t count, loff_t *ppos) 137 { 138 struct ipmb_dev *ipmb_dev = to_ipmb_dev(file); 139 u8 rq_sa, netf_rq_lun, msg_len; 140 struct i2c_client *temp_client; 141 u8 msg[MAX_MSG_LEN]; 142 ssize_t ret; 143 144 if (!count || count > sizeof(msg)) 145 return -EINVAL; 146 147 if (copy_from_user(&msg, buf, count)) 148 return -EFAULT; 149 150 if (msg[IPMB_MSG_LEN_IDX] < IPMB_REQUEST_LEN_MIN || 151 count < (size_t)msg[IPMB_MSG_LEN_IDX] + 1) 152 return -EINVAL; 153 154 rq_sa = GET_7BIT_ADDR(msg[RQ_SA_8BIT_IDX]); 155 netf_rq_lun = msg[NETFN_LUN_IDX]; 156 157 /* Check i2c block transfer vs smbus */ 158 if (ipmb_dev->is_i2c_protocol) { 159 ret = ipmb_i2c_write(ipmb_dev->client, msg, rq_sa); 160 return (ret == 1) ? count : ret; 161 } 162 163 /* 164 * subtract rq_sa and netf_rq_lun from the length of the msg. Fill the 165 * temporary client. Note that its use is an exception for IPMI. 166 */ 167 msg_len = msg[IPMB_MSG_LEN_IDX] - SMBUS_MSG_HEADER_LENGTH; 168 temp_client = kmemdup(ipmb_dev->client, sizeof(*temp_client), GFP_KERNEL); 169 if (!temp_client) 170 return -ENOMEM; 171 172 temp_client->addr = rq_sa; 173 174 ret = i2c_smbus_write_block_data(temp_client, netf_rq_lun, msg_len, 175 msg + SMBUS_MSG_IDX_OFFSET); 176 kfree(temp_client); 177 178 return ret < 0 ? ret : count; 179 } 180 181 static __poll_t ipmb_poll(struct file *file, poll_table *wait) 182 { 183 struct ipmb_dev *ipmb_dev = to_ipmb_dev(file); 184 __poll_t mask = EPOLLOUT; 185 186 mutex_lock(&ipmb_dev->file_mutex); 187 poll_wait(file, &ipmb_dev->wait_queue, wait); 188 189 if (atomic_read(&ipmb_dev->request_queue_len)) 190 mask |= EPOLLIN; 191 mutex_unlock(&ipmb_dev->file_mutex); 192 193 return mask; 194 } 195 196 static const struct file_operations ipmb_fops = { 197 .owner = THIS_MODULE, 198 .read = ipmb_read, 199 .write = ipmb_write, 200 .poll = ipmb_poll, 201 }; 202 203 /* Called with ipmb_dev->lock held. */ 204 static void ipmb_handle_request(struct ipmb_dev *ipmb_dev) 205 { 206 struct ipmb_request_elem *queue_elem; 207 208 if (atomic_read(&ipmb_dev->request_queue_len) >= 209 REQUEST_QUEUE_MAX_LEN) 210 return; 211 212 queue_elem = kmalloc_obj(*queue_elem, GFP_ATOMIC); 213 if (!queue_elem) 214 return; 215 216 memcpy(&queue_elem->request, &ipmb_dev->request, 217 sizeof(struct ipmb_msg)); 218 list_add(&queue_elem->list, &ipmb_dev->request_queue); 219 atomic_inc(&ipmb_dev->request_queue_len); 220 wake_up_all(&ipmb_dev->wait_queue); 221 } 222 223 static u8 ipmb_verify_checksum1(struct ipmb_dev *ipmb_dev, u8 rs_sa) 224 { 225 /* The 8 lsb of the sum is 0 when the checksum is valid */ 226 return (rs_sa + ipmb_dev->request.netfn_rs_lun + 227 ipmb_dev->request.checksum1); 228 } 229 230 /* 231 * Verify if message has proper ipmb header with minimum length 232 * and correct checksum byte. 233 */ 234 static bool is_ipmb_msg(struct ipmb_dev *ipmb_dev, u8 rs_sa) 235 { 236 if ((ipmb_dev->msg_idx >= IPMB_REQUEST_LEN_MIN) && 237 (!ipmb_verify_checksum1(ipmb_dev, rs_sa))) 238 return true; 239 240 return false; 241 } 242 243 /* 244 * The IPMB protocol only supports I2C Writes so there is no need 245 * to support I2C_SLAVE_READ* events. 246 * This i2c callback function only monitors IPMB request messages 247 * and adds them in a queue, so that they can be handled by 248 * receive_ipmb_request. 249 */ 250 static int ipmb_slave_cb(struct i2c_client *client, 251 enum i2c_slave_event event, u8 *val) 252 { 253 struct ipmb_dev *ipmb_dev = i2c_get_clientdata(client); 254 u8 *buf = (u8 *)&ipmb_dev->request; 255 unsigned long flags; 256 257 spin_lock_irqsave(&ipmb_dev->lock, flags); 258 switch (event) { 259 case I2C_SLAVE_WRITE_REQUESTED: 260 memset(&ipmb_dev->request, 0, sizeof(ipmb_dev->request)); 261 ipmb_dev->msg_idx = 0; 262 263 /* 264 * At index 0, ipmb_msg stores the length of msg, 265 * skip it for now. 266 * The len will be populated once the whole 267 * buf is populated. 268 * 269 * The I2C bus driver's responsibility is to pass the 270 * data bytes to the backend driver; it does not 271 * forward the i2c slave address. 272 * Since the first byte in the IPMB message is the 273 * address of the responder, it is the responsibility 274 * of the IPMB driver to format the message properly. 275 * So this driver prepends the address of the responder 276 * to the received i2c data before the request message 277 * is handled in userland. 278 */ 279 buf[++ipmb_dev->msg_idx] = GET_8BIT_ADDR(client->addr); 280 break; 281 282 case I2C_SLAVE_WRITE_RECEIVED: 283 if (ipmb_dev->msg_idx >= sizeof(struct ipmb_msg) - 1) 284 break; 285 286 buf[++ipmb_dev->msg_idx] = *val; 287 break; 288 289 case I2C_SLAVE_STOP: 290 ipmb_dev->request.len = ipmb_dev->msg_idx; 291 if (is_ipmb_msg(ipmb_dev, GET_8BIT_ADDR(client->addr))) 292 ipmb_handle_request(ipmb_dev); 293 break; 294 295 default: 296 break; 297 } 298 spin_unlock_irqrestore(&ipmb_dev->lock, flags); 299 300 return 0; 301 } 302 303 static int ipmb_probe(struct i2c_client *client) 304 { 305 struct ipmb_dev *ipmb_dev; 306 int ret; 307 308 ipmb_dev = devm_kzalloc(&client->dev, sizeof(*ipmb_dev), 309 GFP_KERNEL); 310 if (!ipmb_dev) 311 return -ENOMEM; 312 313 spin_lock_init(&ipmb_dev->lock); 314 init_waitqueue_head(&ipmb_dev->wait_queue); 315 atomic_set(&ipmb_dev->request_queue_len, 0); 316 INIT_LIST_HEAD(&ipmb_dev->request_queue); 317 318 mutex_init(&ipmb_dev->file_mutex); 319 320 ipmb_dev->miscdev.minor = MISC_DYNAMIC_MINOR; 321 322 ipmb_dev->miscdev.name = devm_kasprintf(&client->dev, GFP_KERNEL, 323 "%s%d", "ipmb-", 324 client->adapter->nr); 325 if (!ipmb_dev->miscdev.name) 326 return -ENOMEM; 327 328 ipmb_dev->miscdev.fops = &ipmb_fops; 329 ipmb_dev->miscdev.parent = &client->dev; 330 ret = misc_register(&ipmb_dev->miscdev); 331 if (ret) 332 return ret; 333 334 ipmb_dev->is_i2c_protocol 335 = device_property_read_bool(&client->dev, "i2c-protocol"); 336 337 ipmb_dev->client = client; 338 i2c_set_clientdata(client, ipmb_dev); 339 ret = i2c_slave_register(client, ipmb_slave_cb); 340 if (ret) { 341 misc_deregister(&ipmb_dev->miscdev); 342 return ret; 343 } 344 345 return 0; 346 } 347 348 static void ipmb_remove(struct i2c_client *client) 349 { 350 struct ipmb_dev *ipmb_dev = i2c_get_clientdata(client); 351 352 i2c_slave_unregister(client); 353 misc_deregister(&ipmb_dev->miscdev); 354 } 355 356 static const struct i2c_device_id ipmb_id[] = { 357 { .name = "ipmb-dev" }, 358 { } 359 }; 360 MODULE_DEVICE_TABLE(i2c, ipmb_id); 361 362 #ifdef CONFIG_ACPI 363 static const struct acpi_device_id acpi_ipmb_id[] = { 364 { .id = "IPMB0001" }, 365 { } 366 }; 367 MODULE_DEVICE_TABLE(acpi, acpi_ipmb_id); 368 #endif 369 370 static struct i2c_driver ipmb_driver = { 371 .driver = { 372 .name = "ipmb-dev", 373 .acpi_match_table = ACPI_PTR(acpi_ipmb_id), 374 }, 375 .probe = ipmb_probe, 376 .remove = ipmb_remove, 377 .id_table = ipmb_id, 378 }; 379 module_i2c_driver(ipmb_driver); 380 381 MODULE_AUTHOR("Mellanox Technologies"); 382 MODULE_DESCRIPTION("IPMB driver"); 383 MODULE_LICENSE("GPL v2"); 384