1 // SPDX-License-Identifier: GPL-2.0 2 3 /* 4 * Driver to talk to a remote management controller on IPMB. 5 */ 6 7 #include <linux/acpi.h> 8 #include <linux/errno.h> 9 #include <linux/i2c.h> 10 #include <linux/miscdevice.h> 11 #include <linux/module.h> 12 #include <linux/mutex.h> 13 #include <linux/poll.h> 14 #include <linux/slab.h> 15 #include <linux/spinlock.h> 16 #include <linux/semaphore.h> 17 #include <linux/kthread.h> 18 #include <linux/wait.h> 19 #include <linux/ipmi_msgdefs.h> 20 #include <linux/ipmi_smi.h> 21 22 #define DEVICE_NAME "ipmi-ipmb" 23 24 static int bmcaddr = 0x20; 25 module_param(bmcaddr, int, 0644); 26 MODULE_PARM_DESC(bmcaddr, "Address to use for BMC."); 27 28 static unsigned int retry_time_ms = 250; 29 module_param(retry_time_ms, uint, 0644); 30 MODULE_PARM_DESC(max_retries, "Timeout time between retries, in milliseconds."); 31 32 static unsigned int max_retries = 1; 33 module_param(max_retries, uint, 0644); 34 MODULE_PARM_DESC(max_retries, "Max resends of a command before timing out."); 35 36 /* Add room for the two slave addresses, two checksums, and rqSeq. */ 37 #define IPMB_MAX_MSG_LEN (IPMI_MAX_MSG_LENGTH + 5) 38 39 struct ipmi_ipmb_dev { 40 struct ipmi_smi *intf; 41 struct i2c_client *client; 42 43 struct ipmi_smi_handlers handlers; 44 45 bool ready; 46 47 u8 bmcaddr; 48 49 u8 curr_seq; 50 51 struct ipmi_smi_msg *next_msg; 52 struct ipmi_smi_msg *working_msg; 53 54 /* Transmit thread. */ 55 struct task_struct *thread; 56 struct semaphore wake_thread; 57 struct semaphore got_rsp; 58 spinlock_t lock; 59 bool stopping; 60 61 u8 xmitmsg[IPMB_MAX_MSG_LEN]; 62 unsigned int xmitlen; 63 64 u8 rcvmsg[IPMB_MAX_MSG_LEN]; 65 unsigned int rcvlen; 66 bool overrun; 67 }; 68 69 static bool valid_ipmb(struct ipmi_ipmb_dev *iidev) 70 { 71 u8 *msg = iidev->rcvmsg; 72 u8 netfn; 73 74 if (iidev->overrun) 75 return false; 76 77 /* Minimum message size. */ 78 if (iidev->rcvlen < 7) 79 return false; 80 81 /* Is it a response? */ 82 netfn = msg[1] >> 2; 83 if (netfn & 1) { 84 /* Response messages have an added completion code. */ 85 if (iidev->rcvlen < 8) 86 return false; 87 } 88 89 if (ipmb_checksum(msg, 3) != 0) 90 return false; 91 if (ipmb_checksum(msg + 3, iidev->rcvlen - 3) != 0) 92 return false; 93 94 return true; 95 } 96 97 static void ipmi_ipmb_check_msg_done(struct ipmi_ipmb_dev *iidev) 98 { 99 struct ipmi_smi_msg *imsg = NULL; 100 u8 *msg = iidev->rcvmsg; 101 bool is_cmd; 102 unsigned long flags; 103 104 if (iidev->rcvlen == 0) 105 return; 106 if (!valid_ipmb(iidev)) 107 goto done; 108 109 is_cmd = ((msg[1] >> 2) & 1) == 0; 110 111 if (is_cmd) { 112 /* Ignore commands until we are up. */ 113 if (!iidev->ready) 114 goto done; 115 116 /* It's a command, allocate a message for it. */ 117 imsg = ipmi_alloc_smi_msg(); 118 if (!imsg) 119 goto done; 120 imsg->type = IPMI_SMI_MSG_TYPE_IPMB_DIRECT; 121 imsg->data_size = 0; 122 } else { 123 spin_lock_irqsave(&iidev->lock, flags); 124 if (iidev->working_msg) { 125 u8 seq = msg[4] >> 2; 126 bool xmit_rsp = (iidev->working_msg->data[0] >> 2) & 1; 127 128 /* 129 * Responses should carry the sequence we sent 130 * them with. If it's a transmitted response, 131 * ignore it. And if the message hasn't been 132 * transmitted, ignore it. 133 */ 134 if (!xmit_rsp && seq == iidev->curr_seq) { 135 iidev->curr_seq = (iidev->curr_seq + 1) & 0x3f; 136 137 imsg = iidev->working_msg; 138 iidev->working_msg = NULL; 139 } 140 } 141 spin_unlock_irqrestore(&iidev->lock, flags); 142 } 143 144 if (!imsg) 145 goto done; 146 147 if (imsg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) { 148 imsg->rsp[0] = msg[1]; /* NetFn/LUN */ 149 /* 150 * Keep the source address, rqSeq. Drop the trailing 151 * checksum. 152 */ 153 memcpy(imsg->rsp + 1, msg + 3, iidev->rcvlen - 4); 154 imsg->rsp_size = iidev->rcvlen - 3; 155 } else { 156 imsg->rsp[0] = msg[1]; /* NetFn/LUN */ 157 /* 158 * Skip the source address, rqSeq. Drop the trailing 159 * checksum. 160 */ 161 memcpy(imsg->rsp + 1, msg + 5, iidev->rcvlen - 6); 162 imsg->rsp_size = iidev->rcvlen - 5; 163 } 164 ipmi_smi_msg_received(iidev->intf, imsg); 165 if (!is_cmd) 166 up(&iidev->got_rsp); 167 168 done: 169 iidev->overrun = false; 170 iidev->rcvlen = 0; 171 } 172 173 /* 174 * The IPMB protocol only supports i2c writes so there is no need to 175 * support I2C_SLAVE_READ* events, except to know if the other end has 176 * issued a read without going to stop mode. 177 */ 178 static int ipmi_ipmb_slave_cb(struct i2c_client *client, 179 enum i2c_slave_event event, u8 *val) 180 { 181 struct ipmi_ipmb_dev *iidev = i2c_get_clientdata(client); 182 183 switch (event) { 184 case I2C_SLAVE_WRITE_REQUESTED: 185 ipmi_ipmb_check_msg_done(iidev); 186 /* 187 * First byte is the slave address, to ease the checksum 188 * calculation. 189 */ 190 iidev->rcvmsg[0] = client->addr << 1; 191 iidev->rcvlen = 1; 192 break; 193 194 case I2C_SLAVE_WRITE_RECEIVED: 195 if (iidev->rcvlen >= sizeof(iidev->rcvmsg)) 196 iidev->overrun = true; 197 else 198 iidev->rcvmsg[iidev->rcvlen++] = *val; 199 break; 200 201 case I2C_SLAVE_READ_REQUESTED: 202 case I2C_SLAVE_STOP: 203 ipmi_ipmb_check_msg_done(iidev); 204 break; 205 206 case I2C_SLAVE_READ_PROCESSED: 207 break; 208 } 209 210 return 0; 211 } 212 213 static void ipmi_ipmb_send_response(struct ipmi_ipmb_dev *iidev, 214 struct ipmi_smi_msg *msg, u8 cc) 215 { 216 if ((msg->data[0] >> 2) & 1) { 217 /* 218 * It's a response being sent, we needto return a 219 * response response. Fake a send msg command 220 * response with channel 0. This will always be ipmb 221 * direct. 222 */ 223 msg->data[0] = (IPMI_NETFN_APP_REQUEST | 1) << 2; 224 msg->data[3] = IPMI_SEND_MSG_CMD; 225 msg->data[4] = cc; 226 msg->data_size = 5; 227 } 228 msg->rsp[0] = msg->data[0] | (1 << 2); 229 if (msg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) { 230 msg->rsp[1] = msg->data[1]; 231 msg->rsp[2] = msg->data[2]; 232 msg->rsp[3] = msg->data[3]; 233 msg->rsp[4] = cc; 234 msg->rsp_size = 5; 235 } else { 236 msg->rsp[1] = msg->data[1]; 237 msg->rsp[2] = cc; 238 msg->rsp_size = 3; 239 } 240 ipmi_smi_msg_received(iidev->intf, msg); 241 } 242 243 static void ipmi_ipmb_format_for_xmit(struct ipmi_ipmb_dev *iidev, 244 struct ipmi_smi_msg *msg) 245 { 246 if (msg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) { 247 iidev->xmitmsg[0] = msg->data[1]; 248 iidev->xmitmsg[1] = msg->data[0]; 249 memcpy(iidev->xmitmsg + 4, msg->data + 2, msg->data_size - 2); 250 iidev->xmitlen = msg->data_size + 2; 251 } else { 252 iidev->xmitmsg[0] = iidev->bmcaddr; 253 iidev->xmitmsg[1] = msg->data[0]; 254 iidev->xmitmsg[4] = 0; 255 memcpy(iidev->xmitmsg + 5, msg->data + 1, msg->data_size - 1); 256 iidev->xmitlen = msg->data_size + 4; 257 } 258 iidev->xmitmsg[3] = iidev->client->addr << 1; 259 if (((msg->data[0] >> 2) & 1) == 0) 260 /* If it's a command, put in our own sequence number. */ 261 iidev->xmitmsg[4] = ((iidev->xmitmsg[4] & 0x03) | 262 (iidev->curr_seq << 2)); 263 264 /* Now add on the final checksums. */ 265 iidev->xmitmsg[2] = ipmb_checksum(iidev->xmitmsg, 2); 266 iidev->xmitmsg[iidev->xmitlen] = 267 ipmb_checksum(iidev->xmitmsg + 3, iidev->xmitlen - 3); 268 iidev->xmitlen++; 269 } 270 271 static int ipmi_ipmb_thread(void *data) 272 { 273 struct ipmi_ipmb_dev *iidev = data; 274 275 while (!kthread_should_stop()) { 276 long ret; 277 struct i2c_msg i2c_msg; 278 struct ipmi_smi_msg *msg = NULL; 279 unsigned long flags; 280 unsigned int retries = 0; 281 282 /* Wait for a message to send */ 283 ret = down_interruptible(&iidev->wake_thread); 284 if (iidev->stopping) 285 break; 286 if (ret) 287 continue; 288 289 spin_lock_irqsave(&iidev->lock, flags); 290 if (iidev->next_msg) { 291 msg = iidev->next_msg; 292 iidev->next_msg = NULL; 293 } 294 spin_unlock_irqrestore(&iidev->lock, flags); 295 if (!msg) 296 continue; 297 298 ipmi_ipmb_format_for_xmit(iidev, msg); 299 300 retry: 301 i2c_msg.len = iidev->xmitlen - 1; 302 if (i2c_msg.len > 32) { 303 ipmi_ipmb_send_response(iidev, msg, 304 IPMI_REQ_LEN_EXCEEDED_ERR); 305 continue; 306 } 307 308 i2c_msg.addr = iidev->xmitmsg[0] >> 1; 309 i2c_msg.flags = 0; 310 i2c_msg.buf = iidev->xmitmsg + 1; 311 312 /* Rely on i2c_transfer for a barrier. */ 313 iidev->working_msg = msg; 314 315 ret = i2c_transfer(iidev->client->adapter, &i2c_msg, 1); 316 317 if ((msg->data[0] >> 2) & 1) { 318 /* 319 * It's a response, nothing will be returned 320 * by the other end. 321 */ 322 323 iidev->working_msg = NULL; 324 ipmi_ipmb_send_response(iidev, msg, 325 ret < 0 ? IPMI_BUS_ERR : 0); 326 continue; 327 } 328 if (ret < 0) { 329 iidev->working_msg = NULL; 330 ipmi_ipmb_send_response(iidev, msg, IPMI_BUS_ERR); 331 continue; 332 } 333 334 /* A command was sent, wait for its response. */ 335 ret = down_timeout(&iidev->got_rsp, 336 msecs_to_jiffies(retry_time_ms)); 337 338 /* 339 * Grab the message if we can. If the handler hasn't 340 * already handled it, the message will still be there. 341 */ 342 spin_lock_irqsave(&iidev->lock, flags); 343 msg = iidev->working_msg; 344 iidev->working_msg = NULL; 345 spin_unlock_irqrestore(&iidev->lock, flags); 346 347 if (!msg && ret) { 348 /* 349 * If working_msg is not set and we timed out, 350 * that means the message grabbed by 351 * check_msg_done before we could grab it 352 * here. Wait again for check_msg_done to up 353 * the semaphore. 354 */ 355 down(&iidev->got_rsp); 356 } else if (msg && ++retries <= max_retries) { 357 spin_lock_irqsave(&iidev->lock, flags); 358 iidev->working_msg = msg; 359 spin_unlock_irqrestore(&iidev->lock, flags); 360 goto retry; 361 } 362 363 if (msg) 364 ipmi_ipmb_send_response(iidev, msg, IPMI_TIMEOUT_ERR); 365 } 366 367 if (iidev->next_msg) 368 /* Return an unspecified error. */ 369 ipmi_ipmb_send_response(iidev, iidev->next_msg, 0xff); 370 371 return 0; 372 } 373 374 static int ipmi_ipmb_start_processing(void *send_info, 375 struct ipmi_smi *new_intf) 376 { 377 struct ipmi_ipmb_dev *iidev = send_info; 378 379 iidev->intf = new_intf; 380 iidev->ready = true; 381 return 0; 382 } 383 384 static void ipmi_ipmb_stop_thread(struct ipmi_ipmb_dev *iidev) 385 { 386 if (iidev->thread) { 387 struct task_struct *t = iidev->thread; 388 389 iidev->thread = NULL; 390 iidev->stopping = true; 391 up(&iidev->wake_thread); 392 up(&iidev->got_rsp); 393 kthread_stop(t); 394 } 395 } 396 397 static void ipmi_ipmb_shutdown(void *send_info) 398 { 399 struct ipmi_ipmb_dev *iidev = send_info; 400 401 ipmi_ipmb_stop_thread(iidev); 402 } 403 404 static void ipmi_ipmb_sender(void *send_info, 405 struct ipmi_smi_msg *msg) 406 { 407 struct ipmi_ipmb_dev *iidev = send_info; 408 unsigned long flags; 409 410 spin_lock_irqsave(&iidev->lock, flags); 411 BUG_ON(iidev->next_msg); 412 413 iidev->next_msg = msg; 414 spin_unlock_irqrestore(&iidev->lock, flags); 415 416 up(&iidev->wake_thread); 417 } 418 419 static void ipmi_ipmb_request_events(void *send_info) 420 { 421 /* We don't fetch events here. */ 422 } 423 424 static int ipmi_ipmb_remove(struct i2c_client *client) 425 { 426 struct ipmi_ipmb_dev *iidev = i2c_get_clientdata(client); 427 428 if (iidev->client) { 429 iidev->client = NULL; 430 i2c_slave_unregister(client); 431 } 432 ipmi_ipmb_stop_thread(iidev); 433 434 return 0; 435 } 436 437 static int ipmi_ipmb_probe(struct i2c_client *client, 438 const struct i2c_device_id *id) 439 { 440 struct ipmi_ipmb_dev *iidev; 441 int rv; 442 443 iidev = devm_kzalloc(&client->dev, sizeof(*iidev), GFP_KERNEL); 444 if (!iidev) 445 return -ENOMEM; 446 447 iidev->bmcaddr = bmcaddr; 448 449 i2c_set_clientdata(client, iidev); 450 client->flags |= I2C_CLIENT_SLAVE; 451 452 rv = i2c_slave_register(client, ipmi_ipmb_slave_cb); 453 if (rv) 454 return rv; 455 456 iidev->client = client; 457 458 iidev->handlers.flags = IPMI_SMI_CAN_HANDLE_IPMB_DIRECT; 459 iidev->handlers.start_processing = ipmi_ipmb_start_processing; 460 iidev->handlers.shutdown = ipmi_ipmb_shutdown; 461 iidev->handlers.sender = ipmi_ipmb_sender; 462 iidev->handlers.request_events = ipmi_ipmb_request_events; 463 464 spin_lock_init(&iidev->lock); 465 sema_init(&iidev->wake_thread, 0); 466 sema_init(&iidev->got_rsp, 0); 467 468 iidev->thread = kthread_run(ipmi_ipmb_thread, iidev, 469 "kipmb%4.4x", client->addr); 470 if (IS_ERR(iidev->thread)) { 471 rv = PTR_ERR(iidev->thread); 472 dev_notice(&client->dev, 473 "Could not start kernel thread: error %d\n", rv); 474 goto out_err; 475 } 476 477 rv = ipmi_register_smi(&iidev->handlers, 478 iidev, 479 &client->dev, 480 iidev->bmcaddr); 481 if (rv) 482 goto out_err; 483 484 return 0; 485 486 out_err: 487 ipmi_ipmb_remove(client); 488 return rv; 489 } 490 491 static const struct i2c_device_id ipmi_ipmb_id[] = { 492 { DEVICE_NAME, 0 }, 493 {}, 494 }; 495 MODULE_DEVICE_TABLE(i2c, ipmi_ipmb_id); 496 497 static struct i2c_driver ipmi_ipmb_driver = { 498 .class = I2C_CLASS_HWMON, 499 .driver = { 500 .name = DEVICE_NAME, 501 }, 502 .probe = ipmi_ipmb_probe, 503 .remove = ipmi_ipmb_remove, 504 .id_table = ipmi_ipmb_id, 505 }; 506 module_i2c_driver(ipmi_ipmb_driver); 507 508 MODULE_AUTHOR("Corey Minyard"); 509 MODULE_DESCRIPTION("IPMI IPMB driver"); 510 MODULE_LICENSE("GPL v2"); 511