drivers/char/ipmi/ssif_bmc.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * The driver for BMC side of SSIF interface
   4  *
   5  * Copyright (c) 2022, Ampere Computing LLC
   6  *
   7  */
   8
   9 #include <linux/i2c.h>
  10 #include <linux/miscdevice.h>
  11 #include <linux/module.h>
  12 #include <linux/of.h>
  13 #include <linux/platform_device.h>
  14 #include <linux/poll.h>
  15 #include <linux/sched.h>
  16 #include <linux/mutex.h>
  17 #include <linux/spinlock.h>
  18 #include <linux/timer.h>
  19 #include <linux/jiffies.h>
  20 #include <linux/ipmi_ssif_bmc.h>
  21
  22 #define DEVICE_NAME                             "ipmi-ssif-host"
  23
  24 #define GET_8BIT_ADDR(addr_7bit)                (((addr_7bit) << 1) & 0xff)
  25
  26 /* A standard SMBus Transaction is limited to 32 data bytes */
  27 #define MAX_PAYLOAD_PER_TRANSACTION             32
  28 /* Transaction includes the address, the command, the length and the PEC byte */
  29 #define MAX_TRANSACTION                         (MAX_PAYLOAD_PER_TRANSACTION + 4)
  30
  31 #define MAX_IPMI_DATA_PER_START_TRANSACTION     30
  32 #define MAX_IPMI_DATA_PER_MIDDLE_TRANSACTION    31
  33
  34 #define SSIF_IPMI_SINGLEPART_WRITE              0x2
  35 #define SSIF_IPMI_SINGLEPART_READ               0x3
  36 #define SSIF_IPMI_MULTIPART_WRITE_START         0x6
  37 #define SSIF_IPMI_MULTIPART_WRITE_MIDDLE        0x7
  38 #define SSIF_IPMI_MULTIPART_WRITE_END           0x8
  39 #define SSIF_IPMI_MULTIPART_READ_START          0x3
  40 #define SSIF_IPMI_MULTIPART_READ_MIDDLE         0x9
  41
  42 /*
  43  * IPMI 2.0 Spec, section 12.7 SSIF Timing,
  44  * Request-to-Response Time is T6max(250ms) - T1max(20ms) - 3ms = 227ms
  45  * Recover ssif_bmc from busy state if it takes up to 500ms
  46  */
  47 #define RESPONSE_TIMEOUT                        500 /* ms */
  48
  49 struct ssif_part_buffer {
  50         u8 address;
  51         u8 smbus_cmd;
  52         u8 length;
  53         u8 payload[MAX_PAYLOAD_PER_TRANSACTION];
  54         u8 pec;
  55         u8 index;
  56 };
  57
  58 /*
  59  * SSIF internal states:
  60  *   SSIF_READY         0x00 : Ready state
  61  *   SSIF_START         0x01 : Start smbus transaction
  62  *   SSIF_SMBUS_CMD     0x02 : Received SMBus command
  63  *   SSIF_REQ_RECVING   0x03 : Receiving request
  64  *   SSIF_RES_SENDING   0x04 : Sending response
  65  *   SSIF_ABORTING      0x05 : Aborting state
  66  */
  67 enum ssif_state {
  68         SSIF_READY,
  69         SSIF_START,
  70         SSIF_SMBUS_CMD,
  71         SSIF_REQ_RECVING,
  72         SSIF_RES_SENDING,
  73         SSIF_ABORTING,
  74         SSIF_STATE_MAX
  75 };
  76
  77 struct ssif_bmc_ctx {
  78         struct i2c_client       *client;
  79         struct miscdevice       miscdev;
  80         int                     msg_idx;
  81         bool                    pec_support;
  82         /* ssif bmc spinlock */
  83         spinlock_t              lock;
  84         wait_queue_head_t       wait_queue;
  85         u8                      running;
  86         enum ssif_state         state;
  87         /* Timeout waiting for response */
  88         struct timer_list       response_timer;
  89         bool                    response_timer_inited;
  90         /* Flag to identify a Multi-part Read Transaction */
  91         bool                    is_singlepart_read;
  92         u8                      nbytes_processed;
  93         u8                      remain_len;
  94         u8                      recv_len;
  95         /* Block Number of a Multi-part Read Transaction */
  96         u8                      block_num;
  97         bool                    request_available;
  98         bool                    response_in_progress;
  99         bool                    busy;
 100         bool                    aborting;
 101         /* Buffer for SSIF Transaction part*/
 102         struct ssif_part_buffer part_buf;
 103         struct ipmi_ssif_msg    response;
 104         struct ipmi_ssif_msg    request;
 105 };
 106
 107 static inline struct ssif_bmc_ctx *to_ssif_bmc(struct file *file)
 108 {
 109         return container_of(file->private_data, struct ssif_bmc_ctx, miscdev);
 110 }
 111
 112 static const char *state_to_string(enum ssif_state state)
 113 {
 114         switch (state) {
 115         case SSIF_READY:
 116                 return "SSIF_READY";
 117         case SSIF_START:
 118                 return "SSIF_START";
 119         case SSIF_SMBUS_CMD:
 120                 return "SSIF_SMBUS_CMD";
 121         case SSIF_REQ_RECVING:
 122                 return "SSIF_REQ_RECVING";
 123         case SSIF_RES_SENDING:
 124                 return "SSIF_RES_SENDING";
 125         case SSIF_ABORTING:
 126                 return "SSIF_ABORTING";
 127         default:
 128                 return "SSIF_STATE_UNKNOWN";
 129         }
 130 }
 131
 132 /* Handle SSIF message that will be sent to user */
 133 static ssize_t ssif_bmc_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 134 {
 135         struct ssif_bmc_ctx *ssif_bmc = to_ssif_bmc(file);
 136         struct ipmi_ssif_msg msg;
 137         unsigned long flags;
 138         ssize_t ret;
 139
 140         spin_lock_irqsave(&ssif_bmc->lock, flags);
 141         while (!ssif_bmc->request_available) {
 142                 spin_unlock_irqrestore(&ssif_bmc->lock, flags);
 143                 if (file->f_flags & O_NONBLOCK)
 144                         return -EAGAIN;
 145                 ret = wait_event_interruptible(ssif_bmc->wait_queue,
 146                                                ssif_bmc->request_available);
 147                 if (ret)
 148                         return ret;
 149                 spin_lock_irqsave(&ssif_bmc->lock, flags);
 150         }
 151
 152         if (count < min_t(ssize_t,
 153                           sizeof_field(struct ipmi_ssif_msg, len) + ssif_bmc->request.len,
 154                           sizeof(struct ipmi_ssif_msg))) {
 155                 spin_unlock_irqrestore(&ssif_bmc->lock, flags);
 156                 ret = -EINVAL;
 157         } else {
 158                 count = min_t(ssize_t,
 159                               sizeof_field(struct ipmi_ssif_msg, len) + ssif_bmc->request.len,
 160                               sizeof(struct ipmi_ssif_msg));
 161                 memcpy(&msg, &ssif_bmc->request, count);
 162                 ssif_bmc->request_available = false;
 163                 spin_unlock_irqrestore(&ssif_bmc->lock, flags);
 164
 165                 ret = copy_to_user(buf, &msg, count);
 166         }
 167
 168         return (ret < 0) ? ret : count;
 169 }
 170
 171 /* Handle SSIF message that is written by user */
 172 static ssize_t ssif_bmc_write(struct file *file, const char __user *buf, size_t count,
 173                               loff_t *ppos)
 174 {
 175         struct ssif_bmc_ctx *ssif_bmc = to_ssif_bmc(file);
 176         struct ipmi_ssif_msg msg;
 177         unsigned long flags;
 178         ssize_t ret;
 179
 180         if (count < sizeof(msg.len) ||
 181             count > sizeof(struct ipmi_ssif_msg))
 182                 return -EINVAL;
 183
 184         if (copy_from_user(&msg, buf, count))
 185                 return -EFAULT;
 186
 187         if (!msg.len || msg.len > IPMI_SSIF_PAYLOAD_MAX ||
 188             count < sizeof_field(struct ipmi_ssif_msg, len) + msg.len)
 189                 return -EINVAL;
 190
 191         spin_lock_irqsave(&ssif_bmc->lock, flags);
 192         while (ssif_bmc->response_in_progress) {
 193                 spin_unlock_irqrestore(&ssif_bmc->lock, flags);
 194                 if (file->f_flags & O_NONBLOCK)
 195                         return -EAGAIN;
 196                 ret = wait_event_interruptible(ssif_bmc->wait_queue,
 197                                                !ssif_bmc->response_in_progress);
 198                 if (ret)
 199                         return ret;
 200                 spin_lock_irqsave(&ssif_bmc->lock, flags);
 201         }
 202
 203         /*
 204          * The write must complete before the response timeout fired, otherwise
 205          * the response is aborted and wait for next request
 206          * Return -EINVAL if the response is aborted
 207          */
 208         ret = (ssif_bmc->response_timer_inited) ? 0 : -EINVAL;
 209         if (ret)
 210                 goto exit;
 211
 212         del_timer(&ssif_bmc->response_timer);
 213         ssif_bmc->response_timer_inited = false;
 214
 215         memcpy(&ssif_bmc->response, &msg, count);
 216         ssif_bmc->is_singlepart_read = (msg.len <= MAX_PAYLOAD_PER_TRANSACTION);
 217
 218         ssif_bmc->response_in_progress = true;
 219
 220         /* ssif_bmc not busy */
 221         ssif_bmc->busy = false;
 222
 223         /* Clean old request buffer */
 224         memset(&ssif_bmc->request, 0, sizeof(struct ipmi_ssif_msg));
 225 exit:
 226         spin_unlock_irqrestore(&ssif_bmc->lock, flags);
 227
 228         return (ret < 0) ? ret : count;
 229 }
 230
 231 static int ssif_bmc_open(struct inode *inode, struct file *file)
 232 {
 233         struct ssif_bmc_ctx *ssif_bmc = to_ssif_bmc(file);
 234         int ret = 0;
 235
 236         spin_lock_irq(&ssif_bmc->lock);
 237         if (!ssif_bmc->running)
 238                 ssif_bmc->running = 1;
 239         else
 240                 ret = -EBUSY;
 241         spin_unlock_irq(&ssif_bmc->lock);
 242
 243         return ret;
 244 }
 245
 246 static __poll_t ssif_bmc_poll(struct file *file, poll_table *wait)
 247 {
 248         struct ssif_bmc_ctx *ssif_bmc = to_ssif_bmc(file);
 249         __poll_t mask = 0;
 250
 251         poll_wait(file, &ssif_bmc->wait_queue, wait);
 252
 253         spin_lock_irq(&ssif_bmc->lock);
 254         /* The request is available, userspace application can get the request */
 255         if (ssif_bmc->request_available)
 256                 mask |= EPOLLIN;
 257
 258         spin_unlock_irq(&ssif_bmc->lock);
 259
 260         return mask;
 261 }
 262
 263 static int ssif_bmc_release(struct inode *inode, struct file *file)
 264 {
 265         struct ssif_bmc_ctx *ssif_bmc = to_ssif_bmc(file);
 266
 267         spin_lock_irq(&ssif_bmc->lock);
 268         ssif_bmc->running = 0;
 269         spin_unlock_irq(&ssif_bmc->lock);
 270
 271         return 0;
 272 }
 273
 274 /*
 275  * System calls to device interface for user apps
 276  */
 277 static const struct file_operations ssif_bmc_fops = {
 278         .owner          = THIS_MODULE,
 279         .open           = ssif_bmc_open,
 280         .read           = ssif_bmc_read,
 281         .write          = ssif_bmc_write,
 282         .release        = ssif_bmc_release,
 283         .poll           = ssif_bmc_poll,
 284 };
 285
 286 /* Called with ssif_bmc->lock held. */
 287 static void complete_response(struct ssif_bmc_ctx *ssif_bmc)
 288 {
 289         /* Invalidate response in buffer to denote it having been sent. */
 290         ssif_bmc->response.len = 0;
 291         ssif_bmc->response_in_progress = false;
 292         ssif_bmc->nbytes_processed = 0;
 293         ssif_bmc->remain_len = 0;
 294         ssif_bmc->busy = false;
 295         memset(&ssif_bmc->part_buf, 0, sizeof(struct ssif_part_buffer));
 296         wake_up_all(&ssif_bmc->wait_queue);
 297 }
 298
 299 static void response_timeout(struct timer_list *t)
 300 {
 301         struct ssif_bmc_ctx *ssif_bmc = from_timer(ssif_bmc, t, response_timer);
 302         unsigned long flags;
 303
 304         spin_lock_irqsave(&ssif_bmc->lock, flags);
 305
 306         /* Do nothing if the response is in progress */
 307         if (!ssif_bmc->response_in_progress) {
 308                 /* Recover ssif_bmc from busy */
 309                 ssif_bmc->busy = false;
 310                 ssif_bmc->response_timer_inited = false;
 311                 /* Set aborting flag */
 312                 ssif_bmc->aborting = true;
 313         }
 314
 315         spin_unlock_irqrestore(&ssif_bmc->lock, flags);
 316 }
 317
 318 /* Called with ssif_bmc->lock held. */
 319 static void handle_request(struct ssif_bmc_ctx *ssif_bmc)
 320 {
 321         /* set ssif_bmc to busy waiting for response */
 322         ssif_bmc->busy = true;
 323         /* Request message is available to process */
 324         ssif_bmc->request_available = true;
 325         /* Clean old response buffer */
 326         memset(&ssif_bmc->response, 0, sizeof(struct ipmi_ssif_msg));
 327         /* This is the new READ request.*/
 328         wake_up_all(&ssif_bmc->wait_queue);
 329
 330         /* Armed timer to recover slave from busy state in case of no response */
 331         if (!ssif_bmc->response_timer_inited) {
 332                 timer_setup(&ssif_bmc->response_timer, response_timeout, 0);
 333                 ssif_bmc->response_timer_inited = true;
 334         }
 335         mod_timer(&ssif_bmc->response_timer, jiffies + msecs_to_jiffies(RESPONSE_TIMEOUT));
 336 }
 337
 338 static void calculate_response_part_pec(struct ssif_part_buffer *part)
 339 {
 340         u8 addr = part->address;
 341
 342         /* PEC - Start Read Address */
 343         part->pec = i2c_smbus_pec(0, &addr, 1);
 344         /* PEC - SSIF Command */
 345         part->pec = i2c_smbus_pec(part->pec, &part->smbus_cmd, 1);
 346         /* PEC - Restart Write Address */
 347         addr = addr | 0x01;
 348         part->pec = i2c_smbus_pec(part->pec, &addr, 1);
 349         part->pec = i2c_smbus_pec(part->pec, &part->length, 1);
 350         if (part->length)
 351                 part->pec = i2c_smbus_pec(part->pec, part->payload, part->length);
 352 }
 353
 354 static void set_singlepart_response_buffer(struct ssif_bmc_ctx *ssif_bmc)
 355 {
 356         struct ssif_part_buffer *part = &ssif_bmc->part_buf;
 357
 358         part->address = GET_8BIT_ADDR(ssif_bmc->client->addr);
 359         part->length = (u8)ssif_bmc->response.len;
 360
 361         /* Clear the rest to 0 */
 362         memset(part->payload + part->length, 0, MAX_PAYLOAD_PER_TRANSACTION - part->length);
 363         memcpy(&part->payload[0], &ssif_bmc->response.payload[0], part->length);
 364 }
 365
 366 static void set_multipart_response_buffer(struct ssif_bmc_ctx *ssif_bmc)
 367 {
 368         struct ssif_part_buffer *part = &ssif_bmc->part_buf;
 369         u8 part_len = 0;
 370
 371         part->address = GET_8BIT_ADDR(ssif_bmc->client->addr);
 372         switch (part->smbus_cmd) {
 373         case SSIF_IPMI_MULTIPART_READ_START:
 374                 /*
 375                  * Read Start length is 32 bytes.
 376                  * Read Start transfer first 30 bytes of IPMI response
 377                  * and 2 special code 0x00, 0x01.
 378                  */
 379                 ssif_bmc->nbytes_processed = 0;
 380                 ssif_bmc->block_num = 0;
 381                 part->length = MAX_PAYLOAD_PER_TRANSACTION;
 382                 part_len = MAX_IPMI_DATA_PER_START_TRANSACTION;
 383                 ssif_bmc->remain_len = ssif_bmc->response.len - part_len;
 384
 385                 part->payload[0] = 0x00; /* Start Flag */
 386                 part->payload[1] = 0x01; /* Start Flag */
 387
 388                 memcpy(&part->payload[2], &ssif_bmc->response.payload[0], part_len);
 389                 break;
 390
 391         case SSIF_IPMI_MULTIPART_READ_MIDDLE:
 392                 /*
 393                  * IPMI READ Middle or READ End messages can carry up to 31 bytes
 394                  * IPMI data plus block number byte.
 395                  */
 396                 if (ssif_bmc->remain_len <= MAX_IPMI_DATA_PER_MIDDLE_TRANSACTION) {
 397                         /*
 398                          * This is READ End message
 399                          *  Return length is the remaining response data length
 400                          *  plus block number
 401                          *  Block number 0xFF is to indicate this is last message
 402                          *
 403                          */
 404                         /* Clean the buffer */
 405                         memset(&part->payload[0], 0, MAX_PAYLOAD_PER_TRANSACTION);
 406                         part->length = ssif_bmc->remain_len + 1;
 407                         part_len = ssif_bmc->remain_len;
 408                         ssif_bmc->block_num = 0xFF;
 409                         part->payload[0] = ssif_bmc->block_num;
 410                 } else {
 411                         /*
 412                          * This is READ Middle message
 413                          *  Response length is the maximum SMBUS transfer length
 414                          *  Block number byte is incremented
 415                          * Return length is maximum SMBUS transfer length
 416                          */
 417                         part->length = MAX_PAYLOAD_PER_TRANSACTION;
 418                         part_len = MAX_IPMI_DATA_PER_MIDDLE_TRANSACTION;
 419                         part->payload[0] = ssif_bmc->block_num;
 420                         ssif_bmc->block_num++;
 421                 }
 422
 423                 ssif_bmc->remain_len -= part_len;
 424                 memcpy(&part->payload[1], ssif_bmc->response.payload + ssif_bmc->nbytes_processed,
 425                        part_len);
 426                 break;
 427
 428         default:
 429                 /* Do not expect to go to this case */
 430                 dev_err(&ssif_bmc->client->dev, "%s: Unexpected SMBus command 0x%x\n",
 431                         __func__, part->smbus_cmd);
 432                 break;
 433         }
 434
 435         ssif_bmc->nbytes_processed += part_len;
 436 }
 437
 438 static bool supported_read_cmd(u8 cmd)
 439 {
 440         if (cmd == SSIF_IPMI_SINGLEPART_READ ||
 441             cmd == SSIF_IPMI_MULTIPART_READ_START ||
 442             cmd == SSIF_IPMI_MULTIPART_READ_MIDDLE)
 443                 return true;
 444
 445         return false;
 446 }
 447
 448 static bool supported_write_cmd(u8 cmd)
 449 {
 450         if (cmd == SSIF_IPMI_SINGLEPART_WRITE ||
 451             cmd == SSIF_IPMI_MULTIPART_WRITE_START ||
 452             cmd == SSIF_IPMI_MULTIPART_WRITE_MIDDLE ||
 453             cmd == SSIF_IPMI_MULTIPART_WRITE_END)
 454                 return true;
 455
 456         return false;
 457 }
 458
 459 /* Process the IPMI response that will be read by master */
 460 static void handle_read_processed(struct ssif_bmc_ctx *ssif_bmc, u8 *val)
 461 {
 462         struct ssif_part_buffer *part = &ssif_bmc->part_buf;
 463
 464         /* msg_idx start from 0 */
 465         if (part->index < part->length)
 466                 *val = part->payload[part->index];
 467         else if (part->index == part->length && ssif_bmc->pec_support)
 468                 *val = part->pec;
 469         else
 470                 *val = 0;
 471
 472         part->index++;
 473 }
 474
 475 static void handle_write_received(struct ssif_bmc_ctx *ssif_bmc, u8 *val)
 476 {
 477         /*
 478          * The msg_idx must be 1 when first enter SSIF_REQ_RECVING state
 479          * And it would never exceeded 36 bytes included the 32 bytes max payload +
 480          * the address + the command + the len and the PEC.
 481          */
 482         if (ssif_bmc->msg_idx < 1  || ssif_bmc->msg_idx > MAX_TRANSACTION)
 483                 return;
 484
 485         if (ssif_bmc->msg_idx == 1) {
 486                 ssif_bmc->part_buf.length = *val;
 487                 ssif_bmc->part_buf.index = 0;
 488         } else {
 489                 ssif_bmc->part_buf.payload[ssif_bmc->part_buf.index++] = *val;
 490         }
 491
 492         ssif_bmc->msg_idx++;
 493 }
 494
 495 static bool validate_request_part(struct ssif_bmc_ctx *ssif_bmc)
 496 {
 497         struct ssif_part_buffer *part = &ssif_bmc->part_buf;
 498         bool ret = true;
 499         u8 cpec;
 500         u8 addr;
 501
 502         if (part->index == part->length) {
 503                 /* PEC is not included */
 504                 ssif_bmc->pec_support = false;
 505                 ret = true;
 506                 goto exit;
 507         }
 508
 509         if (part->index != part->length + 1) {
 510                 ret = false;
 511                 goto exit;
 512         }
 513
 514         /* PEC is included */
 515         ssif_bmc->pec_support = true;
 516         part->pec = part->payload[part->length];
 517         addr = GET_8BIT_ADDR(ssif_bmc->client->addr);
 518         cpec = i2c_smbus_pec(0, &addr, 1);
 519         cpec = i2c_smbus_pec(cpec, &part->smbus_cmd, 1);
 520         cpec = i2c_smbus_pec(cpec, &part->length, 1);
 521         /*
 522          * As SMBus specification does not allow the length
 523          * (byte count) in the Write-Block protocol to be zero.
 524          * Therefore, it is illegal to have the last Middle
 525          * transaction in the sequence carry 32-byte and have
 526          * a length of ‘0’ in the End transaction.
 527          * But some users may try to use this way and we should
 528          * prevent ssif_bmc driver broken in this case.
 529          */
 530         if (part->length)
 531                 cpec = i2c_smbus_pec(cpec, part->payload, part->length);
 532
 533         if (cpec != part->pec)
 534                 ret = false;
 535
 536 exit:
 537         return ret;
 538 }
 539
 540 static void process_request_part(struct ssif_bmc_ctx *ssif_bmc)
 541 {
 542         struct ssif_part_buffer *part = &ssif_bmc->part_buf;
 543         unsigned int len;
 544
 545         switch (part->smbus_cmd) {
 546         case SSIF_IPMI_SINGLEPART_WRITE:
 547                 /* save the whole part to request*/
 548                 ssif_bmc->request.len = part->length;
 549                 memcpy(ssif_bmc->request.payload, part->payload, part->length);
 550
 551                 break;
 552         case SSIF_IPMI_MULTIPART_WRITE_START:
 553                 ssif_bmc->request.len = 0;
 554
 555                 fallthrough;
 556         case SSIF_IPMI_MULTIPART_WRITE_MIDDLE:
 557         case SSIF_IPMI_MULTIPART_WRITE_END:
 558                 len = ssif_bmc->request.len + part->length;
 559                 /* Do the bound check here, not allow the request len exceed 254 bytes */
 560                 if (len > IPMI_SSIF_PAYLOAD_MAX) {
 561                         dev_warn(&ssif_bmc->client->dev,
 562                                  "Warn: Request exceeded 254 bytes, aborting");
 563                         /* Request too long, aborting */
 564                         ssif_bmc->aborting =  true;
 565                 } else {
 566                         memcpy(ssif_bmc->request.payload + ssif_bmc->request.len,
 567                                part->payload, part->length);
 568                         ssif_bmc->request.len += part->length;
 569                 }
 570                 break;
 571         default:
 572                 /* Do not expect to go to this case */
 573                 dev_err(&ssif_bmc->client->dev, "%s: Unexpected SMBus command 0x%x\n",
 574                         __func__, part->smbus_cmd);
 575                 break;
 576         }
 577 }
 578
 579 static void process_smbus_cmd(struct ssif_bmc_ctx *ssif_bmc, u8 *val)
 580 {
 581         /* SMBUS command can vary (single or multi-part) */
 582         ssif_bmc->part_buf.smbus_cmd = *val;
 583         ssif_bmc->msg_idx = 1;
 584         memset(&ssif_bmc->part_buf.payload[0], 0, MAX_PAYLOAD_PER_TRANSACTION);
 585
 586         if (*val == SSIF_IPMI_SINGLEPART_WRITE || *val == SSIF_IPMI_MULTIPART_WRITE_START) {
 587                 /*
 588                  * The response maybe not come in-time, causing host SSIF driver
 589                  * to timeout and resend a new request. In such case check for
 590                  * pending response and clear it
 591                  */
 592                 if (ssif_bmc->response_in_progress)
 593                         complete_response(ssif_bmc);
 594
 595                 /* This is new request, flip aborting flag if set */
 596                 if (ssif_bmc->aborting)
 597                         ssif_bmc->aborting = false;
 598         }
 599 }
 600
 601 static void on_read_requested_event(struct ssif_bmc_ctx *ssif_bmc, u8 *val)
 602 {
 603         if (ssif_bmc->state == SSIF_READY ||
 604             ssif_bmc->state == SSIF_START ||
 605             ssif_bmc->state == SSIF_REQ_RECVING ||
 606             ssif_bmc->state == SSIF_RES_SENDING) {
 607                 dev_warn(&ssif_bmc->client->dev,
 608                          "Warn: %s unexpected READ REQUESTED in state=%s\n",
 609                          __func__, state_to_string(ssif_bmc->state));
 610                 ssif_bmc->state = SSIF_ABORTING;
 611                 *val = 0;
 612                 return;
 613
 614         } else if (ssif_bmc->state == SSIF_SMBUS_CMD) {
 615                 if (!supported_read_cmd(ssif_bmc->part_buf.smbus_cmd)) {
 616                         dev_warn(&ssif_bmc->client->dev, "Warn: Unknown SMBus read command=0x%x",
 617                                  ssif_bmc->part_buf.smbus_cmd);
 618                         ssif_bmc->aborting = true;
 619                 }
 620
 621                 if (ssif_bmc->aborting)
 622                         ssif_bmc->state = SSIF_ABORTING;
 623                 else
 624                         ssif_bmc->state = SSIF_RES_SENDING;
 625         }
 626
 627         ssif_bmc->msg_idx = 0;
 628
 629         /* Send 0 if there is nothing to send */
 630         if (!ssif_bmc->response_in_progress || ssif_bmc->state == SSIF_ABORTING) {
 631                 *val = 0;
 632                 return;
 633         }
 634
 635         if (ssif_bmc->is_singlepart_read)
 636                 set_singlepart_response_buffer(ssif_bmc);
 637         else
 638                 set_multipart_response_buffer(ssif_bmc);
 639
 640         calculate_response_part_pec(&ssif_bmc->part_buf);
 641         ssif_bmc->part_buf.index = 0;
 642         *val = ssif_bmc->part_buf.length;
 643 }
 644
 645 static void on_read_processed_event(struct ssif_bmc_ctx *ssif_bmc, u8 *val)
 646 {
 647         if (ssif_bmc->state == SSIF_READY ||
 648             ssif_bmc->state == SSIF_START ||
 649             ssif_bmc->state == SSIF_REQ_RECVING ||
 650             ssif_bmc->state == SSIF_SMBUS_CMD) {
 651                 dev_warn(&ssif_bmc->client->dev,
 652                          "Warn: %s unexpected READ PROCESSED in state=%s\n",
 653                          __func__, state_to_string(ssif_bmc->state));
 654                 ssif_bmc->state = SSIF_ABORTING;
 655                 *val = 0;
 656                 return;
 657         }
 658
 659         /* Send 0 if there is nothing to send */
 660         if (!ssif_bmc->response_in_progress || ssif_bmc->state == SSIF_ABORTING) {
 661                 *val = 0;
 662                 return;
 663         }
 664
 665         handle_read_processed(ssif_bmc, val);
 666 }
 667
 668 static void on_write_requested_event(struct ssif_bmc_ctx *ssif_bmc, u8 *val)
 669 {
 670         if (ssif_bmc->state == SSIF_READY || ssif_bmc->state == SSIF_SMBUS_CMD) {
 671                 ssif_bmc->state = SSIF_START;
 672
 673         } else if (ssif_bmc->state == SSIF_START ||
 674                    ssif_bmc->state == SSIF_REQ_RECVING ||
 675                    ssif_bmc->state == SSIF_RES_SENDING) {
 676                 dev_warn(&ssif_bmc->client->dev,
 677                          "Warn: %s unexpected WRITE REQUEST in state=%s\n",
 678                          __func__, state_to_string(ssif_bmc->state));
 679                 ssif_bmc->state = SSIF_ABORTING;
 680                 return;
 681         }
 682
 683         ssif_bmc->msg_idx = 0;
 684         ssif_bmc->part_buf.address = *val;
 685 }
 686
 687 static void on_write_received_event(struct ssif_bmc_ctx *ssif_bmc, u8 *val)
 688 {
 689         if (ssif_bmc->state == SSIF_READY ||
 690             ssif_bmc->state == SSIF_RES_SENDING) {
 691                 dev_warn(&ssif_bmc->client->dev,
 692                          "Warn: %s unexpected WRITE RECEIVED in state=%s\n",
 693                          __func__, state_to_string(ssif_bmc->state));
 694                 ssif_bmc->state = SSIF_ABORTING;
 695
 696         } else if (ssif_bmc->state == SSIF_START) {
 697                 ssif_bmc->state = SSIF_SMBUS_CMD;
 698
 699         } else if (ssif_bmc->state == SSIF_SMBUS_CMD) {
 700                 if (!supported_write_cmd(ssif_bmc->part_buf.smbus_cmd)) {
 701                         dev_warn(&ssif_bmc->client->dev, "Warn: Unknown SMBus write command=0x%x",
 702                                  ssif_bmc->part_buf.smbus_cmd);
 703                         ssif_bmc->aborting = true;
 704                 }
 705
 706                 if (ssif_bmc->aborting)
 707                         ssif_bmc->state = SSIF_ABORTING;
 708                 else
 709                         ssif_bmc->state = SSIF_REQ_RECVING;
 710         }
 711
 712         /* This is response sending state */
 713         if (ssif_bmc->state == SSIF_REQ_RECVING)
 714                 handle_write_received(ssif_bmc, val);
 715         else if (ssif_bmc->state == SSIF_SMBUS_CMD)
 716                 process_smbus_cmd(ssif_bmc, val);
 717 }
 718
 719 static void on_stop_event(struct ssif_bmc_ctx *ssif_bmc, u8 *val)
 720 {
 721         if (ssif_bmc->state == SSIF_READY ||
 722             ssif_bmc->state == SSIF_START ||
 723             ssif_bmc->state == SSIF_SMBUS_CMD ||
 724             ssif_bmc->state == SSIF_ABORTING) {
 725                 dev_warn(&ssif_bmc->client->dev,
 726                          "Warn: %s unexpected SLAVE STOP in state=%s\n",
 727                          __func__, state_to_string(ssif_bmc->state));
 728                 ssif_bmc->state = SSIF_READY;
 729
 730         } else if (ssif_bmc->state == SSIF_REQ_RECVING) {
 731                 if (validate_request_part(ssif_bmc)) {
 732                         process_request_part(ssif_bmc);
 733                         if (ssif_bmc->part_buf.smbus_cmd == SSIF_IPMI_SINGLEPART_WRITE ||
 734                             ssif_bmc->part_buf.smbus_cmd == SSIF_IPMI_MULTIPART_WRITE_END)
 735                                 handle_request(ssif_bmc);
 736                         ssif_bmc->state = SSIF_READY;
 737                 } else {
 738                         /*
 739                          * A BMC that receives an invalid request drop the data for the write
 740                          * transaction and any further transactions (read or write) until
 741                          * the next valid read or write Start transaction is received
 742                          */
 743                         dev_err(&ssif_bmc->client->dev, "Error: invalid pec\n");
 744                         ssif_bmc->aborting = true;
 745                 }
 746         } else if (ssif_bmc->state == SSIF_RES_SENDING) {
 747                 if (ssif_bmc->is_singlepart_read || ssif_bmc->block_num == 0xFF)
 748                         /* Invalidate response buffer to denote it is sent */
 749                         complete_response(ssif_bmc);
 750                 ssif_bmc->state = SSIF_READY;
 751         }
 752
 753         /* Reset message index */
 754         ssif_bmc->msg_idx = 0;
 755 }
 756
 757 /*
 758  * Callback function to handle I2C slave events
 759  */
 760 static int ssif_bmc_cb(struct i2c_client *client, enum i2c_slave_event event, u8 *val)
 761 {
 762         unsigned long flags;
 763         struct ssif_bmc_ctx *ssif_bmc = i2c_get_clientdata(client);
 764         int ret = 0;
 765
 766         spin_lock_irqsave(&ssif_bmc->lock, flags);
 767
 768         switch (event) {
 769         case I2C_SLAVE_READ_REQUESTED:
 770                 on_read_requested_event(ssif_bmc, val);
 771                 break;
 772
 773         case I2C_SLAVE_WRITE_REQUESTED:
 774                 on_write_requested_event(ssif_bmc, val);
 775                 break;
 776
 777         case I2C_SLAVE_READ_PROCESSED:
 778                 on_read_processed_event(ssif_bmc, val);
 779                 break;
 780
 781         case I2C_SLAVE_WRITE_RECEIVED:
 782                 on_write_received_event(ssif_bmc, val);
 783                 break;
 784
 785         case I2C_SLAVE_STOP:
 786                 on_stop_event(ssif_bmc, val);
 787                 break;
 788
 789         default:
 790                 dev_warn(&ssif_bmc->client->dev, "Warn: Unknown i2c slave event\n");
 791                 break;
 792         }
 793
 794         if (!ssif_bmc->aborting && ssif_bmc->busy)
 795                 ret = -EBUSY;
 796
 797         spin_unlock_irqrestore(&ssif_bmc->lock, flags);
 798
 799         return ret;
 800 }
 801
 802 static int ssif_bmc_probe(struct i2c_client *client)
 803 {
 804         struct ssif_bmc_ctx *ssif_bmc;
 805         int ret;
 806
 807         ssif_bmc = devm_kzalloc(&client->dev, sizeof(*ssif_bmc), GFP_KERNEL);
 808         if (!ssif_bmc)
 809                 return -ENOMEM;
 810
 811         spin_lock_init(&ssif_bmc->lock);
 812
 813         init_waitqueue_head(&ssif_bmc->wait_queue);
 814         ssif_bmc->request_available = false;
 815         ssif_bmc->response_in_progress = false;
 816         ssif_bmc->busy = false;
 817         ssif_bmc->response_timer_inited = false;
 818
 819         /* Register misc device interface */
 820         ssif_bmc->miscdev.minor = MISC_DYNAMIC_MINOR;
 821         ssif_bmc->miscdev.name = DEVICE_NAME;
 822         ssif_bmc->miscdev.fops = &ssif_bmc_fops;
 823         ssif_bmc->miscdev.parent = &client->dev;
 824         ret = misc_register(&ssif_bmc->miscdev);
 825         if (ret)
 826                 return ret;
 827
 828         ssif_bmc->client = client;
 829         ssif_bmc->client->flags |= I2C_CLIENT_SLAVE;
 830
 831         /* Register I2C slave */
 832         i2c_set_clientdata(client, ssif_bmc);
 833         ret = i2c_slave_register(client, ssif_bmc_cb);
 834         if (ret)
 835                 misc_deregister(&ssif_bmc->miscdev);
 836
 837         return ret;
 838 }
 839
 840 static void ssif_bmc_remove(struct i2c_client *client)
 841 {
 842         struct ssif_bmc_ctx *ssif_bmc = i2c_get_clientdata(client);
 843
 844         i2c_slave_unregister(client);
 845         misc_deregister(&ssif_bmc->miscdev);
 846 }
 847
 848 static const struct of_device_id ssif_bmc_match[] = {
 849         { .compatible = "ssif-bmc" },
 850         { },
 851 };
 852 MODULE_DEVICE_TABLE(of, ssif_bmc_match);
 853
 854 static const struct i2c_device_id ssif_bmc_id[] = {
 855         { DEVICE_NAME },
 856         { }
 857 };
 858 MODULE_DEVICE_TABLE(i2c, ssif_bmc_id);
 859
 860 static struct i2c_driver ssif_bmc_driver = {
 861         .driver         = {
 862                 .name           = DEVICE_NAME,
 863                 .of_match_table = ssif_bmc_match,
 864         },
 865         .probe          = ssif_bmc_probe,
 866         .remove         = ssif_bmc_remove,
 867         .id_table       = ssif_bmc_id,
 868 };
 869
 870 module_i2c_driver(ssif_bmc_driver);
 871
 872 MODULE_AUTHOR("Quan Nguyen <[email protected]>");
 873 MODULE_AUTHOR("Chuong Tran <[email protected]>");
 874 MODULE_DESCRIPTION("Linux device driver of the BMC IPMI SSIF interface.");
 875 MODULE_LICENSE("GPL");