drivers/char/ipmi/ipmi_ipmb.c - linux - Git at Google

 // SPDX-License-Identifier: GPL-2.0

 /*
  * Driver to talk to a remote management controller on IPMB.
  */

 #include <linux/acpi.h>
 #include <linux/errno.h>
 #include <linux/i2c.h>
 #include <linux/miscdevice.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/poll.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/semaphore.h>
 #include <linux/kthread.h>
 #include <linux/wait.h>
 #include <linux/ipmi_msgdefs.h>
 #include <linux/ipmi_smi.h>

 #define DEVICE_NAME "ipmi-ipmb"

 static int bmcaddr = 0x20;
 module_param(bmcaddr, int, 0644);
 MODULE_PARM_DESC(bmcaddr, "Address to use for BMC.");

 static unsigned int retry_time_ms = 250;
 module_param(retry_time_ms, uint, 0644);
 MODULE_PARM_DESC(max_retries, "Timeout time between retries, in milliseconds.");

 static unsigned int max_retries = 1;
 module_param(max_retries, uint, 0644);
 MODULE_PARM_DESC(max_retries, "Max resends of a command before timing out.");

 /* Add room for the two slave addresses, two checksums, and rqSeq. */
 #define IPMB_MAX_MSG_LEN (IPMI_MAX_MSG_LENGTH + 5)

 struct ipmi_ipmb_dev {
 	struct ipmi_smi *intf;
 	struct i2c_client *client;

 	struct ipmi_smi_handlers handlers;

 	bool ready;

 	u8 curr_seq;

 	u8 bmcaddr;
 	u32 retry_time_ms;
 	u32 max_retries;

 	struct ipmi_smi_msg *next_msg;
 	struct ipmi_smi_msg *working_msg;

 	/* Transmit thread. */
 	struct task_struct *thread;
 	struct semaphore wake_thread;
 	struct semaphore got_rsp;
 	spinlock_t lock;
 	bool stopping;

 	u8 xmitmsg[IPMB_MAX_MSG_LEN];
 	unsigned int xmitlen;

 	u8 rcvmsg[IPMB_MAX_MSG_LEN];
 	unsigned int rcvlen;
 	bool overrun;
 };

 static bool valid_ipmb(struct ipmi_ipmb_dev *iidev)
 {
 	u8 *msg = iidev->rcvmsg;
 	u8 netfn;

 	if (iidev->overrun)
 		return false;

 	/* Minimum message size. */
 	if (iidev->rcvlen < 7)
 		return false;

 	/* Is it a response? */
 	netfn = msg[1] >> 2;
 	if (netfn & 1) {
 		/* Response messages have an added completion code. */
 		if (iidev->rcvlen < 8)
 			return false;
 	}

 	if (ipmb_checksum(msg, 3) != 0)
 		return false;
 	if (ipmb_checksum(msg + 3, iidev->rcvlen - 3) != 0)
 		return false;

 	return true;
 }

 static void ipmi_ipmb_check_msg_done(struct ipmi_ipmb_dev *iidev)
 {
 	struct ipmi_smi_msg *imsg = NULL;
 	u8 *msg = iidev->rcvmsg;
 	bool is_cmd;
 	unsigned long flags;

 	if (iidev->rcvlen == 0)
 		return;
 	if (!valid_ipmb(iidev))
 		goto done;

 	is_cmd = ((msg[1] >> 2) & 1) == 0;

 	if (is_cmd) {
 		/* Ignore commands until we are up. */
 		if (!iidev->ready)
 			goto done;

 		/* It's a command, allocate a message for it. */
 		imsg = ipmi_alloc_smi_msg();
 		if (!imsg)
 			goto done;
 		imsg->type = IPMI_SMI_MSG_TYPE_IPMB_DIRECT;
 		imsg->data_size = 0;
 	} else {
 		spin_lock_irqsave(&iidev->lock, flags);
 		if (iidev->working_msg) {
 			u8 seq = msg[4] >> 2;
 			bool xmit_rsp = (iidev->working_msg->data[0] >> 2) & 1;

 			/*
 			 * Responses should carry the sequence we sent
 			 * them with.  If it's a transmitted response,
 			 * ignore it.  And if the message hasn't been
 			 * transmitted, ignore it.
 			 */
 			if (!xmit_rsp && seq == iidev->curr_seq) {
 				iidev->curr_seq = (iidev->curr_seq + 1) & 0x3f;

 				imsg = iidev->working_msg;
 				iidev->working_msg = NULL;
 			}
 		}
 		spin_unlock_irqrestore(&iidev->lock, flags);
 	}

 	if (!imsg)
 		goto done;

 	if (imsg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) {
 		imsg->rsp[0] = msg[1]; /* NetFn/LUN */
 		/*
 		 * Keep the source address, rqSeq.  Drop the trailing
 		 * checksum.
 		 */
 		memcpy(imsg->rsp + 1, msg + 3, iidev->rcvlen - 4);
 		imsg->rsp_size = iidev->rcvlen - 3;
 	} else {
 		imsg->rsp[0] = msg[1]; /* NetFn/LUN */
 		/*
 		 * Skip the source address, rqSeq.  Drop the trailing
 		 * checksum.
 		 */
 		memcpy(imsg->rsp + 1, msg + 5, iidev->rcvlen - 6);
 		imsg->rsp_size = iidev->rcvlen - 5;
 	}
 	ipmi_smi_msg_received(iidev->intf, imsg);
 	if (!is_cmd)
 		up(&iidev->got_rsp);

 done:
 	iidev->overrun = false;
 	iidev->rcvlen = 0;
 }

 /*
  * The IPMB protocol only supports i2c writes so there is no need to
  * support I2C_SLAVE_READ* events, except to know if the other end has
  * issued a read without going to stop mode.
  */
 static int ipmi_ipmb_slave_cb(struct i2c_client *client,
 			      enum i2c_slave_event event, u8 *val)
 {
 	struct ipmi_ipmb_dev *iidev = i2c_get_clientdata(client);

 	switch (event) {
 	case I2C_SLAVE_WRITE_REQUESTED:
 		ipmi_ipmb_check_msg_done(iidev);
 		/*
 		 * First byte is the slave address, to ease the checksum
 		 * calculation.
 		 */
 		iidev->rcvmsg[0] = client->addr << 1;
 		iidev->rcvlen = 1;
 		break;

 	case I2C_SLAVE_WRITE_RECEIVED:
 		if (iidev->rcvlen >= sizeof(iidev->rcvmsg))
 			iidev->overrun = true;
 		else
 			iidev->rcvmsg[iidev->rcvlen++] = *val;
 		break;

 	case I2C_SLAVE_READ_REQUESTED:
 	case I2C_SLAVE_STOP:
 		ipmi_ipmb_check_msg_done(iidev);
 		break;

 	case I2C_SLAVE_READ_PROCESSED:
 		break;
 	}

 	return 0;
 }

 static void ipmi_ipmb_send_response(struct ipmi_ipmb_dev *iidev,
 				    struct ipmi_smi_msg *msg, u8 cc)
 {
 	if ((msg->data[0] >> 2) & 1) {
 		/*
 		 * It's a response being sent, we needto return a
 		 * response response.  Fake a send msg command
 		 * response with channel 0.  This will always be ipmb
 		 * direct.
 		 */
 		msg->data[0] = (IPMI_NETFN_APP_REQUEST | 1) << 2;
 		msg->data[3] = IPMI_SEND_MSG_CMD;
 		msg->data[4] = cc;
 		msg->data_size = 5;
 	}
 	msg->rsp[0] = msg->data[0] | (1 << 2);
 	if (msg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) {
 		msg->rsp[1] = msg->data[1];
 		msg->rsp[2] = msg->data[2];
 		msg->rsp[3] = msg->data[3];
 		msg->rsp[4] = cc;
 		msg->rsp_size = 5;
 	} else {
 		msg->rsp[1] = msg->data[1];
 		msg->rsp[2] = cc;
 		msg->rsp_size = 3;
 	}
 	ipmi_smi_msg_received(iidev->intf, msg);
 }

 static void ipmi_ipmb_format_for_xmit(struct ipmi_ipmb_dev *iidev,
 				      struct ipmi_smi_msg *msg)
 {
 	if (msg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) {
 		iidev->xmitmsg[0] = msg->data[1];
 		iidev->xmitmsg[1] = msg->data[0];
 		memcpy(iidev->xmitmsg + 4, msg->data + 2, msg->data_size - 2);
 		iidev->xmitlen = msg->data_size + 2;
 	} else {
 		iidev->xmitmsg[0] = iidev->bmcaddr;
 		iidev->xmitmsg[1] = msg->data[0];
 		iidev->xmitmsg[4] = 0;
 		memcpy(iidev->xmitmsg + 5, msg->data + 1, msg->data_size - 1);
 		iidev->xmitlen = msg->data_size + 4;
 	}
 	iidev->xmitmsg[3] = iidev->client->addr << 1;
 	if (((msg->data[0] >> 2) & 1) == 0)
 		/* If it's a command, put in our own sequence number. */
 		iidev->xmitmsg[4] = ((iidev->xmitmsg[4] & 0x03) |
 				     (iidev->curr_seq << 2));

 	/* Now add on the final checksums. */
 	iidev->xmitmsg[2] = ipmb_checksum(iidev->xmitmsg, 2);
 	iidev->xmitmsg[iidev->xmitlen] =
 		ipmb_checksum(iidev->xmitmsg + 3, iidev->xmitlen - 3);
 	iidev->xmitlen++;
 }

 static int ipmi_ipmb_thread(void *data)
 {
 	struct ipmi_ipmb_dev *iidev = data;

 	while (!kthread_should_stop()) {
 		long ret;
 		struct i2c_msg i2c_msg;
 		struct ipmi_smi_msg *msg = NULL;
 		unsigned long flags;
 		unsigned int retries = 0;

 		/* Wait for a message to send */
 		ret = down_interruptible(&iidev->wake_thread);
 		if (iidev->stopping)
 			break;
 		if (ret)
 			continue;

 		spin_lock_irqsave(&iidev->lock, flags);
 		if (iidev->next_msg) {
 			msg = iidev->next_msg;
 			iidev->next_msg = NULL;
 		}
 		spin_unlock_irqrestore(&iidev->lock, flags);
 		if (!msg)
 			continue;

 		ipmi_ipmb_format_for_xmit(iidev, msg);

 retry:
 		i2c_msg.len = iidev->xmitlen - 1;
 		if (i2c_msg.len > 32) {
 			ipmi_ipmb_send_response(iidev, msg,
 						IPMI_REQ_LEN_EXCEEDED_ERR);
 			continue;
 		}

 		i2c_msg.addr = iidev->xmitmsg[0] >> 1;
 		i2c_msg.flags = 0;
 		i2c_msg.buf = iidev->xmitmsg + 1;

 		/* Rely on i2c_transfer for a barrier. */
 		iidev->working_msg = msg;

 		ret = i2c_transfer(iidev->client->adapter, &i2c_msg, 1);

 		if ((msg->data[0] >> 2) & 1) {
 			/*
 			 * It's a response, nothing will be returned
 			 * by the other end.
 			 */

 			iidev->working_msg = NULL;
 			ipmi_ipmb_send_response(iidev, msg,
 						ret < 0 ? IPMI_BUS_ERR : 0);
 			continue;
 		}
 		if (ret < 0) {
 			iidev->working_msg = NULL;
 			ipmi_ipmb_send_response(iidev, msg, IPMI_BUS_ERR);
 			continue;
 		}

 		/* A command was sent, wait for its response. */
 		ret = down_timeout(&iidev->got_rsp,
 				   msecs_to_jiffies(iidev->retry_time_ms));

 		/*
 		 * Grab the message if we can.  If the handler hasn't
 		 * already handled it, the message will still be there.
 		 */
 		spin_lock_irqsave(&iidev->lock, flags);
 		msg = iidev->working_msg;
 		iidev->working_msg = NULL;
 		spin_unlock_irqrestore(&iidev->lock, flags);

 		if (!msg && ret) {
 			/*
 			 * If working_msg is not set and we timed out,
 			 * that means the message grabbed by
 			 * check_msg_done before we could grab it
 			 * here.  Wait again for check_msg_done to up
 			 * the semaphore.
 			 */
 			down(&iidev->got_rsp);
 		} else if (msg && ++retries <= iidev->max_retries) {
 			spin_lock_irqsave(&iidev->lock, flags);
 			iidev->working_msg = msg;
 			spin_unlock_irqrestore(&iidev->lock, flags);
 			goto retry;
 		}

 		if (msg)
 			ipmi_ipmb_send_response(iidev, msg, IPMI_TIMEOUT_ERR);
 	}

 	if (iidev->next_msg)
 		/* Return an unspecified error. */
 		ipmi_ipmb_send_response(iidev, iidev->next_msg, 0xff);

 	return 0;
 }

 static int ipmi_ipmb_start_processing(void *send_info,
 				      struct ipmi_smi *new_intf)
 {
 	struct ipmi_ipmb_dev *iidev = send_info;

 	iidev->intf = new_intf;
 	iidev->ready = true;
 	return 0;
 }

 static void ipmi_ipmb_stop_thread(struct ipmi_ipmb_dev *iidev)
 {
 	if (iidev->thread) {
 		struct task_struct *t = iidev->thread;

 		iidev->thread = NULL;
 		iidev->stopping = true;
 		up(&iidev->wake_thread);
 		up(&iidev->got_rsp);
 		kthread_stop(t);
 	}
 }

 static void ipmi_ipmb_shutdown(void *send_info)
 {
 	struct ipmi_ipmb_dev *iidev = send_info;

 	ipmi_ipmb_stop_thread(iidev);
 }

 static void ipmi_ipmb_sender(void *send_info,
 			     struct ipmi_smi_msg *msg)
 {
 	struct ipmi_ipmb_dev *iidev = send_info;
 	unsigned long flags;

 	spin_lock_irqsave(&iidev->lock, flags);
 	BUG_ON(iidev->next_msg);

 	iidev->next_msg = msg;
 	spin_unlock_irqrestore(&iidev->lock, flags);

 	up(&iidev->wake_thread);
 }

 static void ipmi_ipmb_request_events(void *send_info)
 {
 	/* We don't fetch events here. */
 }

 static int ipmi_ipmb_remove(struct i2c_client *client)
 {
 	struct ipmi_ipmb_dev *iidev = i2c_get_clientdata(client);

 	if (iidev->client) {
 		iidev->client = NULL;
 		i2c_slave_unregister(client);
 	}
 	ipmi_ipmb_stop_thread(iidev);

 	return 0;
 }

 static int ipmi_ipmb_probe(struct i2c_client *client,
 			   const struct i2c_device_id *id)
 {
 	struct device *dev = &client->dev;
 	struct ipmi_ipmb_dev *iidev;
 	int rv;

 	iidev = devm_kzalloc(&client->dev, sizeof(*iidev), GFP_KERNEL);
 	if (!iidev)
 		return -ENOMEM;

 	if (of_property_read_u8(dev->of_node, "bmcaddr", &iidev->bmcaddr) != 0)
 		iidev->bmcaddr = bmcaddr;
 	if (iidev->bmcaddr == 0 || iidev->bmcaddr & 1) {
 		/* Can't have the write bit set. */
 		dev_notice(&client->dev,
 			   "Invalid bmc address value %2.2x\n", iidev->bmcaddr);
 		return -EINVAL;
 	}

 	if (of_property_read_u32(dev->of_node, "retry-time",
 				 &iidev->retry_time_ms) != 0)
 		iidev->retry_time_ms = retry_time_ms;

 	if (of_property_read_u32(dev->of_node, "max-retries",
 				 &iidev->max_retries) != 0)
 		iidev->max_retries = max_retries;

 	i2c_set_clientdata(client, iidev);
 	client->flags |= I2C_CLIENT_SLAVE;

 	rv = i2c_slave_register(client, ipmi_ipmb_slave_cb);
 	if (rv)
 		return rv;

 	iidev->client = client;

 	iidev->handlers.flags = IPMI_SMI_CAN_HANDLE_IPMB_DIRECT;
 	iidev->handlers.start_processing = ipmi_ipmb_start_processing;
 	iidev->handlers.shutdown = ipmi_ipmb_shutdown;
 	iidev->handlers.sender = ipmi_ipmb_sender;
 	iidev->handlers.request_events = ipmi_ipmb_request_events;

 	spin_lock_init(&iidev->lock);
 	sema_init(&iidev->wake_thread, 0);
 	sema_init(&iidev->got_rsp, 0);

 	iidev->thread = kthread_run(ipmi_ipmb_thread, iidev,
 				    "kipmb%4.4x", client->addr);
 	if (IS_ERR(iidev->thread)) {
 		rv = PTR_ERR(iidev->thread);
 		dev_notice(&client->dev,
 			   "Could not start kernel thread: error %d\n", rv);
 		goto out_err;
 	}

 	rv = ipmi_register_smi(&iidev->handlers,
 			       iidev,
 			       &client->dev,
 			       iidev->bmcaddr);
 	if (rv)
 		goto out_err;

 	return 0;

 out_err:
 	ipmi_ipmb_remove(client);
 	return rv;
 }

 #ifdef CONFIG_OF
 static const struct of_device_id of_ipmi_ipmb_match[] = {
 	{ .type = "ipmi", .compatible = DEVICE_NAME },
 	{},
 };
 MODULE_DEVICE_TABLE(of, of_ipmi_ipmb_match);
 #else
 #define of_ipmi_ipmb_match NULL
 #endif

 static const struct i2c_device_id ipmi_ipmb_id[] = {
 	{ DEVICE_NAME, 0 },
 	{},
 };
 MODULE_DEVICE_TABLE(i2c, ipmi_ipmb_id);

 static struct i2c_driver ipmi_ipmb_driver = {
 	.class		= I2C_CLASS_HWMON,
 	.driver = {
 		.name = DEVICE_NAME,
 		.of_match_table = of_ipmi_ipmb_match,
 	},
 	.probe		= ipmi_ipmb_probe,
 	.remove		= ipmi_ipmb_remove,
 	.id_table	= ipmi_ipmb_id,
 };
 module_i2c_driver(ipmi_ipmb_driver);

 MODULE_AUTHOR("Corey Minyard");
 MODULE_DESCRIPTION("IPMI IPMB driver");
 MODULE_LICENSE("GPL v2");
	// SPDX-License-Identifier: GPL-2.0

	/*
	* Driver to talk to a remote management controller on IPMB.
	*/

	#include <linux/acpi.h>
	#include <linux/errno.h>
	#include <linux/i2c.h>
	#include <linux/miscdevice.h>
	#include <linux/module.h>
	#include <linux/mutex.h>
	#include <linux/poll.h>
	#include <linux/slab.h>
	#include <linux/spinlock.h>
	#include <linux/semaphore.h>
	#include <linux/kthread.h>
	#include <linux/wait.h>
	#include <linux/ipmi_msgdefs.h>
	#include <linux/ipmi_smi.h>

	#define DEVICE_NAME "ipmi-ipmb"

	static int bmcaddr = 0x20;
	module_param(bmcaddr, int, 0644);
	MODULE_PARM_DESC(bmcaddr, "Address to use for BMC.");

	static unsigned int retry_time_ms = 250;
	module_param(retry_time_ms, uint, 0644);
	MODULE_PARM_DESC(max_retries, "Timeout time between retries, in milliseconds.");

	static unsigned int max_retries = 1;
	module_param(max_retries, uint, 0644);
	MODULE_PARM_DESC(max_retries, "Max resends of a command before timing out.");

	/* Add room for the two slave addresses, two checksums, and rqSeq. */
	#define IPMB_MAX_MSG_LEN (IPMI_MAX_MSG_LENGTH + 5)

	struct ipmi_ipmb_dev {
	struct ipmi_smi *intf;
	struct i2c_client *client;

	struct ipmi_smi_handlers handlers;

	bool ready;

	u8 curr_seq;

	u8 bmcaddr;
	u32 retry_time_ms;
	u32 max_retries;

	struct ipmi_smi_msg *next_msg;
	struct ipmi_smi_msg *working_msg;

	/* Transmit thread. */
	struct task_struct *thread;
	struct semaphore wake_thread;
	struct semaphore got_rsp;
	spinlock_t lock;
	bool stopping;

	u8 xmitmsg[IPMB_MAX_MSG_LEN];
	unsigned int xmitlen;

	u8 rcvmsg[IPMB_MAX_MSG_LEN];
	unsigned int rcvlen;
	bool overrun;
	};

	static bool valid_ipmb(struct ipmi_ipmb_dev *iidev)
	{
	u8 *msg = iidev->rcvmsg;
	u8 netfn;

	if (iidev->overrun)
	return false;

	/* Minimum message size. */
	if (iidev->rcvlen < 7)
	return false;

	/* Is it a response? */
	netfn = msg[1] >> 2;
	if (netfn & 1) {
	/* Response messages have an added completion code. */
	if (iidev->rcvlen < 8)
	return false;
	}

	if (ipmb_checksum(msg, 3) != 0)
	return false;
	if (ipmb_checksum(msg + 3, iidev->rcvlen - 3) != 0)
	return false;

	return true;
	}

	static void ipmi_ipmb_check_msg_done(struct ipmi_ipmb_dev *iidev)
	{
	struct ipmi_smi_msg *imsg = NULL;
	u8 *msg = iidev->rcvmsg;
	bool is_cmd;
	unsigned long flags;

	if (iidev->rcvlen == 0)
	return;
	if (!valid_ipmb(iidev))
	goto done;

	is_cmd = ((msg[1] >> 2) & 1) == 0;

	if (is_cmd) {
	/* Ignore commands until we are up. */
	if (!iidev->ready)
	goto done;

	/* It's a command, allocate a message for it. */
	imsg = ipmi_alloc_smi_msg();
	if (!imsg)
	goto done;
	imsg->type = IPMI_SMI_MSG_TYPE_IPMB_DIRECT;
	imsg->data_size = 0;
	} else {
	spin_lock_irqsave(&iidev->lock, flags);
	if (iidev->working_msg) {
	u8 seq = msg[4] >> 2;
	bool xmit_rsp = (iidev->working_msg->data[0] >> 2) & 1;

	/*
	* Responses should carry the sequence we sent
	* them with. If it's a transmitted response,
	* ignore it. And if the message hasn't been
	* transmitted, ignore it.
	*/
	if (!xmit_rsp && seq == iidev->curr_seq) {
	iidev->curr_seq = (iidev->curr_seq + 1) & 0x3f;

	imsg = iidev->working_msg;
	iidev->working_msg = NULL;
	}
	}
	spin_unlock_irqrestore(&iidev->lock, flags);
	}

	if (!imsg)
	goto done;

	if (imsg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) {
	imsg->rsp[0] = msg[1]; /* NetFn/LUN */
	/*
	* Keep the source address, rqSeq. Drop the trailing
	* checksum.
	*/
	memcpy(imsg->rsp + 1, msg + 3, iidev->rcvlen - 4);
	imsg->rsp_size = iidev->rcvlen - 3;
	} else {
	imsg->rsp[0] = msg[1]; /* NetFn/LUN */
	/*
	* Skip the source address, rqSeq. Drop the trailing
	* checksum.
	*/
	memcpy(imsg->rsp + 1, msg + 5, iidev->rcvlen - 6);
	imsg->rsp_size = iidev->rcvlen - 5;
	}
	ipmi_smi_msg_received(iidev->intf, imsg);
	if (!is_cmd)
	up(&iidev->got_rsp);

	done:
	iidev->overrun = false;
	iidev->rcvlen = 0;
	}

	/*
	* The IPMB protocol only supports i2c writes so there is no need to
	* support I2C_SLAVE_READ* events, except to know if the other end has
	* issued a read without going to stop mode.
	*/
	static int ipmi_ipmb_slave_cb(struct i2c_client *client,
	enum i2c_slave_event event, u8 *val)
	{
	struct ipmi_ipmb_dev *iidev = i2c_get_clientdata(client);

	switch (event) {
	case I2C_SLAVE_WRITE_REQUESTED:
	ipmi_ipmb_check_msg_done(iidev);
	/*
	* First byte is the slave address, to ease the checksum
	* calculation.
	*/
	iidev->rcvmsg[0] = client->addr << 1;
	iidev->rcvlen = 1;
	break;

	case I2C_SLAVE_WRITE_RECEIVED:
	if (iidev->rcvlen >= sizeof(iidev->rcvmsg))
	iidev->overrun = true;
	else
	iidev->rcvmsg[iidev->rcvlen++] = *val;
	break;

	case I2C_SLAVE_READ_REQUESTED:
	case I2C_SLAVE_STOP:
	ipmi_ipmb_check_msg_done(iidev);
	break;

	case I2C_SLAVE_READ_PROCESSED:
	break;
	}

	return 0;
	}

	static void ipmi_ipmb_send_response(struct ipmi_ipmb_dev *iidev,
	struct ipmi_smi_msg *msg, u8 cc)
	{
	if ((msg->data[0] >> 2) & 1) {
	/*
	* It's a response being sent, we needto return a
	* response response. Fake a send msg command
	* response with channel 0. This will always be ipmb
	* direct.
	*/
	msg->data[0] = (IPMI_NETFN_APP_REQUEST \| 1) << 2;
	msg->data[3] = IPMI_SEND_MSG_CMD;
	msg->data[4] = cc;
	msg->data_size = 5;
	}
	msg->rsp[0] = msg->data[0] \| (1 << 2);
	if (msg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) {
	msg->rsp[1] = msg->data[1];
	msg->rsp[2] = msg->data[2];
	msg->rsp[3] = msg->data[3];
	msg->rsp[4] = cc;
	msg->rsp_size = 5;
	} else {
	msg->rsp[1] = msg->data[1];
	msg->rsp[2] = cc;
	msg->rsp_size = 3;
	}
	ipmi_smi_msg_received(iidev->intf, msg);
	}

	static void ipmi_ipmb_format_for_xmit(struct ipmi_ipmb_dev *iidev,
	struct ipmi_smi_msg *msg)
	{
	if (msg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) {
	iidev->xmitmsg[0] = msg->data[1];
	iidev->xmitmsg[1] = msg->data[0];
	memcpy(iidev->xmitmsg + 4, msg->data + 2, msg->data_size - 2);
	iidev->xmitlen = msg->data_size + 2;
	} else {
	iidev->xmitmsg[0] = iidev->bmcaddr;
	iidev->xmitmsg[1] = msg->data[0];
	iidev->xmitmsg[4] = 0;
	memcpy(iidev->xmitmsg + 5, msg->data + 1, msg->data_size - 1);
	iidev->xmitlen = msg->data_size + 4;
	}
	iidev->xmitmsg[3] = iidev->client->addr << 1;
	if (((msg->data[0] >> 2) & 1) == 0)
	/* If it's a command, put in our own sequence number. */
	iidev->xmitmsg[4] = ((iidev->xmitmsg[4] & 0x03) \|
	(iidev->curr_seq << 2));

	/* Now add on the final checksums. */
	iidev->xmitmsg[2] = ipmb_checksum(iidev->xmitmsg, 2);
	iidev->xmitmsg[iidev->xmitlen] =
	ipmb_checksum(iidev->xmitmsg + 3, iidev->xmitlen - 3);
	iidev->xmitlen++;
	}

	static int ipmi_ipmb_thread(void *data)
	{
	struct ipmi_ipmb_dev *iidev = data;

	while (!kthread_should_stop()) {
	long ret;
	struct i2c_msg i2c_msg;
	struct ipmi_smi_msg *msg = NULL;
	unsigned long flags;
	unsigned int retries = 0;

	/* Wait for a message to send */
	ret = down_interruptible(&iidev->wake_thread);
	if (iidev->stopping)
	break;
	if (ret)
	continue;

	spin_lock_irqsave(&iidev->lock, flags);
	if (iidev->next_msg) {
	msg = iidev->next_msg;
	iidev->next_msg = NULL;
	}
	spin_unlock_irqrestore(&iidev->lock, flags);
	if (!msg)
	continue;

	ipmi_ipmb_format_for_xmit(iidev, msg);

	retry:
	i2c_msg.len = iidev->xmitlen - 1;
	if (i2c_msg.len > 32) {
	ipmi_ipmb_send_response(iidev, msg,
	IPMI_REQ_LEN_EXCEEDED_ERR);
	continue;
	}

	i2c_msg.addr = iidev->xmitmsg[0] >> 1;
	i2c_msg.flags = 0;
	i2c_msg.buf = iidev->xmitmsg + 1;

	/* Rely on i2c_transfer for a barrier. */
	iidev->working_msg = msg;

	ret = i2c_transfer(iidev->client->adapter, &i2c_msg, 1);

	if ((msg->data[0] >> 2) & 1) {
	/*
	* It's a response, nothing will be returned
	* by the other end.
	*/

	iidev->working_msg = NULL;
	ipmi_ipmb_send_response(iidev, msg,
	ret < 0 ? IPMI_BUS_ERR : 0);
	continue;
	}
	if (ret < 0) {
	iidev->working_msg = NULL;
	ipmi_ipmb_send_response(iidev, msg, IPMI_BUS_ERR);
	continue;
	}

	/* A command was sent, wait for its response. */
	ret = down_timeout(&iidev->got_rsp,
	msecs_to_jiffies(iidev->retry_time_ms));

	/*
	* Grab the message if we can. If the handler hasn't
	* already handled it, the message will still be there.
	*/
	spin_lock_irqsave(&iidev->lock, flags);
	msg = iidev->working_msg;
	iidev->working_msg = NULL;
	spin_unlock_irqrestore(&iidev->lock, flags);

	if (!msg && ret) {
	/*
	* If working_msg is not set and we timed out,
	* that means the message grabbed by
	* check_msg_done before we could grab it
	* here. Wait again for check_msg_done to up
	* the semaphore.
	*/
	down(&iidev->got_rsp);
	} else if (msg && ++retries <= iidev->max_retries) {
	spin_lock_irqsave(&iidev->lock, flags);
	iidev->working_msg = msg;
	spin_unlock_irqrestore(&iidev->lock, flags);
	goto retry;
	}

	if (msg)
	ipmi_ipmb_send_response(iidev, msg, IPMI_TIMEOUT_ERR);
	}

	if (iidev->next_msg)
	/* Return an unspecified error. */
	ipmi_ipmb_send_response(iidev, iidev->next_msg, 0xff);

	return 0;
	}

	static int ipmi_ipmb_start_processing(void *send_info,
	struct ipmi_smi *new_intf)
	{
	struct ipmi_ipmb_dev *iidev = send_info;

	iidev->intf = new_intf;
	iidev->ready = true;
	return 0;
	}

	static void ipmi_ipmb_stop_thread(struct ipmi_ipmb_dev *iidev)
	{
	if (iidev->thread) {
	struct task_struct *t = iidev->thread;

	iidev->thread = NULL;
	iidev->stopping = true;
	up(&iidev->wake_thread);
	up(&iidev->got_rsp);
	kthread_stop(t);
	}
	}

	static void ipmi_ipmb_shutdown(void *send_info)
	{
	struct ipmi_ipmb_dev *iidev = send_info;

	ipmi_ipmb_stop_thread(iidev);
	}

	static void ipmi_ipmb_sender(void *send_info,
	struct ipmi_smi_msg *msg)
	{
	struct ipmi_ipmb_dev *iidev = send_info;
	unsigned long flags;

	spin_lock_irqsave(&iidev->lock, flags);
	BUG_ON(iidev->next_msg);

	iidev->next_msg = msg;
	spin_unlock_irqrestore(&iidev->lock, flags);

	up(&iidev->wake_thread);
	}

	static void ipmi_ipmb_request_events(void *send_info)
	{
	/* We don't fetch events here. */
	}

	static int ipmi_ipmb_remove(struct i2c_client *client)
	{
	struct ipmi_ipmb_dev *iidev = i2c_get_clientdata(client);

	if (iidev->client) {
	iidev->client = NULL;
	i2c_slave_unregister(client);
	}
	ipmi_ipmb_stop_thread(iidev);

	return 0;
	}

	static int ipmi_ipmb_probe(struct i2c_client *client,
	const struct i2c_device_id *id)
	{
	struct device *dev = &client->dev;
	struct ipmi_ipmb_dev *iidev;
	int rv;

	iidev = devm_kzalloc(&client->dev, sizeof(*iidev), GFP_KERNEL);
	if (!iidev)
	return -ENOMEM;

	if (of_property_read_u8(dev->of_node, "bmcaddr", &iidev->bmcaddr) != 0)
	iidev->bmcaddr = bmcaddr;
	if (iidev->bmcaddr == 0 \|\| iidev->bmcaddr & 1) {
	/* Can't have the write bit set. */
	dev_notice(&client->dev,
	"Invalid bmc address value %2.2x\n", iidev->bmcaddr);
	return -EINVAL;
	}

	if (of_property_read_u32(dev->of_node, "retry-time",
	&iidev->retry_time_ms) != 0)
	iidev->retry_time_ms = retry_time_ms;

	if (of_property_read_u32(dev->of_node, "max-retries",
	&iidev->max_retries) != 0)
	iidev->max_retries = max_retries;

	i2c_set_clientdata(client, iidev);
	client->flags \|= I2C_CLIENT_SLAVE;

	rv = i2c_slave_register(client, ipmi_ipmb_slave_cb);
	if (rv)
	return rv;

	iidev->client = client;

	iidev->handlers.flags = IPMI_SMI_CAN_HANDLE_IPMB_DIRECT;
	iidev->handlers.start_processing = ipmi_ipmb_start_processing;
	iidev->handlers.shutdown = ipmi_ipmb_shutdown;
	iidev->handlers.sender = ipmi_ipmb_sender;
	iidev->handlers.request_events = ipmi_ipmb_request_events;

	spin_lock_init(&iidev->lock);
	sema_init(&iidev->wake_thread, 0);
	sema_init(&iidev->got_rsp, 0);

	iidev->thread = kthread_run(ipmi_ipmb_thread, iidev,
	"kipmb%4.4x", client->addr);
	if (IS_ERR(iidev->thread)) {
	rv = PTR_ERR(iidev->thread);
	dev_notice(&client->dev,
	"Could not start kernel thread: error %d\n", rv);
	goto out_err;
	}

	rv = ipmi_register_smi(&iidev->handlers,
	iidev,
	&client->dev,
	iidev->bmcaddr);
	if (rv)
	goto out_err;

	return 0;

	out_err:
	ipmi_ipmb_remove(client);
	return rv;
	}

	#ifdef CONFIG_OF
	static const struct of_device_id of_ipmi_ipmb_match[] = {
	{ .type = "ipmi", .compatible = DEVICE_NAME },
	{},
	};
	MODULE_DEVICE_TABLE(of, of_ipmi_ipmb_match);
	#else
	#define of_ipmi_ipmb_match NULL
	#endif

	static const struct i2c_device_id ipmi_ipmb_id[] = {
	{ DEVICE_NAME, 0 },
	{},
	};
	MODULE_DEVICE_TABLE(i2c, ipmi_ipmb_id);

	static struct i2c_driver ipmi_ipmb_driver = {
	.class = I2C_CLASS_HWMON,
	.driver = {
	.name = DEVICE_NAME,
	.of_match_table = of_ipmi_ipmb_match,
	},
	.probe = ipmi_ipmb_probe,
	.remove = ipmi_ipmb_remove,
	.id_table = ipmi_ipmb_id,
	};
	module_i2c_driver(ipmi_ipmb_driver);

	MODULE_AUTHOR("Corey Minyard");
	MODULE_DESCRIPTION("IPMI IPMB driver");
	MODULE_LICENSE("GPL v2");