aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/char/ipmi (follow)
AgeCommit message (Collapse)AuthorFilesLines
2022-04-29ipmi:ipmi_ipmb: Fix null-ptr-deref in ipmi_unregister_smi()Corey Minyard2-5/+5
KASAN report null-ptr-deref as follows: KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:ipmi_unregister_smi+0x7d/0xd50 drivers/char/ipmi/ipmi_msghandler.c:3680 Call Trace: ipmi_ipmb_remove+0x138/0x1a0 drivers/char/ipmi/ipmi_ipmb.c:443 ipmi_ipmb_probe+0x409/0xda1 drivers/char/ipmi/ipmi_ipmb.c:548 i2c_device_probe+0x959/0xac0 drivers/i2c/i2c-core-base.c:563 really_probe+0x3f3/0xa70 drivers/base/dd.c:541 In ipmi_ipmb_probe(), 'iidev->intf' is not set before ipmi_register_smi() success. And in the error handling case, ipmi_ipmb_remove() is called to release resources, ipmi_unregister_smi() is called without check 'iidev->intf', this will cause KASAN null-ptr-deref issue. General kernel style is to allow NULL to be passed into unregister calls, so fix it that way. This allows a NULL check to be removed in other code. Fixes: 57c9e3c9a374 ("ipmi:ipmi_ipmb: Unregister the SMI on remove") Reported-by: Hulk Robot <hulkci@huawei.com> Cc: stable@vger.kernel.org # v5.17+ Cc: Wei Yongjun <weiyongjun1@huawei.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2022-04-29ipmi: When handling send message responses, don't process the messageCorey Minyard1-0/+2
A chunk was dropped when the code handling send messages was rewritten. Those messages shouldn't be processed normally, they are just an indication that the message was successfully sent and the timers should be started for the real response that should be coming later. Add back in the missing chunk to just discard the message and go on. Fixes: 059747c245f0 ("ipmi: Add support for IPMB direct messages") Reported-by: Joe Wiese <jwiese@rackspace.com> Cc: stable@vger.kernel.org # v5.16+ Signed-off-by: Corey Minyard <cminyard@mvista.com> Tested-by: Joe Wiese <jwiese@rackspace.com>
2022-03-20ipmi: initialize len variableTom Rix1-1/+1
Clang static analysis reports this issue ipmi_ssif.c:1731:3: warning: 4th function call argument is an uninitialized value dev_info(&ssif_info->client->dev, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The 4th parameter is the 'len' variable. len is only set by a successful call to do_cmd(). Initialize to len 0. Signed-off-by: Tom Rix <trix@redhat.com> Message-Id: <20220320135954.2258545-1-trix@redhat.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2022-02-28ipmi: kcs: aspeed: Remove old bindings supportJoel Stanley1-61/+7
It's been a few releases since we depreciated the "v1" bindings. Remove support from the driver as all known device trees have been updated to use the new bindings. Signed-off-by: Joel Stanley <joel@jms.id.au> Message-Id: <20220228062840.449215-1-joel@jms.id.au> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2022-02-23ipmi:ipmb: Add the ability to have a separate slave and master deviceCorey Minyard1-9/+49
A situation has come up where there is a slave-only device for the slave and a separate master device on the same bug. Allow a separate slave device to be registered. Signed-off-by: Corey Minyard <minyard@acm.org>
2022-02-23ipmi:ipmi_ipmb: Unregister the SMI on removeCorey Minyard1-0/+2
Otherwise it will continue to be hooked into the IPMI framework. Signed-off-by: Corey Minyard <minyard@acm.org>
2022-02-22ipmi: kcs: aspeed: Add AST2600 compatible stringJoel Stanley1-0/+1
The AST2600 is already described in the bindings, but the driver never gained a compatible string. Signed-off-by: Joel Stanley <joel@jms.id.au> Message-Id: <20220221070351.121905-1-joel@jms.id.au> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2022-01-17ipmi: ssif: replace strlcpy with strscpyJason Wang1-1/+1
The strlcpy should not be used because it doesn't limit the source length. So that it will lead some potential bugs. But the strscpy doesn't require reading memory from the src string beyond the specified "count" bytes, and since the return value is easier to error-check than strlcpy()'s. In addition, the implementation is robust to the string changing out from underneath it, unlike the current strlcpy() implementation. Thus, replace strlcpy with strscpy. Signed-off-by: Jason Wang <wangborong@cdjrlc.com> Message-Id: <20211222032707.1912186-1-wangborong@cdjrlc.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2022-01-17ipmi/watchdog: Constify identRikard Falkeborn1-1/+1
ident is not modified and can be made const to allow the compiler to put it in read-only memory. Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com> Message-Id: <20211128220154.32927-1-rikard.falkeborn@gmail.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-12-21ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler moduleWu Bo1-1/+1
Hi, When testing install and uninstall of ipmi_si.ko and ipmi_msghandler.ko, the system crashed. The log as follows: [ 141.087026] BUG: unable to handle kernel paging request at ffffffffc09b3a5a [ 141.087241] PGD 8fe4c0d067 P4D 8fe4c0d067 PUD 8fe4c0f067 PMD 103ad89067 PTE 0 [ 141.087464] Oops: 0010 [#1] SMP NOPTI [ 141.087580] CPU: 67 PID: 668 Comm: kworker/67:1 Kdump: loaded Not tainted 4.18.0.x86_64 #47 [ 141.088009] Workqueue: events 0xffffffffc09b3a40 [ 141.088009] RIP: 0010:0xffffffffc09b3a5a [ 141.088009] Code: Bad RIP value. [ 141.088009] RSP: 0018:ffffb9094e2c3e88 EFLAGS: 00010246 [ 141.088009] RAX: 0000000000000000 RBX: ffff9abfdb1f04a0 RCX: 0000000000000000 [ 141.088009] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 [ 141.088009] RBP: 0000000000000000 R08: ffff9abfffee3cb8 R09: 00000000000002e1 [ 141.088009] R10: ffffb9094cb73d90 R11: 00000000000f4240 R12: ffff9abfffee8700 [ 141.088009] R13: 0000000000000000 R14: ffff9abfdb1f04a0 R15: ffff9abfdb1f04a8 [ 141.088009] FS: 0000000000000000(0000) GS:ffff9abfffec0000(0000) knlGS:0000000000000000 [ 141.088009] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 141.088009] CR2: ffffffffc09b3a30 CR3: 0000008fe4c0a001 CR4: 00000000007606e0 [ 141.088009] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 141.088009] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 141.088009] PKRU: 55555554 [ 141.088009] Call Trace: [ 141.088009] ? process_one_work+0x195/0x390 [ 141.088009] ? worker_thread+0x30/0x390 [ 141.088009] ? process_one_work+0x390/0x390 [ 141.088009] ? kthread+0x10d/0x130 [ 141.088009] ? kthread_flush_work_fn+0x10/0x10 [ 141.088009] ? ret_from_fork+0x35/0x40] BUG: unable to handle kernel paging request at ffffffffc0b28a5a [ 200.223240] PGD 97fe00d067 P4D 97fe00d067 PUD 97fe00f067 PMD a580cbf067 PTE 0 [ 200.223464] Oops: 0010 [#1] SMP NOPTI [ 200.223579] CPU: 63 PID: 664 Comm: kworker/63:1 Kdump: loaded Not tainted 4.18.0.x86_64 #46 [ 200.224008] Workqueue: events 0xffffffffc0b28a40 [ 200.224008] RIP: 0010:0xffffffffc0b28a5a [ 200.224008] Code: Bad RIP value. [ 200.224008] RSP: 0018:ffffbf3c8e2a3e88 EFLAGS: 00010246 [ 200.224008] RAX: 0000000000000000 RBX: ffffa0799ad6bca0 RCX: 0000000000000000 [ 200.224008] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 [ 200.224008] RBP: 0000000000000000 R08: ffff9fe43fde3cb8 R09: 00000000000000d5 [ 200.224008] R10: ffffbf3c8cb53d90 R11: 00000000000f4240 R12: ffff9fe43fde8700 [ 200.224008] R13: 0000000000000000 R14: ffffa0799ad6bca0 R15: ffffa0799ad6bca8 [ 200.224008] FS: 0000000000000000(0000) GS:ffff9fe43fdc0000(0000) knlGS:0000000000000000 [ 200.224008] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 200.224008] CR2: ffffffffc0b28a30 CR3: 00000097fe00a002 CR4: 00000000007606e0 [ 200.224008] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 200.224008] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 200.224008] PKRU: 55555554 [ 200.224008] Call Trace: [ 200.224008] ? process_one_work+0x195/0x390 [ 200.224008] ? worker_thread+0x30/0x390 [ 200.224008] ? process_one_work+0x390/0x390 [ 200.224008] ? kthread+0x10d/0x130 [ 200.224008] ? kthread_flush_work_fn+0x10/0x10 [ 200.224008] ? ret_from_fork+0x35/0x40 [ 200.224008] kernel fault(0x1) notification starting on CPU 63 [ 200.224008] kernel fault(0x1) notification finished on CPU 63 [ 200.224008] CR2: ffffffffc0b28a5a [ 200.224008] ---[ end trace c82a412d93f57412 ]--- The reason is as follows: T1: rmmod ipmi_si. ->ipmi_unregister_smi() -> ipmi_bmc_unregister() -> __ipmi_bmc_unregister() -> kref_put(&bmc->usecount, cleanup_bmc_device); -> schedule_work(&bmc->remove_work); T2: rmmod ipmi_msghandler. ipmi_msghander module uninstalled, and the module space will be freed. T3: bmc->remove_work doing cleanup the bmc resource. -> cleanup_bmc_work() -> platform_device_unregister(&bmc->pdev); -> platform_device_del(pdev); -> device_del(&pdev->dev); -> kobject_uevent(&dev->kobj, KOBJ_REMOVE); -> kobject_uevent_env() -> dev_uevent() -> if (dev->type && dev->type->name) 'dev->type'(bmc_device_type) pointer space has freed when uninstall ipmi_msghander module, 'dev->type->name' cause the system crash. drivers/char/ipmi/ipmi_msghandler.c: 2820 static const struct device_type bmc_device_type = { 2821 .groups = bmc_dev_attr_groups, 2822 }; Steps to reproduce: Add a time delay in cleanup_bmc_work() function, and uninstall ipmi_si and ipmi_msghandler module. 2910 static void cleanup_bmc_work(struct work_struct *work) 2911 { 2912 struct bmc_device *bmc = container_of(work, struct bmc_device, 2913 remove_work); 2914 int id = bmc->pdev.id; /* Unregister overwrites id */ 2915 2916 msleep(3000); <--- 2917 platform_device_unregister(&bmc->pdev); 2918 ida_simple_remove(&ipmi_bmc_ida, id); 2919 } Use 'remove_work_wq' instead of 'system_wq' to solve this issues. Fixes: b2cfd8ab4add ("ipmi: Rework device id and guid handling to catch changing BMCs") Signed-off-by: Wu Bo <wubo40@huawei.com> Message-Id: <1640070034-56671-1-git-send-email-wubo40@huawei.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-12-17ipmi: fix initialization when workqueue allocation failsThadeu Lima de Souza Cascardo1-6/+9
If the workqueue allocation fails, the driver is marked as not initialized, and timer and panic_notifier will be left registered. Instead of removing those when workqueue allocation fails, do the workqueue initialization before doing it, and cleanup srcu_struct if it fails. Fixes: 1d49eb91e86e ("ipmi: Move remove_work to dedicated workqueue") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Cc: Corey Minyard <cminyard@mvista.com> Cc: Ioanna Alifieraki <ioanna-maria.alifieraki@canonical.com> Cc: stable@vger.kernel.org Message-Id: <20211217154410.1228673-2-cascardo@canonical.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-12-17ipmi: bail out if init_srcu_struct failsThadeu Lima de Souza Cascardo1-1/+3
In case, init_srcu_struct fails (because of memory allocation failure), we might proceed with the driver initialization despite srcu_struct not being entirely initialized. Fixes: 913a89f009d9 ("ipmi: Don't initialize anything in the core until something uses it") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Cc: Corey Minyard <cminyard@mvista.com> Cc: stable@vger.kernel.org Message-Id: <20211217154410.1228673-1-cascardo@canonical.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-12-08ipmi: ssif: initialize ssif_info->client earlyMian Yousaf Kaukab1-3/+4
During probe ssif_info->client is dereferenced in error path. However, it is set when some of the error checking has already been done. This causes following kernel crash if an error path is taken: [ 30.645593][ T674] ipmi_ssif 0-000e: ipmi_ssif: Not probing, Interface already present [ 30.657616][ T674] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000088 ... [ 30.657723][ T674] pc : __dev_printk+0x28/0xa0 [ 30.657732][ T674] lr : _dev_err+0x7c/0xa0 ... [ 30.657772][ T674] Call trace: [ 30.657775][ T674] __dev_printk+0x28/0xa0 [ 30.657778][ T674] _dev_err+0x7c/0xa0 [ 30.657781][ T674] ssif_probe+0x548/0x900 [ipmi_ssif 62ce4b08badc1458fd896206d9ef69a3c31f3d3e] [ 30.657791][ T674] i2c_device_probe+0x37c/0x3c0 ... Initialize ssif_info->client before any error path can be taken. Clear i2c_client data in the error path to prevent the dangling pointer from leaking. Fixes: c4436c9149c5 ("ipmi_ssif: avoid registering duplicate ssif interface") Cc: stable@vger.kernel.org # 5.4.x Suggested-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Mian Yousaf Kaukab <ykaukab@suse.de> Message-Id: <20211208093239.4432-1-ykaukab@suse.de> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-11-25ipmi:ipmb: Fix unknown command responseCorey Minyard1-3/+5
More missed changes, the response back to another system sending a command that had no user to handle it wasn't formatted properly. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-11-25ipmi: fix IPMI_SMI_MSG_TYPE_IPMB_DIRECT response length checkingCorey Minyard1-4/+15
A couple of issues: The tested data sizes are wrong; during the design that changed and this got missed. The formatting of the reponse couldn't use the normal one, it has to be an IPMB formatted response. Reported-by: Jakub Kicinski <kuba@kernel.org> Fixes: 059747c245f0 ("ipmi: Add support for IPMB direct messages") Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-11-25ipmi: fix oob access due to uninit smi_msg typeJakub Kicinski1-0/+1
We're hitting OOB accesses in handle_ipmb_direct_rcv_rsp() (memcpy of size -1) after user space generates a message. Looks like the message is incorrectly assumed to be of the new IPMB type, because type is never set and message is allocated with kmalloc() not kzalloc(). Fixes: 059747c245f0 ("ipmi: Add support for IPMB direct messages") Signed-off-by: Jakub Kicinski <kuba@kernel.org> Message-Id: <20211124210323.1950976-1-kuba@kernel.org> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-11-23ipmi: msghandler: Make symbol 'remove_work_wq' staticWei Yongjun1-1/+1
The sparse tool complains as follows: drivers/char/ipmi/ipmi_msghandler.c:194:25: warning: symbol 'remove_work_wq' was not declared. Should it be static? This symbol is not used outside of ipmi_msghandler.c, so marks it static. Fixes: 1d49eb91e86e ("ipmi: Move remove_work to dedicated workqueue") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Message-Id: <20211123083618.2366808-1-weiyongjun1@huawei.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-11-15ipmi: Move remove_work to dedicated workqueueIoanna Alifieraki1-1/+12
Currently when removing an ipmi_user the removal is deferred as a work on the system's workqueue. Although this guarantees the free operation will occur in non atomic context, it can race with the ipmi_msghandler module removal (see [1]) . In case a remove_user work is scheduled for removal and shortly after ipmi_msghandler module is removed we can end up in a situation where the module is removed fist and when the work is executed the system crashes with : BUG: unable to handle page fault for address: ffffffffc05c3450 PF: supervisor instruction fetch in kernel mode PF: error_code(0x0010) - not-present page because the pages of the module are gone. In cleanup_ipmi() there is no easy way to detect if there are any pending works to flush them before removing the module. This patch creates a separate workqueue and schedules the remove_work works on it. When removing the module the workqueue is drained when destroyed to avoid the race. [1] https://bugs.launchpad.net/bugs/1950666 Cc: stable@vger.kernel.org # 5.1 Fixes: 3b9a907223d7 (ipmi: fix sleep-in-atomic in free_user at cleanup SRCU user->release_barrier) Signed-off-by: Ioanna Alifieraki <ioanna-maria.alifieraki@canonical.com> Message-Id: <20211115131645.25116-1-ioanna-maria.alifieraki@canonical.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-10-29ipmi: kcs_bmc: Fix a memory leak in the error handling path of 'kcs_bmc_serio_add_device()'Christophe JAILLET1-1/+3
In the unlikely event where 'devm_kzalloc()' fails and 'kzalloc()' succeeds, 'port' would be leaking. Test each allocation separately to avoid the leak. Fixes: 3a3d2f6a4c64 ("ipmi: kcs_bmc: Add serio adaptor") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Message-Id: <ecbfa15e94e64f4b878ecab1541ea46c74807670.1631048724.git.christophe.jaillet@wanadoo.fr> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-10-21char: ipmi: replace snprintf in show functions with sysfs_emitYe Guojin3-16/+16
coccicheck complains about the use of snprintf() in sysfs show functions: WARNING use scnprintf or sprintf Use sysfs_emit instead of scnprintf, snprintf or sprintf makes more sense. Reported-by: Zeal Robot <zealci@zte.com.cn> Signed-off-by: Ye Guojin <ye.guojin@zte.com.cn> Message-Id: <20211021110608.1060260-1-ye.guojin@zte.com.cn> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-10-14ipmi: ipmb: fix dependencies to eliminate build errorRandy Dunlap1-1/+1
When CONFIG_I2C=m, CONFIG_I2C_SLAVE=y (bool), and CONFIG_IPMI_IPMB=y, the build fails with: ld: drivers/char/ipmi/ipmi_ipmb.o: in function `ipmi_ipmb_remove': ipmi_ipmb.c:(.text+0x6b): undefined reference to `i2c_slave_unregister' ld: drivers/char/ipmi/ipmi_ipmb.o: in function `ipmi_ipmb_thread': ipmi_ipmb.c:(.text+0x2a4): undefined reference to `i2c_transfer' ld: drivers/char/ipmi/ipmi_ipmb.o: in function `ipmi_ipmb_probe': ipmi_ipmb.c:(.text+0x646): undefined reference to `i2c_slave_register' ld: drivers/char/ipmi/ipmi_ipmb.o: in function `ipmi_ipmb_driver_init': ipmi_ipmb.c:(.init.text+0xa): undefined reference to `i2c_register_driver' ld: drivers/char/ipmi/ipmi_ipmb.o: in function `ipmi_ipmb_driver_exit': ipmi_ipmb.c:(.exit.text+0x8): undefined reference to `i2c_del_driver' This is due to having a tristate depending on a bool symbol. By adding I2C (tristate) as a dependency, the desired dependencies are met, causing IPMI_IPMB to be changed from =y to =m: -CONFIG_IPMI_IPMB=y +CONFIG_IPMI_IPMB=m Fixes: 63c4eb347164 ("ipmi:ipmb: Add initial support for IPMI over IPMB") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: Corey Minyard <minyard@acm.org> Cc: openipmi-developer@lists.sourceforge.net Cc: Arnd Bergmann <arnd@arndb.de> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Message-Id: <20211012204416.23108-1-rdunlap@infradead.org> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-10-14ipmi:ipmb: Add OF supportCorey Minyard1-5/+34
Add direct OF support for fetching control parameters from the device tree. Make it work like the device tree entries for the other IPMI devices. Also add documentation for this. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-10-07ipmi: bt: Add ast2600 compatible stringJoel Stanley1-0/+1
The AST2600 has the same register set as the previous generation SoCs. Signed-off-by: Joel Stanley <joel@jms.id.au> Acked-by: Rob Herring <robh@kernel.org> Message-Id: <20210903015314.177987-1-joel@jms.id.au> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-10-06ipmi: bt-bmc: Use registers directlyJoel Stanley1-52/+16
This driver was originally written to use the regmap abstraction with no clear benefit. As the registers are always mmio and there is no sharing of the region with other devices, we can safely read and write without the locking that regmap provides. This reduces the code size of the driver by about 25%. Signed-off-by: Joel Stanley <joel@jms.id.au> Message-Id: <20210903051039.307991-1-joel@jms.id.au> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-10-05ipmi: ipmb: Fix off-by-one size check on rcvlenColin Ian King1-1/+1
There is an off-by-one bounds check on the rcvlen causing a potential out of bounds write on iidev->rcvmsg. Fix this by using the >= operator on the bounds check rather than the > operator. Addresses-Coverity: ("Out-of-bounds write") Fixes: 0ba0c3c5d1c1 ("ipmi:ipmb: Add initial support for IPMI over IPMB") Signed-off-by: Colin Ian King <colin.king@canonical.com> Message-Id: <20211005151611.305383-1-colin.king@canonical.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-10-05ipmi:ssif: Use depends on, not select, for I2CCorey Minyard1-1/+1
It's more appropriate here. Suggested-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-10-05ipmi:ipmb: Add initial support for IPMI over IPMBCorey Minyard3-0/+520
This provides access to the management controllers on an IPMB bus to a device sitting on the IPMB bus. It also provides slave capability to respond to received messages on the bus. Signed-off-by: Corey Minyard <minyard@acm.org> Tested-by: Andrew Manley <andrew.manley@sealingtech.com> Reviewed-by: Andrew Manley <andrew.manley@sealingtech.com>
2021-10-05ipmi: Add support for IPMB direct messagesCorey Minyard1-33/+255
An application has come up that has a device sitting right on the IPMB that would like to communicate with the BMC on the IPMB using normal IPMI commands. Sending these commands and handling the responses is easy enough, no modifications are needed to the IPMI infrastructure. But if this is an application that also needs to receive IPMB commands and respond, some way is needed to handle these incoming commands and send the responses. Currently, the IPMI message handler only sends commands to the interface and only receives responses from interface. This change extends the interface to receive commands/responses and send commands/responses. These are formatted differently in support of receiving/sending IPMB messages directly. Signed-off-by: Corey Minyard <minyard@acm.org> Tested-by: Andrew Manley <andrew.manley@sealingtech.com> Reviewed-by: Andrew Manley <andrew.manley@sealingtech.com>
2021-10-05ipmi: Export ipmb_checksum()Corey Minyard1-1/+2
It will be needed by the upcoming ipmb direct addressing. Signed-off-by: Corey Minyard <minyard@acm.org> Tested-by: Andrew Manley <andrew.manley@sealingtech.com> Reviewed-by: Andrew Manley <andrew.manley@sealingtech.com>
2021-10-05ipmi: Check error code before processing BMC responseCorey Minyard1-1/+8
In case an error did occur, print out useful information. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-10-05ipmi:devintf: Return a proper error when recv buffer too smallCorey Minyard1-3/+5
The right error message wasn't being set in one location, and it would return success on a failure. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-10-05ipmi: Disable some operations during a panicCorey Minyard2-8/+19
Don't do kfree or other risky things when oops_in_progress is set. It's easy enough to avoid doing them Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-10-05ipmi:watchdog: Set panic count to proper value on a panicCorey Minyard1-4/+4
You will get two decrements when the messages on a panic are sent, not one, since commit 2033f6858970 ("ipmi: Free receive messages when in an oops") was added, but the watchdog code had a bug where it didn't set the value properly. Reported-by: Anton Lundin <glance@acc.umu.se> Cc: <Stable@vger.kernel.org> # v5.4+ Fixes: 2033f6858970 ("ipmi: Free receive messages when in an oops") Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-09-12Merge tag 'for-linus-5.15-1' of git://github.com/cminyard/linux-ipmiLinus Torvalds1-12/+11
Pull IPMI updates from Corey Minyard: "A couple of very minor fixes for style and rate limiting. Nothing big, but probably needs to go in" * tag 'for-linus-5.15-1' of git://github.com/cminyard/linux-ipmi: char: ipmi: use DEVICE_ATTR helper macro ipmi: rate limit ipmi smi_event failure message
2021-08-30parisc: Make struct parisc_driver::remove() return voidUwe Kleine-König4-9/+7
The caller of this function (parisc_driver_remove() in arch/parisc/kernel/drivers.c) ignores the return value, so better don't return any value at all to not wake wrong expectations in driver authors. The only function that could return a non-zero value before was ipmi_parisc_remove() which returns the return value of ipmi_si_remove_by_dev(). Make this function return void, too, as for all other callers the value is ignored, too. Also fold in a small checkpatch fix for: WARNING: Unnecessary space before function pointer arguments + void (*remove) (struct parisc_device *dev); Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> (for drivers/input) Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> Acked-by: Jiri Slaby <jirislaby@kernel.org> Signed-off-by: Helge Deller <deller@gmx.de>
2021-08-12char: ipmi: use DEVICE_ATTR helper macroDwaipayan Ray1-5/+4
Instead of open coding DEVICE_ATTR, use the helper macro DEVICE_ATTR_RO to replace DEVICE_ATTR with 0444 octal permissions. This was detected as a part of checkpatch evaluation investigating all reports of DEVICE_ATTR_RO warning type. Signed-off-by: Dwaipayan Ray <dwaipayanray1@gmail.com> Message-Id: <20210730062951.84876-1-dwaipayanray1@gmail.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-08-12ipmi: rate limit ipmi smi_event failure messageWen Yang1-7/+7
Sometimes we can't get a valid si_sm_data, and we print an error message accordingly. But the ipmi module seem to like retrying a lot, in which case we flood the kernel log with a lot of messages, eg: [46318019.164726] ipmi_si IPI0001:00: Could not set the global enables: 0xc1. [46318020.109700] ipmi_si IPI0001:00: Could not set the global enables: 0xc1. [46318021.158677] ipmi_si IPI0001:00: Could not set the global enables: 0xc1. [46318022.212598] ipmi_si IPI0001:00: Could not set the global enables: 0xc1. [46318023.258564] ipmi_si IPI0001:00: Could not set the global enables: 0xc1. [46318024.210455] ipmi_si IPI0001:00: Could not set the global enables: 0xc1. [46318025.260473] ipmi_si IPI0001:00: Could not set the global enables: 0xc1. [46318026.308445] ipmi_si IPI0001:00: Could not set the global enables: 0xc1. [46318027.356389] ipmi_si IPI0001:00: Could not set the global enables: 0xc1. [46318028.298288] ipmi_si IPI0001:00: Could not set the global enables: 0xc1. [46318029.363302] ipmi_si IPI0001:00: Could not set the global enables: 0xc1. Signed-off-by: Wen Yang <wenyang@linux.alibaba.com> Cc: Baoyou Xie <baoyou.xie@alibaba-inc.com> Cc: Corey Minyard <minyard@acm.org> Cc: openipmi-developer@lists.sourceforge.net Cc: linux-kernel@vger.kernel.org Message-Id: <20210729093228.77098-1-wenyang@linux.alibaba.com> [Added a missing comma] Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-07-02Merge branch 'akpm' (patches from Andrew)Linus Torvalds1-0/+1
Merge more updates from Andrew Morton: "190 patches. Subsystems affected by this patch series: mm (hugetlb, userfaultfd, vmscan, kconfig, proc, z3fold, zbud, ras, mempolicy, memblock, migration, thp, nommu, kconfig, madvise, memory-hotplug, zswap, zsmalloc, zram, cleanups, kfence, and hmm), procfs, sysctl, misc, core-kernel, lib, lz4, checkpatch, init, kprobes, nilfs2, hfs, signals, exec, kcov, selftests, compress/decompress, and ipc" * emailed patches from Andrew Morton <akpm@linux-foundation.org>: (190 commits) ipc/util.c: use binary search for max_idx ipc/sem.c: use READ_ONCE()/WRITE_ONCE() for use_global_lock ipc: use kmalloc for msg_queue and shmid_kernel ipc sem: use kvmalloc for sem_undo allocation lib/decompressors: remove set but not used variabled 'level' selftests/vm/pkeys: exercise x86 XSAVE init state selftests/vm/pkeys: refill shadow register after implicit kernel write selftests/vm/pkeys: handle negative sys_pkey_alloc() return code selftests/vm/pkeys: fix alloc_random_pkey() to make it really, really random kcov: add __no_sanitize_coverage to fix noinstr for all architectures exec: remove checks in __register_bimfmt() x86: signal: don't do sas_ss_reset() until we are certain that sigframe won't be abandoned hfsplus: report create_date to kstat.btime hfsplus: remove unnecessary oom message nilfs2: remove redundant continue statement in a while-loop kprobes: remove duplicated strong free_insn_page in x86 and s390 init: print out unknown kernel parameters checkpatch: do not complain about positive return values starting with EPOLL checkpatch: improve the indented label test checkpatch: scripts/spdxcheck.py now requires python3 ...
2021-07-01kernel.h: split out panic and oops helpersAndy Shevchenko1-0/+1
kernel.h is being used as a dump for all kinds of stuff for a long time. Here is the attempt to start cleaning it up by splitting out panic and oops helpers. There are several purposes of doing this: - dropping dependency in bug.h - dropping a loop by moving out panic_notifier.h - unload kernel.h from something which has its own domain At the same time convert users tree-wide to use new headers, although for the time being include new header back to kernel.h to avoid twisted indirected includes for existing users. [akpm@linux-foundation.org: thread_info.h needs limits.h] [andriy.shevchenko@linux.intel.com: ia64 fix] Link: https://lkml.kernel.org/r/20210520130557.55277-1-andriy.shevchenko@linux.intel.com Link: https://lkml.kernel.org/r/20210511074137.33666-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org> Co-developed-by: Andrew Morton <akpm@linux-foundation.org> Acked-by: Mike Rapoport <rppt@linux.ibm.com> Acked-by: Corey Minyard <cminyard@mvista.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Kees Cook <keescook@chromium.org> Acked-by: Wei Liu <wei.liu@kernel.org> Acked-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Acked-by: Sebastian Reichel <sre@kernel.org> Acked-by: Luis Chamberlain <mcgrof@kernel.org> Acked-by: Stephen Boyd <sboyd@kernel.org> Acked-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Acked-by: Helge Deller <deller@gmx.de> # parisc Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-06-21ipmi: kcs_bmc_aspeed: Fix less than zero comparison of a unsigned intColin Ian King1-3/+5
The comparisons of the unsigned int hw_type to less than zero always false because it is unsigned. Fix this by using an int for the assignment and less than zero check. Addresses-Coverity: ("Unsigned compared against 0") Fixes: 9d2df9a0ad80 ("ipmi: kcs_bmc_aspeed: Implement KCS SerIRQ configuration") Signed-off-by: Colin Ian King <colin.king@canonical.com> Message-Id: <20210616162913.15259-1-colin.king@canonical.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-06-21ipmi: kcs_bmc_aspeed: Optionally apply status addressAndrew Jeffery1-33/+83
Some Aspeed KCS devices can derive the status register address from the address of the data register. As such, the address of the status register can be implicit in the configuration if desired. On the other hand, sometimes address schemes might be requested that are incompatible with the default addressing scheme. Allow these requests where possible if the devicetree specifies the status register address. Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Chia-Wei Wang <chiawei_wang@aspeedtech.com> Message-Id: <20210608104757.582199-17-andrew@aj.id.au> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-06-21ipmi: kcs_bmc_aspeed: Fix IBFIE typo from datasheetAndrew Jeffery1-12/+12
Input Buffer Full Interrupt Enable (IBFIE) is typoed as IBFIF for some registers in the datasheet. Fix the driver to use the sensible acronym. Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Zev Weiss <zweiss@equinix.com> Message-Id: <20210608104757.582199-16-andrew@aj.id.au> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-06-21ipmi: kcs_bmc_aspeed: Implement KCS SerIRQ configurationAndrew Jeffery1-2/+180
Apply the SerIRQ ID and level/sense behaviours from the devicetree if provided. Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Message-Id: <20210608104757.582199-15-andrew@aj.id.au> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-06-21ipmi: kcs_bmc: Add serio adaptorAndrew Jeffery3-0/+172
kcs_bmc_serio acts as a bridge between the KCS drivers in the IPMI subsystem and the existing userspace interfaces available through the serio subsystem. This is useful when userspace would like to make use of the BMC KCS devices for purposes that aren't IPMI. Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Message-Id: <20210608104757.582199-12-andrew@aj.id.au> Reviewed-by: Zev Weiss <zweiss@equinix.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-06-21ipmi: kcs_bmc: Enable IBF on openAndrew Jeffery3-19/+12
This way devices don't get delivered IRQs when no-one is interested. Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Message-Id: <20210608104757.582199-11-andrew@aj.id.au> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-06-21ipmi: kcs_bmc: Allow clients to control KCS IRQ stateAndrew Jeffery6-57/+131
Add a mechanism for controlling whether the client associated with a KCS device will receive Input Buffer Full (IBF) and Output Buffer Empty (OBE) events. This enables an abstract implementation of poll() for KCS devices. A wart in the implementation is that the ASPEED KCS devices don't support an OBE interrupt for the BMC. Instead we pretend it has one by polling the status register waiting for the Output Buffer Full (OBF) bit to clear, and generating an event when OBE is observed. Cc: CS20 KWLiu <KWLIU@nuvoton.com> Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Zev Weiss <zweiss@equinix.com> Message-Id: <20210608104757.582199-10-andrew@aj.id.au> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-06-21ipmi: kcs_bmc: Decouple the IPMI chardev from the coreAndrew Jeffery5-13/+128
Now that we have untangled the data-structures, split the userspace interface out into its own module. Userspace interfaces and drivers are registered to the KCS BMC core to support arbitrary binding of either. Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Message-Id: <20210608104757.582199-9-andrew@aj.id.au> Reviewed-by: Zev Weiss <zweiss@equinix.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-06-21ipmi: kcs_bmc: Strip private client data from struct kcs_bmcAndrew Jeffery7-294/+367
Move all client-private data out of `struct kcs_bmc` into the KCS client implementation. With this change the KCS BMC core code now only concerns itself with abstract `struct kcs_bmc` and `struct kcs_bmc_client` types, achieving expected separation of concerns. Further, the change clears the path for implementation of alternative userspace interfaces. The chardev data-structures are rearranged in the same manner applied to the KCS device driver data-structures in an earlier patch - `struct kcs_bmc_client` is embedded in the client's private data and we exploit container_of() to translate as required. Finally, now that it is free of client data, `struct kcs_bmc` is renamed to `struct kcs_bmc_device` to contrast `struct kcs_bmc_client`. Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Zev Weiss <zweiss@equinix.com> Message-Id: <20210608104757.582199-8-andrew@aj.id.au> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-06-21ipmi: kcs_bmc: Split headers into device and clientAndrew Jeffery7-52/+117
Strengthen the distinction between code that abstracts the implementation of the KCS behaviours (device drivers) and code that exploits KCS behaviours (clients). Neither needs to know about the APIs required by the other, so provide separate headers. Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Message-Id: <20210608104757.582199-7-andrew@aj.id.au> Reviewed-by: Zev Weiss <zweiss@equinix.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-06-21ipmi: kcs_bmc: Turn the driver data-structures inside-outAndrew Jeffery5-67/+110
Make the KCS device drivers responsible for allocating their own memory. Until now the private data for the device driver was allocated internal to the private data for the chardev interface. This coupling required the slightly awkward API of passing through the struct size for the driver private data to the chardev constructor, and then retrieving a pointer to the driver private data from the allocated chardev memory. In addition to being awkward, the arrangement prevents the implementation of alternative userspace interfaces as the device driver private data is not independent. Peel a layer off the onion and turn the data-structures inside out by exploiting container_of() and embedding `struct kcs_device` in the driver private data. Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Zev Weiss <zweiss@equinix.com> Message-Id: <20210608104757.582199-6-andrew@aj.id.au> Signed-off-by: Corey Minyard <cminyard@mvista.com>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.