summaryrefslogtreecommitdiff
path: root/drivers/char/ipmi
AgeCommit message (Collapse)AuthorFilesLines
2021-12-29ipmi: fix initialization when workqueue allocation failsThadeu Lima de Souza Cascardo1-6/+9
commit 75d70d76cb7b927cace2cb34265d68ebb3306b13 upstream. If the workqueue allocation fails, the driver is marked as not initialized, and timer and panic_notifier will be left registered. Instead of removing those when workqueue allocation fails, do the workqueue initialization before doing it, and cleanup srcu_struct if it fails. Fixes: 1d49eb91e86e ("ipmi: Move remove_work to dedicated workqueue") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Cc: Corey Minyard <cminyard@mvista.com> Cc: Ioanna Alifieraki <ioanna-maria.alifieraki@canonical.com> Cc: stable@vger.kernel.org Message-Id: <20211217154410.1228673-2-cascardo@canonical.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-29ipmi: ssif: initialize ssif_info->client earlyMian Yousaf Kaukab1-3/+4
commit 34f35f8f14bc406efc06ee4ff73202c6fd245d15 upstream. During probe ssif_info->client is dereferenced in error path. However, it is set when some of the error checking has already been done. This causes following kernel crash if an error path is taken: [ 30.645593][ T674] ipmi_ssif 0-000e: ipmi_ssif: Not probing, Interface already present [ 30.657616][ T674] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000088 ... [ 30.657723][ T674] pc : __dev_printk+0x28/0xa0 [ 30.657732][ T674] lr : _dev_err+0x7c/0xa0 ... [ 30.657772][ T674] Call trace: [ 30.657775][ T674] __dev_printk+0x28/0xa0 [ 30.657778][ T674] _dev_err+0x7c/0xa0 [ 30.657781][ T674] ssif_probe+0x548/0x900 [ipmi_ssif 62ce4b08badc1458fd896206d9ef69a3c31f3d3e] [ 30.657791][ T674] i2c_device_probe+0x37c/0x3c0 ... Initialize ssif_info->client before any error path can be taken. Clear i2c_client data in the error path to prevent the dangling pointer from leaking. Fixes: c4436c9149c5 ("ipmi_ssif: avoid registering duplicate ssif interface") Cc: stable@vger.kernel.org # 5.4.x Suggested-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Mian Yousaf Kaukab <ykaukab@suse.de> Message-Id: <20211208093239.4432-1-ykaukab@suse.de> Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-29ipmi: bail out if init_srcu_struct failsThadeu Lima de Souza Cascardo1-1/+3
commit 2b5160b12091285c5aca45980f100a9294af7b04 upstream. In case, init_srcu_struct fails (because of memory allocation failure), we might proceed with the driver initialization despite srcu_struct not being entirely initialized. Fixes: 913a89f009d9 ("ipmi: Don't initialize anything in the core until something uses it") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Cc: Corey Minyard <cminyard@mvista.com> Cc: stable@vger.kernel.org Message-Id: <20211217154410.1228673-1-cascardo@canonical.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-29ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler moduleWu Bo1-1/+1
[ Upstream commit ffb76a86f8096a8206be03b14adda6092e18e275 ] Hi, When testing install and uninstall of ipmi_si.ko and ipmi_msghandler.ko, the system crashed. The log as follows: [ 141.087026] BUG: unable to handle kernel paging request at ffffffffc09b3a5a [ 141.087241] PGD 8fe4c0d067 P4D 8fe4c0d067 PUD 8fe4c0f067 PMD 103ad89067 PTE 0 [ 141.087464] Oops: 0010 [#1] SMP NOPTI [ 141.087580] CPU: 67 PID: 668 Comm: kworker/67:1 Kdump: loaded Not tainted 4.18.0.x86_64 #47 [ 141.088009] Workqueue: events 0xffffffffc09b3a40 [ 141.088009] RIP: 0010:0xffffffffc09b3a5a [ 141.088009] Code: Bad RIP value. [ 141.088009] RSP: 0018:ffffb9094e2c3e88 EFLAGS: 00010246 [ 141.088009] RAX: 0000000000000000 RBX: ffff9abfdb1f04a0 RCX: 0000000000000000 [ 141.088009] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 [ 141.088009] RBP: 0000000000000000 R08: ffff9abfffee3cb8 R09: 00000000000002e1 [ 141.088009] R10: ffffb9094cb73d90 R11: 00000000000f4240 R12: ffff9abfffee8700 [ 141.088009] R13: 0000000000000000 R14: ffff9abfdb1f04a0 R15: ffff9abfdb1f04a8 [ 141.088009] FS: 0000000000000000(0000) GS:ffff9abfffec0000(0000) knlGS:0000000000000000 [ 141.088009] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 141.088009] CR2: ffffffffc09b3a30 CR3: 0000008fe4c0a001 CR4: 00000000007606e0 [ 141.088009] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 141.088009] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 141.088009] PKRU: 55555554 [ 141.088009] Call Trace: [ 141.088009] ? process_one_work+0x195/0x390 [ 141.088009] ? worker_thread+0x30/0x390 [ 141.088009] ? process_one_work+0x390/0x390 [ 141.088009] ? kthread+0x10d/0x130 [ 141.088009] ? kthread_flush_work_fn+0x10/0x10 [ 141.088009] ? ret_from_fork+0x35/0x40] BUG: unable to handle kernel paging request at ffffffffc0b28a5a [ 200.223240] PGD 97fe00d067 P4D 97fe00d067 PUD 97fe00f067 PMD a580cbf067 PTE 0 [ 200.223464] Oops: 0010 [#1] SMP NOPTI [ 200.223579] CPU: 63 PID: 664 Comm: kworker/63:1 Kdump: loaded Not tainted 4.18.0.x86_64 #46 [ 200.224008] Workqueue: events 0xffffffffc0b28a40 [ 200.224008] RIP: 0010:0xffffffffc0b28a5a [ 200.224008] Code: Bad RIP value. [ 200.224008] RSP: 0018:ffffbf3c8e2a3e88 EFLAGS: 00010246 [ 200.224008] RAX: 0000000000000000 RBX: ffffa0799ad6bca0 RCX: 0000000000000000 [ 200.224008] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 [ 200.224008] RBP: 0000000000000000 R08: ffff9fe43fde3cb8 R09: 00000000000000d5 [ 200.224008] R10: ffffbf3c8cb53d90 R11: 00000000000f4240 R12: ffff9fe43fde8700 [ 200.224008] R13: 0000000000000000 R14: ffffa0799ad6bca0 R15: ffffa0799ad6bca8 [ 200.224008] FS: 0000000000000000(0000) GS:ffff9fe43fdc0000(0000) knlGS:0000000000000000 [ 200.224008] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 200.224008] CR2: ffffffffc0b28a30 CR3: 00000097fe00a002 CR4: 00000000007606e0 [ 200.224008] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 200.224008] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 200.224008] PKRU: 55555554 [ 200.224008] Call Trace: [ 200.224008] ? process_one_work+0x195/0x390 [ 200.224008] ? worker_thread+0x30/0x390 [ 200.224008] ? process_one_work+0x390/0x390 [ 200.224008] ? kthread+0x10d/0x130 [ 200.224008] ? kthread_flush_work_fn+0x10/0x10 [ 200.224008] ? ret_from_fork+0x35/0x40 [ 200.224008] kernel fault(0x1) notification starting on CPU 63 [ 200.224008] kernel fault(0x1) notification finished on CPU 63 [ 200.224008] CR2: ffffffffc0b28a5a [ 200.224008] ---[ end trace c82a412d93f57412 ]--- The reason is as follows: T1: rmmod ipmi_si. ->ipmi_unregister_smi() -> ipmi_bmc_unregister() -> __ipmi_bmc_unregister() -> kref_put(&bmc->usecount, cleanup_bmc_device); -> schedule_work(&bmc->remove_work); T2: rmmod ipmi_msghandler. ipmi_msghander module uninstalled, and the module space will be freed. T3: bmc->remove_work doing cleanup the bmc resource. -> cleanup_bmc_work() -> platform_device_unregister(&bmc->pdev); -> platform_device_del(pdev); -> device_del(&pdev->dev); -> kobject_uevent(&dev->kobj, KOBJ_REMOVE); -> kobject_uevent_env() -> dev_uevent() -> if (dev->type && dev->type->name) 'dev->type'(bmc_device_type) pointer space has freed when uninstall ipmi_msghander module, 'dev->type->name' cause the system crash. drivers/char/ipmi/ipmi_msghandler.c: 2820 static const struct device_type bmc_device_type = { 2821 .groups = bmc_dev_attr_groups, 2822 }; Steps to reproduce: Add a time delay in cleanup_bmc_work() function, and uninstall ipmi_si and ipmi_msghandler module. 2910 static void cleanup_bmc_work(struct work_struct *work) 2911 { 2912 struct bmc_device *bmc = container_of(work, struct bmc_device, 2913 remove_work); 2914 int id = bmc->pdev.id; /* Unregister overwrites id */ 2915 2916 msleep(3000); <--- 2917 platform_device_unregister(&bmc->pdev); 2918 ida_simple_remove(&ipmi_bmc_ida, id); 2919 } Use 'remove_work_wq' instead of 'system_wq' to solve this issues. Fixes: b2cfd8ab4add ("ipmi: Rework device id and guid handling to catch changing BMCs") Signed-off-by: Wu Bo <wubo40@huawei.com> Message-Id: <1640070034-56671-1-git-send-email-wubo40@huawei.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-12-08ipmi: msghandler: Make symbol 'remove_work_wq' staticWei Yongjun1-1/+1
commit 5a3ba99b62d8486de0316334e72ac620d4b94fdd upstream. The sparse tool complains as follows: drivers/char/ipmi/ipmi_msghandler.c:194:25: warning: symbol 'remove_work_wq' was not declared. Should it be static? This symbol is not used outside of ipmi_msghandler.c, so marks it static. Fixes: 1d49eb91e86e ("ipmi: Move remove_work to dedicated workqueue") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Message-Id: <20211123083618.2366808-1-weiyongjun1@huawei.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-08ipmi: Move remove_work to dedicated workqueueIoanna Alifieraki1-1/+12
commit 1d49eb91e86e8c1c1614c72e3e958b6b7e2472a9 upstream. Currently when removing an ipmi_user the removal is deferred as a work on the system's workqueue. Although this guarantees the free operation will occur in non atomic context, it can race with the ipmi_msghandler module removal (see [1]) . In case a remove_user work is scheduled for removal and shortly after ipmi_msghandler module is removed we can end up in a situation where the module is removed fist and when the work is executed the system crashes with : BUG: unable to handle page fault for address: ffffffffc05c3450 PF: supervisor instruction fetch in kernel mode PF: error_code(0x0010) - not-present page because the pages of the module are gone. In cleanup_ipmi() there is no easy way to detect if there are any pending works to flush them before removing the module. This patch creates a separate workqueue and schedules the remove_work works on it. When removing the module the workqueue is drained when destroyed to avoid the race. [1] https://bugs.launchpad.net/bugs/1950666 Cc: stable@vger.kernel.org # 5.1 Fixes: 3b9a907223d7 (ipmi: fix sleep-in-atomic in free_user at cleanup SRCU user->release_barrier) Signed-off-by: Ioanna Alifieraki <ioanna-maria.alifieraki@canonical.com> Message-Id: <20211115131645.25116-1-ioanna-maria.alifieraki@canonical.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-18ipmi: Disable some operations during a panicCorey Minyard2-8/+19
[ Upstream commit b36eb5e7b75a756baa64909a176dd4269ee05a8b ] Don't do kfree or other risky things when oops_in_progress is set. It's easy enough to avoid doing them Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-19ipmi/watchdog: Stop watchdog timer when the current action is 'none'Petr Pavlu1-10/+12
commit 2253042d86f57d90a621ac2513a7a7a13afcf809 upstream. When an IPMI watchdog timer is being stopped in ipmi_close() or ipmi_ioctl(WDIOS_DISABLECARD), the current watchdog action is updated to WDOG_TIMEOUT_NONE and _ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB) is called to install this action. The latter function ends up invoking __ipmi_set_timeout() which makes the actual 'Set Watchdog Timer' IPMI request. For IPMI 1.0, this operation results in fully stopping the watchdog timer. For IPMI >= 1.5, function __ipmi_set_timeout() always specifies the "don't stop" flag in the prepared 'Set Watchdog Timer' IPMI request. This causes that the watchdog timer has its action correctly updated to 'none' but the timer continues to run. A problem is that IPMI firmware can then still log an expiration event when the configured timeout is reached, which is unexpected because the watchdog timer was requested to be stopped. The patch fixes this problem by not setting the "don't stop" flag in __ipmi_set_timeout() when the current action is WDOG_TIMEOUT_NONE which results in stopping the watchdog timer. This makes the behaviour for IPMI >= 1.5 consistent with IPMI 1.0. It also matches the logic in __ipmi_heartbeat() which does not allow to reset the watchdog if the current action is WDOG_TIMEOUT_NONE as that would start the timer. Signed-off-by: Petr Pavlu <petr.pavlu@suse.com> Message-Id: <10a41bdc-9c99-089c-8d89-fa98ce5ea080@suse.com> Cc: stable@vger.kernel.org Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-14Merge tag 'for-linus-5.10-1' of git://github.com/cminyard/linux-ipmiLinus Torvalds5-36/+89
Pull IPMI updates from Corey Minyard: "Some minor bug fixes, return values, cleanups of prints, conversion of tasklets to the new API. The biggest change is retrying the initial information fetch from the management controller. If that fails, the iterface is not operational, and one group was having trouble with the management controller not being ready when the OS started up. So a retry was added" * tag 'for-linus-5.10-1' of git://github.com/cminyard/linux-ipmi: ipmi_si: Fix wrong return value in try_smi_init() ipmi: msghandler: Fix a signedness bug ipmi: add retry in try_get_dev_id() ipmi: Clean up some printks ipmi:msghandler: retry to get device id on an error ipmi:sm: Print current state when the state is invalid ipmi: Reset response handler when failing to send the command ipmi: add a newline when printing parameter 'panic_op' by sysfs char: ipmi: convert tasklets to use new tasklet_setup() API
2020-10-05ipmi_si: Fix wrong return value in try_smi_init()Tianjia Zhang1-1/+1
On an error exit path, a negative error code should be returned instead of a positive return value. Fixes: 90b2d4f15ff7 ("ipmi_si: Remove hacks for adding a dummy platform devices") Cc: Corey Minyard <cminyard@mvista.com> Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com> Message-Id: <20201005145212.84435-1-tianjia.zhang@linux.alibaba.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-09-18ipmi: msghandler: Fix a signedness bugDan Carpenter2-2/+2
The type for the completion codes should be unsigned char instead of char. If it is declared as a normal char then the conditions in __get_device_id() are impossible because the IPMI_DEVICE_IN_FW_UPDATE_ERR error codes are higher than 127. drivers/char/ipmi/ipmi_msghandler.c:2449 __get_device_id() warn: impossible condition '(bmc->cc == 209) => ((-128)-127 == 209)' Fixes: f8910ffa81b0 ("ipmi:msghandler: retry to get device id on an error") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Message-Id: <20200918142756.GB909725@mwanda> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-09-16ipmi: add retry in try_get_dev_id()Xianting Tian2-2/+17
Use a retry machanism to give the BMC more opportunities to correctly respond when we receive specific completion codes. This is similar to what is done in __get_device_id(). Signed-off-by: Xianting Tian <tian.xianting@h3c.com> Message-Id: <20200916062129.26129-1-tian.xianting@h3c.com> [Moved GET_DEVICE_ID_MAX_RETRY to include/linux/ipmi.h, reworded some text.] Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-09-15ipmi: Clean up some printksCorey Minyard3-19/+29
Convert to dev_xxx() and fix some verbage. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-09-15ipmi:msghandler: retry to get device id on an errorXianting Tian1-4/+25
We fail to get the BMCS's device id with low probability when loading the ipmi driver and it causes BMC device registration failed. When this issue occurs we got below kernel prints: [Wed Sep 9 19:52:03 2020] ipmi_si IPI0001:00: IPMI message handler: device id demangle failed: -22 [Wed Sep 9 19:52:03 2020] IPMI BT: using default values [Wed Sep 9 19:52:03 2020] IPMI BT: req2rsp=5 secs retries=2 [Wed Sep 9 19:52:03 2020] ipmi_si IPI0001:00: Unable to get the device id: -5 [Wed Sep 9 19:52:04 2020] ipmi_si IPI0001:00: Unable to register device: error -5 When this issue happens, we want to manually unload the driver and try to load it again, but it can't be unloaded by 'rmmod' as it is already 'in use'. We add a print in handle_one_recv_msg(), when this issue happens, the msg we received is "Recv: 1c 01 d5", which means the data_len is 1, data[0] is 0xd5 (completion code), which means "bmc cannot execute command. Command, or request parameter(s), not supported in present state". Debug code: static int handle_one_recv_msg(struct ipmi_smi *intf, struct ipmi_smi_msg *msg) { printk("Recv: %*ph\n", msg->rsp_size, msg->rsp); ... ... } Then in ipmi_demangle_device_id(), it returned '-EINVAL' as 'data_len < 7' and 'data[0] != 0'. We created this patch to retry the get device id when this error happens. We reproduced this issue again and the retry succeed on the first retry, we finally got the correct msg and then all is ok: Recv: 1c 01 00 01 81 05 84 02 af db 07 00 01 00 b9 00 10 00 So use a retry machanism in this patch to give bmc more opportunity to correctly response kernel when we received specific completion codes. Signed-off-by: Xianting Tian <tian.xianting@h3c.com> Message-Id: <20200915071817.4484-1-tian.xianting@h3c.com> [Cleaned up the verbage a bit in the header and prints.] Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-09-15ipmi:sm: Print current state when the state is invalidXianting Tian3-3/+9
Print current state before returning IPMI_NOT_IN_MY_STATE_ERR so we can know where this issue is coming from and possibly fix the state machine. Signed-off-by: Xianting Tian <tian.xianting@h3c.com> Message-Id: <20200915074441.4090-1-tian.xianting@h3c.com> [Converted printk() to pr_xxx().] Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-09-15ipmi: Reset response handler when failing to send the commandMarkus Boehme1-1/+3
When failing to send a command we don't expect a response. Clear the `null_user_handler` like is done in the success path. Signed-off-by: Markus Boehme <markubo@amazon.com> Message-Id: <1599495937-10654-1-git-send-email-markubo@amazon.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-09-03ipmi: add a newline when printing parameter 'panic_op' by sysfsXiongfeng Wang1-4/+4
When I cat ipmi_msghandler parameter 'panic_op' by sysfs, it displays as follows. It's better to add a newline for easy reading. root@(none):/# cat /sys/module/ipmi_msghandler/parameters/panic_op noneroot@(none):/# Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com> Message-Id: <1599130873-2402-1-git-send-email-wangxiongfeng2@huawei.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-08-23treewide: Use fallthrough pseudo-keywordGustavo A. R. Silva1-1/+1
Replace the existing /* fall through */ comments and its variants with the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary fall-through markings when it is the case. [1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
2020-08-18char: ipmi: convert tasklets to use new tasklet_setup() APIAllen Pais1-7/+6
In preparation for unconditionally passing the struct tasklet_struct pointer to all tasklet callbacks, switch to using the new tasklet_setup() and from_tasklet() to pass the tasklet pointer explicitly. Signed-off-by: Romain Perier <romain.perier@gmail.com> Signed-off-by: Allen Pais <allen.lkml@gmail.com> Message-Id: <20200817091617.28119-3-allen.cryptic@gmail.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-07-21ipmi/watchdog: add missing newlines when printing parameters by sysfsXiongfeng Wang1-2/+7
When I cat some ipmi_watchdog parameters by sysfs, it displays as follows. It's better to add a newline for easy reading. root@(none):/# cat /sys/module/ipmi_watchdog/parameters/action resetroot@(none):/# cat /sys/module/ipmi_watchdog/parameters/preaction pre_noneroot@(none):/# cat /sys/module/ipmi_watchdog/parameters/preop preop_noneroot@(none):/# Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com> Message-Id: <1595313309-43881-1-git-send-email-wangxiongfeng2@huawei.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-07-20ipmi: remve duplicate code in __ipmi_bmc_register()Jing Xiangfeng1-2/+0
__ipmi_bmc_register() jumps to the label 'out_free_my_dev_name' in an error path. So we can remove duplicate code in the if (rv). Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com> Message-Id: <20200720080838.148737-1-jingxiangfeng@huawei.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-06-24ipmi: ssif: Remove finished TODO comment about SMBus alertMisono Tomohiro1-5/+0
commit 9162052173d2 ("ipmi: Add alert handling to SSIF") introduces support of SMBus alert. So, just remove TODO comment in order not to confuse future readers. Signed-off-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com> Message-Id: <20200624065405.17653-2-misono.tomohiro@jp.fujitsu.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-06-05Merge tag 'for-linus-5.8-1' of git://github.com/cminyard/linux-ipmiLinus Torvalds4-38/+18
Pull IPMI updates from Corey Minyard: "A few small fixes for things, nothing earth shattering" * tag 'for-linus-5.8-1' of git://github.com/cminyard/linux-ipmi: ipmi:ssif: Remove dynamic platform device handing Try to load acpi_ipmi when an SSIF ACPI IPMI interface is added ipmi_si: Load acpi_ipmi when ACPI IPMI interface added ipmi:bt-bmc: Fix error handling and status check ipmi: Replace guid_copy() with import_guid() where it makes sense ipmi: use vzalloc instead of kmalloc for user creation ipmi:bt-bmc: Fix some format issue of the code ipmi:bt-bmc: Avoid unnecessary check
2020-06-01Merge tag 'docs-5.8' of git://git.lwn.net/linuxLinus Torvalds3-3/+3
Pull documentation updates from Jonathan Corbet: "A fair amount of stuff this time around, dominated by yet another massive set from Mauro toward the completion of the RST conversion. I *really* hope we are getting close to the end of this. Meanwhile, those patches reach pretty far afield to update document references around the tree; there should be no actual code changes there. There will be, alas, more of the usual trivial merge conflicts. Beyond that we have more translations, improvements to the sphinx scripting, a number of additions to the sysctl documentation, and lots of fixes" * tag 'docs-5.8' of git://git.lwn.net/linux: (130 commits) Documentation: fixes to the maintainer-entry-profile template zswap: docs/vm: Fix typo accept_threshold_percent in zswap.rst tracing: Fix events.rst section numbering docs: acpi: fix old http link and improve document format docs: filesystems: add info about efivars content Documentation: LSM: Correct the basic LSM description mailmap: change email for Ricardo Ribalda docs: sysctl/kernel: document unaligned controls Documentation: admin-guide: update bug-hunting.rst docs: sysctl/kernel: document ngroups_max nvdimm: fixes to maintainter-entry-profile Documentation/features: Correct RISC-V kprobes support entry Documentation/features: Refresh the arch support status files Revert "docs: sysctl/kernel: document ngroups_max" docs: move locking-specific documents to locking/ docs: move digsig docs to the security book docs: move the kref doc into the core-api book docs: add IRQ documentation at the core-api book docs: debugging-via-ohci1394.txt: add it to the core-api book docs: fix references for ipmi.rst file ...
2020-05-27ipmi:ssif: Remove dynamic platform device handingCorey Minyard1-22/+1
Platform devices can only come in through the DMI interface, and that will get done before initialization is complete. Therefore there is no reason to hande getting a device in new_ssif_client after initialization. Dynamic entries can still come in through the i2c interfaces, but that's handled differently. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-05-18Try to load acpi_ipmi when an SSIF ACPI IPMI interface is addedCorey Minyard1-0/+1
This is similar to the recent patch for the SI interface, but for SSIF. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-05-18ipmi_si: Load acpi_ipmi when ACPI IPMI interface addedStuart Hayes1-0/+2
Try to load acpi_ipmi when an ACPI IPMI interface is added, so that the ACPI IPMI OpRegion is accessible. Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com> Message-Id: <20200311192409.59923-1-stuart.w.hayes@gmail.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-05-18ipmi:bt-bmc: Fix error handling and status checkTang Bin1-6/+6
If the function platform_get_irq() failed, the negative value returned will not be detected here. So fix error handling in bt_bmc_config_irq(). And in the function bt_bmc_probe(), when get irq failed, it will print error message. So use platform_get_irq_optional() to simplify code. Finally in the function bt_bmc_remove() should make the right status check if get irq failed. Signed-off-by: Shengju Zhang <zhangshengju@cmss.chinamobile.com> Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com> Message-Id: <20200505102906.17196-1-tangbin@cmss.chinamobile.com> [Also set bt_bmc->irq to a negative value if devm_request_irq() fails.] Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-05-18ipmi: Replace guid_copy() with import_guid() where it makes senseAndy Shevchenko1-1/+1
There is a specific API to treat raw data as GUID, i.e. import_guid(). Use it instead of guid_copy() with explicit casting. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Message-Id: <20200422130348.38749-1-andriy.shevchenko@linux.intel.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-05-18ipmi: use vzalloc instead of kmalloc for user creationFeng Tang1-3/+4
We met mulitple times of failure of staring bmc-watchdog, due to the runtime memory allocation failure of order 4. bmc-watchdog: page allocation failure: order:4, mode:0x40cc0(GFP_KERNEL|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0-1 CPU: 1 PID: 2571 Comm: bmc-watchdog Not tainted 5.5.0-00045-g7d6bb61d6188c #1 Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.00.01.0015.110720180833 11/07/2018 Call Trace: dump_stack+0x66/0x8b warn_alloc+0xfe/0x160 __alloc_pages_slowpath+0xd3e/0xd80 __alloc_pages_nodemask+0x2f0/0x340 kmalloc_order+0x18/0x70 kmalloc_order_trace+0x1d/0xb0 ipmi_create_user+0x55/0x2c0 [ipmi_msghandler] ipmi_open+0x72/0x110 [ipmi_devintf] chrdev_open+0xcb/0x1e0 do_dentry_open+0x1ce/0x380 path_openat+0x305/0x14f0 do_filp_open+0x9b/0x110 do_sys_open+0x1bd/0x250 do_syscall_64+0x5b/0x1f0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Using vzalloc/vfree for creating ipmi_user heals the problem Thanks to Stephen Rothwell for finding the vmalloc.h inclusion issue. Signed-off-by: Feng Tang <feng.tang@intel.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-05-18ipmi:bt-bmc: Fix some format issue of the codeTang Bin1-3/+3
Fix some format issue of the code in bt-bmc.c Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com> Signed-off-by: Shengju Zhang <zhangshengju@cmss.chinamobile.com> Message-Id: <20200414141814.19048-1-tangbin@cmss.chinamobile.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-05-18ipmi:bt-bmc: Avoid unnecessary checkTang Bin1-3/+0
bt_bmc_probe() is only called with an openfirmware platform device. Therefore there is no need to check that the passed in device is NULL or that it has an openfirmware node. Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com> Message-Id: <20200408115958.2848-1-tangbin@cmss.chinamobile.com> [Fixed the title up a bit.] Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-05-15docs: fix references for ipmi.rst fileMauro Carvalho Chehab3-3/+3
As this file got moved, fix references for it. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Link: https://lore.kernel.org/r/b6c1ded590f27198de15b16237509128e55fa810.1588345503.git.mchehab+huawei@kernel.org Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-05-14char: ipmi: convert to use i2c_new_client_device()Wolfram Sang1-2/+2
Move away from the deprecated API. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Message-Id: <20200326210958.13051-2-wsa+renesas@sang-engineering.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-04-07ipmi: kcs: Fix aspeed_kcs_probe_of_v1()Dan Carpenter1-1/+1
This needs to return the newly allocated struct but instead it returns zero which leads to an immediate Oops in the caller. Fixes: 09f5f680707e ("ipmi: kcs: aspeed: Implement v2 bindings") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Message-Id: <20200407122149.GA100026@mwanda> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-04-03ipmi: Add missing annotation for ipmi_ssif_lock_cond() and ↵Jules Irenge1-0/+2
ipmi_ssif_unlock_cond() Sparse reports a warning at ipmi_ssif_unlock_cond() and ipmi_ssif_lock_cond() warning: context imbalance in ipmi_ssif_lock_cond() - wrong count at exit warning: context imbalance in ipmi_ssif_unlock_cond() - unexpected unlock The root cause is the missing annotation at ipmi_ssif_unlock_cond() and ipmi_ssif_lock_cond() Add the missing __acquires(&ata_scsi_rbuf_lock) Add the missing __releases(&ata_scsi_rbuf_lock) Signed-off-by: Jules Irenge <jbi.octave@gmail.com> Message-Id: <20200403160505.2832-6-jbi.octave@gmail.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-04-03ipmi: kcs: aspeed: Implement v2 bindingsAndrew Jeffery1-23/+121
The v2 bindings allow us to extract the resources from the devicetree. The table in the driver is retained to derive the channel index, which removes the need for kcs_chan property from the v1 bindings. The v2 bindings allow us to reduce the number of warnings generated by the existing devicetree nodes. Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Haiyue Wang <haiyue.wang@linux.intel.com> Message-Id: <01ef3787e9ddaa9d87cfd55a2ac793053b5a69de.1576462051.git-series.andrew@aj.id.au> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-04-03ipmi: kcs: Finish configuring ASPEED KCS device before enableAndrew Jeffery1-3/+4
The interrupts were configured after the channel was enabled. Configure them beforehand so they will work. Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Haiyue Wang <haiyue.wang@linux.intel.com> Message-Id: <c0aba2c9dfe2d0525e9cefd37995983ead0ec242.1576462051.git-series.andrew@aj.id.au> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-04-03ipmi: fix hung processes in __get_guid()Wen Yang1-2/+2
The wait_event() function is used to detect command completion. When send_guid_cmd() returns an error, smi_send() has not been called to send data. Therefore, wait_event() should not be used on the error path, otherwise it will cause the following warning: [ 1361.588808] systemd-udevd D 0 1501 1436 0x00000004 [ 1361.588813] ffff883f4b1298c0 0000000000000000 ffff883f4b188000 ffff887f7e3d9f40 [ 1361.677952] ffff887f64bd4280 ffffc90037297a68 ffffffff8173ca3b ffffc90000000010 [ 1361.767077] 00ffc90037297ad0 ffff887f7e3d9f40 0000000000000286 ffff883f4b188000 [ 1361.856199] Call Trace: [ 1361.885578] [<ffffffff8173ca3b>] ? __schedule+0x23b/0x780 [ 1361.951406] [<ffffffff8173cfb6>] schedule+0x36/0x80 [ 1362.010979] [<ffffffffa071f178>] get_guid+0x118/0x150 [ipmi_msghandler] [ 1362.091281] [<ffffffff810d5350>] ? prepare_to_wait_event+0x100/0x100 [ 1362.168533] [<ffffffffa071f755>] ipmi_register_smi+0x405/0x940 [ipmi_msghandler] [ 1362.258337] [<ffffffffa0230ae9>] try_smi_init+0x529/0x950 [ipmi_si] [ 1362.334521] [<ffffffffa022f350>] ? std_irq_setup+0xd0/0xd0 [ipmi_si] [ 1362.411701] [<ffffffffa0232bd2>] init_ipmi_si+0x492/0x9e0 [ipmi_si] [ 1362.487917] [<ffffffffa0232740>] ? ipmi_pci_probe+0x280/0x280 [ipmi_si] [ 1362.568219] [<ffffffff810021a0>] do_one_initcall+0x50/0x180 [ 1362.636109] [<ffffffff812231b2>] ? kmem_cache_alloc_trace+0x142/0x190 [ 1362.714330] [<ffffffff811b2ae1>] do_init_module+0x5f/0x200 [ 1362.781208] [<ffffffff81123ca8>] load_module+0x1898/0x1de0 [ 1362.848069] [<ffffffff811202e0>] ? __symbol_put+0x60/0x60 [ 1362.913886] [<ffffffff8130696b>] ? security_kernel_post_read_file+0x6b/0x80 [ 1362.998514] [<ffffffff81124465>] SYSC_finit_module+0xe5/0x120 [ 1363.068463] [<ffffffff81124465>] ? SYSC_finit_module+0xe5/0x120 [ 1363.140513] [<ffffffff811244be>] SyS_finit_module+0xe/0x10 [ 1363.207364] [<ffffffff81003c04>] do_syscall_64+0x74/0x180 Fixes: 50c812b2b951 ("[PATCH] ipmi: add full sysfs support") Signed-off-by: Wen Yang <wenyang@linux.alibaba.com> Cc: Corey Minyard <minyard@acm.org> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: openipmi-developer@lists.sourceforge.net Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org # 2.6.17- Message-Id: <20200403090408.58745-1-wenyang@linux.alibaba.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-03-12drivers: char: ipmi: ipmi_msghandler: Pass lockdep expression to RCU listsAmol Grover1-4/+10
intf->cmd_rcvrs is traversed with list_for_each_entry_rcu outside an RCU read-side critical section but under the protection of intf->cmd_rcvrs_mutex. ipmi_interfaces is traversed using list_for_each_entry_rcu outside an RCU read-side critical section but under the protection of ipmi_interfaces_mutex. Hence, add the corresponding lockdep expression to the list traversal primitive to silence false-positive lockdep warnings, and harden RCU lists. Add macro for the corresponding lockdep expression to make the code clean and concise. Signed-off-by: Amol Grover <frextrite@gmail.com> Message-Id: <20200117132521.31020-1-frextrite@gmail.com> Acked-by: Paul E. McKenney <paulmck@kernel.org> Tested-by: John Garry <john.garry@huawei.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-03-11ipmi_si: Avoid spurious errors for optional IRQsTakashi Iwai1-2/+2
Although the IRQ assignment in ipmi_si driver is optional, platform_get_irq() spews error messages unnecessarily: ipmi_si dmi-ipmi-si.0: IRQ index 0 not found Fix this by switching to platform_get_irq_optional(). Cc: stable@vger.kernel.org # 5.4.x Cc: John Donnelly <john.p.donnelly@oracle.com> Fixes: 7723f4c5ecdb ("driver core: platform: Add an error message to platform_get_irq*()") Reported-and-tested-by: Patrick Vo <patrick.vo@hpe.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Message-Id: <20200205093146.1352-1-tiwai@suse.de> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-01-20drivers: ipmi: fix off-by-one bounds check that leads to a out-of-bounds writeColin Ian King1-1/+1
The end of buffer check is off-by-one since the check is against an index that is pre-incremented before a store to buf[]. Fix this adjusting the bounds check appropriately. Addresses-Coverity: ("Out-of-bounds write") Fixes: 51bd6f291583 ("Add support for IPMB driver") Signed-off-by: Colin Ian King <colin.king@canonical.com> Message-Id: <20200114144031.358003-1-colin.king@canonical.com> Reviewed-by: Asmaa Mnebhi <asmaa@mellanox.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2019-12-23ipmi:ssif: Handle a possible NULL pointer referenceCorey Minyard1-3/+7
In error cases a NULL can be passed to memcpy. The length will always be zero, so it doesn't really matter, but go ahead and check for NULL, anyway, to be more precise and avoid static analysis errors. Reported-by: kbuild test robot <lkp@intel.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2019-12-11drivers: ipmi: Modify max length of IPMB packetVijay Khemka1-1/+1
As per IPMB specification, maximum packet size supported is 255, modified Max length to 240 from 128 to accommodate more data. Signed-off-by: Vijay Khemka <vijaykhemka@fb.com> Message-Id: <20191211190155.1279610-1-vijaykhemka@fb.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2019-12-11drivers: ipmi: Support raw i2c packet in IPMBVijay Khemka1-0/+29
Many IPMB devices don't support smbus protocol and this driver only supports the smbus protocol at the moment. Added support for the i2c protocol as well. There will be a variable "i2c-protocol" passed by the device tree or ACPI table which determines whether the protocol is i2c or smbus. Signed-off-by: Vijay Khemka <vijaykhemka@fb.com> Reviewed-by: Asmaa Mnebhi <asmaa@mellanox.com> Message-Id: <20191211185604.1266063-1-vijaykhemka@fb.com> [IPMB.txt had moved to driver-api/ipmb.rst, I adjusted] Signed-off-by: Corey Minyard <cminyard@mvista.com>
2019-12-01Merge tag 'compat-ioctl-5.5' of ↵Linus Torvalds1-0/+1
git://git.kernel.org:/pub/scm/linux/kernel/git/arnd/playground Pull removal of most of fs/compat_ioctl.c from Arnd Bergmann: "As part of the cleanup of some remaining y2038 issues, I came to fs/compat_ioctl.c, which still has a couple of commands that need support for time64_t. In completely unrelated work, I spent time on cleaning up parts of this file in the past, moving things out into drivers instead. After Al Viro reviewed an earlier version of this series and did a lot more of that cleanup, I decided to try to completely eliminate the rest of it and move it all into drivers. This series incorporates some of Al's work and many patches of my own, but in the end stops short of actually removing the last part, which is the scsi ioctl handlers. I have patches for those as well, but they need more testing or possibly a rewrite" * tag 'compat-ioctl-5.5' of git://git.kernel.org:/pub/scm/linux/kernel/git/arnd/playground: (42 commits) scsi: sd: enable compat ioctls for sed-opal pktcdvd: add compat_ioctl handler compat_ioctl: move SG_GET_REQUEST_TABLE handling compat_ioctl: ppp: move simple commands into ppp_generic.c compat_ioctl: handle PPPIOCGIDLE for 64-bit time_t compat_ioctl: move PPPIOCSCOMPRESS to ppp_generic compat_ioctl: unify copy-in of ppp filters tty: handle compat PPP ioctls compat_ioctl: move SIOCOUTQ out of compat_ioctl.c compat_ioctl: handle SIOCOUTQNSD af_unix: add compat_ioctl support compat_ioctl: reimplement SG_IO handling compat_ioctl: move WDIOC handling into wdt drivers fs: compat_ioctl: move FITRIM emulation into file systems gfs2: add compat_ioctl support compat_ioctl: remove unused convert_in_user macro compat_ioctl: remove last RAID handling code compat_ioctl: remove /dev/raw ioctl translation compat_ioctl: remove PCI ioctl translation compat_ioctl: remove joystick ioctl translation ...
2019-11-27Merge tag 'char-misc-5.5-rc1' of ↵Linus Torvalds1-49/+49
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver updates from Greg KH: "Here is the big set of char/misc and other driver patches for 5.5-rc1 Loads of different things in here, this feels like the catch-all of driver subsystems these days. Full details are in the shortlog, but nothing major overall, just lots of driver updates and additions. All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (198 commits) char: Fix Kconfig indentation, continued habanalabs: add more protection of device during reset habanalabs: flush EQ workers in hard reset habanalabs: make the reset code more consistent habanalabs: expose reset counters via existing INFO IOCTL habanalabs: make code more concise habanalabs: use defines for F/W files habanalabs: remove prints on successful device initialization habanalabs: remove unnecessary checks habanalabs: invalidate MMU cache only once habanalabs: skip VA block list update in reset flow habanalabs: optimize MMU unmap habanalabs: prevent read/write from/to the device during hard reset habanalabs: split MMU properties to PCI/DRAM habanalabs: re-factor MMU masks and documentation habanalabs: type specific MMU cache invalidation habanalabs: re-factor memory module code habanalabs: export uapi defines to user-space habanalabs: don't print error when queues are full habanalabs: increase max jobs number to 512 ...
2019-11-22ipmi: fix ipmb_poll()'s return typeLuc Van Oostenryck1-3/+3
ipmb_poll() is defined as returning 'unsigned int' but the .poll method is declared as returning '__poll_t', a bitwise type. Fix this by using the proper return type and using the EPOLL constants instead of the POLL ones, as required for __poll_t. CC: Corey Minyard <minyard@acm.org> CC: openipmi-developer@lists.sourceforge.net CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com> Message-Id: <20191120000741.30657-1-luc.vanoostenryck@gmail.com> Reviewed-by: Asmaa Mnebhi <asmaa@mellanox.com> Signed-off-by: Corey Miny