From 936750fdba4c45e13bbd17f261bb140dd55f5e93 Mon Sep 17 00:00:00 2001 From: Jinhui Guo Date: Tue, 30 Sep 2025 15:42:37 +0800 Subject: ipmi: Fix the race between __scan_channels() and deliver_response() The race window between __scan_channels() and deliver_response() causes the parameters of some channels to be set to 0. 1.[CPUA] __scan_channels() issues an IPMI request and waits with wait_event() until all channels have been scanned. wait_event() internally calls might_sleep(), which might yield the CPU. (Moreover, an interrupt can preempt wait_event() and force the task to yield the CPU.) 2.[CPUB] deliver_response() is invoked when the CPU receives the IPMI response. After processing a IPMI response, deliver_response() directly assigns intf->wchannels to intf->channel_list and sets intf->channels_ready to true. However, not all channels are actually ready for use. 3.[CPUA] Since intf->channels_ready is already true, wait_event() never enters __wait_event(). __scan_channels() immediately clears intf->null_user_handler and exits. 4.[CPUB] Once intf->null_user_handler is set to NULL, deliver_response() ignores further IPMI responses, leaving the remaining channels zero-initialized and unusable. CPUA CPUB ------------------------------- ----------------------------- __scan_channels() intf->null_user_handler = channel_handler; send_channel_info_cmd(intf, 0); wait_event(intf->waitq, intf->channels_ready); do { might_sleep(); deliver_response() channel_handler() intf->channel_list = intf->wchannels + set; intf->channels_ready = true; send_channel_info_cmd(intf, intf->curr_channel); if (condition) break; __wait_event(wq_head, condition); } while(0) intf->null_user_handler = NULL; deliver_response() if (!msg->user) if (intf->null_user_handler) rv = -EINVAL; return rv; ------------------------------- ----------------------------- Fix the race between __scan_channels() and deliver_response() by deferring both the assignment intf->channel_list = intf->wchannels and the flag intf->channels_ready = true until all channels have been successfully scanned or until the IPMI request has failed. Signed-off-by: Jinhui Guo Message-ID: <20250930074239.2353-2-guojinhui.liam@bytedance.com> Signed-off-by: Corey Minyard --- drivers/char/ipmi/ipmi_msghandler.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c index 3700ab4eba3e..d3f84deee451 100644 --- a/drivers/char/ipmi/ipmi_msghandler.c +++ b/drivers/char/ipmi/ipmi_msghandler.c @@ -3417,8 +3417,6 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) intf->channels_ready = true; wake_up(&intf->waitq); } else { - intf->channel_list = intf->wchannels + set; - intf->channels_ready = true; rv = send_channel_info_cmd(intf, intf->curr_channel); } -- cgit v1.2.3 From 6bd30d8fc523fb880b4be548e8501bc0fe8f42d4 Mon Sep 17 00:00:00 2001 From: Jinhui Guo Date: Tue, 30 Sep 2025 15:42:38 +0800 Subject: ipmi: Fix __scan_channels() failing to rescan channels channel_handler() sets intf->channels_ready to true but never clears it, so __scan_channels() skips any rescan. When the BMC firmware changes a rescan is required. Allow it by clearing the flag before starting a new scan. Signed-off-by: Jinhui Guo Message-ID: <20250930074239.2353-3-guojinhui.liam@bytedance.com> Signed-off-by: Corey Minyard --- drivers/char/ipmi/ipmi_msghandler.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c index d3f84deee451..0a886399f9da 100644 --- a/drivers/char/ipmi/ipmi_msghandler.c +++ b/drivers/char/ipmi/ipmi_msghandler.c @@ -599,7 +599,8 @@ static void __ipmi_bmc_unregister(struct ipmi_smi *intf); static int __ipmi_bmc_register(struct ipmi_smi *intf, struct ipmi_device_id *id, bool guid_set, guid_t *guid, int intf_num); -static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id); +static int __scan_channels(struct ipmi_smi *intf, + struct ipmi_device_id *id, bool rescan); static void free_ipmi_user(struct kref *ref) { @@ -2668,7 +2669,7 @@ retry_bmc_lock: if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num)) need_waiter(intf); /* Retry later on an error. */ else - __scan_channels(intf, &id); + __scan_channels(intf, &id, false); if (!intf_set) { @@ -2688,7 +2689,7 @@ retry_bmc_lock: goto out_noprocessing; } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id))) /* Version info changes, scan the channels again. */ - __scan_channels(intf, &bmc->fetch_id); + __scan_channels(intf, &bmc->fetch_id, true); bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY; @@ -3438,10 +3439,17 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) /* * Must be holding intf->bmc_reg_mutex to call this. */ -static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id) +static int __scan_channels(struct ipmi_smi *intf, + struct ipmi_device_id *id, + bool rescan) { int rv; + if (rescan) { + /* Clear channels_ready to force channels rescan. */ + intf->channels_ready = false; + } + if (ipmi_version_major(id) > 1 || (ipmi_version_major(id) == 1 && ipmi_version_minor(id) >= 5)) { @@ -3656,7 +3664,7 @@ int ipmi_add_smi(struct module *owner, } mutex_lock(&intf->bmc_reg_mutex); - rv = __scan_channels(intf, &id); + rv = __scan_channels(intf, &id, false); mutex_unlock(&intf->bmc_reg_mutex); if (rv) goto out_err_bmc_reg; -- cgit v1.2.3 From 1c35d802758d0b2de066990a46570a4f5c9dd513 Mon Sep 17 00:00:00 2001 From: Jinhui Guo Date: Tue, 30 Sep 2025 15:42:39 +0800 Subject: ipmi: Skip channel scan if channels are already marked ready Channels remain static unless the BMC firmware changes. Therefore, rescanning is unnecessary while they are marked ready and no BMC update has occurred. Signed-off-by: Jinhui Guo Message-ID: <20250930074239.2353-4-guojinhui.liam@bytedance.com> Signed-off-by: Corey Minyard --- drivers/char/ipmi/ipmi_msghandler.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c index 0a886399f9da..3f48fc6ab596 100644 --- a/drivers/char/ipmi/ipmi_msghandler.c +++ b/drivers/char/ipmi/ipmi_msghandler.c @@ -3450,6 +3450,10 @@ static int __scan_channels(struct ipmi_smi *intf, intf->channels_ready = false; } + /* Skip channel scan if channels are already marked ready */ + if (intf->channels_ready) + return 0; + if (ipmi_version_major(id) > 1 || (ipmi_version_major(id) == 1 && ipmi_version_minor(id) >= 5)) { -- cgit v1.2.3 From 1986798af745e90669cdac753da5d1e43dc8ebcb Mon Sep 17 00:00:00 2001 From: "Rob Herring (Arm)" Date: Tue, 14 Oct 2025 10:29:34 -0500 Subject: dt-bindings: ipmi: Convert nuvoton,npcm750-kcs-bmc to DT schema Convert the nuvoton,npcm750-kcs-bmc binding to DT schema format. It's a straight-forward conversion. Signed-off-by: Rob Herring (Arm) Message-ID: <20251014152935.3782463-1-robh@kernel.org> Signed-off-by: Corey Minyard --- .../devicetree/bindings/ipmi/npcm7xx-kcs-bmc.txt | 40 ---------------- .../bindings/ipmi/nuvoton,npcm750-kcs-bmc.yaml | 55 ++++++++++++++++++++++ 2 files changed, 55 insertions(+), 40 deletions(-) delete mode 100644 Documentation/devicetree/bindings/ipmi/npcm7xx-kcs-bmc.txt create mode 100644 Documentation/devicetree/bindings/ipmi/nuvoton,npcm750-kcs-bmc.yaml diff --git a/Documentation/devicetree/bindings/ipmi/npcm7xx-kcs-bmc.txt b/Documentation/devicetree/bindings/ipmi/npcm7xx-kcs-bmc.txt deleted file mode 100644 index 4fda76e63396..000000000000 --- a/Documentation/devicetree/bindings/ipmi/npcm7xx-kcs-bmc.txt +++ /dev/null @@ -1,40 +0,0 @@ -* Nuvoton NPCM KCS (Keyboard Controller Style) IPMI interface - -The Nuvoton SOCs (NPCM) are commonly used as BMCs -(Baseboard Management Controllers) and the KCS interface can be -used to perform in-band IPMI communication with their host. - -Required properties: -- compatible : should be one of - "nuvoton,npcm750-kcs-bmc" - "nuvoton,npcm845-kcs-bmc", "nuvoton,npcm750-kcs-bmc" -- interrupts : interrupt generated by the controller -- kcs_chan : The KCS channel number in the controller - -Example: - - lpc_kcs: lpc_kcs@f0007000 { - compatible = "nuvoton,npcm750-lpc-kcs", "simple-mfd", "syscon"; - reg = <0xf0007000 0x40>; - reg-io-width = <1>; - - #address-cells = <1>; - #size-cells = <1>; - ranges = <0x0 0xf0007000 0x40>; - - kcs1: kcs1@0 { - compatible = "nuvoton,npcm750-kcs-bmc"; - reg = <0x0 0x40>; - interrupts = <0 9 4>; - kcs_chan = <1>; - status = "disabled"; - }; - - kcs2: kcs2@0 { - compatible = "nuvoton,npcm750-kcs-bmc"; - reg = <0x0 0x40>; - interrupts = <0 9 4>; - kcs_chan = <2>; - status = "disabled"; - }; - }; diff --git a/Documentation/devicetree/bindings/ipmi/nuvoton,npcm750-kcs-bmc.yaml b/Documentation/devicetree/bindings/ipmi/nuvoton,npcm750-kcs-bmc.yaml new file mode 100644 index 000000000000..fc5df1c5e3bc --- /dev/null +++ b/Documentation/devicetree/bindings/ipmi/nuvoton,npcm750-kcs-bmc.yaml @@ -0,0 +1,55 @@ +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) +%YAML 1.2 +--- +$id: http://devicetree.org/schemas/ipmi/nuvoton,npcm750-kcs-bmc.yaml# +$schema: http://devicetree.org/meta-schemas/core.yaml# + +title: Nuvoton NPCM KCS BMC + +maintainers: + - Avi Fishman + - Tomer Maimon + - Tali Perry + +description: + The Nuvoton SOCs (NPCM) are commonly used as BMCs (Baseboard Management + Controllers) and the KCS interface can be used to perform in-band IPMI + communication with their host. + +properties: + compatible: + oneOf: + - const: nuvoton,npcm750-kcs-bmc + - items: + - enum: + - nuvoton,npcm845-kcs-bmc + - const: nuvoton,npcm750-kcs-bmc + + reg: + maxItems: 1 + + interrupts: + maxItems: 1 + + kcs_chan: + description: The KCS channel number in the controller + $ref: /schemas/types.yaml#/definitions/uint32 + minimum: 1 + maximum: 3 + +required: + - compatible + - reg + - interrupts + - kcs_chan + +additionalProperties: false + +examples: + - | + kcs@0 { + compatible = "nuvoton,npcm750-kcs-bmc"; + reg = <0x0 0x40>; + interrupts = <9 4>; + kcs_chan = <1>; + }; -- cgit v1.2.3 From d27fea27a307656f0b55d6b9ac24caa40c7e4181 Mon Sep 17 00:00:00 2001 From: "Rob Herring (Arm)" Date: Tue, 14 Oct 2025 10:29:47 -0500 Subject: dt-bindings: ipmi: Convert aspeed,ast2400-ibt-bmc to DT schema Convert the aspeed,ast2400-ibt-bmc binding to DT schema format. It's a straight-forward conversion. Signed-off-by: Rob Herring (Arm) Message-ID: <20251014152948.3782738-1-robh@kernel.org> Reviewed-by: Andrew Jeffery Signed-off-by: Corey Minyard --- .../bindings/ipmi/aspeed,ast2400-ibt-bmc.txt | 28 -------------- .../bindings/ipmi/aspeed,ast2400-ibt-bmc.yaml | 44 ++++++++++++++++++++++ 2 files changed, 44 insertions(+), 28 deletions(-) delete mode 100644 Documentation/devicetree/bindings/ipmi/aspeed,ast2400-ibt-bmc.txt create mode 100644 Documentation/devicetree/bindings/ipmi/aspeed,ast2400-ibt-bmc.yaml diff --git a/Documentation/devicetree/bindings/ipmi/aspeed,ast2400-ibt-bmc.txt b/Documentation/devicetree/bindings/ipmi/aspeed,ast2400-ibt-bmc.txt deleted file mode 100644 index 25f86da804b7..000000000000 --- a/Documentation/devicetree/bindings/ipmi/aspeed,ast2400-ibt-bmc.txt +++ /dev/null @@ -1,28 +0,0 @@ -* Aspeed BT (Block Transfer) IPMI interface - -The Aspeed SOCs (AST2400 and AST2500) are commonly used as BMCs -(BaseBoard Management Controllers) and the BT interface can be used to -perform in-band IPMI communication with their host. - -Required properties: - -- compatible : should be one of - "aspeed,ast2400-ibt-bmc" - "aspeed,ast2500-ibt-bmc" - "aspeed,ast2600-ibt-bmc" -- reg: physical address and size of the registers -- clocks: clock for the device - -Optional properties: - -- interrupts: interrupt generated by the BT interface. without an - interrupt, the driver will operate in poll mode. - -Example: - - ibt@1e789140 { - compatible = "aspeed,ast2400-ibt-bmc"; - reg = <0x1e789140 0x18>; - interrupts = <8>; - clocks = <&syscon ASPEED_CLK_GATE_LCLK>; - }; diff --git a/Documentation/devicetree/bindings/ipmi/aspeed,ast2400-ibt-bmc.yaml b/Documentation/devicetree/bindings/ipmi/aspeed,ast2400-ibt-bmc.yaml new file mode 100644 index 000000000000..c4f7cdbbe16b --- /dev/null +++ b/Documentation/devicetree/bindings/ipmi/aspeed,ast2400-ibt-bmc.yaml @@ -0,0 +1,44 @@ +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) +%YAML 1.2 +--- +$id: http://devicetree.org/schemas/ipmi/aspeed,ast2400-ibt-bmc.yaml# +$schema: http://devicetree.org/meta-schemas/core.yaml# + +title: Aspeed Block Transfer (BT) IPMI interface + +maintainers: + - Joel Stanley + +properties: + compatible: + enum: + - aspeed,ast2400-ibt-bmc + - aspeed,ast2500-ibt-bmc + - aspeed,ast2600-ibt-bmc + + reg: + maxItems: 1 + + clocks: + maxItems: 1 + + interrupts: + maxItems: 1 + +required: + - compatible + - reg + - clocks + +additionalProperties: false + +examples: + - | + #include + + bt@1e789140 { + compatible = "aspeed,ast2400-ibt-bmc"; + reg = <0x1e789140 0x18>; + interrupts = <8>; + clocks = <&syscon ASPEED_CLK_GATE_LCLK>; + }; -- cgit v1.2.3 From 35bcedc1a7938da808f54510d8bc7d90cebb6278 Mon Sep 17 00:00:00 2001 From: Binbin Zhou Date: Wed, 15 Oct 2025 17:55:56 +0800 Subject: MAINTAINERS: Add entry on Loongson-2K IPMI driver When merging the Loongson-2K BMC driver, temporarily removed the addition of the IPMI driver entry in MAINTAINERS to avoid conflicts. This needs to be fixed as soon as possible. Now, adding myself as maintainer for the Loongson-2K IPMI driver. Signed-off-by: Binbin Zhou Message-ID: <20251015095556.3736330-1-zhoubinbin@loongson.cn> Signed-off-by: Corey Minyard --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index 46126ce2f968..053295599785 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -14660,6 +14660,7 @@ LOONGSON-2K Board Management Controller (BMC) DRIVER M: Binbin Zhou M: Chong Qiao S: Maintained +F: drivers/char/ipmi/ipmi_si_ls2k.c F: drivers/mfd/ls2k-bmc-core.c LOONGSON EDAC DRIVER -- cgit v1.2.3