<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/drivers/char/ipmi, branch v3.12.64</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>ipmi: move timer init to before irq is setup</title>
<updated>2016-01-25T14:15:42+00:00</updated>
<author>
<name>Jan Stancek</name>
<email>jstancek@redhat.com</email>
</author>
<published>2015-12-08T18:57:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=e45713934b8ed19373443d74eb4ac4c0642b3e68'/>
<id>e45713934b8ed19373443d74eb4ac4c0642b3e68</id>
<content type='text'>
commit 27f972d3e00b50639deb4cc1392afaeb08d3cecc upstream.

We encountered a panic on boot in ipmi_si on a dell per320 due to an
uninitialized timer as follows.

static int smi_start_processing(void       *send_info,
                                ipmi_smi_t intf)
{
        /* Try to claim any interrupts. */
        if (new_smi-&gt;irq_setup)
                new_smi-&gt;irq_setup(new_smi);

 --&gt; IRQ arrives here and irq handler tries to modify uninitialized timer

    which triggers BUG_ON(!timer-&gt;function) in __mod_timer().

 Call Trace:
   &lt;IRQ&gt;
   [&lt;ffffffffa0532617&gt;] start_new_msg+0x47/0x80 [ipmi_si]
   [&lt;ffffffffa053269e&gt;] start_check_enables+0x4e/0x60 [ipmi_si]
   [&lt;ffffffffa0532bd8&gt;] smi_event_handler+0x1e8/0x640 [ipmi_si]
   [&lt;ffffffff810f5584&gt;] ? __rcu_process_callbacks+0x54/0x350
   [&lt;ffffffffa053327c&gt;] si_irq_handler+0x3c/0x60 [ipmi_si]
   [&lt;ffffffff810efaf0&gt;] handle_IRQ_event+0x60/0x170
   [&lt;ffffffff810f245e&gt;] handle_edge_irq+0xde/0x180
   [&lt;ffffffff8100fc59&gt;] handle_irq+0x49/0xa0
   [&lt;ffffffff8154643c&gt;] do_IRQ+0x6c/0xf0
   [&lt;ffffffff8100ba53&gt;] ret_from_intr+0x0/0x11

        /* Set up the timer that drives the interface. */
        setup_timer(&amp;new_smi-&gt;si_timer, smi_timeout, (long)new_smi);

The following patch fixes the problem.

To: Openipmi-developer@lists.sourceforge.net
To: Corey Minyard &lt;minyard@acm.org&gt;
CC: linux-kernel@vger.kernel.org

Signed-off-by: Jan Stancek &lt;jstancek@redhat.com&gt;
Signed-off-by: Tony Camuso &lt;tcamuso@redhat.com&gt;
Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Jiri Slaby &lt;jslaby@suse.cz&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 27f972d3e00b50639deb4cc1392afaeb08d3cecc upstream.

We encountered a panic on boot in ipmi_si on a dell per320 due to an
uninitialized timer as follows.

static int smi_start_processing(void       *send_info,
                                ipmi_smi_t intf)
{
        /* Try to claim any interrupts. */
        if (new_smi-&gt;irq_setup)
                new_smi-&gt;irq_setup(new_smi);

 --&gt; IRQ arrives here and irq handler tries to modify uninitialized timer

    which triggers BUG_ON(!timer-&gt;function) in __mod_timer().

 Call Trace:
   &lt;IRQ&gt;
   [&lt;ffffffffa0532617&gt;] start_new_msg+0x47/0x80 [ipmi_si]
   [&lt;ffffffffa053269e&gt;] start_check_enables+0x4e/0x60 [ipmi_si]
   [&lt;ffffffffa0532bd8&gt;] smi_event_handler+0x1e8/0x640 [ipmi_si]
   [&lt;ffffffff810f5584&gt;] ? __rcu_process_callbacks+0x54/0x350
   [&lt;ffffffffa053327c&gt;] si_irq_handler+0x3c/0x60 [ipmi_si]
   [&lt;ffffffff810efaf0&gt;] handle_IRQ_event+0x60/0x170
   [&lt;ffffffff810f245e&gt;] handle_edge_irq+0xde/0x180
   [&lt;ffffffff8100fc59&gt;] handle_irq+0x49/0xa0
   [&lt;ffffffff8154643c&gt;] do_IRQ+0x6c/0xf0
   [&lt;ffffffff8100ba53&gt;] ret_from_intr+0x0/0x11

        /* Set up the timer that drives the interface. */
        setup_timer(&amp;new_smi-&gt;si_timer, smi_timeout, (long)new_smi);

The following patch fixes the problem.

To: Openipmi-developer@lists.sourceforge.net
To: Corey Minyard &lt;minyard@acm.org&gt;
CC: linux-kernel@vger.kernel.org

Signed-off-by: Jan Stancek &lt;jstancek@redhat.com&gt;
Signed-off-by: Tony Camuso &lt;tcamuso@redhat.com&gt;
Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Jiri Slaby &lt;jslaby@suse.cz&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ipmi: fix timeout calculation when bmc is disconnected</title>
<updated>2015-08-19T06:36:51+00:00</updated>
<author>
<name>Xie XiuQi</name>
<email>xiexiuqi@huawei.com</email>
</author>
<published>2014-01-24T20:00:52+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=1602b97c0de33a0e2152b6a07ff110b607b87122'/>
<id>1602b97c0de33a0e2152b6a07ff110b607b87122</id>
<content type='text'>
commit e21404dc0ac7ac971c1e36274b48bb460463f4e5 upstream.

Loading ipmi_si module while bmc is disconnected, we found the timeout
is longer than 5 secs.  Actually it takes about 3 mins and 20
secs.(HZ=250)

error message as below:
  Dec 12 19:08:59 linux kernel: IPMI BT: timeout in RD_WAIT [ ] 1 retries left
  Dec 12 19:08:59 linux kernel: BT: write 4 bytes seq=0x01 03 18 00 01
  [...]
  Dec 12 19:12:19 linux kernel: IPMI BT: timeout in RD_WAIT [ ]
  Dec 12 19:12:19 linux kernel: failed 2 retries, sending error response
  Dec 12 19:12:19 linux kernel: IPMI: BT reset (takes 5 secs)
  Dec 12 19:12:19 linux kernel: IPMI BT: flag reset [ ]

Function wait_for_msg_done() use schedule_timeout_uninterruptible(1) to
sleep 1 tick, so we should subtract jiffies_to_usecs(1) instead of 100
usecs from timeout.

Reported-by: Hu Shiyuan &lt;hushiyuan@huawei.com&gt;
Signed-off-by: Xie XiuQi &lt;xiexiuqi@huawei.com&gt;
Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Jiri Slaby &lt;jslaby@suse.cz&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit e21404dc0ac7ac971c1e36274b48bb460463f4e5 upstream.

Loading ipmi_si module while bmc is disconnected, we found the timeout
is longer than 5 secs.  Actually it takes about 3 mins and 20
secs.(HZ=250)

error message as below:
  Dec 12 19:08:59 linux kernel: IPMI BT: timeout in RD_WAIT [ ] 1 retries left
  Dec 12 19:08:59 linux kernel: BT: write 4 bytes seq=0x01 03 18 00 01
  [...]
  Dec 12 19:12:19 linux kernel: IPMI BT: timeout in RD_WAIT [ ]
  Dec 12 19:12:19 linux kernel: failed 2 retries, sending error response
  Dec 12 19:12:19 linux kernel: IPMI: BT reset (takes 5 secs)
  Dec 12 19:12:19 linux kernel: IPMI BT: flag reset [ ]

Function wait_for_msg_done() use schedule_timeout_uninterruptible(1) to
sleep 1 tick, so we should subtract jiffies_to_usecs(1) instead of 100
usecs from timeout.

Reported-by: Hu Shiyuan &lt;hushiyuan@huawei.com&gt;
Signed-off-by: Xie XiuQi &lt;xiexiuqi@huawei.com&gt;
Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Jiri Slaby &lt;jslaby@suse.cz&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ipmi: Reset the KCS timeout when starting error recovery</title>
<updated>2014-06-06T09:40:22+00:00</updated>
<author>
<name>Corey Minyard</name>
<email>cminyard@mvista.com</email>
</author>
<published>2014-04-14T14:46:52+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=e818ab1909b45811829875764d6a78041f303c09'/>
<id>e818ab1909b45811829875764d6a78041f303c09</id>
<content type='text'>
commit eb6d78ec213e6938559b801421d64714dafcf4b2 upstream.

The OBF timer in KCS was not reset in one situation when error recovery
was started, resulting in an immediate timeout.

Reported-by: Bodo Stroesser &lt;bstroesser@ts.fujitsu.com&gt;
Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Jiri Slaby &lt;jslaby@suse.cz&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit eb6d78ec213e6938559b801421d64714dafcf4b2 upstream.

The OBF timer in KCS was not reset in one situation when error recovery
was started, resulting in an immediate timeout.

Reported-by: Bodo Stroesser &lt;bstroesser@ts.fujitsu.com&gt;
Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Jiri Slaby &lt;jslaby@suse.cz&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ipmi: Fix a race restarting the timer</title>
<updated>2014-05-05T11:39:23+00:00</updated>
<author>
<name>Bodo Stroesser</name>
<email>bstroesser@ts.fujitsu.com</email>
</author>
<published>2014-04-14T14:46:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=10083c00587485c79d86b5c425464418cfc3c586'/>
<id>10083c00587485c79d86b5c425464418cfc3c586</id>
<content type='text'>
commit 48e8ac2979920ffa39117e2d725afa3a749bfe8d upstream.

With recent changes it is possible for the timer handler to detect an
idle interface and not start the timer, but the thread to start an
operation at the same time.  The thread will not start the timer in that
instance, resulting in the timer not running.

Instead, move all timer operations under the lock and start the timer in
the thread if it detect non-idle and the timer is not already running.
Moving under locks allows the last timeout to be set in both the thread
and the timer.  'Timer is not running' means that the timer is not
pending and smi_timeout() is not running.  So we need a flag to detect
this correctly.

Also fix a few other timeout bugs: setting the last timeout when the
interrupt has to be disabled and the timer started, and setting the last
timeout in check_start_timer_thread possibly racing with the timer

Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Bodo Stroesser &lt;bstroesser@ts.fujitsu.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Jiri Slaby &lt;jslaby@suse.cz&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 48e8ac2979920ffa39117e2d725afa3a749bfe8d upstream.

With recent changes it is possible for the timer handler to detect an
idle interface and not start the timer, but the thread to start an
operation at the same time.  The thread will not start the timer in that
instance, resulting in the timer not running.

Instead, move all timer operations under the lock and start the timer in
the thread if it detect non-idle and the timer is not already running.
Moving under locks allows the last timeout to be set in both the thread
and the timer.  'Timer is not running' means that the timer is not
pending and smi_timeout() is not running.  So we need a flag to detect
this correctly.

Also fix a few other timeout bugs: setting the last timeout when the
interrupt has to be disabled and the timer started, and setting the last
timeout in check_start_timer_thread possibly racing with the timer

Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Bodo Stroesser &lt;bstroesser@ts.fujitsu.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Jiri Slaby &lt;jslaby@suse.cz&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Char: ipmi_bt_sm, fix infinite loop</title>
<updated>2014-04-18T08:26:21+00:00</updated>
<author>
<name>Jiri Slaby</name>
<email>jslaby@suse.cz</email>
</author>
<published>2014-04-14T14:46:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=1070f32690efdfef2dc64183dded068ec54266c7'/>
<id>1070f32690efdfef2dc64183dded068ec54266c7</id>
<content type='text'>
commit a94cdd1f4d30f12904ab528152731fb13a812a16 upstream.

In read_all_bytes, we do

  unsigned char i;
  ...
  bt-&gt;read_data[0] = BMC2HOST;
  bt-&gt;read_count = bt-&gt;read_data[0];
  ...
  for (i = 1; i &lt;= bt-&gt;read_count; i++)
    bt-&gt;read_data[i] = BMC2HOST;

If bt-&gt;read_data[0] == bt-&gt;read_count == 255, we loop infinitely in the
'for' loop.  Make 'i' an 'int' instead of 'char' to get rid of the
overflow and finish the loop after 255 iterations every time.

Signed-off-by: Jiri Slaby &lt;jslaby@suse.cz&gt;
Reported-and-debugged-by: Rui Hui Dian &lt;rhdian@novell.com&gt;
Cc: Tomas Cech &lt;tcech@suse.cz&gt;
Cc: Corey Minyard &lt;minyard@acm.org&gt;
Cc: &lt;openipmi-developer@lists.sourceforge.net&gt;
Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Jiri Slaby &lt;jslaby@suse.cz&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit a94cdd1f4d30f12904ab528152731fb13a812a16 upstream.

In read_all_bytes, we do

  unsigned char i;
  ...
  bt-&gt;read_data[0] = BMC2HOST;
  bt-&gt;read_count = bt-&gt;read_data[0];
  ...
  for (i = 1; i &lt;= bt-&gt;read_count; i++)
    bt-&gt;read_data[i] = BMC2HOST;

If bt-&gt;read_data[0] == bt-&gt;read_count == 255, we loop infinitely in the
'for' loop.  Make 'i' an 'int' instead of 'char' to get rid of the
overflow and finish the loop after 255 iterations every time.

Signed-off-by: Jiri Slaby &lt;jslaby@suse.cz&gt;
Reported-and-debugged-by: Rui Hui Dian &lt;rhdian@novell.com&gt;
Cc: Tomas Cech &lt;tcech@suse.cz&gt;
Cc: Corey Minyard &lt;minyard@acm.org&gt;
Cc: &lt;openipmi-developer@lists.sourceforge.net&gt;
Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Jiri Slaby &lt;jslaby@suse.cz&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>BMC support for PARISC machines</title>
<updated>2013-09-05T15:34:32+00:00</updated>
<author>
<name>Thomas Bogendoerfer</name>
<email>tsbogend@alpha.franken.de</email>
</author>
<published>2013-09-05T11:36:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=fdbeb7de700a3c8fc85d7e595a6bf1c92a27c0a1'/>
<id>fdbeb7de700a3c8fc85d7e595a6bf1c92a27c0a1</id>
<content type='text'>
The last line of PARISC machines (C8000, RP34x0, etc.) have a BMC for
controlling temperature, fan speed and other stuff.  The BMC is
connected via a special bus and listed in the firmware device tree.
This change adds support for these BMCs to the IPMI driver.

Signed-off-by: Thomas Bogendoerfer &lt;tsbogend@alpha.franken.de&gt;
Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The last line of PARISC machines (C8000, RP34x0, etc.) have a BMC for
controlling temperature, fan speed and other stuff.  The BMC is
connected via a special bus and listed in the firmware device tree.
This change adds support for these BMCs to the IPMI driver.

Signed-off-by: Thomas Bogendoerfer &lt;tsbogend@alpha.franken.de&gt;
Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Add MODULE_ALIAS for autoloading ipmi driver on ACPI systems</title>
<updated>2013-09-05T15:34:32+00:00</updated>
<author>
<name>Jordan_Hargrave@Dell.com</name>
<email>Jordan_Hargrave@Dell.com</email>
</author>
<published>2013-09-05T11:36:35+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=a798e2d2d7374ba1e35e2244506f56c8363902cf'/>
<id>a798e2d2d7374ba1e35e2244506f56c8363902cf</id>
<content type='text'>
I'd submitted this about a year ago but it never made it upstream.

The latest versions of the kernel drivers for ipmi can use ACPI to
determine the type of BMC device used in the system.  The following
patch adds a module alias so that udev will autoload the ipmi_si driver.

Signed-off-by: Jordan Hargrave &lt;jordan_hargrave@dell.com&gt;
Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
I'd submitted this about a year ago but it never made it upstream.

The latest versions of the kernel drivers for ipmi can use ACPI to
determine the type of BMC device used in the system.  The following
patch adds a module alias so that udev will autoload the ipmi_si driver.

Signed-off-by: Jordan Hargrave &lt;jordan_hargrave@dell.com&gt;
Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ipmi: Initialize locals to avoid warning</title>
<updated>2013-09-05T15:34:31+00:00</updated>
<author>
<name>Corey Minyard</name>
<email>cminyard@mvista.com</email>
</author>
<published>2013-09-05T11:36:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=f0ba93907b5a7c3c87b6baae1260a254ecfd6f98'/>
<id>f0ba93907b5a7c3c87b6baae1260a254ecfd6f98</id>
<content type='text'>
A couple of variables were getting warnings about being uninitialized.
It was a false warning, but initialize them, anyway.

Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
A couple of variables were getting warnings about being uninitialized.
It was a false warning, but initialize them, anyway.

Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ipmi: info leak in compat_ipmi_ioctl()</title>
<updated>2013-09-05T15:34:31+00:00</updated>
<author>
<name>Dan Carpenter</name>
<email>dan.carpenter@oracle.com</email>
</author>
<published>2013-09-05T11:36:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=fa7df37b588f48a1ff6ef005187f3c5c2281df95'/>
<id>fa7df37b588f48a1ff6ef005187f3c5c2281df95</id>
<content type='text'>
On x86_64 there is a 4 byte hole between -&gt;recv_type and -&gt;addr.

Signed-off-by: Dan Carpenter &lt;dan.carpenter@oracle.com&gt;
Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
On x86_64 there is a 4 byte hole between -&gt;recv_type and -&gt;addr.

Signed-off-by: Dan Carpenter &lt;dan.carpenter@oracle.com&gt;
Signed-off-by: Corey Minyard &lt;cminyard@mvista.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>char: Convert use of typedef ctl_table to struct ctl_table</title>
<updated>2013-06-17T23:43:08+00:00</updated>
<author>
<name>Joe Perches</name>
<email>joe@perches.com</email>
</author>
<published>2013-06-14T02:37:35+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=a151427ed086952cc28f1d5f1cda84c33e48e358'/>
<id>a151427ed086952cc28f1d5f1cda84c33e48e358</id>
<content type='text'>
This typedef is unnecessary and should just be removed.

Signed-off-by: Joe Perches &lt;joe@perches.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This typedef is unnecessary and should just be removed.

Signed-off-by: Joe Perches &lt;joe@perches.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
