[RFC] ipmi: ipmi_ssif: require minimum response length

[RFC] ipmi: ipmi_ssif: require minimum response length

[Jian Zhang]

A valid IPMI over SSIF response must contain at least three bytes
(NetFn/LUN, Command and Completion Code).

Some DMA-only I2C controllers may return short reads instead of a
proper NACK when the response is not ready. Treat such short reads
as incomplete and retry until a full response is received.

Signed-off-by: Jian Zhang <zhangjian.3032@bytedance.com>
---
 drivers/char/ipmi/ipmi_ssif.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index 37a5cb5c53f1..64ee939a7a4b 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -1300,7 +1300,7 @@ static int read_response(struct i2c_client *client, unsigned char *resp)
 	while (retry_cnt > 0) {
 		ret = i2c_smbus_read_block_data(client, SSIF_IPMI_RESPONSE,
 						resp);
-		if (ret > 0)
+		if (ret >= 3)
 			break;
 		msleep(SSIF_MSG_MSEC);
 		retry_cnt--;
-- 
2.20.1

Re: [RFC] ipmi: ipmi_ssif: require minimum response length

[Corey Minyard]

On Mon, Mar 02, 2026 at 02:17:46PM +0800, Jian Zhang wrote:
> A valid IPMI over SSIF response must contain at least three bytes
> (NetFn/LUN, Command and Completion Code).
> 
> Some DMA-only I2C controllers may return short reads instead of a
> proper NACK when the response is not ready. Treat such short reads
> as incomplete and retry until a full response is received.

Well that's unfriendly of them.

Anyway, I see the issue.  I would ask a couple of things:

Can you add a comment before this "if" statement so people in the future
know why it's this way?  Otherwise it's a bit mysterious.

Wouldn't the i2c_smbus_read_block_data() in ipmi_ssif_thread() have the
same issue?  We should fix all of these if so.

Thanks,

-corey

> 
> Signed-off-by: Jian Zhang <zhangjian.3032@bytedance.com>
> ---
>  drivers/char/ipmi/ipmi_ssif.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
> index 37a5cb5c53f1..64ee939a7a4b 100644
> --- a/drivers/char/ipmi/ipmi_ssif.c
> +++ b/drivers/char/ipmi/ipmi_ssif.c
> @@ -1300,7 +1300,7 @@ static int read_response(struct i2c_client *client, unsigned char *resp)
>  	while (retry_cnt > 0) {
>  		ret = i2c_smbus_read_block_data(client, SSIF_IPMI_RESPONSE,
>  						resp);
> -		if (ret > 0)
> +		if (ret >= 3)
>  			break;
>  		msleep(SSIF_MSG_MSEC);
>  		retry_cnt--;
> -- 
> 2.20.1

Re: [RFC] ipmi: ipmi_ssif: require minimum response length

[ByteDance]

Thanks for the review!  I’ll send the v2 patch.

Jian.

> 2026年3月3日 21:50，Corey Minyard <corey@minyard.net> 写道：
> 
> On Mon, Mar 02, 2026 at 02:17:46PM +0800, Jian Zhang wrote:
>> A valid IPMI over SSIF response must contain at least three bytes
>> (NetFn/LUN, Command and Completion Code).
>> 
>> Some DMA-only I2C controllers may return short reads instead of a
>> proper NACK when the response is not ready. Treat such short reads
>> as incomplete and retry until a full response is received.
> 
> Well that's unfriendly of them.
> 
> Anyway, I see the issue.  I would ask a couple of things:
> 
> Can you add a comment before this "if" statement so people in the future
> know why it's this way?  Otherwise it's a bit mysterious.
> 
> Wouldn't the i2c_smbus_read_block_data() in ipmi_ssif_thread() have the
> same issue?  We should fix all of these if so.
> 
> Thanks,
> 
> -corey
> 
>> 
>> Signed-off-by: Jian Zhang <zhangjian.3032@bytedance.com>
>> ---
>> drivers/char/ipmi/ipmi_ssif.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>> 
>> diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
>> index 37a5cb5c53f1..64ee939a7a4b 100644
>> --- a/drivers/char/ipmi/ipmi_ssif.c
>> +++ b/drivers/char/ipmi/ipmi_ssif.c
>> @@ -1300,7 +1300,7 @@ static int read_response(struct i2c_client *client, unsigned char *resp)
>> while (retry_cnt > 0) {
>> ret = i2c_smbus_read_block_data(client, SSIF_IPMI_RESPONSE,
>> resp);
>> - if (ret > 0)
>> + if (ret >= 3)
>> break;
>> msleep(SSIF_MSG_MSEC);
>> retry_cnt--;
>> -- 
>> 2.20.1

Re: [RFC] ipmi: ipmi_ssif: require minimum response length

[ByteDance]

Hi Corey,

Thanks for pointing out the multi-part handling.

After reviewing the source code in detail, I found that the following cases:

    • Multi-part Read Start
    • Multi-part Read Retry
    • Multi-part Read End

all allow byte lengths smaller than 3.

Additionally, the IPMI specification states:
```
If there is no data available, the BMC will NACK the read portion of the SMBus transfer.
```

Given this, my patch is incorrect. I’ll withdraw it and work on fixing the issue properly in the BMC I²C controller instead.

Thanks again for the review and the helpful feedback.

Best regards,
Jian




> 2026年3月4日 10:35，ByteDance <zhangjian.3032@bytedance.com> 写道：
> 
> Thanks for the review!  I’ll send the v2 patch.
> 
> Jian.
> 
>> 2026年3月3日 21:50，Corey Minyard <corey@minyard.net> 写道：
>> 
>> On Mon, Mar 02, 2026 at 02:17:46PM +0800, Jian Zhang wrote:
>>> A valid IPMI over SSIF response must contain at least three bytes
>>> (NetFn/LUN, Command and Completion Code).
>>> 
>>> Some DMA-only I2C controllers may return short reads instead of a
>>> proper NACK when the response is not ready. Treat such short reads
>>> as incomplete and retry until a full response is received.
>> 
>> Well that's unfriendly of them.
>> 
>> Anyway, I see the issue.  I would ask a couple of things:
>> 
>> Can you add a comment before this "if" statement so people in the future
>> know why it's this way?  Otherwise it's a bit mysterious.
>> 
>> Wouldn't the i2c_smbus_read_block_data() in ipmi_ssif_thread() have the
>> same issue?  We should fix all of these if so.
>> 
>> Thanks,
>> 
>> -corey
>> 
>>> 
>>> Signed-off-by: Jian Zhang <zhangjian.3032@bytedance.com>
>>> ---
>>> drivers/char/ipmi/ipmi_ssif.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>> 
>>> diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
>>> index 37a5cb5c53f1..64ee939a7a4b 100644
>>> --- a/drivers/char/ipmi/ipmi_ssif.c
>>> +++ b/drivers/char/ipmi/ipmi_ssif.c
>>> @@ -1300,7 +1300,7 @@ static int read_response(struct i2c_client *client, unsigned char *resp)
>>> while (retry_cnt > 0) {
>>> ret = i2c_smbus_read_block_data(client, SSIF_IPMI_RESPONSE,
>>> resp);
>>> - if (ret > 0)
>>> + if (ret >= 3)
>>> break;
>>> msleep(SSIF_MSG_MSEC);
>>> retry_cnt--;
>>> -- 
>>> 2.20.1
>