Re: [RFC] ipmi: ipmi_ssif: require minimum response length

[ByteDance]

Hi Corey,

Thanks for pointing out the multi-part handling.

After reviewing the source code in detail, I found that the following cases:

    • Multi-part Read Start
    • Multi-part Read Retry
    • Multi-part Read End

all allow byte lengths smaller than 3.

Additionally, the IPMI specification states:
```
If there is no data available, the BMC will NACK the read portion of the SMBus transfer.
```

Given this, my patch is incorrect. I’ll withdraw it and work on fixing the issue properly in the BMC I²C controller instead.

Thanks again for the review and the helpful feedback.

Best regards,
Jian




> 2026年3月4日 10:35，ByteDance <zhangjian.3032@xxxxxxxxxxxxx> 写道：
> 
> Thanks for the review!  I’ll send the v2 patch.
> 
> Jian.
> 
>> 2026年3月3日 21:50，Corey Minyard <corey@xxxxxxxxxxx> 写道：
>> 
>> On Mon, Mar 02, 2026 at 02:17:46PM +0800, Jian Zhang wrote:
>>> A valid IPMI over SSIF response must contain at least three bytes
>>> (NetFn/LUN, Command and Completion Code).
>>> 
>>> Some DMA-only I2C controllers may return short reads instead of a
>>> proper NACK when the response is not ready. Treat such short reads
>>> as incomplete and retry until a full response is received.
>> 
>> Well that's unfriendly of them.
>> 
>> Anyway, I see the issue.  I would ask a couple of things:
>> 
>> Can you add a comment before this "if" statement so people in the future
>> know why it's this way?  Otherwise it's a bit mysterious.
>> 
>> Wouldn't the i2c_smbus_read_block_data() in ipmi_ssif_thread() have the
>> same issue?  We should fix all of these if so.
>> 
>> Thanks,
>> 
>> -corey
>> 
>>> 
>>> Signed-off-by: Jian Zhang <zhangjian.3032@xxxxxxxxxxxxx>
>>> ---
>>> drivers/char/ipmi/ipmi_ssif.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>> 
>>> diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
>>> index 37a5cb5c53f1..64ee939a7a4b 100644
>>> --- a/drivers/char/ipmi/ipmi_ssif.c
>>> +++ b/drivers/char/ipmi/ipmi_ssif.c
>>> @@ -1300,7 +1300,7 @@ static int read_response(struct i2c_client *client, unsigned char *resp)
>>> while (retry_cnt > 0) {
>>> ret = i2c_smbus_read_block_data(client, SSIF_IPMI_RESPONSE,
>>> resp);
>>> - if (ret > 0)
>>> + if (ret >= 3)
>>> break;
>>> msleep(SSIF_MSG_MSEC);
>>> retry_cnt--;
>>> -- 
>>> 2.20.1
>