* [PATCH v2] usb: usb251xb: Lock i2c-bus segment the hub resides
@ 2019-04-25 22:32 ` Serge Semin
0 siblings, 0 replies; 13+ messages in thread
From: Serge Semin @ 2019-04-25 22:32 UTC (permalink / raw)
To: Richard Leitner, Greg Kroah-Hartman; +Cc: Serge Semin, linux-usb, linux-kernel
SMBus slave configuration is activated by CFG_SEL[1:0]=0x1 pins
state. This is the mode the hub is supposed to be to let this driver
work correctly. But a race condition might happen right after reset
is cleared due to CFG_SEL[0] pin being multiplexed with SMBus SCL
function. In case if the reset pin is handled by a i2c GPIO expander,
which is also placed at the same i2c-bus segment as the usb251x
SMB-interface connected to, then the hub reset clearance might
cause the CFG_SEL[0] being latched in unpredictable state. So
sometimes the hub configuration mode might be 0x1 (as expected),
but sometimes being 0x0, which doesn't imply to have the hub SMBus-slave
interface activated and consequently causes this driver failure.
In order to fix the problem we must make sure the GPIO-reset chip doesn't
reside the same i2c-bus segment as the SMBus-interface of the hub. If
it doesn't, we can safely block the segment for the time the reset is
cleared to prevent anyone generating a traffic at the i2c-bus SCL lane
connected to the CFG_SEL[0] pin. But if it does, nothing we can do, so
just return an error. If we locked the i2c-bus segment and tried to
communicate with the GPIO-expander, it would cause a deadlock. If we didn't
lock the i2c-bus segment, it would randomly cause the CFG_SEL[0] bit flip.
Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Changelog v2
- Execute the check code only if GPIOLIB is enabled (reported by
a build robot).
---
drivers/usb/misc/usb251xb.c | 62 +++++++++++++++++++++++++++++++++++++
1 file changed, 62 insertions(+)
diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c
index 04684849d683..cdc80e8c2d8a 100644
--- a/drivers/usb/misc/usb251xb.c
+++ b/drivers/usb/misc/usb251xb.c
@@ -12,6 +12,7 @@
#include <linux/delay.h>
#include <linux/gpio/consumer.h>
+#include <linux/gpio/driver.h>
#include <linux/i2c.h>
#include <linux/module.h>
#include <linux/nls.h>
@@ -222,11 +223,51 @@ static const struct usb251xb_data usb2517i_data = {
.product_str = "USB2517i",
};
+#ifdef CONFIG_GPIOLIB
+static int usb251xb_check_dev_children(struct device *dev, void *child)
+{
+ if (dev->type == &i2c_adapter_type) {
+ return device_for_each_child(dev, child,
+ usb251xb_check_dev_children);
+ }
+
+ return (dev == child);
+}
+
+static int usb251x_check_gpio_chip(struct usb251xb *hub)
+{
+ struct gpio_chip *gc = gpiod_to_chip(hub->gpio_reset);
+ struct i2c_adapter *adap = hub->i2c->adapter;
+ int ret;
+
+ if (!hub->gpio_reset)
+ return 0;
+
+ if (!gc)
+ return -EINVAL;
+
+ ret = usb251xb_check_dev_children(&adap->dev, gc->parent);
+ if (ret) {
+ dev_err(hub->dev, "Reset GPIO chip is at the same i2c-bus\n");
+ return -EINVAL;
+ }
+
+ return 0;
+}
+#else
+static int usb251x_check_gpio_chip(struct usb251xb *hub)
+{
+ return 0;
+}
+#endif
+
static void usb251xb_reset(struct usb251xb *hub, int state)
{
if (!hub->gpio_reset)
return;
+ i2c_lock_bus(hub->i2c->adapter, I2C_LOCK_SEGMENT);
+
gpiod_set_value_cansleep(hub->gpio_reset, state);
/* wait for hub recovery/stabilization */
@@ -234,6 +275,8 @@ static void usb251xb_reset(struct usb251xb *hub, int state)
usleep_range(500, 750); /* >=500us at power on */
else
usleep_range(1, 10); /* >=1us at power down */
+
+ i2c_unlock_bus(hub->i2c->adapter, I2C_LOCK_SEGMENT);
}
static int usb251xb_connect(struct usb251xb *hub)
@@ -621,6 +664,25 @@ static int usb251xb_probe(struct usb251xb *hub)
}
}
+ /*
+ * usb251x SMBus-slave SCL lane is muxed with CFG_SEL0 pin. So if anyone
+ * tries to work with the bus at the moment the hub reset is released,
+ * it may cause an invalid config being latched by usb251x. Particularly
+ * one of the config modes makes the hub loading a default registers
+ * value without SMBus-slave interface activation. If the hub
+ * accidentally gets this mode, this will cause the driver SMBus-
+ * functions failure. Normally we could just lock the SMBus-segment the
+ * hub i2c-interface resides for the device-specific reset timing. But
+ * the GPIO controller, which is used to handle the hub reset, might be
+ * placed at the same i2c-bus segment. In this case an error should be
+ * returned since we can't safely use the GPIO controller to clear the
+ * reset state (it may affect the hub configuration) and we can't lock
+ * the i2c-bus segment (it will cause a deadlock).
+ */
+ err = usb251x_check_gpio_chip(hub);
+ if (err)
+ return err;
+
err = usb251xb_connect(hub);
if (err) {
dev_err(dev, "Failed to connect hub (%d)\n", err);
--
2.21.0
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [v2] usb: usb251xb: Lock i2c-bus segment the hub resides
@ 2019-04-25 22:32 ` Serge Semin
0 siblings, 0 replies; 13+ messages in thread
From: Serge Semin @ 2019-04-25 22:32 UTC (permalink / raw)
To: Richard Leitner, Greg Kroah-Hartman; +Cc: Serge Semin, linux-usb, linux-kernel
SMBus slave configuration is activated by CFG_SEL[1:0]=0x1 pins
state. This is the mode the hub is supposed to be to let this driver
work correctly. But a race condition might happen right after reset
is cleared due to CFG_SEL[0] pin being multiplexed with SMBus SCL
function. In case if the reset pin is handled by a i2c GPIO expander,
which is also placed at the same i2c-bus segment as the usb251x
SMB-interface connected to, then the hub reset clearance might
cause the CFG_SEL[0] being latched in unpredictable state. So
sometimes the hub configuration mode might be 0x1 (as expected),
but sometimes being 0x0, which doesn't imply to have the hub SMBus-slave
interface activated and consequently causes this driver failure.
In order to fix the problem we must make sure the GPIO-reset chip doesn't
reside the same i2c-bus segment as the SMBus-interface of the hub. If
it doesn't, we can safely block the segment for the time the reset is
cleared to prevent anyone generating a traffic at the i2c-bus SCL lane
connected to the CFG_SEL[0] pin. But if it does, nothing we can do, so
just return an error. If we locked the i2c-bus segment and tried to
communicate with the GPIO-expander, it would cause a deadlock. If we didn't
lock the i2c-bus segment, it would randomly cause the CFG_SEL[0] bit flip.
Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Changelog v2
- Execute the check code only if GPIOLIB is enabled (reported by
a build robot).
---
drivers/usb/misc/usb251xb.c | 62 +++++++++++++++++++++++++++++++++++++
1 file changed, 62 insertions(+)
diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c
index 04684849d683..cdc80e8c2d8a 100644
--- a/drivers/usb/misc/usb251xb.c
+++ b/drivers/usb/misc/usb251xb.c
@@ -12,6 +12,7 @@
#include <linux/delay.h>
#include <linux/gpio/consumer.h>
+#include <linux/gpio/driver.h>
#include <linux/i2c.h>
#include <linux/module.h>
#include <linux/nls.h>
@@ -222,11 +223,51 @@ static const struct usb251xb_data usb2517i_data = {
.product_str = "USB2517i",
};
+#ifdef CONFIG_GPIOLIB
+static int usb251xb_check_dev_children(struct device *dev, void *child)
+{
+ if (dev->type == &i2c_adapter_type) {
+ return device_for_each_child(dev, child,
+ usb251xb_check_dev_children);
+ }
+
+ return (dev == child);
+}
+
+static int usb251x_check_gpio_chip(struct usb251xb *hub)
+{
+ struct gpio_chip *gc = gpiod_to_chip(hub->gpio_reset);
+ struct i2c_adapter *adap = hub->i2c->adapter;
+ int ret;
+
+ if (!hub->gpio_reset)
+ return 0;
+
+ if (!gc)
+ return -EINVAL;
+
+ ret = usb251xb_check_dev_children(&adap->dev, gc->parent);
+ if (ret) {
+ dev_err(hub->dev, "Reset GPIO chip is at the same i2c-bus\n");
+ return -EINVAL;
+ }
+
+ return 0;
+}
+#else
+static int usb251x_check_gpio_chip(struct usb251xb *hub)
+{
+ return 0;
+}
+#endif
+
static void usb251xb_reset(struct usb251xb *hub, int state)
{
if (!hub->gpio_reset)
return;
+ i2c_lock_bus(hub->i2c->adapter, I2C_LOCK_SEGMENT);
+
gpiod_set_value_cansleep(hub->gpio_reset, state);
/* wait for hub recovery/stabilization */
@@ -234,6 +275,8 @@ static void usb251xb_reset(struct usb251xb *hub, int state)
usleep_range(500, 750); /* >=500us at power on */
else
usleep_range(1, 10); /* >=1us at power down */
+
+ i2c_unlock_bus(hub->i2c->adapter, I2C_LOCK_SEGMENT);
}
static int usb251xb_connect(struct usb251xb *hub)
@@ -621,6 +664,25 @@ static int usb251xb_probe(struct usb251xb *hub)
}
}
+ /*
+ * usb251x SMBus-slave SCL lane is muxed with CFG_SEL0 pin. So if anyone
+ * tries to work with the bus at the moment the hub reset is released,
+ * it may cause an invalid config being latched by usb251x. Particularly
+ * one of the config modes makes the hub loading a default registers
+ * value without SMBus-slave interface activation. If the hub
+ * accidentally gets this mode, this will cause the driver SMBus-
+ * functions failure. Normally we could just lock the SMBus-segment the
+ * hub i2c-interface resides for the device-specific reset timing. But
+ * the GPIO controller, which is used to handle the hub reset, might be
+ * placed at the same i2c-bus segment. In this case an error should be
+ * returned since we can't safely use the GPIO controller to clear the
+ * reset state (it may affect the hub configuration) and we can't lock
+ * the i2c-bus segment (it will cause a deadlock).
+ */
+ err = usb251x_check_gpio_chip(hub);
+ if (err)
+ return err;
+
err = usb251xb_connect(hub);
if (err) {
dev_err(dev, "Failed to connect hub (%d)\n", err);
^ permalink raw reply related [flat|nested] 13+ messages in thread
* Re: [PATCH v2] usb: usb251xb: Lock i2c-bus segment the hub resides
@ 2019-04-26 10:45 ` Serge Semin
0 siblings, 0 replies; 13+ messages in thread
From: Serge Semin @ 2019-04-26 10:45 UTC (permalink / raw)
To: Richard Leitner, Greg Kroah-Hartman; +Cc: Serge Semin, linux-usb, linux-kernel
On Fri, Apr 26, 2019 at 01:32:56AM +0300, Serge Semin wrote:
Ahh, sorry. Forget about this email. I'll resend it with the valid In-Reply-To
message-id.
-Sergey
> SMBus slave configuration is activated by CFG_SEL[1:0]=0x1 pins
> state. This is the mode the hub is supposed to be to let this driver
> work correctly. But a race condition might happen right after reset
> is cleared due to CFG_SEL[0] pin being multiplexed with SMBus SCL
> function. In case if the reset pin is handled by a i2c GPIO expander,
> which is also placed at the same i2c-bus segment as the usb251x
> SMB-interface connected to, then the hub reset clearance might
> cause the CFG_SEL[0] being latched in unpredictable state. So
> sometimes the hub configuration mode might be 0x1 (as expected),
> but sometimes being 0x0, which doesn't imply to have the hub SMBus-slave
> interface activated and consequently causes this driver failure.
>
> In order to fix the problem we must make sure the GPIO-reset chip doesn't
> reside the same i2c-bus segment as the SMBus-interface of the hub. If
> it doesn't, we can safely block the segment for the time the reset is
> cleared to prevent anyone generating a traffic at the i2c-bus SCL lane
> connected to the CFG_SEL[0] pin. But if it does, nothing we can do, so
> just return an error. If we locked the i2c-bus segment and tried to
> communicate with the GPIO-expander, it would cause a deadlock. If we didn't
> lock the i2c-bus segment, it would randomly cause the CFG_SEL[0] bit flip.
>
> Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> Changelog v2
> - Execute the check code only if GPIOLIB is enabled (reported by
> a build robot).
>
> ---
> drivers/usb/misc/usb251xb.c | 62 +++++++++++++++++++++++++++++++++++++
> 1 file changed, 62 insertions(+)
>
> diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c
> index 04684849d683..cdc80e8c2d8a 100644
> --- a/drivers/usb/misc/usb251xb.c
> +++ b/drivers/usb/misc/usb251xb.c
> @@ -12,6 +12,7 @@
>
> #include <linux/delay.h>
> #include <linux/gpio/consumer.h>
> +#include <linux/gpio/driver.h>
> #include <linux/i2c.h>
> #include <linux/module.h>
> #include <linux/nls.h>
> @@ -222,11 +223,51 @@ static const struct usb251xb_data usb2517i_data = {
> .product_str = "USB2517i",
> };
>
> +#ifdef CONFIG_GPIOLIB
> +static int usb251xb_check_dev_children(struct device *dev, void *child)
> +{
> + if (dev->type == &i2c_adapter_type) {
> + return device_for_each_child(dev, child,
> + usb251xb_check_dev_children);
> + }
> +
> + return (dev == child);
> +}
> +
> +static int usb251x_check_gpio_chip(struct usb251xb *hub)
> +{
> + struct gpio_chip *gc = gpiod_to_chip(hub->gpio_reset);
> + struct i2c_adapter *adap = hub->i2c->adapter;
> + int ret;
> +
> + if (!hub->gpio_reset)
> + return 0;
> +
> + if (!gc)
> + return -EINVAL;
> +
> + ret = usb251xb_check_dev_children(&adap->dev, gc->parent);
> + if (ret) {
> + dev_err(hub->dev, "Reset GPIO chip is at the same i2c-bus\n");
> + return -EINVAL;
> + }
> +
> + return 0;
> +}
> +#else
> +static int usb251x_check_gpio_chip(struct usb251xb *hub)
> +{
> + return 0;
> +}
> +#endif
> +
> static void usb251xb_reset(struct usb251xb *hub, int state)
> {
> if (!hub->gpio_reset)
> return;
>
> + i2c_lock_bus(hub->i2c->adapter, I2C_LOCK_SEGMENT);
> +
> gpiod_set_value_cansleep(hub->gpio_reset, state);
>
> /* wait for hub recovery/stabilization */
> @@ -234,6 +275,8 @@ static void usb251xb_reset(struct usb251xb *hub, int state)
> usleep_range(500, 750); /* >=500us at power on */
> else
> usleep_range(1, 10); /* >=1us at power down */
> +
> + i2c_unlock_bus(hub->i2c->adapter, I2C_LOCK_SEGMENT);
> }
>
> static int usb251xb_connect(struct usb251xb *hub)
> @@ -621,6 +664,25 @@ static int usb251xb_probe(struct usb251xb *hub)
> }
> }
>
> + /*
> + * usb251x SMBus-slave SCL lane is muxed with CFG_SEL0 pin. So if anyone
> + * tries to work with the bus at the moment the hub reset is released,
> + * it may cause an invalid config being latched by usb251x. Particularly
> + * one of the config modes makes the hub loading a default registers
> + * value without SMBus-slave interface activation. If the hub
> + * accidentally gets this mode, this will cause the driver SMBus-
> + * functions failure. Normally we could just lock the SMBus-segment the
> + * hub i2c-interface resides for the device-specific reset timing. But
> + * the GPIO controller, which is used to handle the hub reset, might be
> + * placed at the same i2c-bus segment. In this case an error should be
> + * returned since we can't safely use the GPIO controller to clear the
> + * reset state (it may affect the hub configuration) and we can't lock
> + * the i2c-bus segment (it will cause a deadlock).
> + */
> + err = usb251x_check_gpio_chip(hub);
> + if (err)
> + return err;
> +
> err = usb251xb_connect(hub);
> if (err) {
> dev_err(dev, "Failed to connect hub (%d)\n", err);
> --
> 2.21.0
>
^ permalink raw reply [flat|nested] 13+ messages in thread
* [v2] usb: usb251xb: Lock i2c-bus segment the hub resides
@ 2019-04-26 10:45 ` Serge Semin
0 siblings, 0 replies; 13+ messages in thread
From: Serge Semin @ 2019-04-26 10:45 UTC (permalink / raw)
To: Richard Leitner, Greg Kroah-Hartman; +Cc: Serge Semin, linux-usb, linux-kernel
On Fri, Apr 26, 2019 at 01:32:56AM +0300, Serge Semin wrote:
Ahh, sorry. Forget about this email. I'll resend it with the valid In-Reply-To
message-id.
-Sergey
> SMBus slave configuration is activated by CFG_SEL[1:0]=0x1 pins
> state. This is the mode the hub is supposed to be to let this driver
> work correctly. But a race condition might happen right after reset
> is cleared due to CFG_SEL[0] pin being multiplexed with SMBus SCL
> function. In case if the reset pin is handled by a i2c GPIO expander,
> which is also placed at the same i2c-bus segment as the usb251x
> SMB-interface connected to, then the hub reset clearance might
> cause the CFG_SEL[0] being latched in unpredictable state. So
> sometimes the hub configuration mode might be 0x1 (as expected),
> but sometimes being 0x0, which doesn't imply to have the hub SMBus-slave
> interface activated and consequently causes this driver failure.
>
> In order to fix the problem we must make sure the GPIO-reset chip doesn't
> reside the same i2c-bus segment as the SMBus-interface of the hub. If
> it doesn't, we can safely block the segment for the time the reset is
> cleared to prevent anyone generating a traffic at the i2c-bus SCL lane
> connected to the CFG_SEL[0] pin. But if it does, nothing we can do, so
> just return an error. If we locked the i2c-bus segment and tried to
> communicate with the GPIO-expander, it would cause a deadlock. If we didn't
> lock the i2c-bus segment, it would randomly cause the CFG_SEL[0] bit flip.
>
> Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> Changelog v2
> - Execute the check code only if GPIOLIB is enabled (reported by
> a build robot).
>
> ---
> drivers/usb/misc/usb251xb.c | 62 +++++++++++++++++++++++++++++++++++++
> 1 file changed, 62 insertions(+)
>
> diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c
> index 04684849d683..cdc80e8c2d8a 100644
> --- a/drivers/usb/misc/usb251xb.c
> +++ b/drivers/usb/misc/usb251xb.c
> @@ -12,6 +12,7 @@
>
> #include <linux/delay.h>
> #include <linux/gpio/consumer.h>
> +#include <linux/gpio/driver.h>
> #include <linux/i2c.h>
> #include <linux/module.h>
> #include <linux/nls.h>
> @@ -222,11 +223,51 @@ static const struct usb251xb_data usb2517i_data = {
> .product_str = "USB2517i",
> };
>
> +#ifdef CONFIG_GPIOLIB
> +static int usb251xb_check_dev_children(struct device *dev, void *child)
> +{
> + if (dev->type == &i2c_adapter_type) {
> + return device_for_each_child(dev, child,
> + usb251xb_check_dev_children);
> + }
> +
> + return (dev == child);
> +}
> +
> +static int usb251x_check_gpio_chip(struct usb251xb *hub)
> +{
> + struct gpio_chip *gc = gpiod_to_chip(hub->gpio_reset);
> + struct i2c_adapter *adap = hub->i2c->adapter;
> + int ret;
> +
> + if (!hub->gpio_reset)
> + return 0;
> +
> + if (!gc)
> + return -EINVAL;
> +
> + ret = usb251xb_check_dev_children(&adap->dev, gc->parent);
> + if (ret) {
> + dev_err(hub->dev, "Reset GPIO chip is at the same i2c-bus\n");
> + return -EINVAL;
> + }
> +
> + return 0;
> +}
> +#else
> +static int usb251x_check_gpio_chip(struct usb251xb *hub)
> +{
> + return 0;
> +}
> +#endif
> +
> static void usb251xb_reset(struct usb251xb *hub, int state)
> {
> if (!hub->gpio_reset)
> return;
>
> + i2c_lock_bus(hub->i2c->adapter, I2C_LOCK_SEGMENT);
> +
> gpiod_set_value_cansleep(hub->gpio_reset, state);
>
> /* wait for hub recovery/stabilization */
> @@ -234,6 +275,8 @@ static void usb251xb_reset(struct usb251xb *hub, int state)
> usleep_range(500, 750); /* >=500us at power on */
> else
> usleep_range(1, 10); /* >=1us at power down */
> +
> + i2c_unlock_bus(hub->i2c->adapter, I2C_LOCK_SEGMENT);
> }
>
> static int usb251xb_connect(struct usb251xb *hub)
> @@ -621,6 +664,25 @@ static int usb251xb_probe(struct usb251xb *hub)
> }
> }
>
> + /*
> + * usb251x SMBus-slave SCL lane is muxed with CFG_SEL0 pin. So if anyone
> + * tries to work with the bus at the moment the hub reset is released,
> + * it may cause an invalid config being latched by usb251x. Particularly
> + * one of the config modes makes the hub loading a default registers
> + * value without SMBus-slave interface activation. If the hub
> + * accidentally gets this mode, this will cause the driver SMBus-
> + * functions failure. Normally we could just lock the SMBus-segment the
> + * hub i2c-interface resides for the device-specific reset timing. But
> + * the GPIO controller, which is used to handle the hub reset, might be
> + * placed at the same i2c-bus segment. In this case an error should be
> + * returned since we can't safely use the GPIO controller to clear the
> + * reset state (it may affect the hub configuration) and we can't lock
> + * the i2c-bus segment (it will cause a deadlock).
> + */
> + err = usb251x_check_gpio_chip(hub);
> + if (err)
> + return err;
> +
> err = usb251xb_connect(hub);
> if (err) {
> dev_err(dev, "Failed to connect hub (%d)\n", err);
> --
> 2.21.0
>
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] usb: usb251xb: Lock i2c-bus segment the hub resides
2019-04-27 10:45 ` Greg Kroah-Hartman
@ 2019-04-27 10:58 ` Serge Semin
0 siblings, 0 replies; 13+ messages in thread
From: Serge Semin @ 2019-04-27 10:58 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: Richard Leitner, Serge Semin, linux-usb, linux-kernel
On Sat, Apr 27, 2019 at 12:45:00PM +0200, Greg Kroah-Hartman wrote:
> On Sat, Apr 27, 2019 at 12:31:11PM +0300, Serge Semin wrote:
> > On Sat, Apr 27, 2019 at 09:53:23AM +0200, Greg Kroah-Hartman wrote:
> > > On Sat, Apr 27, 2019 at 10:39:41AM +0300, Serge Semin wrote:
> > > > On Sat, Apr 27, 2019 at 09:32:00AM +0200, Greg Kroah-Hartman wrote:
> > > > > On Sat, Apr 27, 2019 at 10:10:27AM +0300, Serge Semin wrote:
> > > > > > On Sat, Apr 27, 2019 at 09:00:42AM +0200, Greg Kroah-Hartman wrote:
> > > > > > > On Fri, Apr 26, 2019 at 01:46:50PM +0300, Serge Semin wrote:
> > > > > > > > SMBus slave configuration is activated by CFG_SEL[1:0]=0x1 pins
> > > > > > > > state. This is the mode the hub is supposed to be to let this driver
> > > > > > > > work correctly. But a race condition might happen right after reset
> > > > > > > > is cleared due to CFG_SEL[0] pin being multiplexed with SMBus SCL
> > > > > > > > function. In case if the reset pin is handled by a i2c GPIO expander,
> > > > > > > > which is also placed at the same i2c-bus segment as the usb251x
> > > > > > > > SMB-interface connected to, then the hub reset clearance might
> > > > > > > > cause the CFG_SEL[0] being latched in unpredictable state. So
> > > > > > > > sometimes the hub configuration mode might be 0x1 (as expected),
> > > > > > > > but sometimes being 0x0, which doesn't imply to have the hub SMBus-slave
> > > > > > > > interface activated and consequently causes this driver failure.
> > > > > > > >
> > > > > > > > In order to fix the problem we must make sure the GPIO-reset chip doesn't
> > > > > > > > reside the same i2c-bus segment as the SMBus-interface of the hub. If
> > > > > > > > it doesn't, we can safely block the segment for the time the reset is
> > > > > > > > cleared to prevent anyone generating a traffic at the i2c-bus SCL lane
> > > > > > > > connected to the CFG_SEL[0] pin. But if it does, nothing we can do, so
> > > > > > > > just return an error. If we locked the i2c-bus segment and tried to
> > > > > > > > communicate with the GPIO-expander, it would cause a deadlock. If we didn't
> > > > > > > > lock the i2c-bus segment, it would randomly cause the CFG_SEL[0] bit flip.
> > > > > > > >
> > > > > > > > Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
> > > > > > > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > > > > > >
> > > > > > > I signed off on this? Where? When?
> > > > > > >
> > > > > > > never add a s-o-b line that you did not create, that implies a legal
> > > > > > > agreement.
> > > > > > >
> > > > > >
> > > > > > Ah, shit. Sorry. I should have added Acked-by. That's what I was going to do,
> > > > > > since you already added the first version of this into linux-next tree. But
> > > > > > apparently copy-pasted and left as is...
> > > > >
> > > > > If I have already applied a patch, I can't apply it again (or a
> > > > > different version.) You need to send a fix-up patch for the reported
> > > > > issue, not a whole new one as I can not go back in time and rewrite
> > > > > history.
> > > > >
> > > > > thanks,
> > > > >
> > > > > greg k-h
> > > >
> > > > Ok. Should I send it in reply to this patch or as a completely separate one?
> > >
> > > A separate one.
> >
> > Just did this.
> >
> > Two more questions.
> >
> > Is there any online service or ready-to-use configs-gen-script to build
> > patchsets locally with various kernel configs before sending them for review?
> > By using this I'd most likely prevent such unfortunate mistakes in future
> > patches.
>
> 'make allmodconfig' works for me. Also, the 0-day bot sometimes will
> test patches sent to the mailing list before they are applied, but that
> doesn't always work.
>
> > I suppose the situation like this isn't unique, and there are other patches
> > submitted with possible compilation problems. In this case seeing the linux-next
> > will be eventually integrated into the linux-stable, then at the point of those
> > patches the kernel source code will be build-broken corresponding config.
> > In this case wouldn't it be better to have some rebasable branch with build
> > robot service and fix the problematic patches in-place instead of
> > apply an incrementing commits? This also would keep the source code cleaner
> > at that particular commits.
>
> As this passed the first round of 0-day testing in my rebasable branch,
> I assumed it was good enough. But later testing found that not to be
> the case, which is pretty rare. And I can't have public trees that are
> rebasable as people work off of them, so we can just live with fixing
> this up.
>
> thanks,
>
> greg k-h
Ok. Thanks for clarification. Next time I'll use the allmodconfig for a generic
build-test and, as there aren't other way, try to anticipate a possible configs
disabling issues.
-Sergey
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] usb: usb251xb: Lock i2c-bus segment the hub resides
2019-04-27 9:31 ` Serge Semin
@ 2019-04-27 10:45 ` Greg Kroah-Hartman
2019-04-27 10:58 ` Serge Semin
0 siblings, 1 reply; 13+ messages in thread
From: Greg Kroah-Hartman @ 2019-04-27 10:45 UTC (permalink / raw)
To: Serge Semin; +Cc: Richard Leitner, Serge Semin, linux-usb, linux-kernel
On Sat, Apr 27, 2019 at 12:31:11PM +0300, Serge Semin wrote:
> On Sat, Apr 27, 2019 at 09:53:23AM +0200, Greg Kroah-Hartman wrote:
> > On Sat, Apr 27, 2019 at 10:39:41AM +0300, Serge Semin wrote:
> > > On Sat, Apr 27, 2019 at 09:32:00AM +0200, Greg Kroah-Hartman wrote:
> > > > On Sat, Apr 27, 2019 at 10:10:27AM +0300, Serge Semin wrote:
> > > > > On Sat, Apr 27, 2019 at 09:00:42AM +0200, Greg Kroah-Hartman wrote:
> > > > > > On Fri, Apr 26, 2019 at 01:46:50PM +0300, Serge Semin wrote:
> > > > > > > SMBus slave configuration is activated by CFG_SEL[1:0]=0x1 pins
> > > > > > > state. This is the mode the hub is supposed to be to let this driver
> > > > > > > work correctly. But a race condition might happen right after reset
> > > > > > > is cleared due to CFG_SEL[0] pin being multiplexed with SMBus SCL
> > > > > > > function. In case if the reset pin is handled by a i2c GPIO expander,
> > > > > > > which is also placed at the same i2c-bus segment as the usb251x
> > > > > > > SMB-interface connected to, then the hub reset clearance might
> > > > > > > cause the CFG_SEL[0] being latched in unpredictable state. So
> > > > > > > sometimes the hub configuration mode might be 0x1 (as expected),
> > > > > > > but sometimes being 0x0, which doesn't imply to have the hub SMBus-slave
> > > > > > > interface activated and consequently causes this driver failure.
> > > > > > >
> > > > > > > In order to fix the problem we must make sure the GPIO-reset chip doesn't
> > > > > > > reside the same i2c-bus segment as the SMBus-interface of the hub. If
> > > > > > > it doesn't, we can safely block the segment for the time the reset is
> > > > > > > cleared to prevent anyone generating a traffic at the i2c-bus SCL lane
> > > > > > > connected to the CFG_SEL[0] pin. But if it does, nothing we can do, so
> > > > > > > just return an error. If we locked the i2c-bus segment and tried to
> > > > > > > communicate with the GPIO-expander, it would cause a deadlock. If we didn't
> > > > > > > lock the i2c-bus segment, it would randomly cause the CFG_SEL[0] bit flip.
> > > > > > >
> > > > > > > Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
> > > > > > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > > > > >
> > > > > > I signed off on this? Where? When?
> > > > > >
> > > > > > never add a s-o-b line that you did not create, that implies a legal
> > > > > > agreement.
> > > > > >
> > > > >
> > > > > Ah, shit. Sorry. I should have added Acked-by. That's what I was going to do,
> > > > > since you already added the first version of this into linux-next tree. But
> > > > > apparently copy-pasted and left as is...
> > > >
> > > > If I have already applied a patch, I can't apply it again (or a
> > > > different version.) You need to send a fix-up patch for the reported
> > > > issue, not a whole new one as I can not go back in time and rewrite
> > > > history.
> > > >
> > > > thanks,
> > > >
> > > > greg k-h
> > >
> > > Ok. Should I send it in reply to this patch or as a completely separate one?
> >
> > A separate one.
>
> Just did this.
>
> Two more questions.
>
> Is there any online service or ready-to-use configs-gen-script to build
> patchsets locally with various kernel configs before sending them for review?
> By using this I'd most likely prevent such unfortunate mistakes in future
> patches.
'make allmodconfig' works for me. Also, the 0-day bot sometimes will
test patches sent to the mailing list before they are applied, but that
doesn't always work.
> I suppose the situation like this isn't unique, and there are other patches
> submitted with possible compilation problems. In this case seeing the linux-next
> will be eventually integrated into the linux-stable, then at the point of those
> patches the kernel source code will be build-broken corresponding config.
> In this case wouldn't it be better to have some rebasable branch with build
> robot service and fix the problematic patches in-place instead of
> apply an incrementing commits? This also would keep the source code cleaner
> at that particular commits.
As this passed the first round of 0-day testing in my rebasable branch,
I assumed it was good enough. But later testing found that not to be
the case, which is pretty rare. And I can't have public trees that are
rebasable as people work off of them, so we can just live with fixing
this up.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] usb: usb251xb: Lock i2c-bus segment the hub resides
2019-04-27 7:53 ` Greg Kroah-Hartman
@ 2019-04-27 9:31 ` Serge Semin
2019-04-27 10:45 ` Greg Kroah-Hartman
0 siblings, 1 reply; 13+ messages in thread
From: Serge Semin @ 2019-04-27 9:31 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: Richard Leitner, Serge Semin, linux-usb, linux-kernel
On Sat, Apr 27, 2019 at 09:53:23AM +0200, Greg Kroah-Hartman wrote:
> On Sat, Apr 27, 2019 at 10:39:41AM +0300, Serge Semin wrote:
> > On Sat, Apr 27, 2019 at 09:32:00AM +0200, Greg Kroah-Hartman wrote:
> > > On Sat, Apr 27, 2019 at 10:10:27AM +0300, Serge Semin wrote:
> > > > On Sat, Apr 27, 2019 at 09:00:42AM +0200, Greg Kroah-Hartman wrote:
> > > > > On Fri, Apr 26, 2019 at 01:46:50PM +0300, Serge Semin wrote:
> > > > > > SMBus slave configuration is activated by CFG_SEL[1:0]=0x1 pins
> > > > > > state. This is the mode the hub is supposed to be to let this driver
> > > > > > work correctly. But a race condition might happen right after reset
> > > > > > is cleared due to CFG_SEL[0] pin being multiplexed with SMBus SCL
> > > > > > function. In case if the reset pin is handled by a i2c GPIO expander,
> > > > > > which is also placed at the same i2c-bus segment as the usb251x
> > > > > > SMB-interface connected to, then the hub reset clearance might
> > > > > > cause the CFG_SEL[0] being latched in unpredictable state. So
> > > > > > sometimes the hub configuration mode might be 0x1 (as expected),
> > > > > > but sometimes being 0x0, which doesn't imply to have the hub SMBus-slave
> > > > > > interface activated and consequently causes this driver failure.
> > > > > >
> > > > > > In order to fix the problem we must make sure the GPIO-reset chip doesn't
> > > > > > reside the same i2c-bus segment as the SMBus-interface of the hub. If
> > > > > > it doesn't, we can safely block the segment for the time the reset is
> > > > > > cleared to prevent anyone generating a traffic at the i2c-bus SCL lane
> > > > > > connected to the CFG_SEL[0] pin. But if it does, nothing we can do, so
> > > > > > just return an error. If we locked the i2c-bus segment and tried to
> > > > > > communicate with the GPIO-expander, it would cause a deadlock. If we didn't
> > > > > > lock the i2c-bus segment, it would randomly cause the CFG_SEL[0] bit flip.
> > > > > >
> > > > > > Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
> > > > > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > > > >
> > > > > I signed off on this? Where? When?
> > > > >
> > > > > never add a s-o-b line that you did not create, that implies a legal
> > > > > agreement.
> > > > >
> > > >
> > > > Ah, shit. Sorry. I should have added Acked-by. That's what I was going to do,
> > > > since you already added the first version of this into linux-next tree. But
> > > > apparently copy-pasted and left as is...
> > >
> > > If I have already applied a patch, I can't apply it again (or a
> > > different version.) You need to send a fix-up patch for the reported
> > > issue, not a whole new one as I can not go back in time and rewrite
> > > history.
> > >
> > > thanks,
> > >
> > > greg k-h
> >
> > Ok. Should I send it in reply to this patch or as a completely separate one?
>
> A separate one.
Just did this.
Two more questions.
Is there any online service or ready-to-use configs-gen-script to build
patchsets locally with various kernel configs before sending them for review?
By using this I'd most likely prevent such unfortunate mistakes in future
patches.
I suppose the situation like this isn't unique, and there are other patches
submitted with possible compilation problems. In this case seeing the linux-next
will be eventually integrated into the linux-stable, then at the point of those
patches the kernel source code will be build-broken corresponding config.
In this case wouldn't it be better to have some rebasable branch with build
robot service and fix the problematic patches in-place instead of
apply an incrementing commits? This also would keep the source code cleaner
at that particular commits.
-Sergey
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] usb: usb251xb: Lock i2c-bus segment the hub resides
2019-04-27 7:39 ` Serge Semin
@ 2019-04-27 7:53 ` Greg Kroah-Hartman
2019-04-27 9:31 ` Serge Semin
0 siblings, 1 reply; 13+ messages in thread
From: Greg Kroah-Hartman @ 2019-04-27 7:53 UTC (permalink / raw)
To: Serge Semin; +Cc: Richard Leitner, Serge Semin, linux-usb, linux-kernel
On Sat, Apr 27, 2019 at 10:39:41AM +0300, Serge Semin wrote:
> On Sat, Apr 27, 2019 at 09:32:00AM +0200, Greg Kroah-Hartman wrote:
> > On Sat, Apr 27, 2019 at 10:10:27AM +0300, Serge Semin wrote:
> > > On Sat, Apr 27, 2019 at 09:00:42AM +0200, Greg Kroah-Hartman wrote:
> > > > On Fri, Apr 26, 2019 at 01:46:50PM +0300, Serge Semin wrote:
> > > > > SMBus slave configuration is activated by CFG_SEL[1:0]=0x1 pins
> > > > > state. This is the mode the hub is supposed to be to let this driver
> > > > > work correctly. But a race condition might happen right after reset
> > > > > is cleared due to CFG_SEL[0] pin being multiplexed with SMBus SCL
> > > > > function. In case if the reset pin is handled by a i2c GPIO expander,
> > > > > which is also placed at the same i2c-bus segment as the usb251x
> > > > > SMB-interface connected to, then the hub reset clearance might
> > > > > cause the CFG_SEL[0] being latched in unpredictable state. So
> > > > > sometimes the hub configuration mode might be 0x1 (as expected),
> > > > > but sometimes being 0x0, which doesn't imply to have the hub SMBus-slave
> > > > > interface activated and consequently causes this driver failure.
> > > > >
> > > > > In order to fix the problem we must make sure the GPIO-reset chip doesn't
> > > > > reside the same i2c-bus segment as the SMBus-interface of the hub. If
> > > > > it doesn't, we can safely block the segment for the time the reset is
> > > > > cleared to prevent anyone generating a traffic at the i2c-bus SCL lane
> > > > > connected to the CFG_SEL[0] pin. But if it does, nothing we can do, so
> > > > > just return an error. If we locked the i2c-bus segment and tried to
> > > > > communicate with the GPIO-expander, it would cause a deadlock. If we didn't
> > > > > lock the i2c-bus segment, it would randomly cause the CFG_SEL[0] bit flip.
> > > > >
> > > > > Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
> > > > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > > >
> > > > I signed off on this? Where? When?
> > > >
> > > > never add a s-o-b line that you did not create, that implies a legal
> > > > agreement.
> > > >
> > >
> > > Ah, shit. Sorry. I should have added Acked-by. That's what I was going to do,
> > > since you already added the first version of this into linux-next tree. But
> > > apparently copy-pasted and left as is...
> >
> > If I have already applied a patch, I can't apply it again (or a
> > different version.) You need to send a fix-up patch for the reported
> > issue, not a whole new one as I can not go back in time and rewrite
> > history.
> >
> > thanks,
> >
> > greg k-h
>
> Ok. Should I send it in reply to this patch or as a completely separate one?
A separate one.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] usb: usb251xb: Lock i2c-bus segment the hub resides
2019-04-27 7:32 ` Greg Kroah-Hartman
@ 2019-04-27 7:39 ` Serge Semin
2019-04-27 7:53 ` Greg Kroah-Hartman
0 siblings, 1 reply; 13+ messages in thread
From: Serge Semin @ 2019-04-27 7:39 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: Richard Leitner, Serge Semin, linux-usb, linux-kernel
On Sat, Apr 27, 2019 at 09:32:00AM +0200, Greg Kroah-Hartman wrote:
> On Sat, Apr 27, 2019 at 10:10:27AM +0300, Serge Semin wrote:
> > On Sat, Apr 27, 2019 at 09:00:42AM +0200, Greg Kroah-Hartman wrote:
> > > On Fri, Apr 26, 2019 at 01:46:50PM +0300, Serge Semin wrote:
> > > > SMBus slave configuration is activated by CFG_SEL[1:0]=0x1 pins
> > > > state. This is the mode the hub is supposed to be to let this driver
> > > > work correctly. But a race condition might happen right after reset
> > > > is cleared due to CFG_SEL[0] pin being multiplexed with SMBus SCL
> > > > function. In case if the reset pin is handled by a i2c GPIO expander,
> > > > which is also placed at the same i2c-bus segment as the usb251x
> > > > SMB-interface connected to, then the hub reset clearance might
> > > > cause the CFG_SEL[0] being latched in unpredictable state. So
> > > > sometimes the hub configuration mode might be 0x1 (as expected),
> > > > but sometimes being 0x0, which doesn't imply to have the hub SMBus-slave
> > > > interface activated and consequently causes this driver failure.
> > > >
> > > > In order to fix the problem we must make sure the GPIO-reset chip doesn't
> > > > reside the same i2c-bus segment as the SMBus-interface of the hub. If
> > > > it doesn't, we can safely block the segment for the time the reset is
> > > > cleared to prevent anyone generating a traffic at the i2c-bus SCL lane
> > > > connected to the CFG_SEL[0] pin. But if it does, nothing we can do, so
> > > > just return an error. If we locked the i2c-bus segment and tried to
> > > > communicate with the GPIO-expander, it would cause a deadlock. If we didn't
> > > > lock the i2c-bus segment, it would randomly cause the CFG_SEL[0] bit flip.
> > > >
> > > > Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
> > > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > >
> > > I signed off on this? Where? When?
> > >
> > > never add a s-o-b line that you did not create, that implies a legal
> > > agreement.
> > >
> >
> > Ah, shit. Sorry. I should have added Acked-by. That's what I was going to do,
> > since you already added the first version of this into linux-next tree. But
> > apparently copy-pasted and left as is...
>
> If I have already applied a patch, I can't apply it again (or a
> different version.) You need to send a fix-up patch for the reported
> issue, not a whole new one as I can not go back in time and rewrite
> history.
>
> thanks,
>
> greg k-h
Ok. Should I send it in reply to this patch or as a completely separate one?
-Sergey
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] usb: usb251xb: Lock i2c-bus segment the hub resides
2019-04-27 7:10 ` Serge Semin
@ 2019-04-27 7:32 ` Greg Kroah-Hartman
2019-04-27 7:39 ` Serge Semin
0 siblings, 1 reply; 13+ messages in thread
From: Greg Kroah-Hartman @ 2019-04-27 7:32 UTC (permalink / raw)
To: Serge Semin; +Cc: Richard Leitner, Serge Semin, linux-usb, linux-kernel
On Sat, Apr 27, 2019 at 10:10:27AM +0300, Serge Semin wrote:
> On Sat, Apr 27, 2019 at 09:00:42AM +0200, Greg Kroah-Hartman wrote:
> > On Fri, Apr 26, 2019 at 01:46:50PM +0300, Serge Semin wrote:
> > > SMBus slave configuration is activated by CFG_SEL[1:0]=0x1 pins
> > > state. This is the mode the hub is supposed to be to let this driver
> > > work correctly. But a race condition might happen right after reset
> > > is cleared due to CFG_SEL[0] pin being multiplexed with SMBus SCL
> > > function. In case if the reset pin is handled by a i2c GPIO expander,
> > > which is also placed at the same i2c-bus segment as the usb251x
> > > SMB-interface connected to, then the hub reset clearance might
> > > cause the CFG_SEL[0] being latched in unpredictable state. So
> > > sometimes the hub configuration mode might be 0x1 (as expected),
> > > but sometimes being 0x0, which doesn't imply to have the hub SMBus-slave
> > > interface activated and consequently causes this driver failure.
> > >
> > > In order to fix the problem we must make sure the GPIO-reset chip doesn't
> > > reside the same i2c-bus segment as the SMBus-interface of the hub. If
> > > it doesn't, we can safely block the segment for the time the reset is
> > > cleared to prevent anyone generating a traffic at the i2c-bus SCL lane
> > > connected to the CFG_SEL[0] pin. But if it does, nothing we can do, so
> > > just return an error. If we locked the i2c-bus segment and tried to
> > > communicate with the GPIO-expander, it would cause a deadlock. If we didn't
> > > lock the i2c-bus segment, it would randomly cause the CFG_SEL[0] bit flip.
> > >
> > > Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
> > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> >
> > I signed off on this? Where? When?
> >
> > never add a s-o-b line that you did not create, that implies a legal
> > agreement.
> >
>
> Ah, shit. Sorry. I should have added Acked-by. That's what I was going to do,
> since you already added the first version of this into linux-next tree. But
> apparently copy-pasted and left as is...
If I have already applied a patch, I can't apply it again (or a
different version.) You need to send a fix-up patch for the reported
issue, not a whole new one as I can not go back in time and rewrite
history.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] usb: usb251xb: Lock i2c-bus segment the hub resides
2019-04-27 7:00 ` Greg Kroah-Hartman
@ 2019-04-27 7:10 ` Serge Semin
2019-04-27 7:32 ` Greg Kroah-Hartman
0 siblings, 1 reply; 13+ messages in thread
From: Serge Semin @ 2019-04-27 7:10 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: Richard Leitner, Serge Semin, linux-usb, linux-kernel
On Sat, Apr 27, 2019 at 09:00:42AM +0200, Greg Kroah-Hartman wrote:
> On Fri, Apr 26, 2019 at 01:46:50PM +0300, Serge Semin wrote:
> > SMBus slave configuration is activated by CFG_SEL[1:0]=0x1 pins
> > state. This is the mode the hub is supposed to be to let this driver
> > work correctly. But a race condition might happen right after reset
> > is cleared due to CFG_SEL[0] pin being multiplexed with SMBus SCL
> > function. In case if the reset pin is handled by a i2c GPIO expander,
> > which is also placed at the same i2c-bus segment as the usb251x
> > SMB-interface connected to, then the hub reset clearance might
> > cause the CFG_SEL[0] being latched in unpredictable state. So
> > sometimes the hub configuration mode might be 0x1 (as expected),
> > but sometimes being 0x0, which doesn't imply to have the hub SMBus-slave
> > interface activated and consequently causes this driver failure.
> >
> > In order to fix the problem we must make sure the GPIO-reset chip doesn't
> > reside the same i2c-bus segment as the SMBus-interface of the hub. If
> > it doesn't, we can safely block the segment for the time the reset is
> > cleared to prevent anyone generating a traffic at the i2c-bus SCL lane
> > connected to the CFG_SEL[0] pin. But if it does, nothing we can do, so
> > just return an error. If we locked the i2c-bus segment and tried to
> > communicate with the GPIO-expander, it would cause a deadlock. If we didn't
> > lock the i2c-bus segment, it would randomly cause the CFG_SEL[0] bit flip.
> >
> > Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> I signed off on this? Where? When?
>
> never add a s-o-b line that you did not create, that implies a legal
> agreement.
>
Ah, shit. Sorry. I should have added Acked-by. That's what I was going to do,
since you already added the first version of this into linux-next tree. But
apparently copy-pasted and left as is...
-Sergey
> greg k-h
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] usb: usb251xb: Lock i2c-bus segment the hub resides
2019-04-26 10:46 ` [PATCH v2] " Serge Semin
@ 2019-04-27 7:00 ` Greg Kroah-Hartman
2019-04-27 7:10 ` Serge Semin
0 siblings, 1 reply; 13+ messages in thread
From: Greg Kroah-Hartman @ 2019-04-27 7:00 UTC (permalink / raw)
To: Serge Semin; +Cc: Richard Leitner, Serge Semin, linux-usb, linux-kernel
On Fri, Apr 26, 2019 at 01:46:50PM +0300, Serge Semin wrote:
> SMBus slave configuration is activated by CFG_SEL[1:0]=0x1 pins
> state. This is the mode the hub is supposed to be to let this driver
> work correctly. But a race condition might happen right after reset
> is cleared due to CFG_SEL[0] pin being multiplexed with SMBus SCL
> function. In case if the reset pin is handled by a i2c GPIO expander,
> which is also placed at the same i2c-bus segment as the usb251x
> SMB-interface connected to, then the hub reset clearance might
> cause the CFG_SEL[0] being latched in unpredictable state. So
> sometimes the hub configuration mode might be 0x1 (as expected),
> but sometimes being 0x0, which doesn't imply to have the hub SMBus-slave
> interface activated and consequently causes this driver failure.
>
> In order to fix the problem we must make sure the GPIO-reset chip doesn't
> reside the same i2c-bus segment as the SMBus-interface of the hub. If
> it doesn't, we can safely block the segment for the time the reset is
> cleared to prevent anyone generating a traffic at the i2c-bus SCL lane
> connected to the CFG_SEL[0] pin. But if it does, nothing we can do, so
> just return an error. If we locked the i2c-bus segment and tried to
> communicate with the GPIO-expander, it would cause a deadlock. If we didn't
> lock the i2c-bus segment, it would randomly cause the CFG_SEL[0] bit flip.
>
> Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
I signed off on this? Where? When?
never add a s-o-b line that you did not create, that implies a legal
agreement.
greg k-h
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH v2] usb: usb251xb: Lock i2c-bus segment the hub resides
2019-04-24 14:49 [PATCH] " Serge Semin
@ 2019-04-26 10:46 ` Serge Semin
2019-04-27 7:00 ` Greg Kroah-Hartman
0 siblings, 1 reply; 13+ messages in thread
From: Serge Semin @ 2019-04-26 10:46 UTC (permalink / raw)
To: Richard Leitner, Greg Kroah-Hartman; +Cc: Serge Semin, linux-usb, linux-kernel
SMBus slave configuration is activated by CFG_SEL[1:0]=0x1 pins
state. This is the mode the hub is supposed to be to let this driver
work correctly. But a race condition might happen right after reset
is cleared due to CFG_SEL[0] pin being multiplexed with SMBus SCL
function. In case if the reset pin is handled by a i2c GPIO expander,
which is also placed at the same i2c-bus segment as the usb251x
SMB-interface connected to, then the hub reset clearance might
cause the CFG_SEL[0] being latched in unpredictable state. So
sometimes the hub configuration mode might be 0x1 (as expected),
but sometimes being 0x0, which doesn't imply to have the hub SMBus-slave
interface activated and consequently causes this driver failure.
In order to fix the problem we must make sure the GPIO-reset chip doesn't
reside the same i2c-bus segment as the SMBus-interface of the hub. If
it doesn't, we can safely block the segment for the time the reset is
cleared to prevent anyone generating a traffic at the i2c-bus SCL lane
connected to the CFG_SEL[0] pin. But if it does, nothing we can do, so
just return an error. If we locked the i2c-bus segment and tried to
communicate with the GPIO-expander, it would cause a deadlock. If we didn't
lock the i2c-bus segment, it would randomly cause the CFG_SEL[0] bit flip.
Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Changelog v2
- Execute the check code only if GPIOLIB is enabled (reported by
a build robot).
---
drivers/usb/misc/usb251xb.c | 62 +++++++++++++++++++++++++++++++++++++
1 file changed, 62 insertions(+)
diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c
index 04684849d683..cdc80e8c2d8a 100644
--- a/drivers/usb/misc/usb251xb.c
+++ b/drivers/usb/misc/usb251xb.c
@@ -12,6 +12,7 @@
#include <linux/delay.h>
#include <linux/gpio/consumer.h>
+#include <linux/gpio/driver.h>
#include <linux/i2c.h>
#include <linux/module.h>
#include <linux/nls.h>
@@ -222,11 +223,51 @@ static const struct usb251xb_data usb2517i_data = {
.product_str = "USB2517i",
};
+#ifdef CONFIG_GPIOLIB
+static int usb251xb_check_dev_children(struct device *dev, void *child)
+{
+ if (dev->type == &i2c_adapter_type) {
+ return device_for_each_child(dev, child,
+ usb251xb_check_dev_children);
+ }
+
+ return (dev == child);
+}
+
+static int usb251x_check_gpio_chip(struct usb251xb *hub)
+{
+ struct gpio_chip *gc = gpiod_to_chip(hub->gpio_reset);
+ struct i2c_adapter *adap = hub->i2c->adapter;
+ int ret;
+
+ if (!hub->gpio_reset)
+ return 0;
+
+ if (!gc)
+ return -EINVAL;
+
+ ret = usb251xb_check_dev_children(&adap->dev, gc->parent);
+ if (ret) {
+ dev_err(hub->dev, "Reset GPIO chip is at the same i2c-bus\n");
+ return -EINVAL;
+ }
+
+ return 0;
+}
+#else
+static int usb251x_check_gpio_chip(struct usb251xb *hub)
+{
+ return 0;
+}
+#endif
+
static void usb251xb_reset(struct usb251xb *hub, int state)
{
if (!hub->gpio_reset)
return;
+ i2c_lock_bus(hub->i2c->adapter, I2C_LOCK_SEGMENT);
+
gpiod_set_value_cansleep(hub->gpio_reset, state);
/* wait for hub recovery/stabilization */
@@ -234,6 +275,8 @@ static void usb251xb_reset(struct usb251xb *hub, int state)
usleep_range(500, 750); /* >=500us at power on */
else
usleep_range(1, 10); /* >=1us at power down */
+
+ i2c_unlock_bus(hub->i2c->adapter, I2C_LOCK_SEGMENT);
}
static int usb251xb_connect(struct usb251xb *hub)
@@ -621,6 +664,25 @@ static int usb251xb_probe(struct usb251xb *hub)
}
}
+ /*
+ * usb251x SMBus-slave SCL lane is muxed with CFG_SEL0 pin. So if anyone
+ * tries to work with the bus at the moment the hub reset is released,
+ * it may cause an invalid config being latched by usb251x. Particularly
+ * one of the config modes makes the hub loading a default registers
+ * value without SMBus-slave interface activation. If the hub
+ * accidentally gets this mode, this will cause the driver SMBus-
+ * functions failure. Normally we could just lock the SMBus-segment the
+ * hub i2c-interface resides for the device-specific reset timing. But
+ * the GPIO controller, which is used to handle the hub reset, might be
+ * placed at the same i2c-bus segment. In this case an error should be
+ * returned since we can't safely use the GPIO controller to clear the
+ * reset state (it may affect the hub configuration) and we can't lock
+ * the i2c-bus segment (it will cause a deadlock).
+ */
+ err = usb251x_check_gpio_chip(hub);
+ if (err)
+ return err;
+
err = usb251xb_connect(hub);
if (err) {
dev_err(dev, "Failed to connect hub (%d)\n", err);
--
2.21.0
^ permalink raw reply related [flat|nested] 13+ messages in thread
end of thread, other threads:[~2019-04-27 10:58 UTC | newest]
Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-25 22:32 [PATCH v2] usb: usb251xb: Lock i2c-bus segment the hub resides Serge Semin
2019-04-25 22:32 ` [v2] " Serge Semin
2019-04-26 10:45 ` [PATCH v2] " Serge Semin
2019-04-26 10:45 ` [v2] " Serge Semin
-- strict thread matches above, loose matches on Subject: below --
2019-04-24 14:49 [PATCH] " Serge Semin
2019-04-26 10:46 ` [PATCH v2] " Serge Semin
2019-04-27 7:00 ` Greg Kroah-Hartman
2019-04-27 7:10 ` Serge Semin
2019-04-27 7:32 ` Greg Kroah-Hartman
2019-04-27 7:39 ` Serge Semin
2019-04-27 7:53 ` Greg Kroah-Hartman
2019-04-27 9:31 ` Serge Semin
2019-04-27 10:45 ` Greg Kroah-Hartman
2019-04-27 10:58 ` Serge Semin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.