From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Subject: usb: usb251xb: Lock i2c-bus segment the hub resides From: Serge Semin Message-Id: <20190424144914.10580-1-fancer.lancer@gmail.com> Date: Wed, 24 Apr 2019 17:49:14 +0300 To: Richard Leitner , Greg Kroah-Hartman Cc: Serge Semin , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org List-ID: U01CdXMgc2xhdmUgY29uZmlndXJhdGlvbiBpcyBhY3RpdmF0ZWQgYnkgQ0ZHX1NFTFsxOjBdPTB4 MSBwaW5zCnN0YXRlLiBUaGlzIGlzIHRoZSBtb2RlIHRoZSBodWIgaXMgc3VwcG9zZWQgdG8gYmUg dG8gbGV0IHRoaXMgZHJpdmVyCndvcmsgY29ycmVjdGx5LiBCdXQgYSByYWNlIGNvbmRpdGlvbiBt aWdodCBoYXBwZW4gcmlnaHQgYWZ0ZXIgcmVzZXQKaXMgY2xlYXJlZCBkdWUgdG8gQ0ZHX1NFTFsw XSBwaW4gYmVpbmcgbXVsdGlwbGV4ZWQgd2l0aCBTTUJ1cyBTQ0wKZnVuY3Rpb24uIEluIGNhc2Ug aWYgdGhlIHJlc2V0IHBpbiBpcyBoYW5kbGVkIGJ5IGEgaTJjIEdQSU8gZXhwYW5kZXIsCndoaWNo IGlzIGFsc28gcGxhY2VkIGF0IHRoZSBzYW1lIGkyYy1idXMgc2VnbWVudCBhcyB0aGUgdXNiMjUx eApTTUItaW50ZXJmYWNlIGNvbm5lY3RlZCB0bywgdGhlbiB0aGUgaHViIHJlc2V0IGNsZWFyYW5j ZSBtaWdodApjYXVzZSB0aGUgQ0ZHX1NFTFswXSBiZWluZyBsYXRjaGVkIGluIHVucHJlZGljdGFi bGUgc3RhdGUuIFNvCnNvbWV0aW1lcyB0aGUgaHViIGNvbmZpZ3VyYXRpb24gbW9kZSBtaWdodCBi ZSAweDEgKGFzIGV4cGVjdGVkKSwKYnV0IHNvbWV0aW1lcyBiZWluZyAweDAsIHdoaWNoIGRvZXNu J3QgaW1wbHkgdG8gaGF2ZSB0aGUgaHViIFNNQnVzLXNsYXZlCmludGVyZmFjZSBhY3RpdmF0ZWQg YW5kIGNvbnNlcXVlbnRseSBjYXVzZXMgdGhpcyBkcml2ZXIgZmFpbHVyZS4KCkluIG9yZGVyIHRv IGZpeCB0aGUgcHJvYmxlbSB3ZSBtdXN0IG1ha2Ugc3VyZSB0aGUgR1BJTy1yZXNldCBjaGlwIGRv ZXNuJ3QKcmVzaWRlIHRoZSBzYW1lIGkyYy1idXMgc2VnbWVudCBhcyB0aGUgU01CdXMtaW50ZXJm YWNlIG9mIHRoZSBodWIuIElmCml0IGRvZXNuJ3QsIHdlIGNhbiBzYWZlbHkgYmxvY2sgdGhlIHNl Z21lbnQgZm9yIHRoZSB0aW1lIHRoZSByZXNldCBpcwpjbGVhcmVkIHRvIHByZXZlbnQgYW55b25l IGdlbmVyYXRpbmcgYSB0cmFmZmljIGF0IHRoZSBpMmMtYnVzIFNDTCBsYW5lCmNvbm5lY3RlZCB0 byB0aGUgQ0ZHX1NFTFswXSBwaW4uIEJ1dCBpZiBpdCBkb2VzLCBub3RoaW5nIHdlIGNhbiBkbywg c28KanVzdCByZXR1cm4gYW4gZXJyb3IuIElmIHdlIGxvY2tlZCB0aGUgaTJjLWJ1cyBzZWdtZW50 IGFuZCB0cmllZCB0bwpjb21tdW5pY2F0ZSB3aXRoIHRoZSBHUElPLWV4cGFuZGVyLCBpdCB3b3Vs ZCBjYXVzZSBhIGRlYWRsb2NrLiBJZiB3ZSBkaWRuJ3QKbG9jayB0aGUgaTJjLWJ1cyBzZWdtZW50 LCBpdCB3b3VsZCByYW5kb21seSBjYXVzZSB0aGUgQ0ZHX1NFTFswXSBiaXQgZmxpcC4KClNpZ25l ZC1vZmYtYnk6IFNlcmdlIFNlbWluIDxmYW5jZXIubGFuY2VyQGdtYWlsLmNvbT4KLS0tCiBkcml2 ZXJzL3VzYi9taXNjL3VzYjI1MXhiLmMgfCA1NSArKysrKysrKysrKysrKysrKysrKysrKysrKysr KysrKysrKysrCiAxIGZpbGUgY2hhbmdlZCwgNTUgaW5zZXJ0aW9ucygrKQoKZGlmZiAtLWdpdCBh L2RyaXZlcnMvdXNiL21pc2MvdXNiMjUxeGIuYyBiL2RyaXZlcnMvdXNiL21pc2MvdXNiMjUxeGIu YwppbmRleCAwNDY4NDg0OWQ2ODMuLjkzOWIzYmVkZDRjOCAxMDA2NDQKLS0tIGEvZHJpdmVycy91 c2IvbWlzYy91c2IyNTF4Yi5jCisrKyBiL2RyaXZlcnMvdXNiL21pc2MvdXNiMjUxeGIuYwpAQCAt MTIsNiArMTIsNyBAQAogCiAjaW5jbHVkZSA8bGludXgvZGVsYXkuaD4KICNpbmNsdWRlIDxsaW51 eC9ncGlvL2NvbnN1bWVyLmg+CisjaW5jbHVkZSA8bGludXgvZ3Bpby9kcml2ZXIuaD4KICNpbmNs dWRlIDxsaW51eC9pMmMuaD4KICNpbmNsdWRlIDxsaW51eC9tb2R1bGUuaD4KICNpbmNsdWRlIDxs aW51eC9ubHMuaD4KQEAgLTIyMiwxMSArMjIzLDQ0IEBAIHN0YXRpYyBjb25zdCBzdHJ1Y3QgdXNi MjUxeGJfZGF0YSB1c2IyNTE3aV9kYXRhID0gewogCS5wcm9kdWN0X3N0ciA9ICJVU0IyNTE3aSIs CiB9OwogCitzdGF0aWMgaW50IHVzYjI1MXhiX2NoZWNrX2Rldl9jaGlsZHJlbihzdHJ1Y3QgZGV2 aWNlICpkZXYsIHZvaWQgKmNoaWxkKQoreworCWlmIChkZXYtPnR5cGUgPT0gJmkyY19hZGFwdGVy X3R5cGUpIHsKKwkJcmV0dXJuIGRldmljZV9mb3JfZWFjaF9jaGlsZChkZXYsIGNoaWxkLAorCQkJ CQkgICAgIHVzYjI1MXhiX2NoZWNrX2Rldl9jaGlsZHJlbik7CisJfQorCisJcmV0dXJuIChkZXYg PT0gY2hpbGQpOworfQorCitzdGF0aWMgaW50IHVzYjI1MXhfY2hlY2tfZ3Bpb19jaGlwKHN0cnVj dCB1c2IyNTF4YiAqaHViKQoreworCXN0cnVjdCBncGlvX2NoaXAgKmdjID0gZ3Bpb2RfdG9fY2hp cChodWItPmdwaW9fcmVzZXQpOworCXN0cnVjdCBpMmNfYWRhcHRlciAqYWRhcCA9IGh1Yi0+aTJj LT5hZGFwdGVyOworCWludCByZXQ7CisKKwlpZiAoIWh1Yi0+Z3Bpb19yZXNldCkKKwkJcmV0dXJu IDA7CisKKwlpZiAoIWdjKQorCQlyZXR1cm4gLUVJTlZBTDsKKworCXJldCA9IHVzYjI1MXhiX2No ZWNrX2Rldl9jaGlsZHJlbigmYWRhcC0+ZGV2LCBnYy0+cGFyZW50KTsKKwlpZiAocmV0KSB7CisJ CWRldl9lcnIoaHViLT5kZXYsICJSZXNldCBHUElPIGNoaXAgaXMgYXQgdGhlIHNhbWUgaTJjLWJ1 c1xuIik7CisJCXJldHVybiAtRUlOVkFMOworCX0KKworCXJldHVybiAwOworfQorCiBzdGF0aWMg dm9pZCB1c2IyNTF4Yl9yZXNldChzdHJ1Y3QgdXNiMjUxeGIgKmh1YiwgaW50IHN0YXRlKQogewog CWlmICghaHViLT5ncGlvX3Jlc2V0KQogCQlyZXR1cm47CiAKKwlpMmNfbG9ja19idXMoaHViLT5p MmMtPmFkYXB0ZXIsIEkyQ19MT0NLX1NFR01FTlQpOworCiAJZ3Bpb2Rfc2V0X3ZhbHVlX2NhbnNs ZWVwKGh1Yi0+Z3Bpb19yZXNldCwgc3RhdGUpOwogCiAJLyogd2FpdCBmb3IgaHViIHJlY292ZXJ5 L3N0YWJpbGl6YXRpb24gKi8KQEAgLTIzNCw2ICsyNjgsOCBAQCBzdGF0aWMgdm9pZCB1c2IyNTF4 Yl9yZXNldChzdHJ1Y3QgdXNiMjUxeGIgKmh1YiwgaW50IHN0YXRlKQogCQl1c2xlZXBfcmFuZ2Uo NTAwLCA3NTApOwkvKiA+PTUwMHVzIGF0IHBvd2VyIG9uICovCiAJZWxzZQogCQl1c2xlZXBfcmFu Z2UoMSwgMTApOwkvKiA+PTF1cyBhdCBwb3dlciBkb3duICovCisKKwlpMmNfdW5sb2NrX2J1cyho dWItPmkyYy0+YWRhcHRlciwgSTJDX0xPQ0tfU0VHTUVOVCk7CiB9CiAKIHN0YXRpYyBpbnQgdXNi MjUxeGJfY29ubmVjdChzdHJ1Y3QgdXNiMjUxeGIgKmh1YikKQEAgLTYyMSw2ICs2NTcsMjUgQEAg c3RhdGljIGludCB1c2IyNTF4Yl9wcm9iZShzdHJ1Y3QgdXNiMjUxeGIgKmh1YikKIAkJfQogCX0K IAorCS8qCisJICogdXNiMjUxeCBTTUJ1cy1zbGF2ZSBTQ0wgbGFuZSBpcyBtdXhlZCB3aXRoIENG R19TRUwwIHBpbi4gU28gaWYgYW55b25lCisJICogdHJpZXMgdG8gd29yayB3aXRoIHRoZSBidXMg YXQgdGhlIG1vbWVudCB0aGUgaHViIHJlc2V0IGlzIHJlbGVhc2VkLAorCSAqIGl0IG1heSBjYXVz ZSBhbiBpbnZhbGlkIGNvbmZpZyBiZWluZyBsYXRjaGVkIGJ5IHVzYjI1MXguIFBhcnRpY3VsYXJs eQorCSAqIG9uZSBvZiB0aGUgY29uZmlnIG1vZGVzIG1ha2VzIHRoZSBodWIgbG9hZGluZyBhIGRl ZmF1bHQgcmVnaXN0ZXJzCisJICogdmFsdWUgd2l0aG91dCBTTUJ1cy1zbGF2ZSBpbnRlcmZhY2Ug YWN0aXZhdGlvbi4gSWYgdGhlIGh1YgorCSAqIGFjY2lkZW50YWxseSBnZXRzIHRoaXMgbW9kZSwg dGhpcyB3aWxsIGNhdXNlIHRoZSBkcml2ZXIgU01CdXMtCisJICogZnVuY3Rpb25zIGZhaWx1cmUu IE5vcm1hbGx5IHdlIGNvdWxkIGp1c3QgbG9jayB0aGUgU01CdXMtc2VnbWVudCB0aGUKKwkgKiBo dWIgaTJjLWludGVyZmFjZSByZXNpZGVzIGZvciB0aGUgZGV2aWNlLXNwZWNpZmljIHJlc2V0IHRp bWluZy4gQnV0CisJICogdGhlIEdQSU8gY29udHJvbGxlciwgd2hpY2ggaXMgdXNlZCB0byBoYW5k bGUgdGhlIGh1YiByZXNldCwgbWlnaHQgYmUKKwkgKiBwbGFjZWQgYXQgdGhlIHNhbWUgaTJjLWJ1 cyBzZWdtZW50LiBJbiB0aGlzIGNhc2UgYW4gZXJyb3Igc2hvdWxkIGJlCisJICogcmV0dXJuZWQg c2luY2Ugd2UgY2FuJ3Qgc2FmZWx5IHVzZSB0aGUgR1BJTyBjb250cm9sbGVyIHRvIGNsZWFyIHRo ZQorCSAqIHJlc2V0IHN0YXRlIChpdCBtYXkgYWZmZWN0IHRoZSBodWIgY29uZmlndXJhdGlvbikg YW5kIHdlIGNhbid0IGxvY2sKKwkgKiB0aGUgaTJjLWJ1cyBzZWdtZW50IChpdCB3aWxsIGNhdXNl IGEgZGVhZGxvY2spLgorCSAqLworCWVyciA9IHVzYjI1MXhfY2hlY2tfZ3Bpb19jaGlwKGh1Yik7 CisJaWYgKGVycikKKwkJcmV0dXJuIGVycjsKKwogCWVyciA9IHVzYjI1MXhiX2Nvbm5lY3QoaHVi KTsKIAlpZiAoZXJyKSB7CiAJCWRldl9lcnIoZGV2LCAiRmFpbGVkIHRvIGNvbm5lY3QgaHViICgl ZClcbiIsIGVycik7Cg== From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6210BC10F11 for ; Wed, 24 Apr 2019 14:49:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 252ED218FC for ; Wed, 24 Apr 2019 14:49:58 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="c50nKEv/" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732306AbfDXOtu (ORCPT ); Wed, 24 Apr 2019 10:49:50 -0400 Received: from mail-lj1-f196.google.com ([209.85.208.196]:35766 "EHLO mail-lj1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731011AbfDXOtr (ORCPT ); Wed, 24 Apr 2019 10:49:47 -0400 Received: by mail-lj1-f196.google.com with SMTP id t4so17161711ljc.2; Wed, 24 Apr 2019 07:49:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=bofPGkO0Fr+MuENc58WU9P5S59OCZQC8382116tFtCg=; b=c50nKEv/w+xO5RPKV7gxufTcXqfQ+1tT10gGQtegZOKIa6aYKeVzOCnewV2HGwleI9 eVE4PXuaAC73S3WlUUKk0GRSZRReJsQ3DU04GmzMn0xA24D0Xp4hgYII5bj2q/7pFnhc nBo6Co17Tf+YoOZY4QcbOtZBJOkrpNOCAz6wMZCRK6TSIWpqxEYJrmS695Gagup0cxSc uKDFBu/cDNiKsBK4XFWeC9OIDx4meVYOKLD6YuBN5ncAHPb8LPFTmDDpwQZxdT2+tm5J fFdCyQnxRhKLWDJBLjICNzTlIMWGpn3kzOXwXmXvprzl3DSvzpXCxf5BQVFzUTImfWNz ytAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=bofPGkO0Fr+MuENc58WU9P5S59OCZQC8382116tFtCg=; b=E4PTwP6JAxqm23LuPLsJtLfwNKA27vqEsCvyZIBIpO15aFkGc9D2o3vRh9phqAvAdJ 0c4DtEA2TpKdZJz9uxWIrpWKh2fCQpiElzYFb2Io29lKu8T33N8esyWIuBGV/4rRyd7N w+0b3iFOa32vQnZAdkUT/pj/X/VCl+v0aSnaPTSjug1hU+nn2Foxy9AjNYHrpr8qBx9G /A4++AdQ1Mo4UXFn34no0PblKtWiiolyQtndYr3QtmXO7vktd+c9VMwC4B9AdFEltY+2 ACUx5eMDGTcikCaoZylP7AJ71xSkly692tyDZPTvwqPs2hhMVLBNFSVubEQK+j/SWDWT o95w== X-Gm-Message-State: APjAAAUYYVu9XqRwlXjTwzf0aYpitfg2ao4TyiKEqLEYBUlEul6byYAR nstz83Lz0jdNBW2JMuhBiJj/QlViKec= X-Google-Smtp-Source: APXvYqyoXVZbgnCl1EFhYDQDLYZOELvk49LAXkjFsQlYlRe/vxojRIrDSRrx9IbwM0rTmBV8UcM7ug== X-Received: by 2002:a2e:4e12:: with SMTP id c18mr17951314ljb.3.1556117383924; Wed, 24 Apr 2019 07:49:43 -0700 (PDT) Received: from localhost.localdomain ([5.164.240.123]) by smtp.gmail.com with ESMTPSA id h26sm2273109lfm.11.2019.04.24.07.49.42 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Apr 2019 07:49:42 -0700 (PDT) From: Serge Semin To: Richard Leitner , Greg Kroah-Hartman Cc: Serge Semin , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] usb: usb251xb: Lock i2c-bus segment the hub resides Date: Wed, 24 Apr 2019 17:49:14 +0300 Message-Id: <20190424144914.10580-1-fancer.lancer@gmail.com> X-Mailer: git-send-email 2.21.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Message-ID: <20190424144914.W3FyCmS4s0Mj7VIlyUeqHqOZFK9cZmye9uLcf05gbqU@z> SMBus slave configuration is activated by CFG_SEL[1:0]=0x1 pins state. This is the mode the hub is supposed to be to let this driver work correctly. But a race condition might happen right after reset is cleared due to CFG_SEL[0] pin being multiplexed with SMBus SCL function. In case if the reset pin is handled by a i2c GPIO expander, which is also placed at the same i2c-bus segment as the usb251x SMB-interface connected to, then the hub reset clearance might cause the CFG_SEL[0] being latched in unpredictable state. So sometimes the hub configuration mode might be 0x1 (as expected), but sometimes being 0x0, which doesn't imply to have the hub SMBus-slave interface activated and consequently causes this driver failure. In order to fix the problem we must make sure the GPIO-reset chip doesn't reside the same i2c-bus segment as the SMBus-interface of the hub. If it doesn't, we can safely block the segment for the time the reset is cleared to prevent anyone generating a traffic at the i2c-bus SCL lane connected to the CFG_SEL[0] pin. But if it does, nothing we can do, so just return an error. If we locked the i2c-bus segment and tried to communicate with the GPIO-expander, it would cause a deadlock. If we didn't lock the i2c-bus segment, it would randomly cause the CFG_SEL[0] bit flip. Signed-off-by: Serge Semin --- drivers/usb/misc/usb251xb.c | 55 +++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c index 04684849d683..939b3bedd4c8 100644 --- a/drivers/usb/misc/usb251xb.c +++ b/drivers/usb/misc/usb251xb.c @@ -12,6 +12,7 @@ #include #include +#include #include #include #include @@ -222,11 +223,44 @@ static const struct usb251xb_data usb2517i_data = { .product_str = "USB2517i", }; +static int usb251xb_check_dev_children(struct device *dev, void *child) +{ + if (dev->type == &i2c_adapter_type) { + return device_for_each_child(dev, child, + usb251xb_check_dev_children); + } + + return (dev == child); +} + +static int usb251x_check_gpio_chip(struct usb251xb *hub) +{ + struct gpio_chip *gc = gpiod_to_chip(hub->gpio_reset); + struct i2c_adapter *adap = hub->i2c->adapter; + int ret; + + if (!hub->gpio_reset) + return 0; + + if (!gc) + return -EINVAL; + + ret = usb251xb_check_dev_children(&adap->dev, gc->parent); + if (ret) { + dev_err(hub->dev, "Reset GPIO chip is at the same i2c-bus\n"); + return -EINVAL; + } + + return 0; +} + static void usb251xb_reset(struct usb251xb *hub, int state) { if (!hub->gpio_reset) return; + i2c_lock_bus(hub->i2c->adapter, I2C_LOCK_SEGMENT); + gpiod_set_value_cansleep(hub->gpio_reset, state); /* wait for hub recovery/stabilization */ @@ -234,6 +268,8 @@ static void usb251xb_reset(struct usb251xb *hub, int state) usleep_range(500, 750); /* >=500us at power on */ else usleep_range(1, 10); /* >=1us at power down */ + + i2c_unlock_bus(hub->i2c->adapter, I2C_LOCK_SEGMENT); } static int usb251xb_connect(struct usb251xb *hub) @@ -621,6 +657,25 @@ static int usb251xb_probe(struct usb251xb *hub) } } + /* + * usb251x SMBus-slave SCL lane is muxed with CFG_SEL0 pin. So if anyone + * tries to work with the bus at the moment the hub reset is released, + * it may cause an invalid config being latched by usb251x. Particularly + * one of the config modes makes the hub loading a default registers + * value without SMBus-slave interface activation. If the hub + * accidentally gets this mode, this will cause the driver SMBus- + * functions failure. Normally we could just lock the SMBus-segment the + * hub i2c-interface resides for the device-specific reset timing. But + * the GPIO controller, which is used to handle the hub reset, might be + * placed at the same i2c-bus segment. In this case an error should be + * returned since we can't safely use the GPIO controller to clear the + * reset state (it may affect the hub configuration) and we can't lock + * the i2c-bus segment (it will cause a deadlock). + */ + err = usb251x_check_gpio_chip(hub); + if (err) + return err; + err = usb251xb_connect(hub); if (err) { dev_err(dev, "Failed to connect hub (%d)\n", err); -- 2.21.0