Re: PMBus memory overflow

[Matt Corallo <yalbrymrb@mattcorallo.com>]

On 4/18/25 6:30 PM, Guenter Roeck wrote:
> On 4/18/25 14:03, Matt Corallo wrote:
>>
>>
>> On 4/17/25 9:21 PM, Guenter Roeck wrote:
>>> On 4/17/25 11:14, Matt Corallo wrote:
>>>> I do not, sadly (though FSP support has been rumored to help out at least marginally, though 
>>>> they haven't been useful for me). Interestingly the (I guess ancient now) pmbus_peek.c script 
>>>> has no issues reading from it (added a quick print on the -E2BIG line and it didn't get hit). 
>>>> pmbuss_peek.c says the following:
>>>>
>>>> root@rackchill-refresh:~# ./a.out -b /dev/i2c-3 -s 0x59
>>>> PMBus slave on /dev/i2c-3, address 0x59
>>>>
>>>
>>> pmbus_peek supports reading up to 255 bytes into the receive buffer.
>>
>> Hmm, I'm using this version, which on L622 checks for a length > 32 (and doesn't get hit in the -s 
>> command) - https://github.com/jktjkt/pmbus_peek/blob/master/pmbus_peek.c#L622
>>
> 
> Sorry, I am only guessing here. The code in pmbus_peek.c is a bit odd, though:
> It does validate the first byte, but then it jumps to try_i2c: and tries again,
> this time reading up to 255 bytes. I am not really sure if that ends up reporting
> an error or not. The comment "NOTE:  this probably won't be visible" doesn't
> really improve my confidence that it will report the problem.

Sure, that's why I `printf("BAD LEN\n");`'d there but didn't see it get hit.


> If you are up to compiling code, it would be great if you could add some debug logs
> into pmbus_peek.c and/or into the hid-cp2112.c driver to see what is actually
> returned from the chip.

Sure, of course. Obviously easier to do in pmbus_peek if you have any suggested logs you want. The 
device caps output is (and still never hit my BAD LEN printf):

./a.out -b /dev/i2c-3 -l -v 0x58
PMBus slave on /dev/i2c-3, address 0x58

Inventory Data:
   Manufacturer:		FSP-GROUP
   Model:		FSP520-20RAB
   Revision:		(null)
   Built on:		
   Serial:		
   IC Device:		PIC24FJ32GA004

PMBus revisions (0x22):	part I, ver 1.1; part II, ver 1.2
Capabilities (0x90):	PEC, SMBALERT#, 100 KHz

Supported Commands:
   00 page                      rw u8 (bitmask)
   01 operation                 rw u8 (bitmask)
   02 on_off_config             rw u8 (bitmask)
   03 clear_fault                w nodata
   05 page_plus_read             w block
   19 capability                r  u8 (bitmask)
   1a query                     rw process_call
   1b smbalert_mask             rw block
   20 vout_mode                 r  u8 (bitmask)
   30 coefficients              r  process_call
   3b fan_command_1             rw s16 (LINEAR)
   79 status_word               r  u16 (bitmask)
   7a status_vout               r  u8 (bitmask)
   7b status_iout               r  u8 (bitmask)
   7c status_input              r  u8 (bitmask)
   7d status_temperature        r  u8 (bitmask)
   81 status_fans_1_2           rw u8 (bitmask)
   86 read_ein                  r  block(6), Energy counter (DIRECT)
   87 read_eout                 r  block(6), Energy counter (DIRECT)
   88 read_vin                  r  s16 (LINEAR), Volts
   89 read_iin                  r  s16 (LINEAR), Amperes
   8b read_vout                 r  x16 (VOUT_MODE), Volts
   8c read_iout                 r  s16 (LINEAR), Amperes
   8d read_temperature_1        r  s16 (LINEAR), degrees Celsius
   8e read_temperature_2        r  s16 (LINEAR), degrees Celsius
   90 read_fan_speed_1          r  s16 (LINEAR)
   95 read_frequency            r  s16 (LINEAR)
   96 read_pout                 r  s16 (LINEAR), Watts
   97 read_pin                  r  s16 (LINEAR), Watts
   98 pmbus_revision            r  u8 (bitmask)
   99 mfr_id                    r  block, ISO 8859/1 string
   9a mfr_model                 r  block, ISO 8859/1 string
   9d mfr_date                  r  block, ISO 8859/1 string
   9e mfr_serial                r  block, ISO 8859/1 string
   a4 mfr_vout_min              r  s16 (LINEAR), Volts
   a5 mfr_iout_max              r  s16 (LINEAR), Amperes
   ad ic_device_id              r  block, ISO 8859/1 string
   d1 mfr_specific_01           r  (UNKNOWN call syntax)
   d2 mfr_specific_02           r  (UNKNOWN call syntax)
   d4 mfr_specific_04           r  (UNKNOWN call syntax)
   d5 mfr_specific_05           r  (UNKNOWN call syntax)
   d7 mfr_specific_07           rw (UNKNOWN call syntax)
   d8 mfr_specific_08           r  (UNKNOWN call syntax)
   d9 mfr_specific_09           r  (UNKNOWN call syntax)
   da mfr_specific_10           r  (UNKNOWN call syntax)
   db mfr_specific_11           r  (UNKNOWN call syntax)
   de mfr_specific_14           r  (UNKNOWN call syntax)
   e0 mfr_specific_16           r  (UNKNOWN call syntax)
   e1 mfr_specific_17           rw (UNKNOWN call syntax)
   e2 mfr_specific_18           rw (UNKNOWN call syntax)
   e3 mfr_specific_19           rw (UNKNOWN call syntax)
   e5 mfr_specific_21            w (UNKNOWN call syntax)
   f0 mfr_specific_32           rw (UNKNOWN call syntax)