Re: PMBus memory overflow

[Matt Corallo <yalbrymrb@mattcorallo.com>]

On 4/17/25 2:00 PM, Guenter Roeck wrote:
> On Thu, Apr 17, 2025 at 11:39:14AM -0400, Matt Corallo wrote:
>> When adding the PMBus entry for a FSP520-20RAB (actually FSP Twins Pro but
>> it appears to be identical hardware with a provided SMBus -> USB adapter and
>> it self-reports as an FSP520-20RAB when queried over PMBus using the old
>> pmbus_peek.c script) with `echo pmbus 0x59 >
>> /sys/bus/i2c/devices/i2c-3/new_device` I got the following BUG_ON (on
>> Proxmox's 6.8.12-8-pve kernel). Its redundant and reports back fine on 0x60
>> and 0x59 for both of its modules (using pmbus_peek.c) and I'd already added
>> 0x60 and it BUG'd adding the second module at 0x59.
>>
> ...
>> Apr 17 15:31:19 rackchill-refresh kernel:  i2c_smbus_read_block_data+0x116/0x120
>> Apr 17 15:31:19 rackchill-refresh kernel:
>> pmbus_check_block_register.constprop.0+0x77/0x100 [pmbus_core]
> 
> Interesting. That function reads into a buffer which is larger than the
> largest valid PMBus transaction. I can only imagine that the controller
> returns invalid data in that transaction, where the first returned byte
> is not the length of the transfer but something else.
> i2c_smbus_read_block_data() does an unconditional
> 	memcpy(values, &data.block[1], data.block[0]);
> which of course will go haywire if data.block[0] (or in other words the
> first data byte returned from the device) exceeds the size of the
> data buffer. Do you happen to have a datasheet ?

I do not, sadly (though FSP support has been rumored to help out at least marginally, though they 
haven't been useful for me). Interestingly the (I guess ancient now) pmbus_peek.c script has no 
issues reading from it (added a quick print on the -E2BIG line and it didn't get hit). pmbuss_peek.c 
says the following:

root@rackchill-refresh:~# ./a.out -b /dev/i2c-3 -s 0x59
PMBus slave on /dev/i2c-3, address 0x59

Inventory Data:
   Manufacturer:		FSP-GROUP
   Model:		FSP520-20RAB
   Revision:		(null)
   Built on:		
   Serial:		
   IC Device:		PIC24FJ32GA004

PMBus revisions (0x22):	part I, ver 1.1; part II, ver 1.2
Capabilities (0x90):	PEC, SMBALERT#, 100 KHz

Status 0000:

Attribute Values:
   page                  00: (BITMAP)
   operation             00: (BITMAP)
   on_off_config         15: (BITMAP)
   vout_mode             17: (BITMAP)
   fan_command_1         0000: 0
   ein                   ba4ba00938ba: 5.26211e+06
   eout                  1e56a12038ba: 5.29753e+06
   vin                   f1e8: 122 Volts
   iin                   c09c: 0.609375 Amperes
   vout                  1869: 12.2051 Volts
   iout                  caad: 5.35156 Amperes
   temperature_1         001c: 28 degrees Celsius
   temperature_2         0024: 36 degrees Celsius
   fan_speed_1           1a1f: 4344
   frequency             f0ec: 59
   pout                  f108: 66 Watts
   pin                   f128: 74 Watts
   mfr_vout_min          0000: 0 Volts
   mfr_iout_max          0000: 0 Amperes

root@rackchill-refresh:~# ./a.out -b /dev/i2c-3 -s 0x58
PMBus slave on /dev/i2c-3, address 0x58

Inventory Data:
   Manufacturer:		FSP-GROUP
   Model:		FSP520-20RAB
   Revision:		(null)
   Built on:		
   Serial:		
   IC Device:		PIC24FJ32GA004

PMBus revisions (0x22):	part I, ver 1.1; part II, ver 1.2
Capabilities (0x90):	PEC, SMBALERT#, 100 KHz

Status 0000:

Attribute Values:
   page                  00: (BITMAP)
   operation             00: (BITMAP)
   on_off_config         15: (BITMAP)
   vout_mode             17: (BITMAP)
   fan_command_1         0000: 0
   ein                   0574e89f8070: 7.63164e+06
   eout                  613f88b78070: 4.47254e+06
   vin                   f1e8: 122 Volts
   iin                   c039: 0.222656 Amperes
   vout                  1871: 12.2207 Volts
   iout                  c11e: 1.11719 Amperes
   temperature_1         001b: 27 degrees Celsius
   temperature_2         0024: 36 degrees Celsius
   fan_speed_1           13e5: 3988
   frequency             f0ec: 59
   pout                  f038: 14 Watts
   pin                   f050: 20 Watts
   mfr_vout_min          0000: 0 Volts
   mfr_iout_max          0000: 0 Amperes