From: Tam Nguyen <tamnguyenchi@os.amperecomputing.com>
To: linux-kernel@vger.kernel.org, linux-i2c@vger.kernel.org
Cc: patches@amperecomputing.com, jarkko.nikula@linux.intel.com,
andriy.shevchenko@linux.intel.com,
mika.westerberg@linux.intel.com, jsd@semihalf.com,
tamnguyenchi@os.amperecomputing.com,
chuong@os.amperecomputing.com, darren@os.amperecomputing.com,
stable@vger.kernel.org
Subject: [PATCH v2 2/2] i2c: designware: Handle invalid SMBus block data response length value
Date: Wed, 26 Jul 2023 15:00:01 +0700 [thread overview]
Message-ID: <20230726080001.337353-3-tamnguyenchi@os.amperecomputing.com> (raw)
In-Reply-To: <20230726080001.337353-1-tamnguyenchi@os.amperecomputing.com>
In the I2C_FUNC_SMBUS_BLOCK_DATA case, the invalid length byte value
(outside of 1-32) of the SMBus block data response from the Slave device
is not correctly handled by the I2C Designware driver.
In case IC_EMPTYFIFO_HOLD_MASTER_EN==1, which cannot be detected
from the registers, the Master can be disabled only if the STOP bit
is set. Without STOP bit set, the Master remains active, holding the bus
until receiving a block data response length. This hangs the bus and
is unrecoverable.
Avoid this by issuing another dump read to reach the stop condition when
an invalid length byte is received.
Cc: stable@vger.kernel.org
Signed-off-by: Tam Nguyen <tamnguyenchi@os.amperecomputing.com>
---
drivers/i2c/busses/i2c-designware-master.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
index e96276d1b002..c51fc1f4b97e 100644
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -528,8 +528,19 @@ i2c_dw_read(struct dw_i2c_dev *dev)
regmap_read(dev->map, DW_IC_DATA_CMD, &tmp);
tmp &= DW_IC_DATA_CMD_DAT;
/* Ensure length byte is a valid value */
- if (flags & I2C_M_RECV_LEN &&
- tmp <= I2C_SMBUS_BLOCK_MAX && tmp > 0) {
+ if (flags & I2C_M_RECV_LEN) {
+ /*
+ * if IC_EMPTYFIFO_HOLD_MASTER_EN is set, which cannot be
+ * detected from the registers, the controller can be
+ * disabled if the STOP bit is set. But it is only set
+ * after receiving block data response length in
+ * I2C_FUNC_SMBUS_BLOCK_DATA case. That needs to read
+ * another byte with STOP bit set when the block data
+ * response length is invalid to complete the transaction.
+ */
+ if (!tmp || tmp > I2C_SMBUS_BLOCK_MAX)
+ tmp = 1;
+
len = i2c_dw_recv_len(dev, tmp);
}
*buf++ = tmp;
--
2.25.1
next prev parent reply other threads:[~2023-07-26 8:09 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-26 7:59 [PATCH v2 0/2] i2c: designware: Handle invalid SMBus block data response length value Tam Nguyen
2023-07-26 8:00 ` [PATCH v2 1/2] i2c: designware: Correct length byte validation logic Tam Nguyen
2023-07-27 10:36 ` Jarkko Nikula
2023-08-14 13:29 ` Wolfram Sang
2023-07-26 8:00 ` Tam Nguyen [this message]
2023-07-27 10:49 ` [PATCH v2 2/2] i2c: designware: Handle invalid SMBus block data response length value Jarkko Nikula
2023-08-14 13:29 ` Wolfram Sang
2023-08-02 20:02 ` [PATCH v2 0/2] " Andi Shyti
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230726080001.337353-3-tamnguyenchi@os.amperecomputing.com \
--to=tamnguyenchi@os.amperecomputing.com \
--cc=andriy.shevchenko@linux.intel.com \
--cc=chuong@os.amperecomputing.com \
--cc=darren@os.amperecomputing.com \
--cc=jarkko.nikula@linux.intel.com \
--cc=jsd@semihalf.com \
--cc=linux-i2c@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mika.westerberg@linux.intel.com \
--cc=patches@amperecomputing.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox