linux-kernel - Re: [PATCH] i2c: designware: fix slave omitted IC_INTR_STOP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f4ae83cc-b366-71a8-d174-0bb668dc1992@linux.intel.com>
Date:   Wed, 14 Oct 2020 13:43:39 +0300
From:   Jarkko Nikula <jarkko.nikula@...ux.intel.com>
To:     Michael Wu <michael.wu@...ics.com>,
        Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        Mika Westerberg <mika.westerberg@...ux.intel.com>,
        linux-i2c@...r.kernel.org, linux-kernel@...r.kernel.org
Cc:     Morgan Chang <morgan.chang@...ics.com>,
        Dean Hsiao <dean.hsiao@...ics.com>,
        Paul Chen <paul.chen@...ics.com>
Subject: Re: [PATCH] i2c: designware: fix slave omitted IC_INTR_STOP_DET

Hi

On 10/14/20 8:25 AM, Michael Wu wrote:
> When an I2C slave works, sometimes both IC_INTR_RX_FULL and
> IC_INTR_STOP_DET are rising during an IRQ handle, especially when system
> is busy or too late to handle interrupts.
> 
> If IC_INTR_RX_FULL is rising and the system doesn't handle immediately,
> IC_INTR_STOP_DET may be rising and the system has to handle these two
> events. For this there may be two problems:
> e
> 1. IC_INTR_STOP_DET is rising after i2c_dw_read_clear_intrbits_slave()
>     done: It seems invalidated because WRITE_REQUESTED is done after the
>     1st WRITE_RECEIVED.
> 
> $ i2cset -f -y 2 0x42 0x00 0x41; dmesg -c
> [0][clear_intrbits]0x1 STATUS SLAVE_ACTIVITY=0x1 : RAW_INTR_STAT=0x514 : INTR_STAT=0x4
> [1][irq_handler   ]0x1 STATUS SLAVE_ACTIVITY=0x1 : RAW_INTR_STAT=0x514 : INTR_STAT=0x4
> WRITE_RECEIVED
> [0][clear_intrbits]0x1 STATUS SLAVE_ACTIVITY=0x1 : RAW_INTR_STAT=0x514 : INTR_STAT=0x4
> [1][irq_handler   ]0x1 STATUS SLAVE_ACTIVITY=0x0 : RAW_INTR_STAT=0x714 : INTR_STAT=0x204
> WRITE_REQUESTED
> WRITE_RECEIVED
> [0][clear_intrbits]0x1 STATUS SLAVE_ACTIVITY=0x0 : RAW_INTR_STAT=0x710 : INTR_STAT=0x200
> [1][irq_handler   ]0x1 STATUS SLAVE_ACTIVITY=0x0 : RAW_INTR_STAT=0x510 : INTR_STAT=0x0
> STOP
> [2][clear_intrbits]0x1 STATUS SLAVE_ACTIVITY=0x0 : RAW_INTR_STAT=0x510 : INTR_STAT=0x0
> 
>    t1: ISR with the 1st IC_INTR_RX_FULL.
>    t2: Clear listed IC_INTR bits by i2c_dw_read_clear_intrbits_slave().
>    t3: Enter i2c_dw_irq_handler_slave() and then do
>        i2c_slave_event(WRITE_RECEIVED) because
>        if (stat & DW_IC_INTR_RX_FULL).
>    t4: ISR with the 2nd IC_INTR_RX_FULL.
>    t5: Clear listed IC_INTR bits by i2c_dw_read_clear_intrbits_slave(),
>        while IC_INTR_STOP_DET has not risen yet.
>    t6: Enter i2c_dw_irq_handler_slave() and then IC_INTR_STOP_DET is
>        rising. i2c_slave_event(WRITE_REQUESTED) will be done first because
>        if ((stat & DW_IC_INTR_RX_FULL) && (stat & DW_IC_INTR_STOP_DET)) and
>        then doing i2c_slave_event(WRITE_RECEIVED).
>    t7: do i2c_slave_event(STOP) due to IC_INTR_STOP_DET not be cleared yet.
> 
> 2. Both IC_INTR_STOP_DET and IC_INTR_RX_FULL are rising before
>     i2c_dw_read_clear_intrbits_slave(): STOP cannot wait because
>     IC_INTR_STOP_DET is cleared by i2c_dw_read_clear_intrbits_slave().
> 
> $ i2cset -f -y 2 0x42 0x00 0x41; dmesg -c
> [0][clear_intrbits]0x1 STATUS SLAVE_ACTIVITY=0x1 : RAW_INTR_STAT=0x514 : INTR_STAT=0x4
> [1][irq_handler   ]0x1 STATUS SLAVE_ACTIVITY=0x1 : RAW_INTR_STAT=0x514 : INTR_STAT=0x4
> WRITE_RECEIVED
> [0][clear_intrbits]0x1 STATUS SLAVE_ACTIVITY=0x0 : RAW_INTR_STAT=0x714 : INTR_STAT=0x204
> [1][irq_handler   ]0x1 STATUS SLAVE_ACTIVITY=0x0 : RAW_INTR_STAT=0x514 : INTR_STAT=0x4
> WRITE_RECEIVED
> 
>    t1: ISR with the 1st IC_INTR_RX_FULL.
>    t2: Clear listed IC_INTR bits by i2c_dw_read_clear_intrbits_slave().
>    t3: Enter i2c_dw_irq_handler_slave() and then do
>        i2c_slave_event(WRITE_RECEIVED) because
>        if (stat & DW_IC_INTR_RX_FULL).
>    t4: ISR with both IC_INTR_STOP_DET and the 2nd IC_INTR_RX_FULL.
>    t5: Clear listed IC_INTR bits by i2c_dw_read_clear_intrbits_slave(). The
>        current IC_INTR_STOP_DET is cleared by this
>        i2c_dw_read_clear_intrbits_slave().
>    t6: Enter i2c_dw_irq_handler_slave() and then do
>        i2c_slave_event(WRITE_RECEIVED) because
>        if (stat & DW_IC_INTR_RX_FULL).
>    t7: i2c_slave_event(STOP) never be done because IC_INTR_STOP_DET was
>        cleared in t5.
> 
> In order to resolve these problems, i2c_dw_read_clear_intrbits_slave()
> should be called only one time in ISR and take the returned stat to handle
> those occurred events.
> 
> Signed-off-by: Michael Wu <michael.wu@...ics.com>
> ---
>   drivers/i2c/busses/i2c-designware-slave.c | 79 ++++++++++++-----------
>   1 file changed, 40 insertions(+), 39 deletions(-)
> 
Thanks for the patch. I was thinking this too after your report but 
haven't found actually time to look at implementing it.

But what I was thinking it is probably good to have two patches. First 
patch that changes only i2c_dw_read_clear_intrbits_slave() semantics so 
that it's called only once like here and second patch that does other 
logic changes. Makes easier to catch possible regressions I think.

Jarkko