| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20220826084001.3341215-1-badhri@google.com>
Date: Fri, 26 Aug 2022 01:39:58 -0700
From: Badhri Jagan Sridharan <badhri@...gle.com>
To: Guenter Roeck <linux@...ck-us.net>,
Heikki Krogerus <heikki.krogerus@...ux.intel.com>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
Kyle Tso <kyletso@...gle.com>,
Badhri Jagan Sridharan <badhri@...gle.com>
Subject: [PATCH v1 1/4] usb: typec: tcpm: Add callbacks to mitigate wakeups
due to contaminant
On some of the TCPC implementations, when the Type-C port is exposed
to contaminants, such as water, TCPC stops toggling while reporting OPEN
either by the time TCPM reads CC pin status or during CC debounce
window. This causes TCPM to be stuck in TOGGLING state. If TCPM is made
to restart toggling, the behavior recurs causing redundant CPU wakeups
till the USB-C port is free of contaminant.
[206199.287817] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected]
[206199.640337] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected]
[206199.985789] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected]
...
To mitigate redundant TCPM wakeups, TCPCs which do have the needed hardware
can implement the check_contaminant callback which is invoked by TCPM
to evaluate for presence of contaminant. Lower level TCPC driver can
restart toggling through TCPM_PORT_CLEAN event when the driver detects
that USB-C port is free of contaminant. check_contaminant callback also passes
the disconnect_while_debounce flag which when true denotes that the CC pins
transitioned to OPEN state during the CC debounce window.
Signed-off-by: Badhri Jagan Sridharan <badhri@...gle.com>
---
drivers/usb/typec/tcpm/tcpm.c | 59 +++++++++++++++++++++++++++++++++--
include/linux/usb/tcpm.h | 7 +++++
2 files changed, 64 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index ea5a917c51b1..072c5a2817d0 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -36,6 +36,7 @@
#define FOREACH_STATE(S) \
S(INVALID_STATE), \
S(TOGGLING), \
+ S(CHECK_CONTAMINANT), \
S(SRC_UNATTACHED), \
S(SRC_ATTACH_WAIT), \
S(SRC_ATTACHED), \
@@ -249,6 +250,7 @@ enum frs_typec_current {
#define TCPM_RESET_EVENT BIT(2)
#define TCPM_FRS_EVENT BIT(3)
#define TCPM_SOURCING_VBUS BIT(4)
+#define TCPM_PORT_CLEAN BIT(5)
#define LOG_BUFFER_ENTRIES 1024
#define LOG_BUFFER_ENTRY_SIZE 128
@@ -483,6 +485,13 @@ struct tcpm_port {
* SNK_READY for non-pd link.
*/
bool slow_charger_loop;
+
+ /*
+ * When true indicates CC pins transitioned to OPEN state while
+ * debouncing(tCCDebounce).
+ */
+ bool disconnect_while_debouncing;
+
#ifdef CONFIG_DEBUG_FS
struct dentry *dentry;
struct mutex logbuffer_lock; /* log buffer access lock */
@@ -3663,6 +3672,7 @@ static int tcpm_src_attach(struct tcpm_port *port)
port->partner = NULL;
port->attached = true;
+ port->disconnect_while_debouncing = false;
port->send_discover = true;
return 0;
@@ -3797,6 +3807,7 @@ static int tcpm_snk_attach(struct tcpm_port *port)
port->partner = NULL;
port->attached = true;
+ port->disconnect_while_debouncing = false;
port->send_discover = true;
return 0;
@@ -3824,6 +3835,7 @@ static int tcpm_acc_attach(struct tcpm_port *port)
tcpm_typec_connect(port);
port->attached = true;
+ port->disconnect_while_debouncing = false;
return 0;
}
@@ -3908,11 +3920,22 @@ static void run_state_machine(struct tcpm_port *port)
switch (port->state) {
case TOGGLING:
break;
+ case CHECK_CONTAMINANT:
+ port->tcpc->check_contaminant(port->tcpc, port->disconnect_while_debouncing);
+ port->disconnect_while_debouncing = false;
+ break;
/* SRC states */
case SRC_UNATTACHED:
if (!port->non_pd_role_swap)
tcpm_swap_complete(port, -ENOTCONN);
tcpm_src_detach(port);
+ if (port->disconnect_while_debouncing) {
+ /* Check for contaminant when port reports disconnected while debouncing */
+ if (port->tcpc->check_contaminant) {
+ tcpm_set_state(port, CHECK_CONTAMINANT, 0);
+ break;
+ }
+ }
if (tcpm_start_toggling(port, tcpm_rp_cc(port))) {
tcpm_set_state(port, TOGGLING, 0);
break;
@@ -3922,6 +3945,7 @@ static void run_state_machine(struct tcpm_port *port)
tcpm_set_state(port, SNK_UNATTACHED, PD_T_DRP_SNK);
break;
case SRC_ATTACH_WAIT:
+ port->disconnect_while_debouncing = true;
if (tcpm_port_is_debug(port))
tcpm_set_state(port, DEBUG_ACC_ATTACHED,
PD_T_CC_DEBOUNCE);
@@ -3936,6 +3960,7 @@ static void run_state_machine(struct tcpm_port *port)
break;
case SNK_TRY:
+ port->disconnect_while_debouncing = false;
port->try_snk_count++;
/*
* Requirements:
@@ -4150,6 +4175,13 @@ static void run_state_machine(struct tcpm_port *port)
tcpm_swap_complete(port, -ENOTCONN);
tcpm_pps_complete(port, -ENOTCONN);
tcpm_snk_detach(port);
+ if (port->disconnect_while_debouncing) {
+ port->disconnect_while_debouncing = false;
+ if (port->tcpc->check_contaminant) {
+ tcpm_set_state(port, CHECK_CONTAMINANT, 0);
+ break;
+ }
+ }
if (tcpm_start_toggling(port, TYPEC_CC_RD)) {
tcpm_set_state(port, TOGGLING, 0);
break;
@@ -4159,6 +4191,7 @@ static void run_state_machine(struct tcpm_port *port)
tcpm_set_state(port, SRC_UNATTACHED, PD_T_DRP_SRC);
break;
case SNK_ATTACH_WAIT:
+ port->disconnect_while_debouncing = true;
if ((port->cc1 == TYPEC_CC_OPEN &&
port->cc2 != TYPEC_CC_OPEN) ||
(port->cc1 != TYPEC_CC_OPEN &&
@@ -4170,14 +4203,16 @@ static void run_state_machine(struct tcpm_port *port)
PD_T_PD_DEBOUNCE);
break;
case SNK_DEBOUNCED:
- if (tcpm_port_is_disconnected(port))
+ if (tcpm_port_is_disconnected(port)) {
tcpm_set_state(port, SNK_UNATTACHED,
PD_T_PD_DEBOUNCE);
- else if (port->vbus_present)
+ } else if (port->vbus_present) {
tcpm_set_state(port,
tcpm_try_src(port) ? SRC_TRY
: SNK_ATTACHED,
0);
+ port->disconnect_while_debouncing = false;
+ }
break;
case SRC_TRY:
port->try_src_count++;
@@ -4925,6 +4960,12 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1,
tcpm_set_state(port, SRC_ATTACH_WAIT, 0);
else if (tcpm_port_is_sink(port))
tcpm_set_state(port, SNK_ATTACH_WAIT, 0);
+ /* Check for contaminant when port reports disconnected while toggling */
+ else if (tcpm_port_is_disconnected(port) && port->tcpc->check_contaminant)
+ tcpm_set_state(port, CHECK_CONTAMINANT, 0);
+ break;
+ case CHECK_CONTAMINANT:
+ /* Wait for Toggling to be resumed */
break;
case SRC_UNATTACHED:
case ACC_UNATTACHED:
@@ -5225,6 +5266,7 @@ static void _tcpm_pd_vbus_off(struct tcpm_port *port)
case SNK_ATTACH_WAIT:
case SNK_DEBOUNCED:
/* Do nothing, as TCPM is still waiting for vbus to reaach VSAFE5V to connect */
+ port->disconnect_while_debouncing = false;
break;
case SNK_NEGOTIATE_CAPABILITIES:
@@ -5425,6 +5467,10 @@ static void tcpm_pd_event_handler(struct kthread_work *work)
port->vbus_source = true;
_tcpm_pd_vbus_on(port);
}
+ if (events & TCPM_PORT_CLEAN) {
+ tcpm_log(port, "port clean");
+ tcpm_set_state(port, TOGGLING, 0);
+ }
spin_lock(&port->pd_event_lock);
}
@@ -5477,6 +5523,15 @@ void tcpm_sourcing_vbus(struct tcpm_port *port)
}
EXPORT_SYMBOL_GPL(tcpm_sourcing_vbus);
+void tcpm_port_clean(struct tcpm_port *port)
+{
+ spin_lock(&port->pd_event_lock);
+ port->pd_events |= TCPM_PORT_CLEAN;
+ spin_unlock(&port->pd_event_lock);
+ kthread_queue_work(port->wq, &port->event_work);
+}
+EXPORT_SYMBOL_GPL(tcpm_port_clean);
+
static void tcpm_enable_frs_work(struct kthread_work *work)
{
struct tcpm_port *port = container_of(work, struct tcpm_port, enable_frs);
diff --git a/include/linux/usb/tcpm.h b/include/linux/usb/tcpm.h
index bffc8d3e14ad..436563d91a49 100644
--- a/include/linux/usb/tcpm.h
+++ b/include/linux/usb/tcpm.h
@@ -114,6 +114,11 @@ enum tcpm_transmit_type {
* Optional; The USB Communications Capable bit indicates if port
* partner is capable of communication over the USB data lines
* (e.g. D+/- or SS Tx/Rx). Called to notify the status of the bit.
+ * @check_contaminant:
+ * Optional; The callback is called when CC pins report open status
+ * at the end of the deboumce period or when the port is still
+ * toggling. Chip level drivers are expected to check for contaminant
+ * and call tcpm_clean_port when the port is clean.
*/
struct tcpc_dev {
struct fwnode_handle *fwnode;
@@ -148,6 +153,7 @@ struct tcpc_dev {
bool pps_active, u32 requested_vbus_voltage);
bool (*is_vbus_vsafe0v)(struct tcpc_dev *dev);
void (*set_partner_usb_comm_capable)(struct tcpc_dev *dev, bool enable);
+ void (*check_contaminant)(struct tcpc_dev *dev, bool disconnect_while_debouncing);
};
struct tcpm_port;
@@ -165,5 +171,6 @@ void tcpm_pd_transmit_complete(struct tcpm_port *port,
enum tcpm_transmit_status status);
void tcpm_pd_hard_reset(struct tcpm_port *port);
void tcpm_tcpc_reset(struct tcpm_port *port);
+void tcpm_port_clean(struct tcpm_port *port);
#endif /* __LINUX_USB_TCPM_H */
--
2.37.2.672.g94769d06f0-goog
Powered by blists - more mailing lists