linux-kernel - Re: [PATCH RESEND 2/2] usb: typec: tipd: fix event checking for tps6598x

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b6bf7f8e-7d46-4b70-930c-9483f13fd80a@wolfvision.net>
Date: Wed, 3 Apr 2024 10:55:29 +0200
From: Javier Carrasco <javier.carrasco@...fvision.net>
To: Heikki Krogerus <heikki.krogerus@...ux.intel.com>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
 Abdel Alkuor <abdelalkuor@...tab.com>, linux-usb@...r.kernel.org,
 linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH RESEND 2/2] usb: typec: tipd: fix event checking for
 tps6598x

On 4/2/24 12:29, Heikki Krogerus wrote:
> On Thu, Mar 28, 2024 at 05:55:52PM +0100, Javier Carrasco wrote:
>> The current interrupt service routine of the tps6598x only reads the
>> first 64 bits of the INT_EVENT1 and INT_EVENT2 registers, which means
>> that any event above that range will be ignored, leaving interrupts
>> unattended. Moreover, those events will not be cleared, and the device
>> will keep the interrupt enabled.
>>
>> This issue has been observed while attempting to load patches, and the
>> 'ReadyForPatch' field (bit 81) of INT_EVENT1 was set.
>>
>> Read the complete INT_EVENT registers to handle all interrupts generated
>> by the device in a similar fashion to what is already done for the
>> tps25750.
>>
>> Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
>> Cc: stable@...r.kernel.org
>> Signed-off-by: Javier Carrasco <javier.carrasco@...fvision.net>
>> ---
>>  drivers/usb/typec/tipd/core.c | 31 ++++++++++++++++++-------------
>>  1 file changed, 18 insertions(+), 13 deletions(-)
>>
>> diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
>> index 7c2f01344860..308748d6cae6 100644
>> --- a/drivers/usb/typec/tipd/core.c
>> +++ b/drivers/usb/typec/tipd/core.c
>> @@ -637,48 +637,53 @@ static irqreturn_t tps25750_interrupt(int irq, void *data)
>>  static irqreturn_t tps6598x_interrupt(int irq, void *data)
>>  {
>>  	struct tps6598x *tps = data;
>> -	u64 event1 = 0;
>> -	u64 event2 = 0;
>> +	u64 event1[2] = { };
>> +	u64 event2[2] = { };
>>  	u32 status;
>>  	int ret;
>>  
>>  	mutex_lock(&tps->lock);
>>  
>> -	ret = tps6598x_read64(tps, TPS_REG_INT_EVENT1, &event1);
>> -	ret |= tps6598x_read64(tps, TPS_REG_INT_EVENT2, &event2);
>> +	ret = tps6598x_block_read(tps, TPS_REG_INT_EVENT1, event1, 11);
> 
> This is not going to work with the older TI PD controllers.
> 
> The lenght of these registers is 8 bytes on the older TI PD
> controllers (TPS65981, TPS65982, etc.). I think we need to split this
> function.
> 

That is a good point. I had a look at the older TI PD controllers and I
agree with you that we should split the function to cover both register
lengths separately.

I was thinking about adding a new compatible for the newer PD
controllers (tps65987 and tps65988), keeping the current tps6598x for
the older ones as well as backwards compatibility. But backwards
compatibility would also mean that flags beyond the first 8 bytes would
be ignored.

On the other hand, the upper flags are only relevant for firmware
updates, so we could check those (i.e. read 11 bytes) if a firmware was
provided via "firmware-name", and ignore them (i.e. read 8 bytes) otherwise.

Other ideas or improvements to mine are more than welcome.

Best regards,
Javier Carrasco