Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6e3c8beb authored by Serge Semin's avatar Serge Semin Committed by Greg Kroah-Hartman
Browse files

usb: usb251xb: Lock i2c-bus segment the hub resides 



SMBus slave configuration is activated by CFG_SEL[1:0]=0x1 pins
state. This is the mode the hub is supposed to be to let this driver
work correctly. But a race condition might happen right after reset
is cleared due to CFG_SEL[0] pin being multiplexed with SMBus SCL
function. In case if the reset pin is handled by a i2c GPIO expander,
which is also placed at the same i2c-bus segment as the usb251x
SMB-interface connected to, then the hub reset clearance might
cause the CFG_SEL[0] being latched in unpredictable state. So
sometimes the hub configuration mode might be 0x1 (as expected),
but sometimes being 0x0, which doesn't imply to have the hub SMBus-slave
interface activated and consequently causes this driver failure.

In order to fix the problem we must make sure the GPIO-reset chip doesn't
reside the same i2c-bus segment as the SMBus-interface of the hub. If
it doesn't, we can safely block the segment for the time the reset is
cleared to prevent anyone generating a traffic at the i2c-bus SCL lane
connected to the CFG_SEL[0] pin. But if it does, nothing we can do, so
just return an error. If we locked the i2c-bus segment and tried to
communicate with the GPIO-expander, it would cause a deadlock. If we didn't
lock the i2c-bus segment, it would randomly cause the CFG_SEL[0] bit flip.

Signed-off-by: default avatarSerge Semin <fancer.lancer@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 77a49465

drivers/usb/misc/usb251xb.c

+55 −0
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ 


#include <linux/delay.h>

#include <linux/gpio/consumer.h>

#include <linux/gpio/driver.h>

#include <linux/i2c.h>

#include <linux/module.h>

#include <linux/nls.h>
@@ -222,11 +223,44 @@ static const struct usb251xb_data usb2517i_data = { 
	.product_str = "USB2517i",

};



static int usb251xb_check_dev_children(struct device *dev, void *child)

{

	if (dev->type == &i2c_adapter_type) {

		return device_for_each_child(dev, child,

					     usb251xb_check_dev_children);

	}



	return (dev == child);

}



static int usb251x_check_gpio_chip(struct usb251xb *hub)

{

	struct gpio_chip *gc = gpiod_to_chip(hub->gpio_reset);

	struct i2c_adapter *adap = hub->i2c->adapter;

	int ret;



	if (!hub->gpio_reset)

		return 0;



	if (!gc)

		return -EINVAL;



	ret = usb251xb_check_dev_children(&adap->dev, gc->parent);

	if (ret) {

		dev_err(hub->dev, "Reset GPIO chip is at the same i2c-bus\n");

		return -EINVAL;

	}



	return 0;

}



static void usb251xb_reset(struct usb251xb *hub, int state)

{

	if (!hub->gpio_reset)

		return;



	i2c_lock_bus(hub->i2c->adapter, I2C_LOCK_SEGMENT);



	gpiod_set_value_cansleep(hub->gpio_reset, state);



	/* wait for hub recovery/stabilization */
@@ -234,6 +268,8 @@ static void usb251xb_reset(struct usb251xb *hub, int state) 
		usleep_range(500, 750);	/* >=500us at power on */

	else

		usleep_range(1, 10);	/* >=1us at power down */



	i2c_unlock_bus(hub->i2c->adapter, I2C_LOCK_SEGMENT);

}



static int usb251xb_connect(struct usb251xb *hub)
@@ -621,6 +657,25 @@ static int usb251xb_probe(struct usb251xb *hub) 
		}

	}



	/*

	 * usb251x SMBus-slave SCL lane is muxed with CFG_SEL0 pin. So if anyone

	 * tries to work with the bus at the moment the hub reset is released,

	 * it may cause an invalid config being latched by usb251x. Particularly

	 * one of the config modes makes the hub loading a default registers

	 * value without SMBus-slave interface activation. If the hub

	 * accidentally gets this mode, this will cause the driver SMBus-

	 * functions failure. Normally we could just lock the SMBus-segment the

	 * hub i2c-interface resides for the device-specific reset timing. But

	 * the GPIO controller, which is used to handle the hub reset, might be

	 * placed at the same i2c-bus segment. In this case an error should be

	 * returned since we can't safely use the GPIO controller to clear the

	 * reset state (it may affect the hub configuration) and we can't lock

	 * the i2c-bus segment (it will cause a deadlock).

	 */

	err = usb251x_check_gpio_chip(hub);

	if (err)

		return err;



	err = usb251xb_connect(hub);

	if (err) {

		dev_err(dev, "Failed to connect hub (%d)\n", err);