Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <bf392104-96b0-a85b-f68e-088bd3884d9a@linux.intel.com>
Date:   Wed, 24 May 2023 15:33:31 +0300
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Firefox/102.0 Thunderbird/102.10.0
Subject: Re: [PATCH v1] i2c: designware: Handle invalid SMBus block data
 response length
Content-Language: en-US
To:     Tam Nguyen <tamnguyenchi@os.amperecomputing.com>,
        linux-kernel@vger.kernel.org, linux-i2c@vger.kernel.org
Cc:     patches@amperecomputing.com, andriy.shevchenko@linux.intel.com,
        mika.westerberg@linux.intel.com, jsd@semihalf.com,
        chuong@os.amperecomputing.com, darren@os.amperecomputing.com,
        stable@vger.kernel.org
References: <20230523082118.10935-1-tamnguyenchi@os.amperecomputing.com>
From:   Jarkko Nikula <jarkko.nikula@linux.intel.com>
In-Reply-To: <20230523082118.10935-1-tamnguyenchi@os.amperecomputing.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

Hi

On 5/23/23 11:21, Tam Nguyen wrote:
> In I2C_FUNC_SMBUS_BLOCK_DATA case, the I2C Designware driver does not
> handle correctly when it receives the length of SMBus block data
> response from SMBus slave device, which is outside the range 1-32 bytes.
> Consequently, the I2C Designware bus is stuck and cannot recover.
> Because if IC_EMPTYFIFO_HOLD_MASTER_EN is set, which cannot be detected
> from the registers, the controller can be disabled if the STOP bit is set.
> But it is only set after receiving block data response length.
> 
> Hence, to prevent the bus from stuck condition, after receiving the
> invalid block data response length, the driver will read another byte
> with STOP bit set.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Tam Nguyen <tamnguyenchi@os.amperecomputing.com>
> ---
>   drivers/i2c/busses/i2c-designware-master.c | 15 +++++++++++++--
>   1 file changed, 13 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
> index 55ea91a63382..94dadd785ed0 100644
> --- a/drivers/i2c/busses/i2c-designware-master.c
> +++ b/drivers/i2c/busses/i2c-designware-master.c
> @@ -527,8 +527,19 @@ i2c_dw_read(struct dw_i2c_dev *dev)
>   
>   			regmap_read(dev->map, DW_IC_DATA_CMD, &tmp);
>   			/* Ensure length byte is a valid value */
> -			if (flags & I2C_M_RECV_LEN &&
> -			    (tmp & DW_IC_DATA_CMD_DAT) <= I2C_SMBUS_BLOCK_MAX && tmp > 0) {
> +			if (flags & I2C_M_RECV_LEN) {
> +				/*
> +				 * if IC_EMPTYFIFO_HOLD_MASTER_EN is set, which cannot be
> +				 * detected from the registers, the controller can be
> +				 * disabled if the STOP bit is set. But it is only set
> +				 * after receiving block data response length in
> +				 * I2C_FUNC_SMBUS_BLOCK_DATA case. That needs to read
> +				 * another byte with STOP bit set when the block data
> +				 * response length is invalid to complete the transaction.
> +				 */
> +				if ((tmp & DW_IC_DATA_CMD_DAT) > I2C_SMBUS_BLOCK_MAX || tmp == 0)
> +					tmp = 1;
> +
>   				len = i2c_dw_recv_len(dev, tmp);
>   			}
>   			*buf++ = tmp;

Looks otherwise good to me but I'm wondering the "tmp == 0" test can it 
have the bit 11 set (on a HW where it's supported) and should it be 
covered with DW_IC_DATA_CMD_DAT mask too? Please see commit f53f15ba5a85 
("i2c: designware: Get right data length").