The ISRs of the tps25750 and tps6598x do not handle generated events properly under all circumstances.
The tps6598x ISR does not read all bits of the INT_EVENTX registers, leaving events signaled with bits above 64 unattended. Moreover, these events are not cleared, leaving the interrupt enabled.
The tps25750 reads all bits of the INT_EVENT1 register, but the event checking is not right because the same event is checked in two different regions of the same register by means of an OR operation.
This series aims to fix both issues by reading all bits of the INT_EVENTX registers, and limiting the event checking to the region where the supported events are defined (currently they are limited to the first 64 bits of the registers, as the are defined as BIT_ULL()).
If the need for events above the first 64 bits of the INT_EVENTX registers arises, a different mechanism might be required. But for the current needs, all definitions can be left as they are.
Note: resend to add the Cc tag for 'stable' (fixes in the series).
Signed-off-by: Javier Carrasco javier.carrasco@wolfvision.net --- Javier Carrasco (2): usb: typec: tipd: fix event checking for tps25750 usb: typec: tipd: fix event checking for tps6598x
drivers/usb/typec/tipd/core.c | 37 +++++++++++++++++++++---------------- 1 file changed, 21 insertions(+), 16 deletions(-) --- base-commit: 4cece764965020c22cff7665b18a012006359095 change-id: 20240328-tps6598x_fix_event_handling-3398d3d82f85
Best regards,
In its current form, the interrupt service routine of the tps25750 checks the event flags in the lowest 64 bits of the interrupt event register (event[0]), but also in the upper part (event[1]).
Given that all flags are defined as BIT() or BIT_ULL(), they are restricted to the first 64 bits of the INT_EVENT1 register. Including the upper part of the register can lead to false positives e.g. if the event 64 bits above the one being checked is set, but the one being checked is not.
Restrict the flag checking to the first 64 bits of the INT_EVENT1 register.
Fixes: 7e7a3c815d22 ("USB: typec: tps6598x: Add TPS25750 support") Cc: stable@vger.kernel.org Signed-off-by: Javier Carrasco javier.carrasco@wolfvision.net --- drivers/usb/typec/tipd/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c index 0717cfcd9f8c..7c2f01344860 100644 --- a/drivers/usb/typec/tipd/core.c +++ b/drivers/usb/typec/tipd/core.c @@ -604,11 +604,11 @@ static irqreturn_t tps25750_interrupt(int irq, void *data) if (!tps6598x_read_status(tps, &status)) goto err_clear_ints;
- if ((event[0] | event[1]) & TPS_REG_INT_POWER_STATUS_UPDATE) + if (event[0] & TPS_REG_INT_POWER_STATUS_UPDATE) if (!tps6598x_read_power_status(tps)) goto err_clear_ints;
- if ((event[0] | event[1]) & TPS_REG_INT_DATA_STATUS_UPDATE) + if (event[0] & TPS_REG_INT_DATA_STATUS_UPDATE) if (!tps6598x_read_data_status(tps)) goto err_clear_ints;
@@ -617,7 +617,7 @@ static irqreturn_t tps25750_interrupt(int irq, void *data) * a plug event. Therefore, we need to check * for pr/dr status change to set TypeC dr/pr accordingly. */ - if ((event[0] | event[1]) & TPS_REG_INT_PLUG_EVENT || + if (event[0] & TPS_REG_INT_PLUG_EVENT || tps6598x_has_role_changed(tps, status)) tps6598x_handle_plug_event(tps, status);
On Thu, Mar 28, 2024 at 05:55:51PM +0100, Javier Carrasco wrote:
In its current form, the interrupt service routine of the tps25750 checks the event flags in the lowest 64 bits of the interrupt event register (event[0]), but also in the upper part (event[1]).
Given that all flags are defined as BIT() or BIT_ULL(), they are restricted to the first 64 bits of the INT_EVENT1 register. Including the upper part of the register can lead to false positives e.g. if the event 64 bits above the one being checked is set, but the one being checked is not.
Restrict the flag checking to the first 64 bits of the INT_EVENT1 register.
Fixes: 7e7a3c815d22 ("USB: typec: tps6598x: Add TPS25750 support") Cc: stable@vger.kernel.org Signed-off-by: Javier Carrasco javier.carrasco@wolfvision.net
Acked-by: Heikki Krogerus heikki.krogerus@linux.intel.com
drivers/usb/typec/tipd/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c index 0717cfcd9f8c..7c2f01344860 100644 --- a/drivers/usb/typec/tipd/core.c +++ b/drivers/usb/typec/tipd/core.c @@ -604,11 +604,11 @@ static irqreturn_t tps25750_interrupt(int irq, void *data) if (!tps6598x_read_status(tps, &status)) goto err_clear_ints;
- if ((event[0] | event[1]) & TPS_REG_INT_POWER_STATUS_UPDATE)
- if (event[0] & TPS_REG_INT_POWER_STATUS_UPDATE) if (!tps6598x_read_power_status(tps)) goto err_clear_ints;
- if ((event[0] | event[1]) & TPS_REG_INT_DATA_STATUS_UPDATE)
- if (event[0] & TPS_REG_INT_DATA_STATUS_UPDATE) if (!tps6598x_read_data_status(tps)) goto err_clear_ints;
@@ -617,7 +617,7 @@ static irqreturn_t tps25750_interrupt(int irq, void *data) * a plug event. Therefore, we need to check * for pr/dr status change to set TypeC dr/pr accordingly. */
- if ((event[0] | event[1]) & TPS_REG_INT_PLUG_EVENT ||
- if (event[0] & TPS_REG_INT_PLUG_EVENT || tps6598x_has_role_changed(tps, status)) tps6598x_handle_plug_event(tps, status);
-- 2.40.1
The current interrupt service routine of the tps6598x only reads the first 64 bits of the INT_EVENT1 and INT_EVENT2 registers, which means that any event above that range will be ignored, leaving interrupts unattended. Moreover, those events will not be cleared, and the device will keep the interrupt enabled.
This issue has been observed while attempting to load patches, and the 'ReadyForPatch' field (bit 81) of INT_EVENT1 was set.
Read the complete INT_EVENT registers to handle all interrupts generated by the device in a similar fashion to what is already done for the tps25750.
Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers") Cc: stable@vger.kernel.org Signed-off-by: Javier Carrasco javier.carrasco@wolfvision.net --- drivers/usb/typec/tipd/core.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-)
diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c index 7c2f01344860..308748d6cae6 100644 --- a/drivers/usb/typec/tipd/core.c +++ b/drivers/usb/typec/tipd/core.c @@ -637,48 +637,53 @@ static irqreturn_t tps25750_interrupt(int irq, void *data) static irqreturn_t tps6598x_interrupt(int irq, void *data) { struct tps6598x *tps = data; - u64 event1 = 0; - u64 event2 = 0; + u64 event1[2] = { }; + u64 event2[2] = { }; u32 status; int ret;
mutex_lock(&tps->lock);
- ret = tps6598x_read64(tps, TPS_REG_INT_EVENT1, &event1); - ret |= tps6598x_read64(tps, TPS_REG_INT_EVENT2, &event2); + ret = tps6598x_block_read(tps, TPS_REG_INT_EVENT1, event1, 11); if (ret) { - dev_err(tps->dev, "%s: failed to read events\n", __func__); + dev_err(tps->dev, "%s: failed to read event1\n", __func__); goto err_unlock; } - trace_tps6598x_irq(event1, event2); + ret = tps6598x_block_read(tps, TPS_REG_INT_EVENT2, event2, 11); + if (ret) { + dev_err(tps->dev, "%s: failed to read event2\n", __func__); + goto err_unlock; + } + trace_tps6598x_irq(event1[0], event2[0]);
- if (!(event1 | event2)) + if (!(event1[0] | event1[1] | event2[0] | event2[1])) goto err_unlock;
if (!tps6598x_read_status(tps, &status)) goto err_clear_ints;
- if ((event1 | event2) & TPS_REG_INT_POWER_STATUS_UPDATE) + if ((event1[0] | event2[0]) & TPS_REG_INT_POWER_STATUS_UPDATE) if (!tps6598x_read_power_status(tps)) goto err_clear_ints;
- if ((event1 | event2) & TPS_REG_INT_DATA_STATUS_UPDATE) + if ((event1[0] | event2[0]) & TPS_REG_INT_DATA_STATUS_UPDATE) if (!tps6598x_read_data_status(tps)) goto err_clear_ints;
/* Handle plug insert or removal */ - if ((event1 | event2) & TPS_REG_INT_PLUG_EVENT) + if ((event1[0] | event2[0]) & TPS_REG_INT_PLUG_EVENT) tps6598x_handle_plug_event(tps, status);
err_clear_ints: - tps6598x_write64(tps, TPS_REG_INT_CLEAR1, event1); - tps6598x_write64(tps, TPS_REG_INT_CLEAR2, event2); + tps6598x_block_write(tps, TPS_REG_INT_CLEAR1, event1, 11); + tps6598x_block_write(tps, TPS_REG_INT_CLEAR2, event2, 11);
err_unlock: mutex_unlock(&tps->lock);
- if (event1 | event2) + if (event1[0] | event1[1] | event2[0] | event2[1]) return IRQ_HANDLED; + return IRQ_NONE; }
On Thu, Mar 28, 2024 at 05:55:52PM +0100, Javier Carrasco wrote:
The current interrupt service routine of the tps6598x only reads the first 64 bits of the INT_EVENT1 and INT_EVENT2 registers, which means that any event above that range will be ignored, leaving interrupts unattended. Moreover, those events will not be cleared, and the device will keep the interrupt enabled.
This issue has been observed while attempting to load patches, and the 'ReadyForPatch' field (bit 81) of INT_EVENT1 was set.
Read the complete INT_EVENT registers to handle all interrupts generated by the device in a similar fashion to what is already done for the tps25750.
Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers") Cc: stable@vger.kernel.org Signed-off-by: Javier Carrasco javier.carrasco@wolfvision.net
drivers/usb/typec/tipd/core.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-)
diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c index 7c2f01344860..308748d6cae6 100644 --- a/drivers/usb/typec/tipd/core.c +++ b/drivers/usb/typec/tipd/core.c @@ -637,48 +637,53 @@ static irqreturn_t tps25750_interrupt(int irq, void *data) static irqreturn_t tps6598x_interrupt(int irq, void *data) { struct tps6598x *tps = data;
- u64 event1 = 0;
- u64 event2 = 0;
- u64 event1[2] = { };
- u64 event2[2] = { }; u32 status; int ret;
mutex_lock(&tps->lock);
- ret = tps6598x_read64(tps, TPS_REG_INT_EVENT1, &event1);
- ret |= tps6598x_read64(tps, TPS_REG_INT_EVENT2, &event2);
- ret = tps6598x_block_read(tps, TPS_REG_INT_EVENT1, event1, 11);
This is not going to work with the older TI PD controllers.
The lenght of these registers is 8 bytes on the older TI PD controllers (TPS65981, TPS65982, etc.). I think we need to split this function.
if (ret) {
dev_err(tps->dev, "%s: failed to read events\n", __func__);
dev_err(tps->dev, "%s: failed to read event1\n", __func__);
- trace_tps6598x_irq(event1, event2);
- ret = tps6598x_block_read(tps, TPS_REG_INT_EVENT2, event2, 11);
- if (ret) {
dev_err(tps->dev, "%s: failed to read event2\n", __func__);goto err_unlock;- }
- trace_tps6598x_irq(event1[0], event2[0]);
- if (!(event1 | event2))
- if (!(event1[0] | event1[1] | event2[0] | event2[1])) goto err_unlock;
if (!tps6598x_read_status(tps, &status)) goto err_clear_ints;
- if ((event1 | event2) & TPS_REG_INT_POWER_STATUS_UPDATE)
- if ((event1[0] | event2[0]) & TPS_REG_INT_POWER_STATUS_UPDATE) if (!tps6598x_read_power_status(tps)) goto err_clear_ints;
- if ((event1 | event2) & TPS_REG_INT_DATA_STATUS_UPDATE)
- if ((event1[0] | event2[0]) & TPS_REG_INT_DATA_STATUS_UPDATE) if (!tps6598x_read_data_status(tps)) goto err_clear_ints;
/* Handle plug insert or removal */
- if ((event1 | event2) & TPS_REG_INT_PLUG_EVENT)
- if ((event1[0] | event2[0]) & TPS_REG_INT_PLUG_EVENT) tps6598x_handle_plug_event(tps, status);
err_clear_ints:
- tps6598x_write64(tps, TPS_REG_INT_CLEAR1, event1);
- tps6598x_write64(tps, TPS_REG_INT_CLEAR2, event2);
- tps6598x_block_write(tps, TPS_REG_INT_CLEAR1, event1, 11);
- tps6598x_block_write(tps, TPS_REG_INT_CLEAR2, event2, 11);
err_unlock: mutex_unlock(&tps->lock);
- if (event1 | event2)
- if (event1[0] | event1[1] | event2[0] | event2[1]) return IRQ_HANDLED;
- return IRQ_NONE;
}
-- 2.40.1
On 4/2/24 12:29, Heikki Krogerus wrote:
On Thu, Mar 28, 2024 at 05:55:52PM +0100, Javier Carrasco wrote:
The current interrupt service routine of the tps6598x only reads the first 64 bits of the INT_EVENT1 and INT_EVENT2 registers, which means that any event above that range will be ignored, leaving interrupts unattended. Moreover, those events will not be cleared, and the device will keep the interrupt enabled.
This issue has been observed while attempting to load patches, and the 'ReadyForPatch' field (bit 81) of INT_EVENT1 was set.
Read the complete INT_EVENT registers to handle all interrupts generated by the device in a similar fashion to what is already done for the tps25750.
Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers") Cc: stable@vger.kernel.org Signed-off-by: Javier Carrasco javier.carrasco@wolfvision.net
drivers/usb/typec/tipd/core.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-)
diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c index 7c2f01344860..308748d6cae6 100644 --- a/drivers/usb/typec/tipd/core.c +++ b/drivers/usb/typec/tipd/core.c @@ -637,48 +637,53 @@ static irqreturn_t tps25750_interrupt(int irq, void *data) static irqreturn_t tps6598x_interrupt(int irq, void *data) { struct tps6598x *tps = data;
- u64 event1 = 0;
- u64 event2 = 0;
- u64 event1[2] = { };
- u64 event2[2] = { }; u32 status; int ret;
mutex_lock(&tps->lock);
- ret = tps6598x_read64(tps, TPS_REG_INT_EVENT1, &event1);
- ret |= tps6598x_read64(tps, TPS_REG_INT_EVENT2, &event2);
- ret = tps6598x_block_read(tps, TPS_REG_INT_EVENT1, event1, 11);
This is not going to work with the older TI PD controllers.
The lenght of these registers is 8 bytes on the older TI PD controllers (TPS65981, TPS65982, etc.). I think we need to split this function.
That is a good point. I had a look at the older TI PD controllers and I agree with you that we should split the function to cover both register lengths separately.
I was thinking about adding a new compatible for the newer PD controllers (tps65987 and tps65988), keeping the current tps6598x for the older ones as well as backwards compatibility. But backwards compatibility would also mean that flags beyond the first 8 bytes would be ignored.
On the other hand, the upper flags are only relevant for firmware updates, so we could check those (i.e. read 11 bytes) if a firmware was provided via "firmware-name", and ignore them (i.e. read 8 bytes) otherwise.
Other ideas or improvements to mine are more than welcome.
Best regards, Javier Carrasco
On Wed, Apr 03, 2024 at 10:55:29AM +0200, Javier Carrasco wrote:
- ret = tps6598x_read64(tps, TPS_REG_INT_EVENT1, &event1);
- ret |= tps6598x_read64(tps, TPS_REG_INT_EVENT2, &event2);
- ret = tps6598x_block_read(tps, TPS_REG_INT_EVENT1, event1, 11);
This is not going to work with the older TI PD controllers.
The lenght of these registers is 8 bytes on the older TI PD controllers (TPS65981, TPS65982, etc.). I think we need to split this function.
That is a good point. I had a look at the older TI PD controllers and I agree with you that we should split the function to cover both register lengths separately.
I was thinking about adding a new compatible for the newer PD controllers (tps65987 and tps65988), keeping the current tps6598x for the older ones as well as backwards compatibility. But backwards compatibility would also mean that flags beyond the first 8 bytes would be ignored.
On the other hand, the upper flags are only relevant for firmware updates, so we could check those (i.e. read 11 bytes) if a firmware was provided via "firmware-name", and ignore them (i.e. read 8 bytes) otherwise.
Other ideas or improvements to mine are more than welcome.
I don't have any good ideas. On ACPI platforms the same device ID may be used with all of these, so we should actually try to figure out the version from registers like VID, DID and Version (if they are available).
thanks,
On 4/5/24 08:49, Heikki Krogerus wrote:
On Wed, Apr 03, 2024 at 10:55:29AM +0200, Javier Carrasco wrote:
- ret = tps6598x_read64(tps, TPS_REG_INT_EVENT1, &event1);
- ret |= tps6598x_read64(tps, TPS_REG_INT_EVENT2, &event2);
- ret = tps6598x_block_read(tps, TPS_REG_INT_EVENT1, event1, 11);
This is not going to work with the older TI PD controllers.
The lenght of these registers is 8 bytes on the older TI PD controllers (TPS65981, TPS65982, etc.). I think we need to split this function.
That is a good point. I had a look at the older TI PD controllers and I agree with you that we should split the function to cover both register lengths separately.
I was thinking about adding a new compatible for the newer PD controllers (tps65987 and tps65988), keeping the current tps6598x for the older ones as well as backwards compatibility. But backwards compatibility would also mean that flags beyond the first 8 bytes would be ignored.
On the other hand, the upper flags are only relevant for firmware updates, so we could check those (i.e. read 11 bytes) if a firmware was provided via "firmware-name", and ignore them (i.e. read 8 bytes) otherwise.
Other ideas or improvements to mine are more than welcome.
I don't have any good ideas. On ACPI platforms the same device ID may be used with all of these, so we should actually try to figure out the version from registers like VID, DID and Version (if they are available).
thanks,
VID and DID can be modified by the application firmware, but there is a byte in the Version register we can use for this. According to TI[1], it is guaranteed that the older TI PD controllers (TPS65981/2/6) will always deliver AB = 0x00 when reading from the Version register, which is 4 bytes long formatted like this: ABXX.YY.ZZ. The newer PD controllers (TPS65987/8) will return either AB = 0xF7 (DH parts) or AB = 0xF9 (DK parts).
We can add some simple logic to read 8 bytes if AB is 0x00, which could be the default as well, and 11 bytes otherwise.
Link: https://e2e.ti.com/support/power-management-group/power-management/f/power-m... [1]
Thanks for your feedback and best regards, Javier Carrasco
On Thu, Mar 28, 2024 at 05:55:50PM +0100, Javier Carrasco wrote:
The ISRs of the tps25750 and tps6598x do not handle generated events properly under all circumstances.
The tps6598x ISR does not read all bits of the INT_EVENTX registers, leaving events signaled with bits above 64 unattended. Moreover, these events are not cleared, leaving the interrupt enabled.
The tps25750 reads all bits of the INT_EVENT1 register, but the event checking is not right because the same event is checked in two different regions of the same register by means of an OR operation.
This series aims to fix both issues by reading all bits of the INT_EVENTX registers, and limiting the event checking to the region where the supported events are defined (currently they are limited to the first 64 bits of the registers, as the are defined as BIT_ULL()).
If the need for events above the first 64 bits of the INT_EVENTX registers arises, a different mechanism might be required. But for the current needs, all definitions can be left as they are.
Note: resend to add the Cc tag for 'stable' (fixes in the series).
So this should be v3 (or v2?). Next time please follow the guide when submitting patches: https://www.kernel.org/doc/html/latest/process/submitting-patches.html#the-c...
thanks,
On 4/2/24 12:21, Heikki Krogerus wrote:
On Thu, Mar 28, 2024 at 05:55:50PM +0100, Javier Carrasco wrote:
The ISRs of the tps25750 and tps6598x do not handle generated events properly under all circumstances.
The tps6598x ISR does not read all bits of the INT_EVENTX registers, leaving events signaled with bits above 64 unattended. Moreover, these events are not cleared, leaving the interrupt enabled.
The tps25750 reads all bits of the INT_EVENT1 register, but the event checking is not right because the same event is checked in two different regions of the same register by means of an OR operation.
This series aims to fix both issues by reading all bits of the INT_EVENTX registers, and limiting the event checking to the region where the supported events are defined (currently they are limited to the first 64 bits of the registers, as the are defined as BIT_ULL()).
If the need for events above the first 64 bits of the INT_EVENTX registers arises, a different mechanism might be required. But for the current needs, all definitions can be left as they are.
Note: resend to add the Cc tag for 'stable' (fixes in the series).
So this should be v3 (or v2?). Next time please follow the guide when submitting patches: https://www.kernel.org/doc/html/latest/process/submitting-patches.html#the-c...
thanks,
The first resend only added 'stable' to Cc (which was wrong) with no modifications at all, and the second resend (this one) actually modified the commit description to include 'stable', which should have turned it into a v2.
I will tag the next version as v3 to account for this, thanks for the feedback.
Best regards, Javier Carrasco
linux-stable-mirror@lists.linaro.org
-
Heikki Krogerus -
Javier Carrasco