cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

i2c-topology.rst (16129B)


      1================================
      2I2C muxes and complex topologies
      3================================
      4
      5There are a couple of reasons for building more complex I2C topologies
      6than a straight-forward I2C bus with one adapter and one or more devices.
      7
      81. A mux may be needed on the bus to prevent address collisions.
      9
     102. The bus may be accessible from some external bus master, and arbitration
     11   may be needed to determine if it is ok to access the bus.
     12
     133. A device (particularly RF tuners) may want to avoid the digital noise
     14   from the I2C bus, at least most of the time, and sits behind a gate
     15   that has to be operated before the device can be accessed.
     16
     17Etc
     18===
     19
     20These constructs are represented as I2C adapter trees by Linux, where
     21each adapter has a parent adapter (except the root adapter) and zero or
     22more child adapters. The root adapter is the actual adapter that issues
     23I2C transfers, and all adapters with a parent are part of an "i2c-mux"
     24object (quoted, since it can also be an arbitrator or a gate).
     25
     26Depending of the particular mux driver, something happens when there is
     27an I2C transfer on one of its child adapters. The mux driver can
     28obviously operate a mux, but it can also do arbitration with an external
     29bus master or open a gate. The mux driver has two operations for this,
     30select and deselect. select is called before the transfer and (the
     31optional) deselect is called after the transfer.
     32
     33
     34Locking
     35=======
     36
     37There are two variants of locking available to I2C muxes, they can be
     38mux-locked or parent-locked muxes. As is evident from below, it can be
     39useful to know if a mux is mux-locked or if it is parent-locked. The
     40following list was correct at the time of writing:
     41
     42In drivers/i2c/muxes/:
     43
     44======================    =============================================
     45i2c-arb-gpio-challenge    Parent-locked
     46i2c-mux-gpio              Normally parent-locked, mux-locked iff
     47                          all involved gpio pins are controlled by the
     48                          same I2C root adapter that they mux.
     49i2c-mux-gpmux             Normally parent-locked, mux-locked iff
     50                          specified in device-tree.
     51i2c-mux-ltc4306           Mux-locked
     52i2c-mux-mlxcpld           Parent-locked
     53i2c-mux-pca9541           Parent-locked
     54i2c-mux-pca954x           Parent-locked
     55i2c-mux-pinctrl           Normally parent-locked, mux-locked iff
     56                          all involved pinctrl devices are controlled
     57                          by the same I2C root adapter that they mux.
     58i2c-mux-reg               Parent-locked
     59======================    =============================================
     60
     61In drivers/iio/:
     62
     63======================    =============================================
     64gyro/mpu3050              Mux-locked
     65imu/inv_mpu6050/          Mux-locked
     66======================    =============================================
     67
     68In drivers/media/:
     69
     70=======================   =============================================
     71dvb-frontends/lgdt3306a   Mux-locked
     72dvb-frontends/m88ds3103   Parent-locked
     73dvb-frontends/rtl2830     Parent-locked
     74dvb-frontends/rtl2832     Mux-locked
     75dvb-frontends/si2168      Mux-locked
     76usb/cx231xx/              Parent-locked
     77=======================   =============================================
     78
     79
     80Mux-locked muxes
     81----------------
     82
     83Mux-locked muxes does not lock the entire parent adapter during the
     84full select-transfer-deselect transaction, only the muxes on the parent
     85adapter are locked. Mux-locked muxes are mostly interesting if the
     86select and/or deselect operations must use I2C transfers to complete
     87their tasks. Since the parent adapter is not fully locked during the
     88full transaction, unrelated I2C transfers may interleave the different
     89stages of the transaction. This has the benefit that the mux driver
     90may be easier and cleaner to implement, but it has some caveats.
     91
     92==== =====================================================================
     93ML1. If you build a topology with a mux-locked mux being the parent
     94     of a parent-locked mux, this might break the expectation from the
     95     parent-locked mux that the root adapter is locked during the
     96     transaction.
     97
     98ML2. It is not safe to build arbitrary topologies with two (or more)
     99     mux-locked muxes that are not siblings, when there are address
    100     collisions between the devices on the child adapters of these
    101     non-sibling muxes.
    102
    103     I.e. the select-transfer-deselect transaction targeting e.g. device
    104     address 0x42 behind mux-one may be interleaved with a similar
    105     operation targeting device address 0x42 behind mux-two. The
    106     intension with such a topology would in this hypothetical example
    107     be that mux-one and mux-two should not be selected simultaneously,
    108     but mux-locked muxes do not guarantee that in all topologies.
    109
    110ML3. A mux-locked mux cannot be used by a driver for auto-closing
    111     gates/muxes, i.e. something that closes automatically after a given
    112     number (one, in most cases) of I2C transfers. Unrelated I2C transfers
    113     may creep in and close prematurely.
    114
    115ML4. If any non-I2C operation in the mux driver changes the I2C mux state,
    116     the driver has to lock the root adapter during that operation.
    117     Otherwise garbage may appear on the bus as seen from devices
    118     behind the mux, when an unrelated I2C transfer is in flight during
    119     the non-I2C mux-changing operation.
    120==== =====================================================================
    121
    122
    123Mux-locked Example
    124------------------
    125
    126
    127::
    128
    129                   .----------.     .--------.
    130    .--------.     |   mux-   |-----| dev D1 |
    131    |  root  |--+--|  locked  |     '--------'
    132    '--------'  |  |  mux M1  |--.  .--------.
    133                |  '----------'  '--| dev D2 |
    134                |  .--------.       '--------'
    135                '--| dev D3 |
    136                   '--------'
    137
    138When there is an access to D1, this happens:
    139
    140 1. Someone issues an I2C transfer to D1.
    141 2. M1 locks muxes on its parent (the root adapter in this case).
    142 3. M1 calls ->select to ready the mux.
    143 4. M1 (presumably) does some I2C transfers as part of its select.
    144    These transfers are normal I2C transfers that locks the parent
    145    adapter.
    146 5. M1 feeds the I2C transfer from step 1 to its parent adapter as a
    147    normal I2C transfer that locks the parent adapter.
    148 6. M1 calls ->deselect, if it has one.
    149 7. Same rules as in step 4, but for ->deselect.
    150 8. M1 unlocks muxes on its parent.
    151
    152This means that accesses to D2 are lockout out for the full duration
    153of the entire operation. But accesses to D3 are possibly interleaved
    154at any point.
    155
    156
    157Parent-locked muxes
    158-------------------
    159
    160Parent-locked muxes lock the parent adapter during the full select-
    161transfer-deselect transaction. The implication is that the mux driver
    162has to ensure that any and all I2C transfers through that parent
    163adapter during the transaction are unlocked I2C transfers (using e.g.
    164__i2c_transfer), or a deadlock will follow. There are a couple of
    165caveats.
    166
    167==== ====================================================================
    168PL1. If you build a topology with a parent-locked mux being the child
    169     of another mux, this might break a possible assumption from the
    170     child mux that the root adapter is unused between its select op
    171     and the actual transfer (e.g. if the child mux is auto-closing
    172     and the parent mux issues I2C transfers as part of its select).
    173     This is especially the case if the parent mux is mux-locked, but
    174     it may also happen if the parent mux is parent-locked.
    175
    176PL2. If select/deselect calls out to other subsystems such as gpio,
    177     pinctrl, regmap or iio, it is essential that any I2C transfers
    178     caused by these subsystems are unlocked. This can be convoluted to
    179     accomplish, maybe even impossible if an acceptably clean solution
    180     is sought.
    181==== ====================================================================
    182
    183
    184Parent-locked Example
    185---------------------
    186
    187::
    188
    189                   .----------.     .--------.
    190    .--------.     |  parent- |-----| dev D1 |
    191    |  root  |--+--|  locked  |     '--------'
    192    '--------'  |  |  mux M1  |--.  .--------.
    193                |  '----------'  '--| dev D2 |
    194                |  .--------.       '--------'
    195                '--| dev D3 |
    196                   '--------'
    197
    198When there is an access to D1, this happens:
    199
    200 1.  Someone issues an I2C transfer to D1.
    201 2.  M1 locks muxes on its parent (the root adapter in this case).
    202 3.  M1 locks its parent adapter.
    203 4.  M1 calls ->select to ready the mux.
    204 5.  If M1 does any I2C transfers (on this root adapter) as part of
    205     its select, those transfers must be unlocked I2C transfers so
    206     that they do not deadlock the root adapter.
    207 6.  M1 feeds the I2C transfer from step 1 to the root adapter as an
    208     unlocked I2C transfer, so that it does not deadlock the parent
    209     adapter.
    210 7.  M1 calls ->deselect, if it has one.
    211 8.  Same rules as in step 5, but for ->deselect.
    212 9.  M1 unlocks its parent adapter.
    213 10. M1 unlocks muxes on its parent.
    214
    215
    216This means that accesses to both D2 and D3 are locked out for the full
    217duration of the entire operation.
    218
    219
    220Complex Examples
    221================
    222
    223Parent-locked mux as parent of parent-locked mux
    224------------------------------------------------
    225
    226This is a useful topology, but it can be bad::
    227
    228                   .----------.     .----------.     .--------.
    229    .--------.     |  parent- |-----|  parent- |-----| dev D1 |
    230    |  root  |--+--|  locked  |     |  locked  |     '--------'
    231    '--------'  |  |  mux M1  |--.  |  mux M2  |--.  .--------.
    232                |  '----------'  |  '----------'  '--| dev D2 |
    233                |  .--------.    |  .--------.       '--------'
    234                '--| dev D4 |    '--| dev D3 |
    235                   '--------'       '--------'
    236
    237When any device is accessed, all other devices are locked out for
    238the full duration of the operation (both muxes lock their parent,
    239and specifically when M2 requests its parent to lock, M1 passes
    240the buck to the root adapter).
    241
    242This topology is bad if M2 is an auto-closing mux and M1->select
    243issues any unlocked I2C transfers on the root adapter that may leak
    244through and be seen by the M2 adapter, thus closing M2 prematurely.
    245
    246
    247Mux-locked mux as parent of mux-locked mux
    248------------------------------------------
    249
    250This is a good topology::
    251
    252                   .----------.     .----------.     .--------.
    253    .--------.     |   mux-   |-----|   mux-   |-----| dev D1 |
    254    |  root  |--+--|  locked  |     |  locked  |     '--------'
    255    '--------'  |  |  mux M1  |--.  |  mux M2  |--.  .--------.
    256                |  '----------'  |  '----------'  '--| dev D2 |
    257                |  .--------.    |  .--------.       '--------'
    258                '--| dev D4 |    '--| dev D3 |
    259                   '--------'       '--------'
    260
    261When device D1 is accessed, accesses to D2 are locked out for the
    262full duration of the operation (muxes on the top child adapter of M1
    263are locked). But accesses to D3 and D4 are possibly interleaved at
    264any point. Accesses to D3 locks out D1 and D2, but accesses to D4
    265are still possibly interleaved.
    266
    267
    268Mux-locked mux as parent of parent-locked mux
    269---------------------------------------------
    270
    271This is probably a bad topology::
    272
    273                   .----------.     .----------.     .--------.
    274    .--------.     |   mux-   |-----|  parent- |-----| dev D1 |
    275    |  root  |--+--|  locked  |     |  locked  |     '--------'
    276    '--------'  |  |  mux M1  |--.  |  mux M2  |--.  .--------.
    277                |  '----------'  |  '----------'  '--| dev D2 |
    278                |  .--------.    |  .--------.       '--------'
    279                '--| dev D4 |    '--| dev D3 |
    280                   '--------'       '--------'
    281
    282When device D1 is accessed, accesses to D2 and D3 are locked out
    283for the full duration of the operation (M1 locks child muxes on the
    284root adapter). But accesses to D4 are possibly interleaved at any
    285point.
    286
    287This kind of topology is generally not suitable and should probably
    288be avoided. The reason is that M2 probably assumes that there will
    289be no I2C transfers during its calls to ->select and ->deselect, and
    290if there are, any such transfers might appear on the slave side of M2
    291as partial I2C transfers, i.e. garbage or worse. This might cause
    292device lockups and/or other problems.
    293
    294The topology is especially troublesome if M2 is an auto-closing
    295mux. In that case, any interleaved accesses to D4 might close M2
    296prematurely, as might any I2C transfers part of M1->select.
    297
    298But if M2 is not making the above stated assumption, and if M2 is not
    299auto-closing, the topology is fine.
    300
    301
    302Parent-locked mux as parent of mux-locked mux
    303---------------------------------------------
    304
    305This is a good topology::
    306
    307                   .----------.     .----------.     .--------.
    308    .--------.     |  parent- |-----|   mux-   |-----| dev D1 |
    309    |  root  |--+--|  locked  |     |  locked  |     '--------'
    310    '--------'  |  |  mux M1  |--.  |  mux M2  |--.  .--------.
    311                |  '----------'  |  '----------'  '--| dev D2 |
    312                |  .--------.    |  .--------.       '--------'
    313                '--| dev D4 |    '--| dev D3 |
    314                   '--------'       '--------'
    315
    316When D1 is accessed, accesses to D2 are locked out for the full
    317duration of the operation (muxes on the top child adapter of M1
    318are locked). Accesses to D3 and D4 are possibly interleaved at
    319any point, just as is expected for mux-locked muxes.
    320
    321When D3 or D4 are accessed, everything else is locked out. For D3
    322accesses, M1 locks the root adapter. For D4 accesses, the root
    323adapter is locked directly.
    324
    325
    326Two mux-locked sibling muxes
    327----------------------------
    328
    329This is a good topology::
    330
    331                                    .--------.
    332                   .----------.  .--| dev D1 |
    333                   |   mux-   |--'  '--------'
    334                .--|  locked  |     .--------.
    335                |  |  mux M1  |-----| dev D2 |
    336                |  '----------'     '--------'
    337                |  .----------.     .--------.
    338    .--------.  |  |   mux-   |-----| dev D3 |
    339    |  root  |--+--|  locked  |     '--------'
    340    '--------'  |  |  mux M2  |--.  .--------.
    341                |  '----------'  '--| dev D4 |
    342                |  .--------.       '--------'
    343                '--| dev D5 |
    344                   '--------'
    345
    346When D1 is accessed, accesses to D2, D3 and D4 are locked out. But
    347accesses to D5 may be interleaved at any time.
    348
    349
    350Two parent-locked sibling muxes
    351-------------------------------
    352
    353This is a good topology::
    354
    355                                    .--------.
    356                   .----------.  .--| dev D1 |
    357                   |  parent- |--'  '--------'
    358                .--|  locked  |     .--------.
    359                |  |  mux M1  |-----| dev D2 |
    360                |  '----------'     '--------'
    361                |  .----------.     .--------.
    362    .--------.  |  |  parent- |-----| dev D3 |
    363    |  root  |--+--|  locked  |     '--------'
    364    '--------'  |  |  mux M2  |--.  .--------.
    365                |  '----------'  '--| dev D4 |
    366                |  .--------.       '--------'
    367                '--| dev D5 |
    368                   '--------'
    369
    370When any device is accessed, accesses to all other devices are locked
    371out.
    372
    373
    374Mux-locked and parent-locked sibling muxes
    375------------------------------------------
    376
    377This is a good topology::
    378
    379                                    .--------.
    380                   .----------.  .--| dev D1 |
    381                   |   mux-   |--'  '--------'
    382                .--|  locked  |     .--------.
    383                |  |  mux M1  |-----| dev D2 |
    384                |  '----------'     '--------'
    385                |  .----------.     .--------.
    386    .--------.  |  |  parent- |-----| dev D3 |
    387    |  root  |--+--|  locked  |     '--------'
    388    '--------'  |  |  mux M2  |--.  .--------.
    389                |  '----------'  '--| dev D4 |
    390                |  .--------.       '--------'
    391                '--| dev D5 |
    392                   '--------'
    393
    394When D1 or D2 are accessed, accesses to D3 and D4 are locked out while
    395accesses to D5 may interleave. When D3 or D4 are accessed, accesses to
    396all other devices are locked out.