rtc: pcf-8563: Report previously detected low-voltage via RTC_VL_BACKUP_LOW

  From: Jan Kiszka <jan.kiszka@siemens.com>

The VL bit in the seconds register remains set only until seconds are
written under main power. As this often happens during boot-up after
picking up a network time, make sure to preserve the low battery state
across this, caching it and returning it via the RTC_VL_BACKUP_LOW bit.

To permit userspace clearing this state during runtime, also implement
RTC_VL_CLR that works against the cached state.

This is emulating RTCs which have a battery voltage check that works
under main power as well.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 drivers/rtc/rtc-pcf8563.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)
  

Hello Jan,

On 09/06/2023 23:04:12+0200, Jan Kiszka wrote:
> From: Jan Kiszka <jan.kiszka@siemens.com>
> 
> The VL bit in the seconds register remains set only until seconds are
> written under main power. As this often happens during boot-up after
> picking up a network time, make sure to preserve the low battery state
> across this, caching it and returning it via the RTC_VL_BACKUP_LOW bit.
> 
> To permit userspace clearing this state during runtime, also implement
> RTC_VL_CLR that works against the cached state.
> 
> This is emulating RTCs which have a battery voltage check that works
> under main power as well.
> 

Emulating doesn't work well and I deliberately chose to not implement
it. For example, in your scenario, if you boot twice without using
VL_READ, you anyway have lost the information. This makes emulating
unreliabl. The fix you need is in userspace where you have to ensure you
read the status before setting the time.

> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
> ---
>  drivers/rtc/rtc-pcf8563.c | 17 ++++++++++++++---
>  1 file changed, 14 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
> index 7e720472213c..f8c6cdb9a39d 100644
> --- a/drivers/rtc/rtc-pcf8563.c
> +++ b/drivers/rtc/rtc-pcf8563.c
> @@ -81,6 +81,7 @@ struct pcf8563 {
>  #ifdef CONFIG_COMMON_CLK
>  	struct clk_hw		clkout_hw;
>  #endif
> +	bool low_bat;
>  };
>  
>  static int pcf8563_read_block_data(struct i2c_client *client, unsigned char reg,
> @@ -207,6 +208,7 @@ static int pcf8563_rtc_read_time(struct device *dev, struct rtc_time *tm)
>  		return err;
>  
>  	if (buf[PCF8563_REG_SC] & PCF8563_SC_LV) {
> +		pcf8563->low_bat = true;
>  		dev_err(&client->dev,
>  			"low voltage detected, date/time is not reliable.\n");
>  		return -EINVAL;
> @@ -277,6 +279,8 @@ static int pcf8563_rtc_set_time(struct device *dev, struct rtc_time *tm)
>  static int pcf8563_rtc_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
>  {
>  	struct i2c_client *client = to_i2c_client(dev);
> +	struct pcf8563 *pcf8563 = i2c_get_clientdata(client);
> +	unsigned int state = 0;
>  	int ret;
>  
>  	switch (cmd) {
> @@ -284,9 +288,16 @@ static int pcf8563_rtc_ioctl(struct device *dev, unsigned int cmd, unsigned long
>  		ret = i2c_smbus_read_byte_data(client, PCF8563_REG_SC);
>  		if (ret < 0)
>  			return ret;
> -
> -		return put_user(ret & PCF8563_SC_LV ? RTC_VL_DATA_INVALID : 0,
> -				(unsigned int __user *)arg);
> +		if (ret & PCF8563_SC_LV) {
> +			state |= RTC_VL_DATA_INVALID;
> +			pcf8563->low_bat = true;
> +		}
> +		if (pcf8563->low_bat)
> +			state |= RTC_VL_BACKUP_LOW;
> +		return put_user(state, (unsigned int __user *)arg);
> +	case RTC_VL_CLR:
> +		pcf8563->low_bat = false;
> +		return 0;
>  	default:
>  		return -ENOIOCTLCMD;
>  	}
> -- 
> 2.35.3
  

On 10.06.23 10:31, Alexandre Belloni wrote:
> Hello Jan,
> 
> On 09/06/2023 23:04:12+0200, Jan Kiszka wrote:
>> From: Jan Kiszka <jan.kiszka@siemens.com>
>>
>> The VL bit in the seconds register remains set only until seconds are
>> written under main power. As this often happens during boot-up after
>> picking up a network time, make sure to preserve the low battery state
>> across this, caching it and returning it via the RTC_VL_BACKUP_LOW bit.
>>
>> To permit userspace clearing this state during runtime, also implement
>> RTC_VL_CLR that works against the cached state.
>>
>> This is emulating RTCs which have a battery voltage check that works
>> under main power as well.
>>
> 
> Emulating doesn't work well and I deliberately chose to not implement
> it. For example, in your scenario, if you boot twice without using
> VL_READ, you anyway have lost the information. This makes emulating
> unreliabl. The fix you need is in userspace where you have to ensure you
> read the status before setting the time.

Then let's make sure the bit is also set in the hardware register. Then
also the reboot issue (which is practically a minor one) is solved. The
current situation is far from optimal.

Jan
  

On 11/06/2023 15:38:04+0200, Jan Kiszka wrote:
> On 10.06.23 10:31, Alexandre Belloni wrote:
> > Hello Jan,
> > 
> > On 09/06/2023 23:04:12+0200, Jan Kiszka wrote:
> >> From: Jan Kiszka <jan.kiszka@siemens.com>
> >>
> >> The VL bit in the seconds register remains set only until seconds are
> >> written under main power. As this often happens during boot-up after
> >> picking up a network time, make sure to preserve the low battery state
> >> across this, caching it and returning it via the RTC_VL_BACKUP_LOW bit.
> >>
> >> To permit userspace clearing this state during runtime, also implement
> >> RTC_VL_CLR that works against the cached state.
> >>
> >> This is emulating RTCs which have a battery voltage check that works
> >> under main power as well.
> >>
> > 
> > Emulating doesn't work well and I deliberately chose to not implement
> > it. For example, in your scenario, if you boot twice without using
> > VL_READ, you anyway have lost the information. This makes emulating
> > unreliabl. The fix you need is in userspace where you have to ensure you
> > read the status before setting the time.
> 
> Then let's make sure the bit is also set in the hardware register. Then
> also the reboot issue (which is practically a minor one) is solved. The
> current situation is far from optimal.

This doesn't work because then the time will be considered invalid. I'm
not sure why you don't want to fix your userspace.
  

On 11.06.23 17:11, Alexandre Belloni wrote:
> On 11/06/2023 15:38:04+0200, Jan Kiszka wrote:
>> On 10.06.23 10:31, Alexandre Belloni wrote:
>>> Hello Jan,
>>>
>>> On 09/06/2023 23:04:12+0200, Jan Kiszka wrote:
>>>> From: Jan Kiszka <jan.kiszka@siemens.com>
>>>>
>>>> The VL bit in the seconds register remains set only until seconds are
>>>> written under main power. As this often happens during boot-up after
>>>> picking up a network time, make sure to preserve the low battery state
>>>> across this, caching it and returning it via the RTC_VL_BACKUP_LOW bit.
>>>>
>>>> To permit userspace clearing this state during runtime, also implement
>>>> RTC_VL_CLR that works against the cached state.
>>>>
>>>> This is emulating RTCs which have a battery voltage check that works
>>>> under main power as well.
>>>>
>>>
>>> Emulating doesn't work well and I deliberately chose to not implement
>>> it. For example, in your scenario, if you boot twice without using
>>> VL_READ, you anyway have lost the information. This makes emulating
>>> unreliabl. The fix you need is in userspace where you have to ensure you
>>> read the status before setting the time.
>>
>> Then let's make sure the bit is also set in the hardware register. Then
>> also the reboot issue (which is practically a minor one) is solved. The
>> current situation is far from optimal.
> 
> This doesn't work because then the time will be considered invalid. I'm
> not sure why you don't want to fix your userspace.
> 

Nope, that could be easily avoided in software. The actual problem is
that the VL bit is not settable (clear-on-write). And that means we
can't do anything about losing the low battery information across
reboots - but that's no difference to the situation with the existing
driver.

There is no "fix" for userspace as there is no standard framework to
read-out the status early and retrieve it from there when the user asks
for it. That's best done in the kernel.

In that light, I still believe my patch is an improvement over the
current situation without making anything worse.

Jan
  

On 11/06/2023 18:28:22+0200, Jan Kiszka wrote:
> On 11.06.23 17:11, Alexandre Belloni wrote:
> > On 11/06/2023 15:38:04+0200, Jan Kiszka wrote:
> >> On 10.06.23 10:31, Alexandre Belloni wrote:
> >>> Hello Jan,
> >>>
> >>> On 09/06/2023 23:04:12+0200, Jan Kiszka wrote:
> >>>> From: Jan Kiszka <jan.kiszka@siemens.com>
> >>>>
> >>>> The VL bit in the seconds register remains set only until seconds are
> >>>> written under main power. As this often happens during boot-up after
> >>>> picking up a network time, make sure to preserve the low battery state
> >>>> across this, caching it and returning it via the RTC_VL_BACKUP_LOW bit.
> >>>>
> >>>> To permit userspace clearing this state during runtime, also implement
> >>>> RTC_VL_CLR that works against the cached state.
> >>>>
> >>>> This is emulating RTCs which have a battery voltage check that works
> >>>> under main power as well.
> >>>>
> >>>
> >>> Emulating doesn't work well and I deliberately chose to not implement
> >>> it. For example, in your scenario, if you boot twice without using
> >>> VL_READ, you anyway have lost the information. This makes emulating
> >>> unreliabl. The fix you need is in userspace where you have to ensure you
> >>> read the status before setting the time.
> >>
> >> Then let's make sure the bit is also set in the hardware register. Then
> >> also the reboot issue (which is practically a minor one) is solved. The
> >> current situation is far from optimal.
> > 
> > This doesn't work because then the time will be considered invalid. I'm
> > not sure why you don't want to fix your userspace.
> > 
> 
> Nope, that could be easily avoided in software. The actual problem is
> that the VL bit is not settable (clear-on-write). And that means we
> can't do anything about losing the low battery information across
> reboots - but that's no difference to the situation with the existing
> driver.
> 
> There is no "fix" for userspace as there is no standard framework to
> read-out the status early and retrieve it from there when the user asks
> for it. That's best done in the kernel.

That's not true, nothing prevents userspace from reading the battery
status before setting the time and destroying the information which is
exactly what you should be doing.

> 
> In that light, I still believe my patch is an improvement over the
> current situation without making anything worse.

The information goes from behaving deterministically to being unreliable
which makes the situation worse.
  

On 12.06.23 00:16, Alexandre Belloni wrote:
> On 11/06/2023 18:28:22+0200, Jan Kiszka wrote:
>> On 11.06.23 17:11, Alexandre Belloni wrote:
>>> On 11/06/2023 15:38:04+0200, Jan Kiszka wrote:
>>>> On 10.06.23 10:31, Alexandre Belloni wrote:
>>>>> Hello Jan,
>>>>>
>>>>> On 09/06/2023 23:04:12+0200, Jan Kiszka wrote:
>>>>>> From: Jan Kiszka <jan.kiszka@siemens.com>
>>>>>>
>>>>>> The VL bit in the seconds register remains set only until seconds are
>>>>>> written under main power. As this often happens during boot-up after
>>>>>> picking up a network time, make sure to preserve the low battery state
>>>>>> across this, caching it and returning it via the RTC_VL_BACKUP_LOW bit.
>>>>>>
>>>>>> To permit userspace clearing this state during runtime, also implement
>>>>>> RTC_VL_CLR that works against the cached state.
>>>>>>
>>>>>> This is emulating RTCs which have a battery voltage check that works
>>>>>> under main power as well.
>>>>>>
>>>>>
>>>>> Emulating doesn't work well and I deliberately chose to not implement
>>>>> it. For example, in your scenario, if you boot twice without using
>>>>> VL_READ, you anyway have lost the information. This makes emulating
>>>>> unreliabl. The fix you need is in userspace where you have to ensure you
>>>>> read the status before setting the time.
>>>>
>>>> Then let's make sure the bit is also set in the hardware register. Then
>>>> also the reboot issue (which is practically a minor one) is solved. The
>>>> current situation is far from optimal.
>>>
>>> This doesn't work because then the time will be considered invalid. I'm
>>> not sure why you don't want to fix your userspace.
>>>
>>
>> Nope, that could be easily avoided in software. The actual problem is
>> that the VL bit is not settable (clear-on-write). And that means we
>> can't do anything about losing the low battery information across
>> reboots - but that's no difference to the situation with the existing
>> driver.
>>
>> There is no "fix" for userspace as there is no standard framework to
>> read-out the status early and retrieve it from there when the user asks
>> for it. That's best done in the kernel.
> 
> That's not true, nothing prevents userspace from reading the battery
> status before setting the time and destroying the information which is
> exactly what you should be doing.

What is your "userspace"? Mine is stock Debian with systemd and
timesyncd enabled. But there is no framework to read the status early
enough and propagate that after timesyncd did its job. Any concrete
suggestion to "fix" userspace?

> 
>>
>> In that light, I still believe my patch is an improvement over the
>> current situation without making anything worse.
> 
> The information goes from behaving deterministically to being unreliable
> which makes the situation worse.

Nope, not at all. You already lose the VL bit today during reboot when
you have written a new value (which is standard). So this here is not
making things worse. It's rather improving the situation for the first
boot at least. Deterministically.

Jan
  

On 12.06.23 08:49, Jan Kiszka wrote:
> On 12.06.23 00:16, Alexandre Belloni wrote:
>> On 11/06/2023 18:28:22+0200, Jan Kiszka wrote:
>>> On 11.06.23 17:11, Alexandre Belloni wrote:
>>>> On 11/06/2023 15:38:04+0200, Jan Kiszka wrote:
>>>>> On 10.06.23 10:31, Alexandre Belloni wrote:
>>>>>> Hello Jan,
>>>>>>
>>>>>> On 09/06/2023 23:04:12+0200, Jan Kiszka wrote:
>>>>>>> From: Jan Kiszka <jan.kiszka@siemens.com>
>>>>>>>
>>>>>>> The VL bit in the seconds register remains set only until seconds are
>>>>>>> written under main power. As this often happens during boot-up after
>>>>>>> picking up a network time, make sure to preserve the low battery state
>>>>>>> across this, caching it and returning it via the RTC_VL_BACKUP_LOW bit.
>>>>>>>
>>>>>>> To permit userspace clearing this state during runtime, also implement
>>>>>>> RTC_VL_CLR that works against the cached state.
>>>>>>>
>>>>>>> This is emulating RTCs which have a battery voltage check that works
>>>>>>> under main power as well.
>>>>>>>
>>>>>>
>>>>>> Emulating doesn't work well and I deliberately chose to not implement
>>>>>> it. For example, in your scenario, if you boot twice without using
>>>>>> VL_READ, you anyway have lost the information. This makes emulating
>>>>>> unreliabl. The fix you need is in userspace where you have to ensure you
>>>>>> read the status before setting the time.
>>>>>
>>>>> Then let's make sure the bit is also set in the hardware register. Then
>>>>> also the reboot issue (which is practically a minor one) is solved. The
>>>>> current situation is far from optimal.
>>>>
>>>> This doesn't work because then the time will be considered invalid. I'm
>>>> not sure why you don't want to fix your userspace.
>>>>
>>>
>>> Nope, that could be easily avoided in software. The actual problem is
>>> that the VL bit is not settable (clear-on-write). And that means we
>>> can't do anything about losing the low battery information across
>>> reboots - but that's no difference to the situation with the existing
>>> driver.
>>>
>>> There is no "fix" for userspace as there is no standard framework to
>>> read-out the status early and retrieve it from there when the user asks
>>> for it. That's best done in the kernel.
>>
>> That's not true, nothing prevents userspace from reading the battery
>> status before setting the time and destroying the information which is
>> exactly what you should be doing.
> 
> What is your "userspace"? Mine is stock Debian with systemd and
> timesyncd enabled. But there is no framework to read the status early
> enough and propagate that after timesyncd did its job. Any concrete
> suggestion to "fix" userspace?
> 

Ping - I still have seen no suggestion to improve this situation otherwise.

>>
>>>
>>> In that light, I still believe my patch is an improvement over the
>>> current situation without making anything worse.
>>
>> The information goes from behaving deterministically to being unreliable
>> which makes the situation worse.
> 
> Nope, not at all. You already lose the VL bit today during reboot when
> you have written a new value (which is standard). So this here is not
> making things worse. It's rather improving the situation for the first
> boot at least. Deterministically.
> 
> Jan
> 

Thanks,
Jan
  

On 11/07/2023 09:27:14+0200, Jan Kiszka wrote:
> >>> Nope, that could be easily avoided in software. The actual problem is
> >>> that the VL bit is not settable (clear-on-write). And that means we
> >>> can't do anything about losing the low battery information across
> >>> reboots - but that's no difference to the situation with the existing
> >>> driver.
> >>>
> >>> There is no "fix" for userspace as there is no standard framework to
> >>> read-out the status early and retrieve it from there when the user asks
> >>> for it. That's best done in the kernel.
> >>
> >> That's not true, nothing prevents userspace from reading the battery
> >> status before setting the time and destroying the information which is
> >> exactly what you should be doing.
> > 
> > What is your "userspace"? Mine is stock Debian with systemd and
> > timesyncd enabled. But there is no framework to read the status early
> > enough and propagate that after timesyncd did its job. Any concrete
> > suggestion to "fix" userspace?
> > 
> 
> Ping - I still have seen no suggestion to improve this situation otherwise.
> 

You can get systemd or any daemon to read the rtc flag before systemd
decides to use NTP and set the time, destroying the information.

This is a systemd issue, not a kernel issue. I already have to handle
two other issues caused by systemd because they don't want to budge, I
will not take a third one.