lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:	Fri, 1 Nov 2013 01:08:27 +0100
From:	Grzegorz Hetman <ghetman@...il.com>
To:	linux-kernel@...r.kernel.org, linux-serial@...r.kernel.org
Subject: Fwd: Driver for touchscreen BF6931A1 instead S2100A

Hi there :)

I replace digitizer in my phone (Huawei u8815), but its based on
BF6931A1 instead S2100A.

BF6931A1 is not proper initialized by driver. It start fail on
synaptics_rmi4_read_pdt where
ret = i2c_smbus_write_byte_data(ts->client, 0xff, 0x00); is called
(set rmi page to zero).

Its just the first symptom where i see that the i2c communication fail.

I try on many way to reset this chip by software but without success:

Dmesg part when the BF6931A1 chip is connected:
<6>[1, swapper] [    1.083416] rmi_bus_init: RMI Bus Driver Init
<7>[1, swapper] [    1.083533] rmi_bus_init: registered bus.
<7>[1, swapper] [    1.083559] rmi_sensor_init: RMI Sensor Init
<7>[1, swapper] [    1.083578] rmi_function_init: RMI Function Init
<4>[1, swapper] [    1.083688] i2c-core: driver [rmi4_ts] using legacy
suspend method
<4>[1, swapper] [    1.083718] i2c-core: driver [rmi4_ts] using legacy
resume method
<4>[1, swapper] [    1.083804] *************** synaptics_rmi4_probe
******************
<4>[1, swapper] [    1.083833] Client adress is: 70
<6>[1, swapper] [    1.083856] the i2c_check_functionality is ok
<3>[1, swapper] [    1.083888] synaptics_rmi4_probe: it's the first
touch driver!
<3>[1, swapper] [    1.150668] qup_i2c qup_i2c.1: QUP: I2C status
flags :0x1121c4, irq:43
<3>[1, swapper] [    1.151383] failed to set rmi page
<3>[1, swapper] [    1.151428] qup_i2c qup_i2c.1: QUP: I2C status
flags :0x1121c4, irq:43
<3>[1, swapper] [    1.152136] I2C read failed querying RMI4 $70 capabilities
<3>[1, swapper] [    1.152164] Error identifying device (-5)
<4>[60, synaptics_wq] [    1.152218] do_exit: exit code=4294967292
<4>[60, synaptics_wq] [    1.152271] synaptics_wq used greatest stack
depth: 6552 bytes left
<4>[1, swapper] [    1.152424] *************** synaptics_rmi4_probe
******************
<4>[1, swapper] [    1.152456] Client adress is: 24
<6>[1, swapper] [    1.152478] the i2c_check_functionality is ok
<3>[1, swapper] [    1.152509] synaptics_rmi4_probe: it's the first
touch driver!
<7>[1, swapper] [    1.152539] gpio_request: gpio-96 (TOUCH_RESET) status -16
<3>[1, swapper] [    1.218838] qup_i2c qup_i2c.1: QUP: I2C status
flags :0x1121c4, irq:43
<3>[1, swapper] [    1.219549] failed to set rmi page
<3>[1, swapper] [    1.219591] qup_i2c qup_i2c.1: QUP: I2C status
flags :0x1121c4, irq:43
<3>[1, swapper] [    1.220299] I2C read failed querying RMI4 $24 capabilities
<3>[1, swapper] [    1.220326] Error identifying device (-5)

And now how its look with original S2100A:

<6>[1, swapper] [    1.039414] rmi_bus_init: RMI Bus Driver Init
<7>[1, swapper] [    1.039529] rmi_bus_init: registered bus.
<7>[1, swapper] [    1.039556] rmi_sensor_init: RMI Sensor Init
<7>[1, swapper] [    1.039576] rmi_function_init: RMI Function Init
<4>[1, swapper] [    1.039683] i2c-core: driver [rmi4_ts] using legacy
suspend method
<4>[1, swapper] [    1.039713] i2c-core: driver [rmi4_ts] using legacy
resume method
<4>[1, swapper] [    1.039798] *************** synaptics_rmi4_probe
******************
<4>[1, swapper] [    1.039828] Client adress is: 70
<6>[1, swapper] [    1.039851] the i2c_check_functionality is ok
<3>[1, swapper] [    1.039883] synaptics_rmi4_probe: it's the first
touch driver!
<4>[1, swapper] [    1.106931] set rmi page to zero successfull
<6>[1, swapper] [    1.111396] 2 fingers
<6>[1, swapper] [    1.111419] EGR features:
<6>[1, swapper] [    1.111441]  pinch: 0
<6>[1, swapper] [    1.111463]  press: 0
<6>[1, swapper] [    1.111483]  flick: 0
<6>[1, swapper] [    1.111503]  early tap: 0
<6>[1, swapper] [    1.111524]  double tap: 0
<6>[1, swapper] [    1.111544]  tap and hold: 0
<6>[1, swapper] [    1.111566]  single tap: 1
<6>[1, swapper] [    1.111588]  palm detect: 0
<6>[1, swapper] [    1.113298] max X: 1068; max Y: 1868
<6>[1, swapper] [    1.114231] Read 0 functions from PDT
<3>[1, swapper] [    1.114256] RMI4 $70 data read: $13 + 15
<6>[1, swapper] [    1.116009] the ReportingMode is changged ok!
<6>[1, swapper] [    1.116376] input: synaptics as /devices/virtual/input/input0
<6>[1, swapper] [    1.116594] synaptics input device registered
<7>[1, swapper] [    1.116696] gpio_request: gpio-146 (Synaptics_rmi) status -22
<7>[1, swapper] [    1.116721] gpio_direction_input: gpio-146 status -22
<6>[1, swapper] [    1.116738] Requesting IRQ...
<6>[1, swapper] [    1.116828] Received IRQ!
<3>[1, swapper] [    1.116868] probingX for Synaptics RMI4 device
Synaptics_rmi at $70...
<4>[1, swapper] [    1.116928] *************** synaptics_rmi4_probe
******************
<4>[1, swapper] [    1.116958] Client adress is: 24
<6>[1, swapper] [    1.116979] the i2c_check_functionality is ok
<3>[1, swapper] [    1.117011] synaptics_rmi4_probe: the touch driver
has detected :)
<4>[1, swapper] [    1.117054] Synaptics_rmi: probe of 1-0024 failed
with error -1

How we can see set rmi page to zero is successfull and also reading
capabilities are fine: RMI4 $70 data read: $13 + 15

Now when I switch(without rebooting) again to BF6931A1 I`m able to use
my touchscreen without any issues!

Now its time to reboot phone and see what dmesg show:

<6>[1, swapper] [    1.039468] rmi_bus_init: RMI Bus Driver Init
<7>[1, swapper] [    1.039583] rmi_bus_init: registered bus.
<7>[1, swapper] [    1.039609] rmi_sensor_init: RMI Sensor Init
<7>[1, swapper] [    1.039628] rmi_function_init: RMI Function Init
<4>[1, swapper] [    1.039736] i2c-core: driver [rmi4_ts] using legacy
suspend method
<4>[1, swapper] [    1.039764] i2c-core: driver [rmi4_ts] using legacy
resume method
<4>[1, swapper] [    1.039851] *************** synaptics_rmi4_probe
******************
<4>[1, swapper] [    1.039879] Client adress is: 70
<6>[1, swapper] [    1.039903] the i2c_check_functionality is ok
<3>[1, swapper] [    1.039934] synaptics_rmi4_probe: it's the first
touch driver!
<4>[1, swapper] [    1.106981] set rmi page to zero successfull
<6>[1, swapper] [    1.111361] 2 fingers
<6>[1, swapper] [    1.111384] EGR features:
<6>[1, swapper] [    1.111406]  pinch: 0
<6>[1, swapper] [    1.111426]  press: 0
<6>[1, swapper] [    1.111448]  flick: 0
<6>[1, swapper] [    1.111468]  early tap: 0
<6>[1, swapper] [    1.111489]  double tap: 0
<6>[1, swapper] [    1.111509]  tap and hold: 0
<6>[1, swapper] [    1.111531]  single tap: 1
<6>[1, swapper] [    1.111553]  palm detect: 0
<6>[1, swapper] [    1.113243] max X: 1036; max Y: 1904
<6>[1, swapper] [    1.114176] Read 0 functions from PDT
<3>[1, swapper] [    1.114203] RMI4 $70 data read: $13 + 15
<7>[18, kworker/0:1] [    1.254419] gpio_request: gpio-141
(i2c_host_vbus_en) status -22
<3>[18, kworker/0:1] [    1.254443] failed to request 141 GPIO
<6>[18, kworker/0:1] [    1.354574] msm_hsusb_host msm_hsusb_host.0:
Qualcomm On-Chip EHCI Host Controller
<6>[18, kworker/0:1] [    1.354644] msm_hsusb_host msm_hsusb_host.0:
new USB bus registered, assigned bus number 1
<6>[18, kworker/0:1] [    1.354824] msm_hsusb_host msm_hsusb_host.0:
irq 47, io base 0xa0800000
<6>[18, kworker/0:1] [    1.354996] usb usb1: New USB device found,
idVendor=1d6b, idProduct=0002
<6>[18, kworker/0:1] [    1.355034] usb usb1: New USB device strings:
Mfr=3, Product=2, SerialNumber=1
<6>[18, kworker/0:1] [    1.355069] usb usb1: Product: Qualcomm
On-Chip EHCI Host Controller
<6>[18, kworker/0:1] [    1.355099] usb usb1: Manufacturer: Linux
3.0.8-perf ehci_hcd
<6>[18, kworker/0:1] [    1.355129] usb usb1: SerialNumber: msm_hsusb_host.0
<6>[18, kworker/0:1] [    1.355879] hub 1-0:1.0: USB hub found
<6>[18, kworker/0:1] [    1.355934] hub 1-0:1.0: 1 port detected
<6>[18, kworker/0:1] [    1.356509] msm_hsusb_host msm_hsusb_host.0:
remove, state 1
<6>[18, kworker/0:1] [    1.356561] usb usb1: USB disconnect, device number 1
<6>[18, kworker/0:1] [    1.374768] msm_hsusb_host msm_hsusb_host.0:
USB bus 1 deregistered
<7>[18, kworker/0:1] [    1.604413] gpio_request: gpio-141
(i2c_host_vbus_en) status -22
<3>[18, kworker/0:1] [    1.604451] failed to request 141 GPIO
<3>[1, swapper] [    2.144336] qup_i2c qup_i2c.1: Transaction timed
out, SL-AD = 0x70
<3>[1, swapper] [    2.144371] qup_i2c qup_i2c.1: I2C Status: 349b00
<3>[1, swapper] [    2.144398] qup_i2c qup_i2c.1: QUP Status: 0
<3>[1, swapper] [    2.144424] qup_i2c qup_i2c.1: OP Flags: 0
<4>[1, swapper] [    2.144458] Failed to read IC name.
<3>[1, swapper] [    2.144506] qup_i2c qup_i2c.1: QUP: I2C status
flags :0x1121c4, irq:43
<3>[1, swapper] [    2.145221] tp_read_input_name: i2c_transfer failed
at address $70
<6>[1, swapper] [    2.145286] the ReportingMode is changged ok!
<6>[1, swapper] [    2.145656] input: synaptics as /devices/virtual/input/input0
<6>[1, swapper] [    2.145863] synaptics input device registered
<7>[1, swapper] [    2.145963] gpio_request: gpio-146 (Synaptics_rmi) status -22
<7>[1, swapper] [    2.145986] gpio_direction_input: gpio-146 status -22
<6>[1, swapper] [    2.146004] Requesting IRQ...
<6>[1, swapper] [    2.146093] Received IRQ!
<3>[1, swapper] [    2.146129] probingX for Synaptics RMI4 device
Synaptics_rmi at $70...
<4>[1, swapper] [    2.146193] *************** synaptics_rmi4_probe
******************
<4>[1, swapper] [    2.146223] Client adress is: 24
<6>[1, swapper] [    2.146244] the i2c_check_functionality is ok
<3>[1, swapper] [    2.146276] synaptics_rmi4_probe: the touch driver
has detected :)
<4>[1, swapper] [    2.146316] Synaptics_rmi: probe of 1-0024 failed
with error -1

As we can see after reboot driver was able to set rmi page to zero abd
read capabilities.
Unfortunate In this moment my touchscreen is not responding and in
dmesg i see a lot of:

<3>[19, kworker/u:1] [  290.841264] synaptics_rmi4_work_func:
i2c_transfer failed
<3>[19, kworker/u:1] [  290.841343] qup_i2c qup_i2c.1: QUP: I2C status
flags :0x1121c4, irq:43
<3>[19, kworker/u:1] [  290.841869] synaptics_rmi4_work_func:
i2c_transfer failed
<3>[19, kworker/u:1] [  290.844888] qup_i2c qup_i2c.1: QUP: I2C status
flags :0x1121c4, irq:43

This state is until i reconnect BF6931A1, (still the same without
connecting the old S2100A).
Now again works fine.

Then when re-flash new kernel (and sometimes when I disconnect all
power) its a big chance to back to state from first dmesg.


In attachment i put my latest code.

Maybe somebody here have idea what i can do else (maybe some hardware
reset of i2c or other magic).

General i`m opened on any tip.

Best Regards,
Grzegorz Hetman.

View attachment "synaptics_i2c_rmi_1564.c" of type "text/x-csrc" (53654 bytes)

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ