| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20200818234215.2255611-1-furquan@google.com>
Date: Tue, 18 Aug 2020 16:42:15 -0700
From: Furquan Shaikh <furquan@...gle.com>
To: Dmitry Torokhov <dmitry.torokhov@...il.com>
Cc: Dan Carpenter <dan.carpenter@...cle.com>,
linux-input@...r.kernel.org, linux-kernel@...r.kernel.org,
adurbin@...gle.com, Furquan Shaikh <furquan@...gle.com>
Subject: [PATCH] drivers: input: Use single i2c_transfer transaction when
using RM_CMD_BANK_SWITCH
On an AMD chromebook, where the same I2C bus is shared by both Raydium
touchscreen and a trackpad device, it is observed that interleaving of
I2C messages when raydium_i2c_read_message() is called leads to the
Raydium touch IC reporting incorrect information. This is the sequence
that was observed to result in the above issue:
* I2C write to Raydium device for RM_CMD_BANK_SWITCH
* I2C write to trackpad device
* I2C read from trackpad device
* I2C write to Raydium device for setting address
* I2C read from Raydium device >>>> This provides incorrect
information
This change updates raydium_i2c_read_message and
raydium_i2c_send_message to perform all the I2C transfers in the
function as part of a single i2c_transfer transaction. This ensures
that no transactions are initiated to any other device on the same bus
in between and hence the information obtained from the touchscreen
device is correct. Verified with the patch across multiple
reboots (>100) that the information reported by the Raydium
touchscreen device during probe is correct.
Signed-off-by: Furquan Shaikh <furquan@...gle.com>
---
drivers/input/touchscreen/raydium_i2c_ts.c | 102 ++++++++++++++++-----
1 file changed, 80 insertions(+), 22 deletions(-)
diff --git a/drivers/input/touchscreen/raydium_i2c_ts.c b/drivers/input/touchscreen/raydium_i2c_ts.c
index fe245439adee..11c00d341eb1 100644
--- a/drivers/input/touchscreen/raydium_i2c_ts.c
+++ b/drivers/input/touchscreen/raydium_i2c_ts.c
@@ -111,6 +111,15 @@ struct raydium_info {
u8 y_res; /* units/mm */
};
+/*
+ * Header to be sent for RM_CMD_BANK_SWITCH command. This is used by
+ * raydium_i2c_{read|send}_message below.
+ */
+struct __packed raydium_bank_switch_header {
+ u8 cmd;
+ __be32 be_addr;
+};
+
/* struct raydium_data - represents state of Raydium touchscreen device */
struct raydium_data {
struct i2c_client *client;
@@ -198,22 +207,44 @@ static int raydium_i2c_read(struct i2c_client *client,
static int raydium_i2c_read_message(struct i2c_client *client,
u32 addr, void *data, size_t len)
{
- __be32 be_addr;
- size_t xfer_len;
- int error;
+ int ret;
while (len) {
- xfer_len = min_t(size_t, len, RM_MAX_READ_SIZE);
-
- be_addr = cpu_to_be32(addr);
+ u8 read_addr = addr & 0xff;
+ struct raydium_bank_switch_header header = {
+ .cmd = RM_CMD_BANK_SWITCH,
+ .be_addr = cpu_to_be32(addr),
+ };
+ size_t xfer_len = min_t(size_t, len, RM_MAX_READ_SIZE);
+ /*
+ * Perform as a single i2c_transfer transaction to ensure that
+ * no other I2C transactions are initiated on the bus to any
+ * other device in between. Initiating transacations to other
+ * devices after RM_CMD_BANK_SWITCH is sent is known to cause
+ * read issues.
+ */
+ struct i2c_msg xfer[] = {
+ {
+ .addr = client->addr,
+ .len = sizeof(header),
+ .buf = (u8 *)&header,
+ },
+ {
+ .addr = client->addr,
+ .len = 1,
+ .buf = &read_addr,
+ },
+ {
+ .addr = client->addr,
+ .flags = I2C_M_RD,
+ .len = xfer_len,
+ .buf = data,
+ }
+ };
- error = raydium_i2c_send(client, RM_CMD_BANK_SWITCH,
- &be_addr, sizeof(be_addr));
- if (!error)
- error = raydium_i2c_read(client, addr & 0xff,
- data, xfer_len);
- if (error)
- return error;
+ ret = i2c_transfer(client->adapter, xfer, ARRAY_SIZE(xfer));
+ if (ret != ARRAY_SIZE(xfer))
+ return ret < 0 ? ret : -EIO;
len -= xfer_len;
data += xfer_len;
@@ -224,22 +255,49 @@ static int raydium_i2c_read_message(struct i2c_client *client,
}
static int raydium_i2c_send_message(struct i2c_client *client,
- u32 addr, const void *data, size_t len)
+ u32 addr, void *data, size_t len)
{
- __be32 be_addr = cpu_to_be32(addr);
- int error;
+ int tries = 0;
- error = raydium_i2c_send(client, RM_CMD_BANK_SWITCH,
- &be_addr, sizeof(be_addr));
- if (!error)
- error = raydium_i2c_send(client, addr & 0xff, data, len);
+ do {
+ int ret;
+ u8 write_addr = addr & 0xff;
+ struct raydium_bank_switch_header header = {
+ .cmd = RM_CMD_BANK_SWITCH,
+ .be_addr = cpu_to_be32(addr),
+ };
+
+ struct i2c_msg xfer[] = {
+ {
+ .addr = client->addr,
+ .len = sizeof(header),
+ .buf = (u8 *)&header,
+ },
+ {
+ .addr = client->addr,
+ .len = 1,
+ .buf = &write_addr,
+ },
+ {
+ .addr = client->addr,
+ .len = len,
+ .buf = data,
+ }
+ };
- return error;
+ ret = i2c_transfer(client->adapter, xfer, ARRAY_SIZE(xfer));
+ if (likely(ret == ARRAY_SIZE(xfer)))
+ return 0;
+
+ msleep(20);
+ } while (++tries < RM_MAX_RETRIES);
+
+ return -EIO;
}
static int raydium_i2c_sw_reset(struct i2c_client *client)
{
- const u8 soft_rst_cmd = 0x01;
+ u8 soft_rst_cmd = 0x01;
int error;
error = raydium_i2c_send_message(client, RM_RESET_MSG_ADDR,
--
2.28.0.220.ged08abb693-goog
Powered by blists - more mailing lists