linux-kernel - Sony IMX290/462 image sensors I2C xfer peculiarity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <m3y1gpw8ri.fsf@t19.piap.pl>
Date:   Fri, 29 Sep 2023 12:53:21 +0200
From:   Krzysztof Hałasa <khalasa@...p.pl>
To:     linux-media <linux-media@...r.kernel.org>,
        lkml <linux-kernel@...r.kernel.org>
Subject: Sony IMX290/462 image sensors I2C xfer peculiarity

Hi,

I am debugging certain IMX290 and IMX462 I2C failures on an NXP
i.MX6MP based board and there seem to be interesting "feature" here:
Sony IMX290 and IMX462 image sensors apparently terminate I2C transfers
after 2^18 of their master clock cycles. For example, with a typical
37.125 MHz clock oscillator, this means about 7 ms. In practice, I'm
barely able to read a block of 128 registers (at I2C 400 kHz clock
rate).

I think the sensors simply disconnect from the bus after 2^18 clock
cycles (starting from the first START condition, the repeated STARTs
don't reset the timeout). This means, in case of a READ operation, the
data read by the CPU after the timeout contains all bits set to 1.
i.MX8MP detects arbitration losses, so if the SDA change to 1 happens on
high clock value (but not on ACK bit), the whole transfer is aborted.
Otherwise, the ending bytes are simply set to FF (and the last non-FF
may be corrupted partially).

The problem is 7 ms is a short time and on a non-real time system even
a simple non-DMA I2C register writes can take as much time. This causes
driver failures.

Needless to say, the datasheets know nothing about the feature.

Any thoughts?
-- 
Krzysztof "Chris" Hałasa

Sieć Badawcza Łukasiewicz
Przemysłowy Instytut Automatyki i Pomiarów PIAP
Al. Jerozolimskie 202, 02-486 Warszawa