| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20240309180429.1ebbe887@jic23-huawei>
Date: Sat, 9 Mar 2024 18:04:29 +0000
From: Jonathan Cameron <jic23@...nel.org>
To: Vasileios Amoiridis <vassilisamir@...il.com>
Cc: lars@...afoo.de, ang.iglesiasg@...il.com,
andriy.shevchenko@...ux.intel.com, linus.walleij@...aro.org,
semen.protsenko@...aro.org, linux-iio@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drivers: iio: pressure: Fixes BMP38x and BMP390 SPI
support
On Wed, 6 Mar 2024 19:08:29 +0100
Vasileios Amoiridis <vassilisamir@...il.com> wrote:
> On Sat, Feb 24, 2024 at 04:30:51PM +0000, Jonathan Cameron wrote:
> > On Mon, 19 Feb 2024 20:13:59 +0100
> > Vasileios Amoiridis <vassilisamir@...il.com> wrote:
> >
> > > According to the datasheet of BMP38x and BMP390 devices, for an SPI
> > > read operation the first byte that is returned needs to be dropped,
> > > and the rest of the bytes are the actual data returned from the
> > > sensor.
> > >
> > > Fixes: 8d329309184d ("iio: pressure: bmp280: Add support for BMP380 sensor family")
> > >
> > > Signed-off-by: Vasileios Amoiridis <vassilisamir@...il.com>
> >
> > Applied and marked for stable - with tweaks to header order and the space above
> > as per discussion.
>
> Hi Jonathan,
>
> I just got my hands on a BME280 humidity sensor and I realized that this commit,
> even though it fixes the SPI support for the BMP38x and BMP390 devices, it breaks
> the SPI support for BME280 and BMP58x. The problem is descirbed below, inline.
>
> > > ---
> > > drivers/iio/pressure/bmp280-spi.c | 49 ++++++++++++++++++++++++++++++-
> > > 1 file changed, 48 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/iio/pressure/bmp280-spi.c b/drivers/iio/pressure/bmp280-spi.c
> > > index e8a5fed07e88..1972014dca93 100644
> > > --- a/drivers/iio/pressure/bmp280-spi.c
> > > +++ b/drivers/iio/pressure/bmp280-spi.c
> > > @@ -8,6 +8,7 @@
> > > #include <linux/spi/spi.h>
> > > #include <linux/err.h>
> > > #include <linux/regmap.h>
> > > +#include <linux/bits.h>
> > >
> > > #include "bmp280.h"
> > >
> > > @@ -35,6 +36,33 @@ static int bmp280_regmap_spi_read(void *context, const void *reg,
> > > return spi_write_then_read(spi, reg, reg_size, val, val_size);
> > > }
> > >
> > > +static int bmp380_regmap_spi_read(void *context, const void *reg,
> > > + size_t reg_size, void *val, size_t val_size)
> > > +{
> > > + struct spi_device *spi = to_spi_device(context);
> > > + u8 rx_buf[4];
> > > + ssize_t status;
> > > +
> > > + /*
> > > + * Maximum number of consecutive bytes read for a temperature or
> > > + * pressure measurement is 3.
> > > + */
> > > + if (val_size > 3)
> > > + return -EINVAL;
> > > + /*
> > > + * According to the BMP3xx datasheets, for a basic SPI read opertion,
> > > + * the first byte needs to be dropped and the rest are the requested
> > > + * data.
> > > + */
> > > + status = spi_write_then_read(spi, reg, 1, rx_buf, val_size + 1);
> > > + if (status)
> > > + return status;
> > > +
> > > + memcpy(val, rx_buf + 1, val_size);
> > > +
> > > + return 0;
> > > +}
> > > +
> > > static struct regmap_bus bmp280_regmap_bus = {
> > > .write = bmp280_regmap_spi_write,
> > > .read = bmp280_regmap_spi_read,
> > > @@ -42,10 +70,19 @@ static struct regmap_bus bmp280_regmap_bus = {
> > > .val_format_endian_default = REGMAP_ENDIAN_BIG,
> > > };
> > >
> > > +static struct regmap_bus bmp380_regmap_bus = {
> > > + .write = bmp280_regmap_spi_write,
> > > + .read = bmp380_regmap_spi_read,
> > > + .read_flag_mask = BIT(7),
> > > + .reg_format_endian_default = REGMAP_ENDIAN_BIG,
> > > + .val_format_endian_default = REGMAP_ENDIAN_BIG,
> > > +};
> > > +
> > > static int bmp280_spi_probe(struct spi_device *spi)
> > > {
> > > const struct spi_device_id *id = spi_get_device_id(spi);
> > > const struct bmp280_chip_info *chip_info;
> > > + struct regmap_bus *bmp_regmap_bus;
> > > struct regmap *regmap;
> > > int ret;
> > >
> > > @@ -58,8 +95,18 @@ static int bmp280_spi_probe(struct spi_device *spi)
> > >
> > > chip_info = spi_get_device_match_data(spi);
> > >
> > > + switch (chip_info->chip_id[0]) {
> > > + case BMP380_CHIP_ID:
> > > + case BMP390_CHIP_ID:
>
> These chip IDs, even though they are IDs, they are not unique and they are
> shared among sensors (see bmp280.h line 290). This means that this cases
> are true also for BME280 and BMP58x devices which of course should not
> happen because their regmap bus is the bmp280_* and not the bmp380_*.
Gah. Anyone who can go say very rude things to bosch please do so.
There is no point in having an ID register if you don't make it change
for incompatible parts!
>
> It can easily be solved by removing the switch-case statement and adding
> an if(!(strcmp(id->name,"bmp380")) which checks the name which is indeed
> unique. I guess that this patch should be reverted, how should I proceed?
Add a flag to the chip_info structure that says whether the extra byte
is needed for a given part. Then use that to pick the regmap.
Alternative would be a pointer to the right regmap, but that is probably
messier to do.
If the fix is simple, stack it as a fix for the fix. If not we can revert
it. Unfortunately it already hit mainline before I saw your message.
Make sure you include a short rant about who bad the hardware is.
Jonathan
>
> > > + bmp_regmap_bus = &bmp380_regmap_bus;
> > > + break;
> > > + default:
> > > + bmp_regmap_bus = &bmp280_regmap_bus;
> > > + break;
> > > + }
> > > +
> > > regmap = devm_regmap_init(&spi->dev,
> > > - &bmp280_regmap_bus,
> > > + bmp_regmap_bus,
> > > &spi->dev,
> > > chip_info->regmap_config);
> > > if (IS_ERR(regmap)) {
> >
Powered by blists - more mailing lists