From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f173.google.com (mail-dy1-f173.google.com [74.125.82.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 60BA3391822 for ; Tue, 5 May 2026 16:21:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777998116; cv=none; b=QEi6aeBaf+KPWpiiS+SNTVaTpqmK4vVAx6zESe48CdoinY7B8p9SHajq82L4hVexhxVnp8b4anxmUqKdR1ps0juqv7dMDo4fTEQxrcKwjsccoGjOey+nIXaNuAEhRhCbKVgEyVqys16I7CFlEYf9iOLVXYdIHEhjzMFHF7LA+qM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777998116; c=relaxed/simple; bh=MhVhqytDBsoXqrV7yikqRH2U/UkDGacf8smarcWqBEc=; h=From:Message-ID:Date:MIME-Version:Subject:To:Cc:References: In-Reply-To:Content-Type; b=Im5IcAqp8u0OgJ4dLuS1B9Ve6CfaPgbvUyJev8EbmJR4TcvQ0yebBUaD25PuqsdVR/dtQh0PV2vZvAl0CJWpxwl1aOTC+oRiEbimXDqWbPrScnrJbGaQdQ3U4N2Mk9ieQ/Q53YtNUmIU4sQh+sZHrw1FbvaoLqCJNsQ69Y2VLwM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=embeddedts.com; spf=pass smtp.mailfrom=embeddedts.com; dkim=pass (1024-bit key) header.d=embeddedts.com header.i=@embeddedts.com header.b=FZn1cz7S; arc=none smtp.client-ip=74.125.82.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=embeddedts.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=embeddedts.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=embeddedts.com header.i=@embeddedts.com header.b="FZn1cz7S" Received: by mail-dy1-f173.google.com with SMTP id 5a478bee46e88-2f03d6cf77bso3664749eec.0 for ; Tue, 05 May 2026 09:21:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=embeddedts.com; s=google; t=1777998113; x=1778602913; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:content-language:references :cc:to:subject:user-agent:mime-version:date:message-id:from:from:to :cc:subject:date:message-id:reply-to; bh=AV/YmfGA78g8SATWPQgqplca6ENgzk/z9se3dsK0CGU=; b=FZn1cz7SvlGEETLWUcGy+QBY1LRaOujalecHshojAwoL2v5m+RKUrBUWRX1ZAMa0vo yk1lHtLNEmEVw8RjVuct+co/TuMyAkkzDKl12AH6wQSto+kUHuzk6XuBCp4oPFmOZsIt EO19/kJ1LT6dzPC9OZmcfZVL8W5ks3Hv5Khmg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777998113; x=1778602913; h=content-transfer-encoding:in-reply-to:content-language:references :cc:to:subject:user-agent:mime-version:date:message-id:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=AV/YmfGA78g8SATWPQgqplca6ENgzk/z9se3dsK0CGU=; b=AYvjqI3peDBZ/Ets19KzYUnp7m89AFcvQiWgiljyg0T2JxXqLzq+mj3BS6Hb21B9te HkaSpubdnAX3+WJH6QdsQE6rwZWkSaxh7VHhCMcQCF1DB2gXKV8S2LNOqwgeBvru0v9y vk0njOoiY75A7td2QAMR0rysnPCgKre/LENKJBLADS9TzSwTXtoMnBTsLPlUcIgs/ca5 MKuZppzYdX5ZD7G2thsW53LE5E96vHZv4Z2ZaGwToej56OkXcjvS38FMtVBknF8tFeb9 /DLp+BfL2r5eb1JYQyuT2iXZwLwXAdNd6LeSZZ6AydRNs8PpPBtP0q9tILveIl2zVW6A DQGA== X-Forwarded-Encrypted: i=1; AFNElJ9vfWJIXz8u7858mxuGXx6Td9Cf7gWBedbVQqo8EiTsiJKaheY6zAfUjddvGxpe11ZW6tLy/yJ1iReFquo=@vger.kernel.org X-Gm-Message-State: AOJu0YwkBmIm1NXzXA4rA6ov5Ag3x4mDNhZzFstW2hyiQqs/rGD2SP+Z 3/NB3+h5SG59VcXZBFSccR5a5n6oUj4GhxyUL3HvekBsV8R/Ehf/AAcSLfxXNfppw8I/KYRTcXF Rx2q/9nr1Jg== X-Gm-Gg: AeBDiesPLp8JJWpxr09A7mudBLytKfHt2j2QkRYJNJlZMrrMP4mphhcXnBSkMiYEMRk 36Kd6oZeR8/LLohsk3Sf0vzfZF7Uiquy13ZVL1Y8oFy9mxoZvkncp2o2UoYPPomPw4BbQKXtHFY xlBUlbF6er6DQB36XmnBdjK8nM0wFQD8fqZFU36TAOkSDoVMjvRFjRrabF7sxmrs9HR/ZhenEtt G5PYyhSSCMZ3D0idd89pblWzcfGyVyPIAVZDO2bKwd91ju6VJsSFSiagDCElKVigjezvaZXv1je aTYjr6CoprPU4cv90aQpq5y4iH0b5IwcKtqrWCZAZ8Lbvgqa/0wbOyevNmteOov0h9R7zSSw7fb zRD5ze5cKvr1UgwCpSRyRaZS4tmaXAVgb9F7m3pfAqiy9oOmbpplbhq7ImLPEcMgvxMn7Z5100m yWpeqXHW1KwrGf0WDYsfPVTbEnKsWl3RSOOLnRl1BYdgE9qja+ONhzJVNsxjCluhGcYIZTHsDGt sFsrBm3WDndZWA2Zxy+nlNS4fENRL6XHqTvltLEmnL+NdPe/U24N7ZMNU9U2rETLjaxkPr3rzVG o3t0iEImmrDoYzo= X-Received: by 2002:a05:7301:3d06:b0:2c1:7793:7bbb with SMTP id 5a478bee46e88-2f409cb094fmr1796691eec.27.1777998113220; Tue, 05 May 2026 09:21:53 -0700 (PDT) Received: from [10.10.10.191] ([184.3.231.126]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-2ee3b29b2casm21012701eec.14.2026.05.05.09.21.52 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 05 May 2026 09:21:52 -0700 (PDT) From: Kris Bahnsen X-Google-Original-From: Kris Bahnsen Message-ID: Date: Tue, 5 May 2026 09:21:50 -0700 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v3] Input: ads7846 - don't use scratch for tx_buf when clearing register To: Dmitry Torokhov Cc: Marek Vasut , stable@vger.kernel.org, Mark Featherston , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org References: <20260430173739.3843425-1-kris@embeddedTS.com> Content-Language: en-US In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Dmitry, On 5/4/26 8:01 PM, Dmitry Torokhov wrote: > Hi Kris, > > On Thu, Apr 30, 2026 at 05:37:38PM +0000, Kris Bahnsen wrote: >> The workaround for XPT2046 clears the command register, giving the >> touchscreen controller a NOP. The change incorrectly re-uses the >> req->scratch variable which is used as rx_buf for xfer[5], so by >> the time xfer[6] occurs, the contents of req->scratch may not be >> 0. It was found that the touchscreen controller can end up in >> a completely unresponsive state due to it being given a command >> the driver does not expect. >> >> Instead, rely on the spi_transfer behavior of tx_buf being NULL to >> transmit all 0 bits and use the scratch variable for the rx_buf for >> both the 1 byte command to and 2 byte response from the controller. >> >> This change was tested on real TSC2046 and ADS7843 controllers, >> but not the XPT2046 the workaround was originally created for. >> Confirming that the original modification to clear the command >> register does not impact either real controller. >> >> Fixes: 781a07da9bb94 ("Input: ads7846 - add dummy command register clearing cycle") >> Cc: stable@vger.kernel.org >> Co-developed-by: Mark Featherston >> Signed-off-by: Mark Featherston >> Signed-off-by: Kris Bahnsen >> --- >> >> V1 -> V2: Don't use rx_buf when clearing command reg >> V2 -> V3: Modify original 2 xfer command to eliminate dev_err() >> output on xfer with len and NULL buffers >> >> drivers/input/touchscreen/ads7846.c | 3 +-- >> 1 file changed, 1 insertion(+), 2 deletions(-) >> >> diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c >> index 4b39f7212d35c..488bcc8393293 100644 >> --- a/drivers/input/touchscreen/ads7846.c >> +++ b/drivers/input/touchscreen/ads7846.c >> @@ -403,8 +403,7 @@ static int ads7846_read12_ser(struct device *dev, unsigned command) >> spi_message_add_tail(&req->xfer[5], &req->msg); >> >> /* clear the command register */ >> - req->scratch = 0; >> - req->xfer[6].tx_buf = &req->scratch; >> + req->xfer[6].rx_buf = &req->scratch; > > Sashiko (I believe correctly) pointed out that by doing this "scratch" > is now write only and this may cause DMA from the device stomp on > message status and other unrelated data that shares the same cacheline > with scracth. While it was already a problem before now it is even more > likely. > > Since scratch is now write-only I believe moving it below "sample" > forces it into separate cacheline and fixes this problem. Could you > please try making this change? Apologies, I'm not quite certain I understand what you mean by "moving it below sample." Do you mean relocating the xfer[6] block immediately below the xfer[3] block like so? If yes, I can get this tested and a v4 patch together. If not, can you please clarify? diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c index 4b39f7212d35..6d57865ff505 100644 --- a/drivers/input/touchscreen/ads7846.c +++ b/drivers/input/touchscreen/ads7846.c @@ -390,6 +390,11 @@ static int ads7846_read12_ser(struct device *dev, unsigned command) req->xfer[3].len = 2; spi_message_add_tail(&req->xfer[3], &req->msg); + /* clear the command register */ + req->xfer[6].rx_buf = &req->scratch; + req->xfer[6].len = 1; + spi_message_add_tail(&req->xfer[6], &req->msg); + /* REVISIT: take a few more samples, and compare ... */ /* converter in low power mode & enable PENIRQ */ @@ -402,12 +407,6 @@ static int ads7846_read12_ser(struct device *dev, unsigned command) req->xfer[5].len = 2; spi_message_add_tail(&req->xfer[5], &req->msg); - /* clear the command register */ - req->scratch = 0; - req->xfer[6].tx_buf = &req->scratch; - req->xfer[6].len = 1; - spi_message_add_tail(&req->xfer[6], &req->msg); - req->xfer[7].rx_buf = &req->scratch; req->xfer[7].len = 2; CS_CHANGE(req->xfer[7]); > > Thanks. > -- Kris Bahnsen Software Engineer embeddedTS