On Friday 21 June 2024 14:25:01 Hans de Goede wrote:
> Unfortunately the SMOxxxx ACPI device does not contain the i2c-address
> of the accelerometer. So a DMI product-name to address mapping table
> is used.
This is statement which I got from Dell for 10 years old Dell models.
I have already stated that poking of address in kernel is a big risk
specially for all current and any future dell hardware. Hiding it just
under the kernel parameter is still a risk, specially as neither its
name, nor description say that it is dangerous.
But anyway, why this code is being introduced? Have you communicated
with Dell about this problem?
> At support to have the kernel probe for the i2c-address for modesl
> which are not on the list.
>
> The new probing code sits behind a new probe_i2c_addr module parameter,
> which is disabled by default because probing might be dangerous.
>
> Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx>
> ---
> drivers/platform/x86/dell/dell-smo8800.c | 152 ++++++++++++++++++++++-
> 1 file changed, 147 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/platform/x86/dell/dell-smo8800.c b/drivers/platform/x86/dell/dell-smo8800.c
> index 4c79b2599d96..d64d200e927a 100644
> --- a/drivers/platform/x86/dell/dell-smo8800.c
> +++ b/drivers/platform/x86/dell/dell-smo8800.c
> @@ -10,6 +10,7 @@
> */
>
> #define DRIVER_NAME "smo8800"
> +#define LIS3_WHO_AM_I 0x0f
>
> #include <linux/device/bus.h>
> #include <linux/dmi.h>
> @@ -25,6 +26,10 @@
> #include <linux/uaccess.h>
> #include <linux/workqueue.h>
>
> +static bool probe_i2c_addr;
> +module_param(probe_i2c_addr, bool, 0444);
> +MODULE_PARM_DESC(probe_i2c_addr, "Probe the i801 I2C bus for the accelerometer on models where the address is unknown");
> +
> struct smo8800_device {
> u32 irq; /* acpi device irq */
> atomic_t counter; /* count after last read */
> @@ -225,6 +230,130 @@ static const struct dmi_system_id smo8800_lis3lv02d_devices[] = {
> { }
> };
>
> +/*
> + * This is the kernel version of the single register device sanity checks from
> + * the i2c_safety_check function from lm_sensors sensor-detect script:
> + * This is meant to prevent access to 1-register-only devices,
> + * which are designed to be accessed with SMBus receive byte and SMBus send
> + * byte transactions (i.e. short reads and short writes) and treat SMBus
> + * read byte as a real write followed by a read. The device detection
> + * routines would write random values to the chip with possibly very nasty
> + * results for the hardware. Note that this function won't catch all such
> + * chips, as it assumes that reads and writes relate to the same register,
> + * but that's the best we can do.
> + */
> +static int i2c_safety_check(struct device *dev, struct i2c_adapter *adap, u8 addr)
> +{
> + union i2c_smbus_data smbus_data;
> + int err;
> + u8 data;
> +
> + /*
> + * First receive a byte from the chip, and remember it. This
> + * also checks if there is a device at the address at all.
> + */
> + err = i2c_smbus_xfer(adap, addr, 0, I2C_SMBUS_READ, 0,
> + I2C_SMBUS_BYTE, &smbus_data);
> + if (err < 0)
> + return err;
> +
> + data = smbus_data.byte;
> +
> + /*
> + * Receive a byte again; very likely to be the same for
> + * 1-register-only devices.
> + */
> + err = i2c_smbus_xfer(adap, addr, 0, I2C_SMBUS_READ, 0,
> + I2C_SMBUS_BYTE, &smbus_data);
> + if (err < 0)
> + return err;
> +
> + if (smbus_data.byte != data)
> + return 0; /* Not a 1-register-only device. */
> +
> + /*
> + * Then try a standard byte read, with a register offset equal to
> + * the read byte; for 1-register-only device this should read
> + * the same byte value in return.
> + */
> + err = i2c_smbus_xfer(adap, addr, 0, I2C_SMBUS_READ, data,
> + I2C_SMBUS_BYTE_DATA, &smbus_data);
> + if (err < 0)
> + return err;
> +
> + if (smbus_data.byte != data)
> + return 0; /* Not a 1-register-only device. */
> +
> + /*
> + * Then try a standard byte read, with a slightly different register
> + * offset; this should again read the register offset in return.
> + */
> + err = i2c_smbus_xfer(adap, addr, 0, I2C_SMBUS_READ, data ^ 0x01,
> + I2C_SMBUS_BYTE_DATA, &smbus_data);
> + if (err < 0)
> + return err;
> +
> + if (smbus_data.byte != (data ^ 0x01))
> + return 0; /* Not a 1-register-only device. */
> +
> + /*
> + * Apparently this is a 1-register-only device, restore the original
> + * register value and leave it alone.
> + */
> + i2c_smbus_xfer(adap, addr, 0, I2C_SMBUS_WRITE, data,
> + I2C_SMBUS_BYTE, NULL);
> + dev_warn(dev, "I2C safety check for address 0x%02x failed, skipping\n", addr);
> + return -ENODEV;
> +}
> +
> +static int smo8800_detect_accel(struct smo8800_device *smo8800,
> + struct i2c_adapter *adap, u8 addr,
> + struct i2c_board_info *info, bool probe)
> +{
> + union i2c_smbus_data smbus_data;
> + const char *type;
> + int err;
> +
> + if (probe) {
> + dev_info(smo8800->dev, "Probing for accelerometer on address 0x%02x\n", addr);
> + err = i2c_safety_check(smo8800->dev, adap, addr);
> + if (err < 0)
> + return err;
> + }
> +
> + err = i2c_smbus_xfer(adap, addr, 0, I2C_SMBUS_READ, LIS3_WHO_AM_I,
> + I2C_SMBUS_BYTE_DATA, &smbus_data);
> + if (err < 0) {
> + dev_warn(smo8800->dev, "Failed to read who-am-i register: %d\n", err);
> + return err;
> + }
> +
> + /* who-am-i register mappings from drivers/misc/lis3lv02d/lis3lv02d.c */
> + switch (smbus_data.byte) {
> + case 0x32:
> + type = "lis331dlh";
> + break;
> + case 0x33:
> + type = "lis2de12"; /* LIS3DC / HP3DC in drivers/misc/lis3lv02d/lis3lv02d.c */
> + break;
> + case 0x3a:
> + type = "lis3lv02dl_accel";
> + break;
> + case 0x3b:
> + type = "lis302dl";
> + break;
> + default:
> + dev_warn(smo8800->dev, "Unknown who-am-i register value 0x%02x\n",
> + smbus_data.byte);
> + return -ENODEV;
> + }
> +
> + dev_dbg(smo8800->dev, "Detected %s accelerometer on address 0x%02x\n", type, addr);
> + strscpy(info->type, "lis3lv02d", I2C_NAME_SIZE);
> + info->addr = addr;
> + return 0;
> +}
> +
> static int smo8800_find_i801(struct device *dev, void *data)
> {
> struct i2c_adapter *adap, **adap_ret = data;
> @@ -247,6 +376,7 @@ static void smo8800_instantiate_i2c_client(struct work_struct *work)
> const struct dmi_system_id *lis3lv02d_dmi_id;
> struct i2c_board_info info = { };
> struct i2c_adapter *adap = NULL;
> + int err;
>
> if (smo8800->i2c_dev)
> return;
> @@ -256,11 +386,22 @@ static void smo8800_instantiate_i2c_client(struct work_struct *work)
> return;
>
> lis3lv02d_dmi_id = dmi_first_match(smo8800_lis3lv02d_devices);
> - if (!lis3lv02d_dmi_id)
> + if (lis3lv02d_dmi_id) {
> + info.addr = (long)lis3lv02d_dmi_id->driver_data;
> + /* Always detect the accel-type, this also checks the accel is actually there */
> + err = smo8800_detect_accel(smo8800, adap, info.addr, &info, false);
> + if (err)
> + goto out_put_adapter;
> + } else if (probe_i2c_addr) {
> + /* First try address 0x29 (most used) and then try 0x1d */
> + if (smo8800_detect_accel(smo8800, adap, 0x29, &info, true) != 0 &&
> + smo8800_detect_accel(smo8800, adap, 0x1d, &info, true) != 0) {
> + dev_warn(smo8800->dev, "failed to probe for lis3lv02d I2C address\n");
> + goto out_put_adapter;
> + }
> + } else {
> goto out_put_adapter;
> -
> - info.addr = (long)lis3lv02d_dmi_id->driver_data;
> - strscpy(info.type, "lis3lv02d", I2C_NAME_SIZE);
> + }
>
> smo8800->i2c_dev = i2c_new_client_device(adap, &info);
> if (IS_ERR(smo8800->i2c_dev)) {
> @@ -357,7 +498,7 @@ static int smo8800_probe(struct platform_device *device)
> smo8800->irq);
> }
>
> - if (dmi_check_system(smo8800_lis3lv02d_devices)) {
> + if (dmi_check_system(smo8800_lis3lv02d_devices) || probe_i2c_addr) {
> /*
> * Register i2c-bus notifier + queue initial scan for lis3lv02d
> * i2c_client instantiation.
> @@ -370,6 +511,7 @@ static int smo8800_probe(struct platform_device *device)
> } else {
> dev_warn(&device->dev,
> "lis3lv02d accelerometer is present on SMBus but its address is unknown, skipping registration\n");
> + dev_info(&device->dev, "Pass dell_smo8800.probe_i2c_addr=1 on the kernel commandline to probe, this may be dangerous!\n");
> if (!smo8800->irq)
> return -ENODEV;
> }
> --
> 2.45.1
>
