commit eb1a148ef4 upstream.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by
moving to a suitable structure in the iio_priv() data with alignment
explicitly requested. This data is allocated with kzalloc so no
data can leak appart from previous readings.
The explicit alignment of ts is necessary to ensure consistent
padding for x86_32 in which the ts would otherwise be 4 byte aligned.
Fixes: 283d26917a ("iio: chemical: ccs811: Add triggered buffer support")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: Narcisa Ana Maria Vasile <narcisaanamaria12@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Based on 2 normalized pattern(s):
this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license version 2 as
published by the free software foundation
this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license version 2 as
published by the free software foundation #
extracted by the scancode license scanner the SPDX license identifier
GPL-2.0-only
has been chosen to replace the boilerplate/reference in 4122 file(s).
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Enrico Weigelt <info@metux.net>
Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org>
Reviewed-by: Allison Randal <allison@lohutok.net>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190604081206.933168790@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CCS811 has different I2C register maps in boot and application mode. When
CCS811 is in boot mode, register APP_START (0xF4) is used to transit the
firmware state from boot to application mode. However, APP_START is not a
valid register location when CCS811 is in application mode (refer to
"CCS811 Bootloader Register Map" and "CCS811 Application Register Map" in
CCS811 datasheet). The driver should not attempt to perform a write to
APP_START while CCS811 is in application mode, as this is not a valid or
documented register location.
When prob function is being called, the driver assumes the CCS811 sensor
is in boot mode, and attempts to perform a write to APP_START. Although
CCS811 powers-up in boot mode, it may have already been transited to
application mode by previous instances, e.g. unload and reload device
driver by the system, or explicitly by user. Depending on the system
design, CCS811 sensor may be permanently connected to system power source
rather than power controlled by GPIO, hence it is possible that the sensor
is never power reset, thus the firmware could be in either boot or
application mode at any given time when driver prob function is being
called.
This patch checks the STATUS register before attempting to send a write to
APP_START. Only if the firmware is not in application mode and has valid
firmware application loaded, then it will continue to start transiting the
firmware boot to application mode.
Signed-off-by: Richard Lai <richard@richardman.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
The resistance member in ccs811_reading struct is an unsigned 16-bit
integer variable used to store RAW_DATA register bytes read from CCS811.
It is kind of misleading to name this struct member as resistance.
About the RAW_DATA register bytes, the CCS811 datasheet states that:
-----
Two byte read only register which contains the latest readings from the
sense resistor.
The most significant 6 bits of the Byte 0 contain the value of the current
through the sensor (0μA to 63μA).
The lower 10 bits contain (as computed from the ADC) the readings of the
voltage across the sensor with the selected current (1023 = 1.65V)"
-----
Hence, the RAW_DATA register byte contains information about electric
current and voltage of the CCS811 sensor. Calling this struct member
'resistance' is kind of misleading, although both electric current and
voltage are needed to calculate the electrical resistance of the sensor
using Ohm's law, V = I x R, in which a new channel type of IIO_RESISTANCE
may be added to the driver in the future.
Signed-off-by: Richard Lai <richard@richardman.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
This particular constant was named with prefix "CCS881", which should be
"CCS811" instead, just like the rest of constant names in the file, as this
driver implementation is for AMS CCS811 sensor. "CCS881" could literally be
referring to another sensor product unrelated to AMS CCS811 sensor.
Signed-off-by: Richard Lai <richard@richardman.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
in_concentration_raw should report, according to sysfs-bus-iio documentation,
a "Raw (unscaled no offset etc.) percentage reading of a substance."
Modify scale to convert from ppm/ppb to percentage:
1 ppm = 0.0001%
1 ppb = 0.0000001%
There is no offset needed to convert the ppm/ppb to percentage,
so remove offset from IIO_CONCENTRATION (IIO_MOD_CO2) channel.
Cc'd stable to reduce chance of userspace breakage in the long
run as we fix this wrong bit of ABI usage.
Signed-off-by: Narcisa Ana Maria Vasile <narcisaanamaria12@gmail.com>
Cc: <Stable@vger.kernel.org>
Reviewed-by: Matt Ranostay <matt.ranostay@konsulko.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Add data ready trigger for hardware interrupts that signal
new, available measurement samples.
Cc: Daniel Baluta <daniel.baluta@gmail.com>
Cc: Alison Schofield <amsfield22@gmail.com>
Signed-off-by: Narcisa Ana Maria Vasile <narcisaanamaria12@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
The equivalent of both of these are now done via macro magic when
the relevant register calls are made. The actual structure
elements will shortly go away.
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Lars-Peter Clausen <lars@metafoo.de>
A software trigger such as hrtimer can be used to capture the data
that will be stored in the buffer.
Cc: Daniel Baluta <daniel.baluta@gmail.com>
Cc: Alison Schofield <amsfield22@gmail.com>
Signed-off-by: Narcisa Ana Maria Vasile <narcisaanamaria12@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Add support for CCS811 VOC sensor. This patch adds support
for reading current and voltage across the sensor and TVOC
and equivalent CO2 values.
Scale and offset values have been computed according to datasheet:
- For current: raw value is in microamps
=> 0.001 scale to convert to milliamps
- For voltage: 1.65V = 1023, therefore 1650mV = 1023
=> 1650.0/1023 = 1.612903 scale to convert to millivolts
- For eCO2: raw value range is from 400ppm to 8192ppm.
=> (val - 400) * (100 - 0) / (8192 - 400) + 0 =
(val - 400) * 0.01283367 => offset: -400, scale = 0.012834
to get a percentage value
-For TVOC: raw value range is from 0ppb to 1187ppb.
=> (val - 0) * 100 / (1187 - 0) + 0 = val * 0.0842459 =>
scale = 0.084246 for getting a percentage value
Cc: Daniel Baluta <daniel.baluta@gmail.com>
Cc: Alison Schofield <amsfield22@gmail.com>
Signed-off-by: Narcisa Ana Maria Vasile <narcisaanamaria12@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Jonathan Cameron