Input: ads7846 - don't use scratch for tx_buf when clearing register

The workaround for XPT2046 clears the command register, giving the
touchscreen controller a NOP. The change incorrectly re-uses the
req->scratch variable which is used as rx_buf for xfer[5], so by
the time xfer[6] occurs, the contents of req->scratch may not be
0. It was found that the touchscreen controller can end up in
a completely unresponsive state due to it being given a command
the driver does not expect.

Instead, rely on the spi_transfer behavior of tx_buf being NULL to
transmit all 0 bits and use the scratch variable for the rx_buf for
both the 1 byte command to and 2 byte response from the controller.

Also relocates the scratch member of struct ser_req to force it
into a different cache line to prevent any potential issues of
DMA stepping on unrelated data in other struct members due to
sharing the same cache line.

This change was tested on real TSC2046 and ADS7843 controllers,
but not the XPT2046 the workaround was originally created for.
Confirming that the original modification to clear the command
register does not impact either real controller.

Fixes: 781a07da9bb94 ("Input: ads7846 - add dummy command register clearing cycle")
Cc: stable@vger.kernel.org
Co-developed-by: Mark Featherston <mark@embeddedTS.com>
Signed-off-by: Mark Featherston <mark@embeddedTS.com>
Signed-off-by: Kris Bahnsen <kris@embeddedTS.com>
Link: https://patch.msgid.link/20260507164943.760009-1-kris@embeddedTS.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index d3b529333ca2d4682351bd209d6d8558a5f90da4..8d6416ac283e5a5ba36524c0bd95e78f9ed79563 100644 (file)
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -328,7 +328,6 @@ struct ser_req {
        u8                      ref_on;
        u8                      command;
        u8                      ref_off;
-       u16                     scratch;
        struct spi_message      msg;
        struct spi_transfer     xfer[8];
        /*
@@ -336,6 +335,7 @@ struct ser_req {
         * transfer buffers to live in their own cache lines.
         */
        __be16 sample ____cacheline_aligned;
+       u16                     scratch;
 };
 
 struct ads7845_ser_req {
@@ -406,8 +406,7 @@ static int ads7846_read12_ser(struct device *dev, unsigned command)
        spi_message_add_tail(&req->xfer[5], &req->msg);
 
        /* clear the command register */
-       req->scratch = 0;
-       req->xfer[6].tx_buf = &req->scratch;
+       req->xfer[6].rx_buf = &req->scratch;
        req->xfer[6].len = 1;
        spi_message_add_tail(&req->xfer[6], &req->msg);