Attend XDA's Second Annual Developer Conference, XDA:DevCon 2014!
5,808,312 Members 38,479 Now Online
XDA Developers Android and Mobile Development Forum

[BUG FIX] Phantom keypress and screen shot

Tip us?
 
electric bill
Old
(Last edited by electric bill; 31st March 2012 at 03:37 AM.) Reason: UPDATE
#1  
Recognized Developer - OP
Thanks Meter 73
Posts: 95
Join Date: Jun 2011
Default [BUG FIX] Phantom keypress and screen shot

I've been working on fixing this issue for awhile. Here's the deal:

The problem.
The four keys at the bottom of the phone are monitored by a melfas touchkey chip (http://www.melfas.com/english/touch/sensor.asp) that connects to the main processor via an I2C bus (http://en.wikipedia.org/wiki/i2c). The melfas chip generates an interrupt whenever one of the keys is touched or released. The processor then reads the key value from this chip over the i2c bus. The problem is that the touchkey chip is located right next to the 3G antenna. When the phone is accessing the 3G network the RF energy gets transferred to the interrupt and i2c clock and data lines causing false interrupts to occur. The processor responds to the interrupt by reading the key value from the cypress chip. The symptoms occur more frequently in low signal areas because the phone outputs a higher RF level in those situations which causes more RF interference on the interrupt line.

Most of the time when a false interrupt has occurred the touchkey chip will return a value of zero for the key and the driver will recognize this as a bad key press and ignore it. Sometimes the RF interference on the i2c clock and/or data line causes a valid value to be returned and the driver reports a key press value to the application. In the case where the driver reports a Ďbackí key down, the software sees this as holding the back key down so when you press the power button you get a screen shot. The easiest way to cure this is to always press and release the back key before pushing the power button. This causes the software to see both a key down and key up event which cancels the screenshot mode.

This RFI induced touchkey interrupt happens hundreds of times per second when the phone is using 3G. It produces lots of different symptoms including applications that always seem to shut down. A wide variety of problems can be attributed to this failure. In addition, the processor spends a lot of time servicing these bogus interrupts, which take cpu time away from the other applications. This can make the phone appear to be slow or even freeze up for short periods of time. Thereís a good chance that most people have experience this to some degree without realizing the root cause.

Solution one. Fix the driver.

Since this is a true hardware failure, a software solution is going to be less than perfect. After dozens of experiments rewriting the interrupt service routines in the driver Iíve settled on a combination of fixes. The first is to re-test the interrupt input line several times. In normal operation when you touch or release a button, the touchkey chip drives the interrupt line low and keeps it low until the driver reads data over the i2c interface. Since the RF interference is a sine wave and is being sampled it causes the interrupt line to go high and low at a fast rate. Sampling the line multiple times in software increases the chance of finding it in the high state. This is done both in the interrupt handler and then again in the interrupt thread. About 90% of the false interrupts are filtered out by testing the line in the handler. If the interrupt handler doesnít find the line high after 10 samples, it masks the interrupt so that another falling edge doesnít produce another interrupt. In testing Iíve noticed that the interrupt handler would run multiple times before the interrupt thread was even called. Once in a while, so many interrupts would get stacked up that the phone would just reboot. It was probably a stack or buffer overflow that wasnít being handled. Remember, this interrupt would happen many hundreds of times a second. About 90% of the remaining false interrupts are filtered out by sampling this line in the thread. That leaves about 1% of the interrupts that need to be further tested. The second test is to read the data from the chip and discard anything that isnít a valid key press value. This is easily done with a case statement. Finally, since occasionally a bogus valid value will get through, I set up a timer so that any key down event that doesnít have a corresponding key up event within 3 seconds is canceled by calling the all_keys_up routine.

This combination all but eliminates the symptoms produced by this failure. The only draw back is that the processor still spends a considerable amount of time servicing the false interrupts. And rarely a phantom keypress does get through. In all, itís a fairly good piece of duct tape and JB Weld.

During my experiments I used a copy of the kgb kernel. My version with the modified driver is in github at https://github.com/dmriley/kgb. If you want to try this yourself, be sure to use the Ďdeví branch.


Solution two. Fix the hardware.

There are three signals that connect from the melfas touchkey chip to the processor. They are the two i2c lines: sdc which is the clock and sda which is the data. The third line is the interrupt. In troubleshooting this problem, I took my phone apart and put oscilloscope probes on the three lines. This allowed me to see the real cause of the problem. Since the interference is RFI (or EMI) the only real way to fix the problem is to either remove the RF or make the impedance of the signals much lower. Removing the RF is easy if you donít need to use 3G. When the phone is using wifi (or no network connectivity at all) the problem does not exist. Also, when you are very close to a cell tower, the phone transmits at a much lower level. This lower level greatly reduces the RFI. Lowering the impedance is a little harder. I2C uses active pull down and passive pull up for the logic levels for both sda and sdc. This means that the impendence is mostly governed by the pull up resistor. This resistor value is typically upwards of 1kohm and probably as high as 3kohms (I didnít measure it in this phone). Since the impedance only needs to be lowered for the 3G frequencies of around 800MHz, a capacitor can be added from the signal source to signal ground. At 800MHZ a 100 pf cap is about 2 ohms (1/ 2*pi*f*c). Thatís a couple of orders of magnitude lower than the pull up resistor alone, and much too low for the RF signal to induce any significant voltage on the line. This value is also low enough not to interfere with the signal rise and fall times for the interrupt line. In the case of the interrupt line, the melfas chip drives the signal low and keeps it low until the interrupt is serviced. Discharging a 100pf cap with a 2mA driver takes only microseconds. This much delay is not noticeable when touching the key and is much less than the amount of time that the processor takes to service the interrupt.

Adding the cap to the interrupt line eliminates false interrupts. A chance does exist that a valid key event during 3G access could cause an incorrect key value to be returned due to RFI on the clock and data lines. The i2c protocol is designed to compensate for capacitive loading on the lines. Although it would cause the clock period to be stretched out significantly it would still only take milliseconds to read the key data from the chip. The difference would be imperceptible. To date I have only added the cap to the interrupt line and have yet to experience an invalid key press.

Iíll post pictures of cap mod.

Summary.

Most people will be satisfied using the software fix. I think that a couple of the kernel devs are incorporating some or most of the driver mods outlined in this document. Both comradesven (kgb dev) and ssewk2x aka Efpophis (glitch dev) were involved in the test and debug process. Much appreciation is given to both of them for the help that they gave me and for allowing me to use and hack up their code on github. Efpophis saved me hours of searching through code. Without their help, Iíd still be unable to build a kernel.


UPDATE:30 Mar 2012
The phone had been working fine since the mod. I hadn't seen a screen capture or any of the other symptoms. Then, a couple of nights ago, while I running maps on 3G (a data intensive app) the touchkey backlights started flashing rapidly like the phone was having a little seizure. And then it happened, the voice search popped up. A couple of debug kernels later I've come to the conclusion (and I'm never wrong) that the clock line (SCL) going to the melfas chip was being toggled by the same RF interference that was causing the false interrupts. A random clock along with random data was causing the chip to turn the backlights on and off as well as generate a false interrupt. I was able to reliably duplicate the problem in a couple of really low signal level areas (not hard to find when you live out in the boonies).

I tore the phone apart (again) today and added a 100pf cap to the scl line right next to the chip. I also added another cap in parallel with the 100pf on the interrupt line. I spent about 1/2 hour tonight running 3G data apps in the same location where the problem first appeared. So far, no problems and none of the debug messages have shown up on dmesg.

If anyone wants pics of the added cap I'll open it back up, no problem, otherwise if you look at this photo you can see which pin is scl (although I incorrectly labeled it SDC in the photo). http://forum.xda-developers.com/atta...4&d=1332117055

If anyone tries these mods I'd be real interested in your results.
The Following 19 Users Say Thank You to electric bill For This Useful Post: [ Click to Expand ]
 
electric bill
Old
(Last edited by electric bill; 17th March 2012 at 06:20 PM.)
#2  
Recognized Developer - OP
Thanks Meter 73
Posts: 95
Join Date: Jun 2011
Here are some pictures of the cap mod:

this is the open phone showing where the melfas touchkey circuit is:
Click image for larger version

Name:	2012-03-17 00.57.24.jpg
Views:	1629
Size:	82.6 KB
ID:	951774
The Following 2 Users Say Thank You to electric bill For This Useful Post: [ Click to Expand ]
 
yohobojo
Old
#3  
Member
Thanks Meter 7
Posts: 84
Join Date: Oct 2010
Location: Kennesaw
Awesome, thanks for doing this for all of us. Phantom key press is really annoying

Sent from my SCH-I500 using XDA App
 
electric bill
Old
(Last edited by electric bill; 17th March 2012 at 06:26 PM.)
#4  
Recognized Developer - OP
Thanks Meter 73
Posts: 95
Join Date: Jun 2011
the cap. yeah, that's a normal size pen to show scale
Click image for larger version

Name:	2012-03-17 00.45.23.jpg
Views:	1185
Size:	96.3 KB
ID:	951812

on the board
Click image for larger version

Name:	cap on.JPG
Views:	1120
Size:	65.5 KB
ID:	951821

with notes
Click image for larger version

Name:	cap notes.JPG
Views:	1080
Size:	72.1 KB
ID:	951820

the antenna problem
Click image for larger version

Name:	2012-03-17 00.58.54.jpg
Views:	1083
Size:	76.4 KB
ID:	951822

close up showing touckey circuit. micro sd card for scale
Click image for larger version

Name:	2012-03-17 00.55.58.jpg
Views:	910
Size:	80.9 KB
ID:	951834

my finger
Click image for larger version

Name:	2012-03-17 00.56.41.jpg
Views:	950
Size:	56.7 KB
ID:	951836

back off
Click image for larger version

Name:	2012-03-17 00.58.12.jpg
Views:	839
Size:	83.6 KB
ID:	951838

another view
Click image for larger version

Name:	2012-03-17 00.52.37.jpg
Views:	893
Size:	99.8 KB
ID:	951837


BTW, I took these pictures with my son's fascinate
The Following 11 Users Say Thank You to electric bill For This Useful Post: [ Click to Expand ]
 
k_nivesout
Old
#5  
k_nivesout's Avatar
Senior Member
Thanks Meter 432
Posts: 2,353
Join Date: Mar 2011
Wow, we're lucky to have someone as capable as yourself figure out this annoying issue! I've kinda kept up on your work, but seeing this breakdown and the photos is helpful in understanding the root cause of the problem. I do wonder sometimes how Samsung missed this issue in their testing, but at least we have custom kernels that implement your fixes and dramatically reduce the phantom presses!
 
sendan
Old
#6  
sendan's Avatar
Senior Member
Thanks Meter 103
Posts: 574
Join Date: Dec 2009
Location: Appleton
Uuuhm...You're an awesome human being. Holy crap. -_-

That's some amazing work, thanks!
 
electric bill
Old
#7  
Recognized Developer - OP
Thanks Meter 73
Posts: 95
Join Date: Jun 2011
Quote:
Originally Posted by k_nivesout View Post
.... I do wonder sometimes how Samsung missed this issue in their testing, but at least we have custom kernels that implement your fixes and dramatically reduce the phantom presses!
Yeah, it's crying shame that Samy couldn't fork over the extra penny to keep this problem from happening in the first place.
 
electric bill
Old
#8  
Recognized Developer - OP
Thanks Meter 73
Posts: 95
Join Date: Jun 2011
Quote:
Originally Posted by sendan View Post
Uuuhm...You're an awesome human being. Holy crap. -_-

That's some amazing work, thanks!
wasn't just me. had help from other members here. I didn't even know where to start looking when I first started. It's so cool that people are willing to do the level of work that the devs here do without expecting anything back.
The Following 7 Users Say Thank You to electric bill For This Useful Post: [ Click to Expand ]
 
neh4pres
Old
#9  
neh4pres's Avatar
Senior Member
Thanks Meter 459
Posts: 2,107
Join Date: Nov 2010
Quote:
Originally Posted by electric bill View Post
wasn't just me. had help from other members here. I didn't even know where to start looking when I first started. It's so cool that people are willing to do the level of work that the devs here do without expecting anything back.
Thanks so much for all the work, and the detail in your post. It is amazing the work everybody does here and the knowledge you pass on to us.
I do have a few questions


Would you mind sharing what kind off iron you used? is that the most bottom line on the board you soldered to? If so, did you have to scratch it or something first? Is it the farthest left line on the chip that was used? Do they make caps that size with leads coming of the 2 sides, and if so would that be a easier mod? Is there a positive and negative side to that capacitor?

I'm really thinking about doing this, if i decide to would you mind sending me 5 of your extra caps for a $10 donation?

Sent from my SCH-I500 using xda premium
 
AlgorithmX
Old
#10  
AlgorithmX's Avatar
Senior Member
Thanks Meter 24
Posts: 187
Join Date: Sep 2010
Location: BFE
Ditto on the $10.00

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes