Commit Graph

1398985 Commits

Author SHA1 Message Date
Dave Stevenson
8d8c6c02dd drm/vc4: Add hvs_dlist_allocs debugfs function.
Users are reporting running out of DLIST memory. Add a
debugfs file to dump out all the allocations.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
2025-11-24 14:23:29 +00:00
Maxime Ripard
1102c671f7 drm/vc4: hvs: Defer dlist slots deallocation
During normal operations, the cursor position update is done through an
asynchronous plane update, which on the vc4 driver basically just
modifies the right dlist word to move the plane to the new coordinates.

However, when we have the overscan margins setup, we fall back to a
regular commit when we are next to the edges. And since that commit
happens to be on a cursor plane, it's considered a legacy cursor update
by KMS.

The main difference it makes is that it won't wait for its completion
(ie, next vblank) before returning. This means if we have multiple
commits happening in rapid succession, we can have several of them
happening before the next vblank.

In parallel, our dlist allocation is tied to a CRTC state, and each time
we do a commit we end up with a new CRTC state, with the previous one
being freed. This means that we free our previous dlist entry (but don't
clear it though) every time a new one is being committed.

Now, if we were to have two commits happening before the next vblank, we
could end up freeing reusing the same dlist entries before the next
vblank.

Indeed, we would start from an initial state taking, for example, the
dlist entries 10 to 20, then start a commit taking the entries 20 to 30
and setting the dlist pointer to 20, and freeing the dlist entries 10 to
20. However, since we haven't reach vblank yet, the HVS is still using
the entries 10 to 20.

If we were to make a new commit now, chances are the allocator are going
to give the 10 to 20 entries back, and we would change their content to
match the new state. If vblank hasn't happened yet, we just corrupted
the active dlist entries.

A first attempt to solve this was made by creating an intermediate dlist
buffer to store the current (ie, as of the last commit) dlist content,
that we would update each time the HVS is done with a frame. However, if
the interrupt handler missed the vblank window, we would end up copying
our intermediate dlist to the hardware one during the composition,
essentially creating the same issue.

Since making sure that our interrupt handler runs within a fixed,
constrained, time window would require to make Linux a real-time kernel,
this seems a bit out of scope.

Instead, we can work around our original issue by keeping the dlist
slots allocation longer. That way, we won't reuse a dlist slot while
it's still in flight. In order to achieve this, instead of freeing the
dlist slot when its associated CRTC state is destroyed, we'll queue it
in a list.

A naive implementation would free the buffers in that queue when we get
our end of frame interrupt. However, there's still a race since, just
like in the shadow dlist case, we don't control when the handler for
that interrupt is going to run. Thus, we can end up with a commit adding
an old dlist allocation to our queue during the window between our
actual interrupt and when our handler will run. And since that buffer is
still being used for the composition of the current frame, we can't free
it right away, exposing us to the original bug.

Fortunately for us, the hardware provides a frame counter that is
increased each time the first line of a frame is being generated.
Associating the frame counter the image is supposed to go away to the
allocation, and then only deallocate buffers that have a counter below
or equal to the one we see when the deallocation code should prevent the
above race from occurring.

Signed-off-by: Maxime Ripard <maxime@cerno.tech>
2025-11-24 14:23:29 +00:00
Dave Stevenson
1b001ad587 drm: vc4: dsi: Handle the different command FIFO widths
DSI0 and DSI1 have different widths for the command FIFO (24bit
vs 32bit), but the driver was assuming the 32bit width of DSI1
in all cases.
DSI0 also wants the data packed as 24bit big endian, so the
formatting code needs updating.

Handle the difference via the variant structure.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
2025-11-24 14:23:29 +00:00
Dave Stevenson
2c46b81fb9 drm/connector: Initialise max_bpc to the minimum value supported
Using increased bit depth for no reason increases power
consumption, and differs from the behaviour prior to the
conversion to use the HDMI helper functions.

Initialise the state max_bpc and requested_max_bpc to the
minimum value supported. This only affects Raspberry Pi,
as the other users of the helpers (rockchip/inno_hdmi and
sunx4i) only support a bit depth of 8.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
2025-11-24 14:23:29 +00:00
Phil Elwell
2137333840 misc: Add ws2812-pio-rp1 driver
ws2812-pio-rp1 is a PIO-based driver for WS2812 LEDS. It creates a
character device in /dev, the default name of which is /dev/leds<n>,
where <n> is the instance number. The number of LEDS should be set
in the DT overlay, as should whether it is RGB or RGBW, and the default
brightness.

Write data to the /dev/* entry in a 4 bytes-per-pixel format in RGBW
order:

  RR GG BB WW RR GG BB WW ...

The white values are ignored unless the rgbw flag is set for the device.

To change the brightness, write a single byte to offset 0, 255 being
full brightness and 0 being off.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:29 +00:00
Phil Elwell
1c0c846491 pwm: Add pwm-pio-rp1 driver
Use the PIO hardware on RP1 to implement a PWM interface.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

pwm: rp1: use pwmchip_get_drvdata() instead of container_of()

The PWM framework may not embed struct pwm_chip within the driver’s
private data. Using container_of() can result in accessing invalid
memory or NULL pointers, especially after recent kernel changes.

Switch to pwmchip_get_drvdata() to reliably access the driver data.
This resolves kernel warnings and probe failures seen after updating
from kernel 6.12.28 to 6.12.34 [1]

While at it remove the now obsolete `struct pwm_chip chip` member from
`struct pwm_pio_rp1`.

[1] https://github.com/raspberrypi/linux/issues/6971

Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
2025-11-24 14:23:28 +00:00
Phil Elwell
af280bd006 misc: Add RP1 PIO driver
Provide remote access to the PIO hardware in RP1. There is a single
instance, with 4 state machines.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

misc: rp1-pio: Support larger data transfers

Add a separate IOCTL for larger transfer with a 32-bit data_bytes
field.

See: https://github.com/raspberrypi/utils/issues/107

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

misc: rp1-pio: More logical probe sequence

Sort the probe function initialisation into a more logical order.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

misc: rp1-pio: Minor cosmetic tweaks

No functional change.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

misc: rp1-pio: Add in-kernel DMA support

Add kernel-facing implementations of pio_sm_config_xfer and
pio_xm_xfer_data.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

misc: rp1-pio: Handle probe errors

Ensure that rp1_pio_open fails if the device failed to probe.

Link: https://github.com/raspberrypi/linux/issues/6593

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

misc: rp1-pio: SM_CONFIG_XFER32 = larger DMA bufs

Add an ioctl type - SM_CONFIG_XFER32 - that takes uints for the buf_size
and buf_count values.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

misc/rp1-pio: Fix copy/paste error in pio_rp1.h

As per the subject, there was a copy/paste error that caused
pio_sm_unclaim from a driver to result in a call to
pio_sm_claim. Fix it.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

misc: rp1-pio: Fix parameter checks wihout client

Passing bad parameters to an API call without a pio pointer will cause
a NULL pointer exception when the persistent error is set. Guard
against that.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

misc: rp1-pio: Convert floats to 24.8 fixed point

Floating point arithmetic is not supported in the kernel, so use fixed
point instead.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

misc: rp1-pio: Error out on incompatible firmware

If the RP1 firmware has reported an error then return that from the PIO
probe function, otherwise defer the probing.

Link: https://github.com/raspberrypi/linux/issues/6642

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

misc: rp1-pio: Demote fw probe error to warning

Support for the RP1 firmware mailbox API is rolling out to Pi 5 EEPROM
images. For most users, the fact that the PIO is not available is no
cause for alarm. Change the message to a warning, so that it does not
appear with "quiet" in cmdline.txt.

Link: https://github.com/raspberrypi/linux/issues/6642

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

misc: rp1-pio: Don't just reuse the same DMA buf

A missing pointer increment meant that not only was the same buffer
being reused again and again, there was also no protection against
using it simultaneously for multiple transfers. Fix that basic bug, and
also move a similar increment to before the transfer is started, which
feels less racy.

See: https://github.com/raspberrypi/linux/issues/6919

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

misc: rp1-pio: Fix a config_xfer error path

If the DMA channel allocation fails, the relevant dma_configs entry
should be marked as no longer claimed, otherwise rp1_pio_sm_dma_free
will be called with an error number as a DMA channel pointer.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

misc: rp1-pio: Request a DMA burst size of 8

Improve DMA performance by increasing the burst size to 8.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:28 +00:00
Phil Elwell
a23341b345 firmware: Add an RP1 firmware interface over mbox
The RP1 firmware runs a simple communications channel over some shared
memory and a mailbox. This driver provides access to that channel.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

firmware: rp1: Simplify rp1_firmware_get

Simplify the implementation of rp1_firmware_get, requiring its clients
to have a valid 'firmware' property. Also make it return NULL on error.

Link: https://github.com/raspberrypi/linux/issues/6593

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

firmware: rp1: Linger on firmware failure

To avoid pointless retries, let the probe function succeed if the
firmware interface is configured correctly but the firmware is
incompatible. The value of the private drvdata field holds the outcome.

Link: https://github.com/raspberrypi/linux/issues/6642

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

firmware: rp1: Rename to rp1-fw to avoid module name collision

There is already the driver in drivers/mfd/rp1.ko, so having
drivers/firmware/rp1.ko can cause issues when using modinfo
and similar, and we can get errors with "Module rp1 is already
loaded" when trying to load it.

Rename the module so that the name is unique.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>

mailbox: rp1: Don't claim channels in of_xlate

The of_xlate method saves the calculated event mask in the con_priv
field. It also rejects subsequent attempt to use that channel because
the mask is non-zero, which causes a repeated instantiation of a client
driver to fail.

The of_xlate method is not meant to be a point of resource acquisition.
Leave the con_priv initialisation, but drop the test that it was
previously zero.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:28 +00:00
Phil Elwell
055c5e5278 mailbox: Add RP1 mailbox support
The Raspberry Pi RP1 includes 2 M3 cores running firmware. This driver
adds a mailbox communication channel to them via a doorbell and some
shared memory.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:28 +00:00
Phil Elwell
71da22ddc8 dmaengine: dw-axi-dmac: Only start idle channels
Attempting to start a non-idle channel causes an error message to be
logged, and is inefficient. Test for emptiness of the desc_issued list
before doing so.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:28 +00:00
Jonathan Bell
336ce53b85 drivers: usb: xhci: set HID bit in streaming endpoint contexts
The xHC may commence Host Initiated Data Moves for streaming endpoints -
see USB3.2 spec s8.12.1.4.2.4. However, this behaviour is typically
counterproductive as the submission of UAS URBs in {Status, Data,
Command} order and 1 outstanding IO per stream ID means the device never
enters Move Data after a HIMD for Status or Data stages with the same
stream ID. For OUT transfers this is especially inefficient as the host
will start transmitting multiple bulk packets as a burst, all of which
get NAKed by the device - wasting bandwidth.

Also, some buggy UAS adapters don't properly handle the EP flow control
state this creates - e.g. RTL9210.

Set Host Initiated Data Move Disable to always defer stream selection to
the device. xHC implementations may treat this field as "don't care,
forced to 1" anyway - xHCI 1.2 s4.12.1.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
2025-11-24 14:23:28 +00:00
Phil Elwell
308ccee2e9 serial: pl011: Request a memory width of 1 byte
In order to avoid losing residue bytes when a receive is terminated
early, set the destination width to single bytes.

Link: https://github.com/raspberrypi/linux/issues/6365

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:28 +00:00
Phil Elwell
21c6e78a2e spi: dw: Let the DMAC set the transfer widths
SPI transfers are of defined length, unlike some UART traffic, so it is
safe to let the DMA controller choose a suitable memory width.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:28 +00:00
Phil Elwell
f5b17dcd65 dmaengine: dw-axi-dmac: Allow client-chosen width
For devices where transfer lengths are not known upfront, there is a
danger when the destination is wider than the source that partial words
can be lost at the end of a transfer. Ideally the controller would be
able to flush the residue, but it can't - it's not even possible to tell
that there is any.

Instead, allow the client driver to avoid the problem by setting a
smaller width.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:28 +00:00
Dave Stevenson
5fe7161e7c drm: Add a rotation parameter to connectors.
Some connectors, particularly writeback, can implement flip
or transpose operations as writing back to memory.

Add a connector rotation property to control this.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
2025-11-24 14:23:28 +00:00
Dave Stevenson
7d9774d772 drm: Add a DRM_MODE_TRANSPOSE option to the DRM rotation property
Some hardware will implement transpose as a rotation operation,
which when combined with X and Y reflect can result in a rotation,
but is a discrete operation in its own right.

Add an option for transpose only.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
2025-11-24 14:23:28 +00:00
Dave Stevenson
ca42a9bf2d drm: Increase plane_mask to 64bit.
The limit of 32 planes per DRM device is dictated by the use
of planes_mask returning a u32.

Change to a u64 such that 64 planes can be supported by a device.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
2025-11-24 14:23:28 +00:00
Dave Stevenson
d9567195b5 drm: Set non-desktop property to true for writeback and virtual connectors
The non-desktop property "Indicates the output should be ignored for
purposes of displaying a standard desktop environment or console."

That sounds like it should be true for all writeback and virtual
connectors as you shouldn't render a desktop to them, so set it
by default.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
2025-11-24 14:23:27 +00:00
Phil Elwell
e8a0f3edf2 iio: humidity: dht11: Allow non-zero decimals
The DHT11 datasheet is pretty cryptic, but it does suggest that after
each integer value (humidity and temperature) there are "decimal"
values. Validate these as integers in the range 0-9 and treat them as
tenths of a unit.

Link: https://github.com/raspberrypi/linux/issues/6220

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:27 +00:00
Jonathan Bell
6fa2c584ba drivers: usb: xhci: prevent a theoretical race on non-coherent platforms
For platforms that have xHCI controllers attached over PCIe, and
non-coherent routes to main memory, a theoretical race exists between
posting new TRBs to a ring, and writing to the doorbell register.

In a contended system, write traffic from the CPU may be stalled before
the memory controller, whereas the CPU to Endpoint route is separate
and not likely to be contended. Similarly, the DMA route from the
endpoint to main memory may be separate and uncontended.

Therefore the xHCI can receive a doorbell write and find a stale view
of a transfer ring. In cases where only a single TRB is ping-ponged at
a time, this can cause the endpoint to not get polled at all.

Adding a readl() before the write forces a round-trip transaction
across PCIe, definitively serialising the CPU along the PCI
producer-consumer ordering rules.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
2025-11-24 14:23:27 +00:00
Jonathan Bell
6fc487b230 usb: dwc3: core: add support for setting NAK enhancement bits for FS/HS
If a device frequently NAKs, it can exhaust the scheduled handshakes in
a frame. It will then not get polled by the controller until the next
frame interval. This is most noticeable on FS devices as the controller
schedules a small set of transactions only once per full-speed frame.

Setting the ENH_PER_NAK_FS/LS bits in the GUCTL1 register increases the
number of transactions that can be scheduled to Async (Control/Bulk)
endpoints in the respective frame time. In the FS case, this only
applies to FS devices directly connected to root ports.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
2025-11-24 14:23:27 +00:00
Jonathan Bell
8e8928cf57 dt-bindings: usb: snps,dwc3: add FS/HS periodic NAK polling quirk
Add two quirk properties that control whether or not the controller
issues many more handshakes to FS/HS Async endpoints in a single
(micro)frame. Enabling these can significantly increase throughput for
endpoints that frequently respond with NAKs.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
2025-11-24 14:23:27 +00:00
Jonathan Bell
788c408f4f mmc: quirks: add more broken Kingston Canvas Go! SD card date ranges
A user has reported that a card of this model from late 2021 doesn't
work, so extend the date range and make it match on all card sizes.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
2025-11-24 14:23:27 +00:00
Phil Elwell
0e8f98c736 mm/vmscan: Maintain TLB coherency in LRU code
As a workaround (and possibly a fix) for CPU spins observed on BCM2837,
use ptep_clear_flush_young instead of ptep_test_and_clear_young inside
lru_gen_look_around in order to expose PTE changes to the MMU. Note that
on architectures that don't require an explicit flush,
ptep_clear_flush_young just calls ptep_test_and_clear_young.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:27 +00:00
Dom Cobley
55dbfddff8 mm/mempolicy: Ignore runtime policy changes when set through cmdline
Some apps like linpack use numa_setpolicy to disable numa,
but that tends to have a significant performance hit for us.

If you have a cmdline.txt setting of numa_policy (to something other
than default), then lets ignore runtime changes and stick with
the cmdline.txt setting.

Not specifying numa_setpolicy in cmdline, or setting
numa_setpolicy=default(*) will allow runtime settings to work.

(*) easier to do when numa_setpolicy=interleave is set in DT.

Ignore logging for the first 40 seconds as there are some
expected switches during boot.

Signed-off-by: Dom Cobley <popcornmix@gmail.com>

Show process name in set_mempolicy() ignored message

Signed-off-by: Trevor Man <tman_github@trejan.com>
2025-11-24 14:23:27 +00:00
Tvrtko Ursulin
ebcc78b555 mm/mempolicy: Add MPOL_RANDOM
To help work around certain memory controller limitations or similar, a
random NUMA allocation memory policy is added.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
2025-11-24 14:23:27 +00:00
Tvrtko Ursulin
9f9e188cc4 iommu/dma: Add ability to configure NUMA allocation policy for remapped allocations
Add iommu_dma_numa_policy= kernel parameter which can be used to modify
the NUMA allocation policy of remapped buffer allocations.

Policy is only used for devices which are not associated with a NUMA node.

Syntax identical to what tmpfs accepts as it's mpol argument is accepted.

Some examples:

 iommu_dma_numa_policy=interleave
 iommu_dma_numa_policy=interleave=skip-interleave
 iommu_dma_numa_policy=bind:0-3,5,7,9-15
 iommu_dma_numa_policy=bind=static:1-2

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
2025-11-24 14:23:27 +00:00
Tvrtko Ursulin
e10480e82d numa/emulation: Check emulated zones around the CMA window
... Make sure CMA zones do not straddle the emulated NUMA nodes ...

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
2025-11-24 14:23:27 +00:00
Tvrtko Ursulin
7ee09be470 mm/numa: Allow override of kernel's default NUMA policy
Add numa_policy kernel argument to allow overriding the kernel's default
NUMA policy at boot time.

Syntax identical to what tmpfs accepts as it's mpol argument is accepted.

Some examples:

 numa_policy=interleave
 numa_policy=interleave=skip-interleave
 numa_policy=bind:0-3,5,7,9-15
 numa_policy=bind=static:1-2

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
2025-11-24 14:23:27 +00:00
Tvrtko Ursulin
b4a4684cf1 dma-buf: system_heap: Allow specifying maximum allocation order
system_heap.max_order=<uint>

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
2025-11-24 14:23:26 +00:00
Kieran Bingham
b762411d88 NotForUpstream: media: video-mux: Propagate controls to source
The i.MX8MP makes calls on it's source device to determine
the link-frequency that should be configured on the CSI2 receiver.

When the source is behind a video mux, we need to pass this call through
to the connected device.

Map the control handler of the source device to the video-mux,
essentially proxying all controls on the mux to the device which has
it's link enabled.

Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
2025-11-24 14:23:26 +00:00
Richard Oliver
79eb29da14 lib: earlycpio: export symbol find_cpio_data()
Add EXPORT_SYMBOL_GPL() for find_cpio_data() so that loadable modules
may also parse uncompressed cpio.

Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
2025-11-24 14:23:26 +00:00
Richard Oliver
c7de20a424 media: i2c: Add driver for Sony IMX500 sensor
The Sony IMX500 is a stacked 1/2.3-inch CMOS digital image sensor and
inbuilt AI processor with an active array CNN (Convolutional Neural
Network) inference engine.  The native sensor size is 4056H x 3040V, and
the module also contains an in-built ISP for the CNN. The module is
programmable through an I2C interface with firmware and neural network
uploads being made over SPI. This driver supports imaging only.

Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>

media: i2c: imx500: Inbuilt AI processor support

Add support for the IMX500's inbuilt AI processor. The IMX500 program
loader, AI processor firmware, DNN weights are accessed via the kernel's
firmware interface on 'open' and are transferred to the IMX500 over SPI.

Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>

media: i2c: imx500: Enable LED during SPI transfers

The Raspberry Pi 'AI Camera' is equipped with an LED. Enable this LED
during SPI transfers to indicate to the end-user that progress is being
made during large tramsfers.

Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>

drivers: media: imx500: Fixes for vblank control

Reduce the default/max framerate of the 2x2 binned mode to 30fps.
The current limit of 50fps can cause the sensor to produce corrupt
frames and cause missing framing events.

Also fixup the vblank control min/max/default/step paramters when
setting up.

Signed-off-by: Naushir Patuck <naush@raspberrypi.com>

drivers: media: imx500: Simplify the vblank control init

Set the VBLANK control minimum and default values to IMX500_VBLANK_MIN
unconditionally everywhere.

Remove the mode specific framerate_default parameter, it is now unused.

Signed-off-by: Naushir Patuck <naush@raspberrypi.com>

drivers: media: imx500: Enable LS correction

This correction is calibrated to approx 5000K.

Signed-off-by: Naushir Patuck <naush@raspberrypi.com>

imx500: Fix for long exposure setup

The IMX500 (unlike the IMX477/IMX708) requires two regsiters to be set
for the exposure shift value to work correctly. The additional register
write (which was missing) is for the integration time shift.

Signed-off-by: Naushir Patuck <naush@raspberrypi.com>

drivers: media: imx500: Enable sensor temperature monitoring

The register needs to be disabled before loading any firmware, otherwise
the upload fails for unknown reasons. Re-enable before starting the
sensor streaming.

Signed-off-by: Naushir Patuck <naush@raspberrypi.com>

drivers: media: imx500: Add device id readback control

Add a new custom control V4L2_CID_USER_GET_IMX500_DEVICE_ID to allow
userland to query the device id from the IMX500 sensor eeprom.

Note that this device id can only be accessed when a network firmware
has been upoloaded to the device, so cannot be cached on probe.

Signed-off-by: Naushir Patuck <naush@raspberrypi.com>

media: i2c: imx500: pm_runtime error paths

This change amends various error-paths in imx500_start_streaming() to
ensure that pm_runtime refcounts do not remain erroneously incremented
on failure.

Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>

media: i2c: imx500: GPIO acquire/release semantics

When the imx500 driver is used as part of the 'AI Camera', the poweroff
state is never reached as the camera and gpio driver share a regulator.
By releasing the GPIOs when they are not in use, 'AI Camera' is able to
achieve a powered-down state.

Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>

media: i2c: imx500: input tensor injection

Input tensor injection is a debug feature that allows a user-controlled
input to be passed directly to IMX500's inference engine (bypassing the
in-built ISP).

Three new custom controls are added to ENABLE_INJECTION before streaming
begins, to provide appropriate input tensors via an INPUT_TENSOR_FD, and
to provide notification of DNN results in the sensor output via
INJECTION_CMP_FRM.

Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
2025-11-24 14:23:26 +00:00
Richard Oliver
2712171799 media: dt-bindings: i2c: Add Sony IMX500
Add YAML device tree binding for the Sony IMX500 CMOS image sensor /
CNN inference engine.  Also, add a MAINTAINERS entry.

Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
2025-11-24 14:23:26 +00:00
Axel
7f547cbe9d rtc: pcf8523: Fix oscillator stop bit handling reading from Control_1
The check if the oscillator stop bit is set was reading from Control_1
register instead of the Seconds register.
This caused the Seconds register to be incorrectly changed if bit 7 of
Control_1 happens to be set.

Signed-off-by: Axel Hammarberg <axel.hammarberg@gmail.com>
2025-11-24 14:23:26 +00:00
Phil Elwell
53cdabb626 Bluetooth: hci_sync: Fix crash on NULL parent
Although later functions can handle a NULL fwnode, fwnode can't handle
being passed a NULL pointer.

See: https://github.com/raspberrypi/linux/issues/6305

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:26 +00:00
Phil Elwell
16744cdb3d gpiolib: Override gpiochip numbers with DT aliases
In the same way that other subsystems support the setting of device
id numbers from Device Tree aliases, allow gpiochip numbers to be
derived from "gpiochip<n>" aliases.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:26 +00:00
Phil Elwell
4137cb7651 hwmon: (adt7410) Add DT compatible strings
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:26 +00:00
Phil Elwell
ec4fce8c7d spi: dw: Clamp the minimum clock speed
The DW SPI interface has a 16-bit clock divider, where the bottom bit
of the divisor must be 0. Limit how low the clock speed can go to
prevent the clock divider from being truncated, as that could lead to
a much higher clock rate than requested.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:26 +00:00
Phil Elwell
d0b9f2cf38 spi: dw: Fix non-DMA transmit-only transfers
Ensure the transmit FIFO has emptied before ending the transfer by
dropping the TX threshold to 0 when the last byte has been pushed into
the FIFO. Include a similar fix for the non-IRQ paths.

See: https://github.com/raspberrypi/linux/issues/6285
Fixes: 6014649de7 ("spi: dw: Save bandwidth with the TMOD_TO feature")
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:26 +00:00
Jonathan Bell
24807484c0 DT: bindings: add a dma-maxburst property to snps,designware-i2s
Do an end-run around ASoC in lieu of not being able to easily find the
associated DMA controller capabilities.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
2025-11-24 14:23:25 +00:00
Jonathan Bell
3dccaf5b35 drivers: dw-axi-dmac: make more sensible choices about memory accesses
There's no real need to constrain MEM access widths to 32-bit (or
narrower), as the DMAC is intelligent enough to size memory accesses
appropriately. Wider accesses are more efficient.

Similarly, MEM burst lengths don't need to be a function of DEV burst
lengths - the DMAC packs/unpacks data into/from its internal channel
FIFOs appropriately. Longer accesses are more efficient.

However, the DMAC doesn't have complete support for unaligned accesses,
and blocks are always defined in integer multiples of SRC_WIDTH, so odd
source lengths or buffer alignments will prevent wide accesses being
used, as before.

There is an implicit requirement to limit requested DEV read burst
lengths to less than the hardware's maximum configured MSIZE - otherwise
RX data will be left over at the end of a block. There is no config
register that reports this value, so the AXI burst length parameter is
used to produce a facsimile of it. Warn if such a request arrives that
doesn't respect this.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
2025-11-24 14:23:25 +00:00
Jonathan Bell
e34d093f50 spi: dw: don't immediately kill DMA transfers if an error occurs
Disabling the peripheral resets controller state which has a dangerous
side-effect of disabling the DMA handshake interface while it is active.
This can cause DMA channels to hang.

The error recovery pathway will wait for DMA to stop and reset the chip
anyway, so mask further FIFO interrupts and let the transfer finish
gracefully.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
2025-11-24 14:23:25 +00:00
Phil Elwell
3ffd66c3a5 spi: dw: Save bandwidth with the TMOD_RO feature
TMOD_RO is the receive-only mode that doesn't require data in the
transmit FIFO in order to generate clock cycles. Using TMOD_RO when the
device doesn't care about the data sent to it saves CPU time and memory
bandwidth.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:25 +00:00
Phil Elwell
2fe57a8337 spi: dw: Save bandwidth with the TMOD_TO feature
TMOD_TO is the transmit-only mode that doesn't put data into the receive
FIFO. Using TMOD_TO when the user doesn't want the received data saves
CPU time and memory bandwidth.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:25 +00:00
Chien-Chia Chen
85d47ae55a brcmfmac: support extsae with psk / 1x offloading
support sae executed in wpa_supplicant and offload 4-way handshake offload.

Signed-off-by: Chien-Chia Chen <carella.chen@infineon.com>

JIRA: SWWLAN-142424
2025-11-24 14:23:25 +00:00
Phil Elwell
d95b1ea0b3 brcmfmac: Add "extsae" as an alias for "sae_ext"
The Cypress firmwares use "extsae" to indicate wpa_supplicant-hosted
SAE/WPA3.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:25 +00:00
Phil Elwell
d679c56154 brcmfmac: Only match complete feature names
The firmware advertises its features as a string of words separated by
spaces. Ensure that feature names are only matched in their entirety.

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:25 +00:00
Phil Elwell
3882e58554 dmaengine: dw-axi-dmac: Honour snps,block-size
The snps,block-size DT property declares the maximum block size for each
channel of the dw-axi-dmac. However, the driver ignores these when
setting max_seg_size and uses MAX_BLOCK_SIZE (4096) instead.

To take advantage of the efficiencies of larger blocks, calculate the
minimum block size across all channels and use that instead.

See: https://github.com/raspberrypi/linux/issues/6256

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
2025-11-24 14:23:25 +00:00
Richard Oliver
4d10762b00 spi: Add a driver for the RPI RP2040 GPIO bridge
The Raspberry Pi RP2040 GPIO bridge is an I2C-attached device exposing
both a Tx-only SPI controller, and a GPIO controller.

Due to the relative difference in transfer rates between standard-mode
I2C and SPI, the GPIO bridge makes use of 12 MiB of non-volatile storage
to cache repeated transfers. This cache is arranged in ~8 KiB blocks and
is addressed by the MD5 digest of the data contained therein.

Optionally, this driver is able to take advantage of Raspberry Pi RP1
GPIOs to achieve faster than I2C data transfer rates.

Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>

spi: rp2040-gpio-bridge: Add debugfs progress indicator

Useful for tracking upload progress via userspace.

Signed-off-by: Naushir Patuck <naush@raspberrypi.com>

spi: rp2040-gpio-bridge: add missing MD5 dependency

rp2040-gpio-bridge relies on the md5 crypto driver. This dependency
cannot be determined automatically as rp2040-gpio-bridge does not
use any of md5's symbols directly.

Declare a soft 'pre' dependency on md5 to ensure that it is included and
loaded before rp2040-gpio-bridge.

Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>

spi: rp2040-gpio-bridge: fix gpiod error handling

In some circumstances, devm_gpiod_get_array_optional() can return
PTR_ERR rather than NULL to indicate failure. Handle these cases.

Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>

spi: rp2040-gpio-bridge: probe: Cfg fast_xfer clk

Fast transfer mode requires that the first bit of data is clocked with a
rising edge. This can cause extra bits of data to be clocked on hardware
where the clock signal uses a pull-up. This change ensures that clk is
driven low before fast data transfer mode is entered.

Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
2025-11-24 14:23:25 +00:00