The non-pi5 variant of tc358743 needs to update the compatible of
csi0 rather than csi1 if the cam0 override is used, otherwise it
gets loaded in Media Controller mode.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Remove the need for the user to know the limitations of this PWM
implementation by adjusting configuration requests to be the closest
acceptable value. Add a get_state method so that the actual values can
be queried.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
EMMC clock speeds are based around divisions of 52Mhz, not the 50MHz
used by SD. As such, relax the "full speed" check (intended to stop
any overclock whenever an operation has to be retried) so that any
requested speed of 50MHz or higher will be overclocked.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
EMMC clock speeds are based around divisions of 52Mhz, not the 50MHz
used by SD. As such, relax the "full speed" check (intended to stop
any overclock whenever an operation has to be retried) so that any
requested speed of 50MHz or higher will be overclocked.
See: https://github.com/raspberrypi/linux/issues/7120
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Switch the power management in the imx708 device driver to use auto-
suspend with a 5s timeout.
This improves mode switching time that avoids additional regulator
switch-on delays and common register I2C writes.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Add an overlay to allow composite video to be output on GPIOs 4-11
on Raspberry Pi 5, 500, 500+ or CM5 only, with an optional 108 MHz
clock on GPIO 0 and duplicate MSB on GPIO 27.
Requires composite video to be enabled and DPI to be disabled.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
The regulator compatible string changed, and implements the PWM
API instead of the backlight one, therefore requiring pwm-backlight
to sit inbetween.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Switch the power management in the imx477 device driver to use auto-
suspend with a 5s timeout.
This improves mode switching time that avoids additional regulator
switch-on delays and common register I2C writes.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Fix these two smatch warnings for the vc-sm-cma driver, rest were false
positives:
../vc-sm-cma/vc_sm.c:413
vc_sm_dma_buf_attach() warn: inconsistent returns '&buf->lock'.
Locked on : 396
Unlocked on: 413
../vc-sm-cma/vc_sm.c:1225
vc_sm_cma_ioctl_alloc() error: we previously assumed 'buffer' could be
null (see line 1113)
Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com>
The 4056x3040 mode appears to need more vertical blanking lines
than any other, leaving a black bar at the bottom of the image.
Increase IMX477_VBLANK_MIN from 4 to 48 to compensate. (It may be
possible to reduce it slightly further, but fix the regression
for now).
https://github.com/raspberrypi/linux/issues/7109
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
hvs6 appears to have dropped support for the component order
field in 3 plane YUV formats.
Support them by swapping the Cb and Cr planes over when
reading the image pointers.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Don't mix dma fence lock with the active_job lock. Use fence_lock to
protect the dma fence used by drm scheduler when signalling a job
completion and queue_lock to protect concurrent access to active bin job
in OOM and stats collection for a given file priv. The issue was
uncovered when PREEMPT_RT on with a system freeze when opening multiple
Chromium tabs on Raspberry Pi 5.
Link: https://github.com/raspberrypi/linux/issues/7035
Fixes: fa6a20c874 ("drm/v3d: Address race-condition between per-fd GPU stats and fd release")
Signed-off-by: Melissa Wen <mwen@igalia.com>
Acked-by: Iago Toral Quiroga <itoral@igalia.com>
Reviewed-by: Maíra Canal <mcanal@igalia.com>
Signed-off-by: Melissa Wen <melissa.srw@gmail.com>
Link: https://lore.kernel.org/r/20250916172022.2779837-1-mwen@igalia.com
Pass-through mode disables all gamma and brightness processing, sending
the raw pixel data directly to the LEDs. It is enabled by setting the
brightness to zero, either in Device Tree or using the runtime method of
writing a single byte (in this case 0) to the device.
See: https://github.com/raspberrypi/linux/issues/7108
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Remove CONFIG_MEDIA_PCI_HAILO from all the arm64 defconfig files as this
driver is no longer built in the kernel tree.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Modify the PDAF Datatype of the Arducam 64MP camera from 0x30 to 0x12
so that the Raspberry Pi 5 cfe driver can receive PDAF data.
Signed-off-by: Lee Jackson <info@arducam.com>
There were various points where the loader was using uninitialised
data, had the potential to run off the end of an array, or was
handling core functions incorrectly. Fix these up.
Also handle 24bpp and 32bpp framebuffers.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
We lost a line in the forward port, which meant that it always used
/dev/fb0, and complained that the sysfs nodes already existed.
Fixes: c91c9f257d ("fbdev: Allow client to request a particular /dev/fbN node")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Although the PIO throughput benefits from larger burst sizes, only the
first two DMA channels support a burst size of 8 - the others are capped
at 4. To avoid misconfiguring the PIO hardware, retrieve the actual
max_burst value from the DMA channel's capabilities.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
This patch adds support for external FSIN-triggered snapshot mode
to the OmniVision OV9282 sensor driver. It enables frame capture
synchronized with an external hardware trigger signal.
Signed-off-by: Omer Faruk Edemen <ofedemen@lectrontech.com>
Upstream series https://lore.kernel.org/linux-media/20250917-csi-bgr-rgb-v3-0-0145571b3aa4@kernel.org/
The tc358743 is an HDMI to MIPI-CSI2 bridge. It can output all three
HDMI 1.4 video formats: RGB 4:4:4, YCbCr 4:2:2, and YCbCr 4:4:4.
RGB 4:4:4 is converted to the MIPI-CSI2 RGB888 video format, and listed
in the driver as MEDIA_BUS_FMT_RGB888_1X24.
Most CSI2 receiver drivers then map MEDIA_BUS_FMT_RGB888_1X24 to
V4L2_PIX_FMT_RGB24.
However, V4L2_PIX_FMT_RGB24 is defined as having its color components in
the R, G and B order, from left to right. MIPI-CSI2 however defines the
RGB888 format with blue first.
This essentially means that the R and B will be swapped compared to what
V4L2_PIX_FMT_RGB24 defines.
The proper MBUS format would be BGR888, so let's use that.
Fixes: d32d98642d ("[media] Driver for Toshiba TC358743 HDMI to CSI-2 bridge")
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Masquerading Interrupt split transfers as Control puts the transfer into
the non-periodic handler in the hub. This stops the hub dropping
complete-split data in the microframe after a CSPLIT should have
arrived, improving resilience to host IRQ latency. Devices are none
the wiser - the handshake tokens are the same.
Originally devised by Hans Petter Selasky @ FreeBSD.
(v2: dwc2 needs an un-masquerade prior to channel interrupt handling)
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Output of raspinfo is now over 65,000 characters, which is more than
GitHub allows in a single form field!
Also adds Pi 500+ and CM0 to the list of models.
8 bit readout is only a reconfiguration of the CSI2 block,
and recomputation of horizontal blanking. Enable it.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The sensor supports readout as 10 or 12 bit. As we are now
computing the horizontal blanking limits dynamically, adding
support for both readout modes falls out trivially, so add
them both.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The timing registers configured are for 450MHz.
If running at a different link frequency, use the automatic
timing control.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Now that the link frequency can be varied, write the link bit
rate registers to reflect the speed being used.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
As we now support variable link frequency, compute the minimum
line_length value that the sensor will work with, and set
V4L2_CID_HBLANK based on that number.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Rather than the hard coded PLL settings for fixed frequencies,
compute the PLL settings based on device tree, validating that
the specified rate can be achieved.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
There are a fair number of registers duplicated in all the mode
tables, so move those into the common table.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
This removes a load of boilerplate code around how registers
are grouped into multiple word values.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The frame length default value doesn't change dynamically, and
neither does any of the other parameters that configure it,
so precompute it instead of working from a frame duration to
get to the value.
The minimum value was also computed, when actually the sensor
will take any value down to 4 lines.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
line_length_pix is a value that the developer wants to know,
so write the values in decimal.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Register line_length_pix was being written by both the tables
of registers and the control handler for V4L2_CID_HBLANK.
Remove the duplication in the tables.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
This is largely to test a previous change that made IOMMU aperture
configurable and allocated lazily; it may be useful in its own right.
We expect IOMMU2 to be well-utilized e.g. when using 64MPix cameras.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
Allocate space for level-2 IOMMU translation tables on demand.
This should save memory in most cases but means that map_pages()
can now fail with -ENOMEM. Unused pages are retained for re-use.
Move all dma_sync* calls into map and unmap functions rather than
batching them up. This makes it easier to ensure they are safely
balanced, now that the tables are held as separate pages.
Add OF properties to override the default aperture size (2GB)
and base address (40GB); this doesn't include any dma-iova-offset.
Various tidy-ups. The internal representation of aperture limits
*does* include dma_iova_offset, as that is more commonly useful.
Clarify the distinction between Linux pages and IOMMU table pages.
Fix wrong definition of MMMU_CTRL_PT_INVALID_EN flag.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
At a high FPS with RAW10, there is frame corruption for 480p because the
rate_factor of 2 is used with the normal 2x2 bining [1]. This commit
ties the rate_factor to the selected binning mode. For the 480p mode,
analog 2x2 binning mode with a rate_factor of 2 is always used. For the
1232p mode the normal 2x2 binning mode is used for RAW10 while analog
2x2 binning mode is used for RAW8.
[1] raspberrypi#5493
Signed-off-by: Vinay Varma <varmavinaym@gmail.com>
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Reworked due to upstream changes
The enum binning_mode is redundant, it only uses values from the earlier
defined binning modes. Remove it.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
The PL011 driver in this downstream kernel tree supports an extra
compatible string - arm,pl011-axi - for use by RP1. This registers as a
platform driver, not an AMBA driver, and has the advantage of responding
to dynamic Device Tree changes such as loading one of the "uart<n>"
overlays.
Change all of the downstream Raspberry Pi dts files to use the new
compatible string. At the same time, remove the override of the periphid
as the upstream code now has the correct value.
See: https://github.com/raspberrypi/linux/issues/7019
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The D-PHY on RP1 support lane polarity swapping, and there
is a standard device tree mechanism for configuring this,
so tie the two together.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
There was lots of register definition information dumped from
the some source into the driver but unused. Remove it, and
format the remaining lines according to the Linux kernel coding
style.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Put particularly the PHY registers into order, bitmasks
defined alongside the registers, and Use tabs for indentation.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Replace one-element array with flexible-array member to fix:
[ 11.725017] ------------[ cut here ]------------
[ 11.725038] memcpy: detected field-spanning write (size 4) of single field "hdr->body" at drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c:130 (size 0)
[ 11.725113] WARNING: CPU: 3 PID: 455 at drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c:130 vc_vchi_cmd_create+0x1a8/0x1d0 [vc_sm_cma]
Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com>
Extend the LED control features of the led-modes property by adding a
led-swap property. This allows the same led-modes values to be used
across designs where the LED assignments differ.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Copy the firmware's handling of FSTROBE, but using module parameters
instead of config.txt entries.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
To ensure we don't get a regression on handling reflect_[xy]
in the middle of the command line string, add a test for it.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The command line parser was looking for an "=" before the ","
separator.
If the command line had reflect_[xy] before another option
which took a parameter, it would find the "=" from the second
option and assume it was associated with the reflect option,
generally leading to a parsing failure.
Handle this case by looking for both "," and "=", and taking
the first instance.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
All the matrix entries for the YUV to RGB conversion matrices were
being filled with the same coefficients.
Compute the values for the BT601, BT709, and BT2020 matrices in
both full and limited range, and program those into the hardware.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Upstream bcm2712 support added/split out the inbound window for MIP1 into
a separate range. For the pcie-32bit-dma overlay to work, both the MIP
and RC ranges need to agree.
Shift the MIP window to the top 4K page below 4GB.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Use native arm64 runners to speed up build process. Cross compile is
still used for arm targets, but also benefit from the arm64 runner
architecture. Overall build time will be reduced by 25 to 30 minutes by
this.
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
Input tensor injection is a debug feature that allows a user-controlled
input to be passed directly to IMX500's inference engine (bypassing the
in-built ISP).
Three new custom controls are added to ENABLE_INJECTION before streaming
begins, to provide appropriate input tensors via an INPUT_TENSOR_FD, and
to provide notification of DNN results in the sensor output via
INJECTION_CMP_FRM.
Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
The driver previously set the global interrupt mask in the ECR register
in bcm54xx_config_init(), disabling all interrupts. This conflicts with
the configuration in bcm_phy_config_intr(), which enables or disables the
global interrupt mask as needed and is called earlier. As a result,
interrupts may remain globally disabled even when the IMR is configured
to unmask specific events.
Remove the ECR handling from bcm54xx_config_init() so that interrupt
enable/disable is managed exclusively by bcm_phy_config_intr().
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
On CM4/CM5, LED3 is used for ETH_LEDY, while LED4 may be unused or serve
as INT_N. Previously, both LEDs 3 and 4 were mirrored from LED1, which
overwrote the INT_N configuration on CM5.
Fix this by only shadowing LED1 to LED3, preserving the setting for
LED4/INT.
Fixes: 9704fab964 ("net: phy: broadcom: Allow ethernet LED mode to be set via device tree")
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
On CM5, the active-low interrupt pin (INT_N) of the Ethernet PHY is
connected to GPIO37. However, an internal pull-up resistor appears to
be missing, which causes the interrupt edge to be missed or not detected
reliably. Fix this by configuring a bias pull-up on the gpio controller.
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
The phy specific structure is missing the pointers for handling
interrupts and link change notification. This results in interrupt's
being polled on CM5:
Fix this and copy the existing pointers from BCM54210E, which match the
implementation.
Before:
[3.501498] macb 1f00100000.ethernet eth0: PHY [1f00100000.ethernet-ffffffff:00] driver [Broadcom BCM54213PE] (irq=POLL)
After:
[3.597582] macb 1f00100000.ethernet eth0: PHY [1f00100000.ethernet-ffffffff:00] driver [Broadcom BCM54213PE] (irq=168)
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
Added 2 overlays for the rpi-power HAT to operate in
either TOP or BOTTOM mode.
Modified makefile and readme accordingly
Signed-off-by: Lucas Hoffmann <lucas.hoffmann@raspberrypi.com>
Increase the timeout for the toolchain installation in the
dtoverlaycheck workflow, to match that for the kernel.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Both drivers/gpu/drm/solomon/ssd130x-i2c.c and
drivers/video/fbdev/ssd1307fb.c were registering the compatible
"solomon,ssd1306fb-i2c", so bringing ambiguity as to which one
got loaded.
fbdev is largely deprecated, so adopt the updated compatible
for the drm driver.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
They're supported by the standard BMP280 driver, so only
needed the overlay configuration.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Device links are used to keep track of suppliers and consumers of
resources, adding some control over the ordering of device probes other
than returning -EPROBE_DEFER. The way the RP1 device is created breaks
this mechanism in the rare case that the use of modules has been
completely disabled, thanks to some opimisations within the device link
code.
Fix this glitch by giving the corresponding fwnode a pointer to the
device, taking the opportunity to remove a pointless check on the
validity of the rp1_node pointer.
See: https://github.com/raspberrypi/linux/issues/7018
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
max-speed is a generic property for ethernet PHYs, so is
supported by the PHY on Pi5, Pi500, and CM5.
Add the override and update the documentation accordingly.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
max-speed is a generic property for ethernet PHYs, so should be supported
by the PHY on CM4/Pi4/Pi400.
Add the override and update the documentation accordingly.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Prevents fullscreen logos from being drawn multiple times.
With small enough logos, the image would be drawn multiple times across the screen.
Signed-off-by: Ben Benson <ben.benson@raspberrypi.com>
To work around the 30fps buffer-flip rate limit when using VEC's
"native" interlaced modes, switch to sending individual fields
to the VEC BE, using an ISR to flip between fields.
When the TV mode is NTSC, change advertised progressive modes to
have 263 total lines; this ameliorates colour artifacts, although
it reduces the frame rate slightly from 60.05Hz to 59.83Hz.
Progressive modes with 262 lines remain supported.
Fix an error in equalising pulse configuration for PAL-M/PAL60.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
Reimplement the vc4-kms-dsi-ili9881-5inch display overlay by applying a
few changes to the vc4-kms-dsi-ili9881-7inch version. In doing so, it
inherits the rotation parameter that was previously absent, which then
needs documenting.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Enable by adding the following to cmdline.txt:
`fullscreen_logo_name=logo.tga fullscreen_logo=1`
Will show the logo file present in /lib/firmware/ on the screen.
This will be fullscreen and rendered early at boot.
Any remaining space is filled with solid color from the image border.
If TGA file is too big, image is clipped accordingly.
Signed-off-by: Ben Benson <ben.benson@raspberrypi.com>
The patch "dmaengine: dw-axi-dmac: add per-channel AXI burst length
support" programs ARLEN/AWLEN from the snps,axi-max-burst-len array but
still exposed a single max_burst value via dma_get_slave_caps(). As a
result all channels reported 8 even when limited to 4, leading to
warnings:
dma dma2chan5: requested source burst length 8 exceeds supported 4
Add a .device_caps callback to return the correct per-channel max_burst.
This allows drivers like amba-pl011 to clamp burst lengths properly.
Fixes: 0e4e6a0c4f4e ("dmaengine: dw-axi-dmac: add per-channel AXI burst length support")
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
PIO benefits from increased DMA bandwidth when used with DMA channels
0 or 1, because they support longer bursts. Add DMA channel selection
attributes to prevent other users from claiming them.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Give the DMAC property "snps,axi-max-burst-len" a value for each DMA
channel, encoding the fact that channels 1 and 2 are more capable
("heavy").
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Add a mechanism to allow clients to prefer some DMA channels over
others. This is required to allow high-bandwidth clients to request
one of the two "heavy" channels, but could also be used to prevent
some clients from hogging all channels.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The DesignWare AXI DMAC IP can be configured with heterogeneous channel
parameters. Allow maximum burst length to be set per-channel by making
snps,axi-max-burst-len an array.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
If the DMA channel allocation fails, the relevant dma_configs entry
should be marked as no longer claimed, otherwise rp1_pio_sm_dma_free
will be called with an error number as a DMA channel pointer.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
As we do a shallow clone of the repo, Fixes: tags
generally don't have the matching commit available
to lookup, and checkpatch logs it.
Ignore this error.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
While we continue to use the downstream RP1 driver, update some other
Kconfig settings to recognise MFD_RP1 as a valid RP1 driver.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Drop from RGB to YUV422 output if RGB couldn't be supported
within the defined max_bpc and TMDS rates, and then try
dropping max_bpc.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Apparently some NVMe SSD implementations don't fall back to MSI cleanly,
instead making the driver allocate one queue via the legacy interrupt.
There are still only 32 vectors available, but should be sufficient for
the majority of use-cases on BCM2711.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Disabling tx_lpi or eee should not cause the value of tx_lpi_timer to
be lost, even though it is not useful until they are re-enabled.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Add two new DT properties:
* microchip,eee-enabled - a boolean to enable EEE
* microchip,tx-lpi-timer - time in microseconds to wait before entering
low power state
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
For applications of the LAN78xx that don't have valid programmed
EEPROMs or OTPs, enabling both LEDs and auto-negotiation by default
seems reasonable.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
lan78xx_link_reset explicitly clears the MAC's view of the PHY's IRQ
status. In doing so it potentially leaves the PHY with a pending
interrupt that will never be acknowledged, at which point no further
interrupts will be generated.
Avoid the problem by acknowledging any pending PHY interrupt after
clearing the MAC's status bit.
See: https://github.com/raspberrypi/linux/issues/2937
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
All other architectures do different cache operations depending on the
dir parameter. Fix arm64 to do the same.
This fixes udmabuf operations when syncing for read e.g. when the CPU
reads back a V4L2 decoded frame buffer.
Signed-off-by: John Cox <jc@kynesim.co.uk>
Add a new minimal alignment field to the format structure. This minimal
alignment will be used if a stride has been provided by userland. If no
stride has been provided by userland (bytesperline == 0), the optimal
alignemnt will be used in the stride calculation.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Rename the align field in the format structure to opt_align to indicate
the optimal alignment for the format.
There is no functional change in this commit.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Each V3D queue works independently and all the dependencies between the
jobs are handled through the DRM scheduler. Therefore, there is no need
to use one single lock for all queues. Using it, creates unnecessary
contention between different queues that can operate independently.
Replace the global spinlock with per-queue locks to improve parallelism
and reduce contention between different V3D queues (BIN, RENDER, TFU,
CSD). This allows independent queues to operate concurrently while
maintaining proper synchronization within each queue.
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Instead of storing the queue's active job in four different variables,
store the active job inside the queue's state. This way, it's possible
to access all active jobs using an index based in `enum v3d_queue`.
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Instead of storing a pointer to the DRM file data, store a pointer
directly to the private V3D file struct.
Signed-off-by: Maíra Canal <mcanal@igalia.com>
There are now formats defined for 2-plane YUV420 at 10, 12,
and 16 bit depth using the most significant bits of the 16bit
word (P010, P012, and P016), and 3-plane YUV420 at those
depths using the least significant bits of the 16 bit word
(S010, S012, and S016).
VC4_GEN_6 can support all those formats although only composing
using at most 10bits of resolution, so add them as supported
formats for all planes.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The function vc4_mock_atomic_add_output() should return a pointer, even
during error treatment. Use the proper macros to create pointers from
the error code.
Signed-off-by: Maíra Canal <mcanal@igalia.com>
The version of the dwc-otg core used in BCM2835 through BCM2712 only does
whole-word writes, as well as needing the documented requirement for DMA
buffers to start on a word boundary.
Also, the alignment method used in the dwc2 driver doesn't handle the
case where the URB has the NO_TRANSFER_DMA_MAP flag set, so reject
buffers that have unaligned DMA start addresses. At least one whole page
should be mapped, so the BCM283x whole-word-write bug should be benign
in this case.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
During the probe() routine, the PiSP BE driver needs to power up the
interface in order to identify and initialize the hardware.
The driver resumes the interface by calling the
pispbe_runtime_resume() function directly, without going
through the pm_runtime helpers, but later suspends it by calling
pm_runtime_put_autosuspend().
This causes a PM usage count imbalance at probe time, notified by the
runtime_pm framework with the below message in the system log:
pispbe 1000880000.pisp_be: Runtime PM usage count underflow!
Fix this by resuming the interface using the pm runtime helpers instead
of calling the resume function directly and use the pm_runtime framework
in the probe() error path. While at it, remove manual suspend of the
interface in the remove() function. The driver cannot be unloaded if in
use, so simply disable runtime pm.
To simplify the implementation, make the driver depend on PM as the
RPI5 platform where the ISP is integrated in uses the PM framework by
default.
Fixes: 12187bd5d4 ("media: raspberrypi: Add support for PiSP BE")
Cc: stable@vger.kernel.org
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
The driver uses pci_msi methods, only defined when CONFIG_PCI_MSI symbol
is set, and cannot be compiled without. Therefore, it depends on this
symbol.
Signed-off-by: Jorge Marques <jorge.marques@analog.com>
Document the gpio-gate-clock-releasing compatible string that enables
acquire/release GPIO semantics on gpio-gated clocks.
Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
Add support for the 'gpio-gate-clock-releasing' compatible string. The
behaviour is identical to that of 'gpio-gate-clock' but the gpio is
acquired on 'enable' and released on 'disable'.
Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
drm_helper_probe_add_cmdline_mode was looking for a match for
the width, height, and refresh rate within the EDID modes, but
didn't check the interlacing flag. That meant that with
video=1920x1080@50i would match any 1920x1080@50 mode that was
found.
The converse would be possible too if an interlaced mode with
matching resolution & refresh rate was found first.
Check the interlacing flag as well.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The brcmfmac driver uses the SDIO vendor ID values to identify which
vendor's driver extensions to use. However, the Cypress/Infineon devices
used by Rasperry Pi devices have a vendor ID of 02d0, which is Broadcom.
In order to use the Cypress driver extensions, modify the static mapping
for "43430" and "4345" (sic) to indicate that they are Cypress parts.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
dwc2_hc_start_transfer() overwrites hc->xfer_len for split-IN transfers.
Drivers may not allocate buffers that are multiples of the endpoint max
packet size, which may cause buffer overruns in the last transfer.
The hardware needs HCTSIZ to be set to a multiple of HCCHAR.MPS, so trim
chan->max_packet in dwc2_assign_and_init_hc().
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
The HFNUM register increments on every microframe in HS mode, and USB
device drivers expect the returned frame count to relate to the overall
frame. Right-shift the returned value by 3 to drop the microframe bits.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
BCM2836 with Cortex-A7 cores has almost the same ARM_LOCAL interrupt
routing logic as BCM2837, so relax the compile guard to CONFIG_SMP not
CONFIG_ARM64.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Interrupts are dispatched round-robin but doing so trampled FIQ routing.
Taking a FIQ on a core without a handler installed is fatal.
Only modify bits 1:0 which are the IRQ route bits.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
The 6.9 kernel introduced a large patchset [1] designed to make gpiochip
usage safe in the presence of potential hotplugging events. The changes
included protecting every gpiochip access with a claim of an interlock.
Running on a Pi 5 these changes reduce GPIO performance from userspace
by around 10%. The penalty would be proportionally higher from kernel,
as seen by SPI speed reductions.
Patch the gpiolib implementation to remove the protection of gpiochip
accesses. By providing alternative implementations of the relevant
macros, the changes are localised and therefore easier to verify.
See: https://github.com/raspberrypi/linux/issues/6854
[1] https://lwn.net/Articles/960024/
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The Renesas uPD controller is a bit more picky about validating Configure
Endpoint TRBs and requires that bit 0 of the ADD field is 1.
This is mentioned in xhci v1.2 s4.6.6.
Also drop a redundant helper function and reject invalid endpoints.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Copying our downstream patch for imx477 that allows configuration
of external synchronisation signals via DT, add the same to imx296.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Distinguish between releasing the watchdog without requesting that it is
stopped, and failing to stop it when requested. The former is standard
behaviour for systemd, while the latter may be unexpected.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
A conditional had been left as == GEN_6_C, when it also applied
to GEN_6_D, resulting in an invalid change to the dlist on async
updates.
Fixes: b7b14b31c8 ("drm/vc4: plane: Add support for 2712 D-step.")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Support vertical flip by setting REG_VREVERSE.
Additional registers also needs to be set per mode, according
to the readout direction (normal/inverted) as mentioned in the
data sheet.
Since the register IMX335_REG_AREA3_ST_ADR_1 is based on the
flip (and is set via vflip related registers), it has been
moved out of the 2592x1944 mode regs.
Signed-off-by: Umang Jain <umang.jain@ideasonboard.com>
Reviewed-by: Tommaso Merciai <tomm.merciai@gmail.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
In commit 81495a59ba ("media: imx335: Fix active area height discrepency")
the height for the mode struct was rectified to '1944'. However, the
name of mode struct is still reflecting to '1940'. Update it.
Signed-off-by: Umang Jain <umang.jain@ideasonboard.com>
Reviewed-by: Tommaso Merciai <tomm.merciai@gmail.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
The existing driver claims AHT20 support in i2c_device_id, but fails to:
1. Use the correct init command (0xBE for AHT20 vs 0xE1 for AHT10)
2. Omit AHT10_MODE_CYC which AHT20 doesn't support/require
Add proper initialization sequence and include "aosong,aht20" in the
device tree match table to fully support the AHT20.
Signed-off-by: Josh Martinez <8892161+joshermar@users.noreply.github.com>
As a follow-up to commit ef79eea9e4 ("drm/vc4: plane: Enable scaler
for YUV444 on GEN6"), the image looks a little soft when rendering at
1:1 due to the scaling filter being enabled.
Switch to using the nearest neighbour filter automatically when
not scaling in YUV444 to compensate.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
GEN6 requires the luma scaler to be enabled for YUV444 to
be rendered at 1:1, otherwise the source plane isn't rendered.
Fixes: 076eedaf76 ("drm/vc4: hvs: Add support for BCM2712 HVS")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
YUV444 support isn't officially supported by the hardware, but
worked if you told it the image was YUV422 with double the width
and altered chroma scaling.
Adding BCM2712 support gained a fetcher memory (UPM). The code
handling UPM allocations didn't have a case for YUV444, so only
allocated based on the base width, and therefore underflowed.
Increase the UPM allocation size for the luma plane of YUV444
to match.
Fixes: 076eedaf76 ("drm/vc4: hvs: Add support for BCM2712 HVS")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Commit 0af46fbc33 ("media: i2c: imx219: Calculate crop rectangle
dynamically") meant that the 1920x1080 switched from using no binning
to using vertical binning but no horizontal binning.
Restore the original behaviour by ensuring the two binning settings
are the same.
Fixes: 0af46fbc33 ("media: i2c: imx219: Calculate crop rectangle dynamically")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
By default, the System Exit Latency and Maximum Exit Latency are used to
calculate hub port U1 and U2 timeout values. This has the effect of
aggressively power-managing a SuperSpeed link but devices are known to
report unfeasibly short device exit latencies in their descriptors,
which under certain usage conditions can significantly degrade
throughput as the link spends longer retraining than being in a useable
state.
The Intel heuristic approach calculates a reasonably large
endpoint-dependent U1 timeout, and uses a minimum U2 timeout that is
several multiples of typical U2 exit latencies.
Add a module parameter that defaults to using this scheme.
This should have the effect of squelching interop edge-cases where LPM
noticeably degrades performance, and avoid the usual workaround where
userspace manually disables it.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Certain versions of the VL805 firmware manipulate the endpoint Link
Control register to toggle ASPM on/off based on workload, but these
versions also report 0 in the Device Capability Acceptable Latency field
leaving the RC with ASPM disabled.
As it turns out, this EP has a broken L0s implementation so a) override
L1 latency to a sensible value and b) mask L0s.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
The existing implementation for clkreq-mode="safe" leaves the HARD_DEBUG
with both control bits clear. This can cause link failure if L1
sub-states are enabled and if either of these conditions occurrs:
- The platform does not connect the CLRKEQ# signal to the EP, and a
pull-up is present on the line
- The platform connects the signal to the EP, and the EP enters an L1.x
or ClkPM state
Additional register bits in the HARD_DEBUG register can be used to force
the RC to drive CLKREQ# low. Also, un-advertise L1ss as a) additional
power savings can't be realised and b) enabling L1ss may incur
additional wake latency from L1.0.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
The number of words to fetch for SAND formats on vc6 needs to account
for all pixels requested by width.
If cropping fractional pixels, then the width was being increased, but
fetch_count had already been computed. That led to insufficient words
being fetched, and the HVS locked up solid.
Apply the fixup for fractional pixel source cropping before computing
fetch_count.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
BCM2712/vc6 uses 256bit words when reading in P030/SAND128,
increased from 128bit on BCM2711/vc5.
Update the code for cropping the read area to handle the correct
word length.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Add two features that assist in diagnosing link instability issues.
The debugfs additions allow for snapshots of the Physical Layer
statistics registers to be taken, during either free-running capture or
after a hardware-controlled capture interval.
To arm the capture engine (and reset the stats counters), write an
integer N to:
/sys/kernel/debug/pcie@<addr>/stats_trigger
The engine will run forever with a value of 0, or disarm after N
microseconds.
To snapshot the hardware stats counters, write to:
/sys/kernel/debug/pcie@<addr>/stats_snapshot
Reading this file will return the snapshot. If no writes have occurred
since boot, the snapshot will be of the initial link training period.
The ltssm_trace module parameter printk's the states during initial link
startup, in situations where failure to establish the link is a fatal
error.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Remove a bogus memory alignment check - transfers will be run bytewise
if needed - and add a check that the overall length is multiple of the
register size, otherwise there is residue.
See: https://github.com/raspberrypi/linux/issues/6733
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Commit 69dbba71ac ("drm/vc4: Add algorithmic handling for SAND")
lost a multiplication by the tile width when doing the pointer arithmetic
for cropping off columns for vc6.
Correct that computation.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The Ilitek ILI9806E driver is used in the Pimoroni HyperPixel4
and potentially other displays. Whilst it can support multiple
interfaces, this driver only accounts for SPI configuration and
DPI video data.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
This property can be used to delay deassertion of external fundamental
reset, which may be useful for endpoints that require an extended time for
internal setup to complete.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Some endpoints need longer than the minimum Tperst_clk time of 100us
that the PCIe specification allows for, as they may need to sequence
internal resets off the stable output of internal PLLs prior to removal
of fundamental reset. PCIe switches are an especially bad case, in some
cases requiring up to 100 milliseconds for stable downstream link
behaviour.
Parse the DT property brcm,tperst-clk-ms and use this to hold PERST# low
during brcm_pcie_start_link().
The BRCM RC typically outputs 200us of stable refclk before deasserting
PERST#. By masking/forcing the output signal while deasserting the
internal reset, the effect is to extend the length of time that the
refclk is active and stable before PERST# is released.
The TX lanes will enter the Polling state before PERST# is released, but
this appears to be harmless.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Some platforms may require an extended time with refclk active before
PERST# is released. Add a property to let the RC driver know how long to
wait.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
The BCM2712 root complexes can interpret priority signalling in two
different ways, based on the incoming Traffic Class of a TLP.
The TLP TCs are assigned to separate internal request/response queues,
and assigned different AXI IDs. These queues can have outgoing AXI
transactions tagged based on:
- Static QoS values
- Dynamic QoS through internal backpressure
- Dynamic QoS with elevation based on Vendor Messages received by the RC
The VDM mechanism is of limited use due to implementation bugs, but the
implicit reordering due to separate ID assignment allows higher-priority
traffic from an EP to overtake other traffic in the RC and rest of the
system.
RP1 assigns TCs based on its internal bus managers, and internally tags
read requests to allow out-of-order completions, so these two features
operate in concert to provide priority service to e.g. MIPI camera or
display traffic.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
There is configurable priority forwarding hardware in this variant of the
Root Complex controller. Add optional properties to configure FIFO
backpressure or Vendor-Defined Message priority forwarding.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
The PHY MDIO register map is different on BCM2712, and as the PHY input
clock is 54MHz not 100MHz, enabling refclk SSC is both broken and
unfixable.
Mask out attempts to enable SSC with a controller quirk.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
It appears that bits in the Root Control Register are reset with
perst_n, which means the PCI layer's call to enable CRS prior to
adding/scanning the bus has no effect. Open-code the enable in
brcm_pcie_start_link as a workaround.
Without CRS visibility, configuration reads issued by the CPU don't
retire if the endpoint returns a CRS response - the RC will poll until a
(large) timeout is reached. This means the core can stall for a long
time during boot.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
These chips use a UBUS-AXI bridge component that has configurable
timeout and error response handling.
Suppress AXI error responses to CPU requests, otherwise these are fatal
if they reach the ARM cluster, and set reasonably large timeouts for
both Mem and Cfg requests.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Pitch has no meaning if the modifier isn't DRM_FORMAT_MOD_LINEAR
as there is no guarantee that the value passed follows the
pattern that pitch * height = size.
Remove that check from framebuffer_check.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The SAND modifier with height 0 is now using the provided pitch as
the column stride, but the UBM allocation needs to be done based
on the plane width.
Recompute the width in these conditions.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The SAND handling had been using what was believed to be a runtime
parameter in the modifier, however that has been clarified that
all permitted variants of the modifier must be advertised, so
making it variable wasn't practical.
With a rationalisation of how the producers of this format are
configured, we can switch to a variant that doesn't have as much
variation, and can be configured such that only 2 options are
required.
Add a modifier with value 0 to denote that the height of the luma
column matches the buffer height, and chroma column will be half
that due to YUV420.
A modifier of 1 denotes that the height of the luma column still
matches the buffer height, but the chroma column height is the same.
This can be used to replicate the previous behaviour.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
vc4's debugfs support was updated with drm_debugfs_entry whilst
BCM2712 support was in progress, and missed that the lookup
in vc6_hvs_debugfs_dlist still followed the old pattern.
Correct that lookup to avoid an invalid dereference.
Fixes: f7af8ae9d3 ("drm/vc4: hvs: Add support for BCM2712 HVS")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Supporting GL rendering of the new HEVC decoder pixel formats requires
Mesa 24.2.5 or later. There are a couple of minor issues holding up
switching to Mesa 24.
Drop the new pixel formats from enum_fmt so that FFMpeg will use
the older ones that earlier versions of Mesa do support.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The BCM2711 and BCM2712 SoCs used on Rapsberry Pi 4 and Raspberry
Pi 5 boards include an HEVC decoder block. Add a driver for it.
Signed-off-by: John Cox <john.cox@raspberrypi.com>
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: hevc_dec: Add in downstream single planar SAND variant
Upstream will take the multi-planar SAND format, but add back
in the downstream single planar variant for backwards compatibility
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: hevc_dec: Add module parameter for video_nr
To avoid user complaints that /dev/video0 isn't their USB
webcam, add downstream patch that allows setting the preferred
video device number.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Adds a binding for the HEVC decoder found on the BCM2711 / Raspberry Pi 4,
and BCM2712 / Raspberry Pi 5.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Add V4L2_PIXFMT_NV12MT_COL128 and V4L2_PIXFMT_NV12MT_10_COL128
to describe the Raspberry Pi HEVC decoder NV12 multiplanar formats.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The Raspberry Pi HEVC decoder uses a tiled format based on
columns for 8 and 10 bit YUV images, so document them as
NV12MT_COL128 and NV12MT_10_COL128.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Keep track of the number of requests and request objects of a media
device. Helps to verify that all request-related memory is freed.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
By default when the last request object is completed, the whole
request completes as well.
But sometimes you want to manually complete a request in a driver,
so add a manual complete mode for this.
In req_queue the driver marks the request for manual completion by
calling media_request_mark_manual_completion, and when the driver
wants to manually complete the request it calls
media_request_manual_complete().
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
commit 59ac702a93 ("drm/vc4: Get the rid of DRM_ERROR()") converted
all calls to DRM_ERROR into drm_err, but also converted one DRM_DEBUG
into a drm_err.
Switch it back to drm_dbg.
Fixes: 59ac702a93 ("drm/vc4: Get the rid of DRM_ERROR()")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
If an HDMI connector has no EDID and the mode is set via the
kernel command line, then drm_reset_display_info() is the only
thing that will have set up any of connector->display_info.
With commit 26ff1c38fc ("drm/connector: hdmi: Compute bpc
and format automatically"), it is now checked that
DRM_COLOR_FORMAT_RGB444 is supported. Whilst it doesn't fail
the request, it does log dev_warn for every commit, spamming
the log.
For HDMI connectors initialise the color_format field to say
it supports RGB444.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
It was noted that if PV1 was in use to drive DSI1, then the
writeback connector could not be used as HVS channel 2 was
already in use.
The HVS allows PV1 (HVS output 2) to be driven by any HVS
channel via the DSP3_MUX setting, but that was hardcoded to be
either 2 (for PV1) or disabled for TXP.
Expand the available channels field for PV1, and configure
DSP3_MUX accordingly.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The commit titled "bcm2835-dma: Derive slave DMA addresses correctly"
(now squashed into DMA roll-up) moved the responsibility for calculating
DMA addresses to the DMA driver. Unfortunately it committed the sin of
using phys_to_dma directly rather than using the approved API, i.e.
dma_map_resource.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
A basic device-specific linear memory mapping was introduced back in
commit ("dma: Take into account dma_pfn_offset") as a single-valued offset
preserved in the device.dma_pfn_offset field, which was initialized for
instance by means of the "dma-ranges" DT property. Afterwards the
functionality was extended to support more than one device-specific region
defined in the device.dma_range_map list of maps. But all of these
improvements concerned a single pointer, page or sg DMA-mapping methods,
while the system resource mapping function turned to miss the
corresponding modification. Thus the dma_direct_map_resource() method now
just casts the CPU physical address to the device DMA address with no
dma-ranges-based mapping taking into account, which is obviously wrong.
Let's fix it by using the phys_to_dma_direct() method to get the
device-specific bus address from the passed memory resource for the case
of the directly mapped DMA.
Fixes: 25f1e18870 ("dma: Take into account dma_pfn_offset")
Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Slave addresses for DMA are meant to be supplied as physical addresses
(contrary to what struct snd_dmaengine_dai_dma_data does).
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Add ALSA jack detection to the vc4-hdmi audio driver so userspace knows
when to add/remove HDMI audio devices.
Signed-off-by: David Turner <david.turner@raspberrypi.com>
bcm2835_dma_suspend_late is only used if CONFIG_PM_SLEEP is defined,
so make it's presence similarly conditional to avoid a build warning
(and hence error).
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
These fields should not be set by either the user or the kernel driver
so remove them. Replace them with padding bytes to maintain backward
compatibility with existing userland applications.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
The principal differences between the downstream SDHOST driver and the
version accepted upstream driver are that the upstream version loses the
overclock support and DMA configuration via DT, but gains some tidying
up (and maintenance by the upstream devs).
Add the missing features (with the exception of the low-overhead logging)
as a patch to the upstream driver.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
v4l2: Add pisp compression format support to v4l2
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: rp1: cfe: Fix use of freed memory on errors
cfe_probe_complete() calls cfe_put() on both success and fail code paths.
This works for the success path, but causes the cfe_device struct to be
freed, even if it will be used later in the teardown code.
Fix this by making the ref handling a bit saner: Let the video nodes
have the refs as they do now, but also keep a ref in the "main" driver,
released only at cfe_remove() time. This way the driver does not depend
on the video nodes keeping the refs.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: cfe: Fix width & height in cfe_start_channel()
The logic for handling width & height in cfe_start_channel() is somewhat
odd and, afaics, broken. The code reads:
bool start_fe = is_fe_enabled(cfe) &&
test_all_nodes(cfe, NODE_ENABLED, NODE_STREAMING);
if (start_fe || is_image_output_node(node)) {
width = node->fmt.fmt.pix.width;
height = node->fmt.fmt.pix.height;
}
cfe_start_channel() is called for all video nodes that will be used. So
this means that if, say, fe_stats is enabled as the last node, start_fe
will be true, and width and height will be taken from fe_stats' node.
The width and height will thus contain garbage, which then gets
programmed to the csi2 registers.
It seems that this often still works fine, though, probably if the width
& height are large enough.
Drop the above code, and instead get the width & height from the csi2
subdev's sink pad for the csi2 channel that is used. For metadata the
width & height will be 0 as before.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: cfe: Fix verbose debug print
The debug print in cfe_schedule_next_csi2_job() is printed every frame,
and should thus use cfe_dbg_irq() to avoid spamming, rather than cfe_dbg().
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: cfe: Rename xxx_dbg_irq() to xxx_dbg_verbose()
Rename the xxx_dbg_irq() macros to xxx_dbg_verbose(), as they can be
used to verbose debugs outside irq context too.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: cfe: Add verbose debug module parameter
Expose the verbose debug flag as a module parameter.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: cfe: Drop unused field
Drop 'sensor_embedded_data' field, as it is unused.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: cfe: Fix default meta format's field
Set default meta format's field to V4L2_FIELD_NONE, instead of zeroing
it which indicates V4L2_FIELD_ANY. Metadata doesn't have fields, so NONE
makes sense, and furthermore the default v4l2 link validation will check
for matching fields, or that the sink field is NONE.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: cfe: Fail streaming if FE_CONFIG node is not enabled
When the FE is enabled, ensure that the FE_CONFIG node is enabled.
Otherwise fail cfe_start_streaming() entirely.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: rp1_cfe: Remove PISP specific MBUS formats
Remove the MEDIA_BUS_FMT_PISP* format codcs entirely. For the image
pad formats, use the 16-bit Bayer format mbus codes instead. For the
config and stats pad formats, use MEDIA_BUS_FMT_FIXED.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: rp1_cfe: Fix link validate test for pixel format
Now that we have removed unique PISP media bus codes, the cfe format
table has multiple entries with the same media bus code for 16-bit
formats. The test in cfe_video_link_validate() did not account for this.
Fix it by testing the media bus code and the V4L2 pixelformat 4cc
together.
As a drive-by, ensure we have a valid CSI2 datatype id when programming
the hardware block.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: cfe: Set the CSI-2 link frequency correctly
Use the sensor provided link frequency to set the DPHY timing parameters
on stream_on. This replaces the hard-coded 999 MHz value currently being
used. As a fallback, revert to the original 999 Mhz link frequency.
As a drive-by, fix a 80-character line formatting error.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: cfe: Don't confuse MHz and Mbps
The driver was interchaning these units when talking about link rate.
Fix this to avoid confusion. Apart from the logging message change,
there is no function change in this commit.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: rp1: csi2: Fix missing reg writes
The driver has two places where it writes a register based on a
condition, and when that condition is false, the driver presumes that
the register has the reset value. This is not a good idea, so fix those
places to always write the register.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: fe: Use ~0, not -1, when working with unsigned values
Use ~0, not -1, when working with unsigned values (-1 is not unsigned).
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: Add back reg write debug prints
Add back debug prints in csi2 and pisp_fe reg_write() functions, but use
the 'irq' variants to avoid spamming in normal situation.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: csi2: Track CSI-2 errors
Track the errors from the CSI-2 receiver: overflows and discards. These
are recorded in a table which can be read by the userspace via debugfs.
As tracking the errors may cause much more interrupt load, the tracking
needs to be enabled with a module parameter.
Note that the recording is not perfect: we only record the last
discarded DT for each discard type, instead of recording all of them.
This means that e.g. if the device is discarding two unmatched DTs, the
debugfs file only shows the last one recorded. Recording all of them
would need a more sophisticated recording system to avoid the need of a
very large table, or dynamic allocation.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: csi2: Set values for enum csi2_mode
Set hardcoded values for enum csi2_mode, as the values will be
programmed to HW registers.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: fe: Fix default mbus code
When pisp_fe_pad_set_fmt() is given an mbus code that CFE does not
support, it currently defaults to MEDIA_BUS_FMT_SBGGR10_1X10. This is
not correct, as FE does not support SBGGR10.
Set the default to MEDIA_BUS_FMT_SRGGB16_1X16 instead.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
drivers: media: cfe: Find the source pads on the sensor entity
The driver was assuming that pad 0 on the sensor entity was the
appropriate source pad, but this isn't necessarily the case.
With video-mux, it has the sink pads first, and then the source
pad as the last one.
Iterate through the sensor pads to find the relevant source pads.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: rp1: cfe: Expose find_format_by_pix()
Make find_format_by_pix() accessible to other files in the driver.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: cfe: Add cfe_find_16bit_code() and cfe_find_compressed_code()
Add helper functions which, given an mbus code, return the 16-bit
remapped mbus code or the compressed mbus code.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: csi2: Use get_frame_desc to get CSI-2 VC and DT
Use get_frame_desc pad op for asking the CSI-2 VC and DT from the source
device driver, instead of hardcoding to VC 0, and getting the DT from a
formats table. To keep backward compatibility with sources that do not
implement get_frame_desc, implement a fallback mechanism that always
uses VC 0, and gets the DT from the formats table, based on the CSI2's
sink pad's format.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: cfe: Add is_image_node()
The hardware supports streaming from memory (in addition to streaming
from the CSI-2 RX), but the driver does not support this at the moment.
There are multiple places in the driver which uses
is_image_output_node(), even if the "output" part is not relevant. Thus,
in a minor preparation for the possible support for streaming from
memory, and to make it more obvious that the pieces of code are not
about the "output", add is_image_node() which will return true for both
input and output video nodes.
While at it, reformat also the metadata related macros to fit inside 80
columns.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: cfe: Dual purpose video nodes
The RP1 CSI-2 DMA can capture both video and metadata just fine, but at
the moment the video nodes are only set to support either video or
metadata.
Make the changes to support both video and metadata. This mostly means
tracking both video format and metadata format separately for each video
node, and using vb2_queue_change_type() to change the vb2 queue type
when needed.
Briefly, this means that the user can get/set both video and meta
formats to a single video node. The vb2 queue buffer type will be
changed when the user calls REQBUFS or CREATE_BUFS ioctls. This buffer
type will be then used as the "mode" for the video node when the user
starts the streaming, and based on that either the video or the meta
format will be used.
A bunch of macros are added (node_supports_xxx()), which tell if a node
can support a particular mode, whereas the existing macros
(is_xxx_node()) will tell if the node is currently in a particular mode.
Note that the latter will only work correctly between the start of the
streaming and the end of the streaming, and thus should be only used in
those code paths.
However, as the userspace (libcamera) does not support dual purpose
video nodes, for the time being let's keep the second video node as
V4L2_CAP_META_CAPTURE only to keep the userspace working.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: Drop LE handling
The driver registers for line-end interrupts, but never uses them. This
just causes extra interrupt load, with more complexity in the driver.
Drop the LE handling. It can easily be added back if later needed.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: cfe: Improve link validation for metadata
Improve the link validation for metadata by:
- Allowing capture buffers that are larger than the incoming frame
(instead of requiring exact match).
- Instead of assuming that a metadata unit ("pixel") is 8 bits, use
find_format_by_code() to get the format and use the bit depth from
there. E.g. bit depth for RAW10 metadata will be 10 bits, when we
move to the upstream metadata formats.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
drivers: media: cfe: Add more robust ISR handlers
Update the ISR logic to be more robust to sensors in problematic states
where interrupts may start arriving overlapped and/or missing.
1) Test for cur_frame in the FE handler, and if present, dequeue it in
an error state so that it does not get orphaned.
2) Move the sequence counter and timestamp variables to the node
structures. This allows the ISR to track channels running ahead when
interrupts arrive unordered.
3) Add a test to ensure we don't have a spurios (but harmlesS) call to
the FE handler in some circumstances.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: rp1: cfe: Fix error paths in cfe_start_streaming
Noted that if we get "node link is not enabled", then we also
get the videobuf2 splat for the driver not cleaning up correctly
on a failed start_streaming, and indeed we weren't returning the
buffers.
Checking the other error paths, noted that the "FE enabled, but
FE_CONFIG node is not" path was not calling pm_runtime_put.
Fix both paths.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drivers: media: cfe: Increase default size of embedded buffer
Increase the size of the default embedded buffer to 16k. This is done to
match what is advertised by the IMX219 driver and workaround a problem
where the embedded stream is not actually used. Without full streams API
support, the media pipeline validation will fail in these circumstances.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: rp1: cfe: Actually use the number of lanes configured
The driver was calling get_mbus_config to ask the sensor subdev
how many CSI2 data lanes it wished to use and with what other
properties, but then failed to pass that to the DPHY configuration.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: rp1: csi2: Fix csi2_pad_set_fmt()
The CSI-2 subdev's set_fmt currently allows setting the source and sink
pad formats quite freely. This is not right, as the CSI-2 block can only
do one of the following when processing the stream: 1) pass through as
is, 2) expand to 16-bits, 3) compress.
The csi2_pad_set_fmt() should take this into account, and only allow
changing the source side mbus code, compared to the sink side format.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: csi2: Use standard link_validate
The current csi2_link_validate() skips some important checks. Let's
rather use the standard v4l2_subdev_link_validate_default() as the
link_validate hook.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: csi2: Squash fixes
media: rp1: fe: Fix pisp_fe_pad_set_fmt()
pisp_fe_pad_set_fmt() allows setting the pad formats quite freely. This
is not correct, and the function should only allow formats as supported
by the hardware. Fix this by:
Allow no format changes for FE_CONFIG_PAD and FE_STATS_PAD. They should
always be the hardcoded initial ones.
Allow setting FE_STREAM_PAD freely (but the mbus code must be
supported), and propagate the format to the FE_OUTPUT0_PAD and
FE_OUTPUT1_PAD pads.
Allow changing the mbus code for FE_OUTPUT0_PAD and FE_OUTPUT1_PAD pads
only if the mbus code is the compressed version of the sink side code.
TODO: FE supports scaling and cropping. This should be represented here
too?
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: fe: Use standard link_validate
The current pisp_fe_link_validate() skips some important checks. Let's
rather use the standard v4l2_subdev_link_validate_default() as the
link_validate hook.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
drivers: media: cfe: Add 16-bit and compressed mono format support
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: rp1: cfe: Add missing remaps
8-bit bayer formats are missing remap definitions. Add them.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
media: rp1: cfe: Add missing compressed remaps
16-bit bayer formats are missing compressed remap definitions. Add them.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
drivers: media: pisp_be: pisp_fe: Update UAPI header licenses
Update the license tags on the pisp UAPI header files with the
"Linux-syscall-note" clause. Also replace the "GPL-2.0" tag with the
preferred "GPL-2.0-only" tag.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: rp1: cfe: Use the MIPI_CSI2_DT_xxx defines for csi_dt
Seeing as we now have the CSI2 data types defined, make use of
them instead of hardcoding the values.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: rp1: cfe: Add a csi_dt value for 16bit formats
Raw 16bit formats didn't have a csi_dt value defined, which
presumably would trip the WARN_ON(!fmt->csi_dt); in
cfe_start_channel.
The value is defined in CSI2 v2.0 as 0x2e, so set it accordingly.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drivers: media: pisp_be: Add mono and 48-bit RGB pixel format support
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: pisp_be: Update seqeuence numbers of the buffers
Add a framebuffer sequence counter and increment on every completed job.
This counter is then used to update the VB2 buffer sequence count before
calling vb2_buffer_done().
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: cfe: Add remap entries for mono formats
The 8-bit and 16-bit mono formats were missing the appropriate remap
entries in the format table.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: rp1-cfe: Fix up link validation for CFE CFG input
After commit 5fd3e2412a ("media: v4l2-subdev: Support hybrid links
in v4l2_subdev_link_validate()") link_validate is called on V4L2
OUTPUT devices such as the CFE cfg buffers input.
The CFE link_validate function was assuming it was always the
sink of a link, which goes wrong on that port and does an invalid
dereference.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: rp1-cfe: Swap "raspberypi,rp1-cfe" compatible to downstream driver
Whilst we are wanting to maintain the downstream driver at the same time
as having the upstream merged, swap the "raspberypi,rp1-cfe" compatible
string across.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media/platform/raspberypi/rp1_cfe: Candidate fix for #5821
To avoid lost frame start in a subsequent session, avoid setting
the number of lanes back to 1 or putting CSI-2 Host into reset.
It's not clear if this is a watertight fix -- what if the camera
itself produced a truncated or garbled packet, or continued to
send until the next start? -- but it does seem to fix the issue.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drivers: media: rpi: cfe: Avoid unpack operation for 16-bit formats
The unpack operation is redundant for 16-bit sensor formats, don't set
the hardware to do it in these cases.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: cfe: Workaround for 16-bit mismatch in the hardware
Set the data type for 16-bit modes to 0 (wildcard) to workarond the
16-bit mismatch in hardware.
We also need to suppress the warning about DT == 0 on start stream in
these cases.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Implement a tristate-style option for "supports-cqe". If the property is
absent or zero, disable CQ completely. For 1, enable CQ unconditionally
for eMMC cards, and known-good SD cards. For 2, enable for eMMC cards,
and all SD cards that are not known-bad.
The sdhci-brcmstb driver needs to know about the tristate as its probe
sequence would otherwise override a disable in mmc_of_parse().
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
These cards have a known-good CQ implementation and are based on a
Longsys product. Add the MANFID for Longsys SD, and the particular CID
details for the Pi card.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
We have found that many SD cards in the field, even of the same make and
model, have latent bugs in their CQ implementation. Some product lines
have fewer bugs with newer manufacture dates, but this is not a
guarantee that a particular card is at a particular firmware revision
level.
Many of these bugs lead to card hangs or data corruption. Add a quirk to
mark a card as having a tested, working CQ implementation and ignore the
capability if absent.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
The sensor has Low Conversion Gain (HCG) and High Conversion Gain (HCG)
modes, with the supposedly the HCG mode having better noise performance
at high gains.
As this parameter changes the gain range of the sensor, it isn't
possible to make this an automatic property, and there is no
suitable V4L2 control to set it, so just add it as a module parameter.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Copy the same validation logic as from the plane rotation property.
Fixes: 8fec3ff870 ("drm: Add a rotation parameter to connectors.")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
When initialized from panel_bridge_attach(), connector should
allow interlaced modes rather than invariably rejecting them,
so that other components can validate them.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
The upstream addition of the kernel parameter cgroup_disable makes it
possible to configure cgroups at boot time. In theory, re-enabling a
disabled cgroup is simply a case of removing the relevant cgroup_disable
setting, but this is difficult if the setting comes from Device Tree.
Re-introduce cgroup_enable as a way around the problem.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
On Raspberry Pi 4 and earlier models the firmware provides
a low speed (up to 115200 baud) bit-bashed UART on arbitrary
GPIOs using the second VPU core.
The firmware driver is designed to support 19200 baud. Higher
rates up to 115200 seem to work but there may be more jitter.
This can be useful for debug or managing additional low
speed peripherals if the hardware PL011 and 8250 hardware
UARTs are already used for console / bluetooth.
The firmware driver requires a fixed core clock frequency
and also requires the VPU PWM audio driver to be disabled
(dtparam=audio=off)
Runtime configuration is handled via the vc-mailbox APIs
with the FIFO buffers being allocated in uncached VPU
addressable memory. The FIFO pointers are stored in spare
VideoCore multi-core sync registers in order to reduce the number
of uncached SDRAM accesses thereby reducing jitter.
Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
serial: rpi-fw-uart: Demote debug log messages
A dev_info call in rpi_fw_uart_configure causes kernel log output every
time one opens the UART. Demote it to dev_dbg.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
LBM is only relevant for each active dlist, so there is
no need to double-buffer the allocations.
Cache the allocations per plane so that we can ensure the
allocations are possible.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Following the example of [1], move the state allocation out of the init
function to make it thread safe.
[1] commit 7e0351ae91 ("drm/vc4: tests: Stop allocating the state in
test init")
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The tests on vc4 (BCM2835-7) were checking for DSI1 muxing being
to restricted channel 2, and therefore muxing with TXP was impossible.
As we no longer have that restriction, update the capabilities
defined for DSI1, move the tests that used to be impossible to the
valid list, and extend for additional combinations that are now
possible.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The BCM2712 comes with a different LBM size computation than the
previous generations, so let's add the few examples provided as kunit
tests to make sure we always satisfy those requirements.
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
We'll start testing our planes code in situations where we will use more
than XRGB8888, so let's add a few common pixel formats.
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
We'll start to add some tests for the plane state logic, so let's create
a helper to add a plane to an existing atomic state.
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Some tests will need to find a plane to run a test on for a given CRTC.
Let's create a small helper to do that.
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
The current mock planes were just using the regular drm_plane_state,
while the driver expect struct vc4_plane_state that subclasses
drm_plane_state.
Hook the proper implementations of reset, duplicate_state, destroy and
atomic_check to create vc4_plane_state.
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
The BCM2712 has a simpler pipeline than the BCM2711, and thus the muxing
requirements are different. Create some tests to make sure we get proper
muxing decisions.
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
The BCM2712 has a simpler pipeline that can only output to a writeback
connector and two HDMI controllers.
Let's allow our kunit tests to create a mock of that pipeline.
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Some tests will need to retrieve the output that was just allocated by
vc4_mock_atomic_add_output().
Instead of making them look them up in the DRM device, we can simply
make vc4_mock_atomic_add_output() return an error pointer that holds the
allocated output instead of the error code.
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
The DRM device pointer and the DRM encoder pointer are redundant, since
the latter is attached to the former and we can just follow the
drm_encoder->dev pointer.
Let's remove the drm_device pointer argument.
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Testing whether the VideoCore generation we want to mock is vc5 or vc4
worked so far, but will be difficult to extend to support BCM2712 (VC6).
Convert to a switch.
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
This is a squash of all firmware-kms related patches from previous
branches, up to and including
"drm/vc4: Set the possible crtcs mask correctly for planes with FKMS"
plus a couple of minor fixups for the 5.9 branch.
Please refer to earlier branches for full history.
This patch includes work by Eric Anholt, James Hughes, Phil Elwell,
Dave Stevenson, Dom Cobley, and Jonathon Bell.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/vc4: Fixup firmware-kms after "drm/atomic: Pass the full state to CRTC atomic enable/disable"
Prototype for those calls changed, so amend fkms (which isn't
upstream) to match.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/vc4: Fixup fkms for API change
Atomic flush and check changed API, so fix up the downstream-only
FKMS driver.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/vc4: Make normalize_zpos conditional on using fkms
Eric's view was that there was no point in having zpos
support on vc4 as all the planes had the same functionality.
Can be later squashed into (and fixes):
drm/vc4: Add firmware-kms mode
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
drm/vc4: FKMS: Change of Broadcast RGB mode needs a mode change
The Broadcast RGB (aka HDMI limited/full range) property is only
notified to the firmware on mode change, so this needs to be
signalled when set.
https://github.com/raspberrypi/firmware/issues/1580
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
vc4/drv: Only notify firmware of display done with kms
fkms driver still wants firmware display to be active
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
ydrm/vc4: fkms: Fix margin calculations for the right/bottom edges
The calculations clipped the right/bottom edge of the clipped
range based on the left/top margins.
https://github.com/raspberrypi/linux/issues/4447
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/vc4: fkms: Use new devm_rpi_firmware_get api
drm/kms: Add allow_fb_modifiers
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
drm/vc4: Add async update support for cursor planes
Now that cursors are implemented as regular planes, all cursor
movements result in atomic updates. As the firmware-kms driver
doesn't support asynchronous updates, these are synchronous, which
limits the update rate to the screen refresh rate. Xorg seems unaware
of this (or at least of the effect of this), because if the mouse is
configured with a higher update rate than the screen then continuous
mouse movement results in an increasing backlog of mouse events -
cue extreme lag.
Add minimal support for asynchronous updates - limited to cursor
planes - to eliminate the lag.
See: https://github.com/raspberrypi/linux/pull/4971https://github.com/raspberrypi/linux/issues/4988
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
drivers/gpu/drm/vc4: Add missing 32-bit RGB formats
The missing 32-bit per pixel ABGR and various "RGB with an X value"
formats are added. Change sent by Dave Stevenson.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
drm: vc4: Fixup duplicated macro definition in vc4_firmware_kms
Both vc4_drv.h and vc4_firmware_kms.c had definitions for
to_vc4_crtc.
Rename the fkms one to make it unique, and drop the magic
define vc4_crtc vc4_kms_crtc
define to_vc4_crtc to_vc4_kms_crtc
that renamed half the variable and function names in a slightly
unexpected way.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/vc4: Fix FKMS for when the YUV chroma planes are different buffers
The code was assuming that it was a single buffer with offsets,
when kmstest uses separate buffers and 0 offsets for each plane.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/vc4: fkms: Rename plane related functions
The name collide with the Full KMS functions that are going to be made
public.
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
drm/vc4_fkms: Fix up interrupt handler for both 2835/2711 and 2712
2712 has switched from using the SMI peripheral to another interrupt
source for the vsync interrupt, so handle both sources cleanly.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/vc4: fkms: No SMI abuse needed on BCM2712
Since we don't use the (absent) SMI block to create interrupts on
BCM2712, there's no need to map any registers.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Currently, booting with no hdmi connected has:
pi@pi4:~ $ vcgencmd measure_clock hdmi pixel
frequency(9)=120010256
frequency(29)=74988280
After connecting hdmi we get:
pi@pi4:~ $ vcgencmd measure_clock hdmi pixel
frequency(9)=300005856
frequency(29)=149989744
and that persists after disconnecting hdmi
I can measure this on a power supply as 10mA@5.2V (52mW).
We should always remove clk_set_min_rate requests
when we no longer need them.
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
The txp block can implement transpose as it writes out the image
data, so expose that through the new connector rotation property.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm: vc4: txp: Do not allow 24bpp formats when transposing
The hardware doesn't support transposing to 24bpp (RGB888/BGR888)
formats. There's no way to advertise this through DRM, so block
it from atomic_check instead.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
As the writeback connector doesn't have the same realtime
constraints of a live display, drop the panic priority for it.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The transposer/writeback connector should be running with a
lower priority, so shouldn't be factored into the load
calculations.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Instead of having 48 generic overlay planes, assign 32 to the
writeback connector so that there is no ambiguity in wlroots
when trying to find a plane for composition using the writeback
connector vs display.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The HVS can accept an arbitrary number of planes, provided
that the overall pixel read load is within limits, and
the display list can fit into the dlist memory.
Now that DRM will support 64 planes per device, increase
the number of overlay planes from 16 to 48 so that the
dlist complexity can be increased (eg 4x4 video wall on
each of 3 displays).
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The register to enable/disable background fill was being set
from atomic flush, however that will be applied immediately and
can be a while before the vblank. If it was required for the
current frame but not for the next one, that can result in
corruption for part of the current frame.
Store the state in vc4_hvs, and update it on vblank.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The documentation says that the TPZ filter can not upscale,
and requesting a scaling factor > 1:1 will output the original
image in the top left, and repeat the right/bottom most pixels
thereafter.
That fits perfectly with upscaling a 1x1 image which is done
a fair amount by some compositors to give solid colour, and it
saves a large amount of LBM (TPZ is based on src size, whilst
PPF is based on dest size).
Select TPZ filter for images with source rectangle <=1.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Seeing as the HVS can be configured with regard the scaling filter,
and DRM now supports selecting scaling filters at a per CRTC or
per plane level, we can implement it.
Default remains as the Mitchell/Netravali filter, but nearest
neighbour is now also implemented.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
There are no MEDIA_BUS_FMT_* defines for GRB or BRG, and adding
them is a pain.
Add a DT override to allow setting the order.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The current reset code doesn't actually stop the hdmi output.
That makes it difficult for displays to handle a mode set.
Powering down the PLL does actually remove the hdmi signal
and makes mode sets more reliable
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
There appears to be a requirement for some devices
(I'm testing with a 8K VRROOM 40Gbps HDMI switch)
for a measable delay between removing the hdmi phy output from
the old mode, to enabling the hdmi phy output for the new mode.
Without the delay, a mode switch has a small change of getting a permanent
'no signal', which requires a subsequent mode switch or a unplug/replug
to redetect.
Switching between 4kp24/25/30 modes fails about 5% of time in my testing.
Add a delay to make it impossible to switch faster than this.
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
The intention of the vc4.force_hotplug setting is to
ignore hotplug completely.
It can be used when a display toggles hotplug when
switching AV inputs, going into standby or changing a
KVM switch, and some side effect of that is unwanted.
It turns out while vc4.force_hotplug currently makes
hotplug always read as asserted, that isn't enough to
stop drm doing lots of stuff, including re-reading
the edid.
An example of what drm does with a hotplug deasert/assert
and vc4.force_hotplug=1 currently is:
https://paste.debian.net/hidden/dc07434b/
That is unwanted. Lets ignore the hotplug interrupt
completely so drm is blissfully unaware of the hotplug change.
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
See: https://forum.libreelec.tv/thread/24783-tv-avr-turns-back-on-right-after-turning-them-off
While the kernel provides a :D flag for assuming device is connected,
it doesn't stop this function from being called and generating a cec_phys_addr_invalidate
message when hotplug is deasserted.
That message provokes a flurry of CEC messages which for many users results in the TV
switching back on again and it's very hard to get it to stay switched off.
It seems to only occur with an AVR and TV connected but has been observed across a
number of manufacturers.
The issue started with https://github.com/raspberrypi/linux/pull/4371
and this provides an optional way of getting back the old behaviour
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
If you disable HDR metadata, then the hardware should stop
sending the infoframe, and that is implemented by the
clear_infoframe hook which wasn't implemented. Add it.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
With the command line parser now providing the information about
the tv mode, use that as the preferred choice for initialising the
default of the tv_mode property.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Similar to the ch7006 and nouveau drivers, introduce a "tv_mode" module
parameter that allow setting the TV norm by specifying vc4.tv_norm= on
the kernel command line.
If that is not specified, try inferring one of the most popular norms
(PAL or NTSC) from the video mode specified on the command line. On
Raspberry Pis, this causes the most common cases of the sdtv_mode
setting in config.txt to be respected.
Signed-off-by: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
drm/vc4: Do not reset tv mode as this is already handled by framework
In vc4_vec_connector_reset, the tv mode is already reset to the
property default by drm_atomic_helper_connector_tv_reset, so there
is no need for a local fixup to potentially some other default.
Fixes: 96922af144 ("drm/vc4: Allow setting the TV norm via module parameter")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The DSI block appears to be able to come up stuck in a condition where
it leaves the lanes in HS mode or just jabbering. This stops LP
transfers from completing as there is no LP time available. This is
signalled via the LP1 contention error.
Enabling video briefly clears that condition, so if we detect the
error condition, enable video mode and then retry.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Some DSI peripheral drivers wish to send commands in the
post_disable or panel unprepare callback. These are called
after the DSI host's disable call, but before the host's
post_disable if pre_enable_prev_first is set.
Don't reset the block until post_disable to allow these
commands to be sent.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The TC358762 bridge and panel decodes the mode differently on
DSI0 to DSI1 for no obvious reason, and results in a shift off
the screen.
Whilst it would be possible to change the compatible used for
the panel, that then messes up Pi5.
As it appears to be restricted to vc4 DSI0, fix up the mode
in vc4_dsi.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The pixel to byte FIFO appears to not always reset correctly,
which can lead to colour errors and/or horizontal shifts.
Reset on every vblank to work around the issue.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The block must be enabled for the FIFO resets to be actioned,
so ensure this is the case.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The initialisation sequence differs slightly from the documentation
in that the clocks are meant to be running before resets and
similar.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
DSI0 is misbehaving and needs to action things on vblank to
work around it.
Add a new hook to call across during vblank.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The dmabuf import already checks that the backing buffer is contiguous
and rejects it if it isn't. vc4 also requires that the buffer is
in the bottom 1GB of RAM, and this is all correctly defined via
dma-ranges.
However the kernel silently uses swiotlb to bounce dma buffers
around if they are in the wrong region. This relies on dma sync
functions to be called in order to copy the data to/from the
bounce buffer.
DRM is based on all memory allocations being coherent with the
GPU so that any updates to a framebuffer will be acted on without
the need for any additional update. This is fairly fundamentally
incompatible with needing to call dma_sync_ to handle the bounce
buffer copies, and therefore we have to detect and reject mappings
that use bounce buffers.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
We have a read-modify-write race when updating SCALER_DISPCTRL for
underrun and end-of-frame interrupts.
Ideally it would be fixed via a spinlock or similar, but that will
require a reasonable amount of study to ensure we don't get deadlocks.
The underrun reporting is only for debug, so disable it for now.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Users are reporting running out of DLIST memory. Add a
debugfs file to dump out all the allocations.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
During normal operations, the cursor position update is done through an
asynchronous plane update, which on the vc4 driver basically just
modifies the right dlist word to move the plane to the new coordinates.
However, when we have the overscan margins setup, we fall back to a
regular commit when we are next to the edges. And since that commit
happens to be on a cursor plane, it's considered a legacy cursor update
by KMS.
The main difference it makes is that it won't wait for its completion
(ie, next vblank) before returning. This means if we have multiple
commits happening in rapid succession, we can have several of them
happening before the next vblank.
In parallel, our dlist allocation is tied to a CRTC state, and each time
we do a commit we end up with a new CRTC state, with the previous one
being freed. This means that we free our previous dlist entry (but don't
clear it though) every time a new one is being committed.
Now, if we were to have two commits happening before the next vblank, we
could end up freeing reusing the same dlist entries before the next
vblank.
Indeed, we would start from an initial state taking, for example, the
dlist entries 10 to 20, then start a commit taking the entries 20 to 30
and setting the dlist pointer to 20, and freeing the dlist entries 10 to
20. However, since we haven't reach vblank yet, the HVS is still using
the entries 10 to 20.
If we were to make a new commit now, chances are the allocator are going
to give the 10 to 20 entries back, and we would change their content to
match the new state. If vblank hasn't happened yet, we just corrupted
the active dlist entries.
A first attempt to solve this was made by creating an intermediate dlist
buffer to store the current (ie, as of the last commit) dlist content,
that we would update each time the HVS is done with a frame. However, if
the interrupt handler missed the vblank window, we would end up copying
our intermediate dlist to the hardware one during the composition,
essentially creating the same issue.
Since making sure that our interrupt handler runs within a fixed,
constrained, time window would require to make Linux a real-time kernel,
this seems a bit out of scope.
Instead, we can work around our original issue by keeping the dlist
slots allocation longer. That way, we won't reuse a dlist slot while
it's still in flight. In order to achieve this, instead of freeing the
dlist slot when its associated CRTC state is destroyed, we'll queue it
in a list.
A naive implementation would free the buffers in that queue when we get
our end of frame interrupt. However, there's still a race since, just
like in the shadow dlist case, we don't control when the handler for
that interrupt is going to run. Thus, we can end up with a commit adding
an old dlist allocation to our queue during the window between our
actual interrupt and when our handler will run. And since that buffer is
still being used for the composition of the current frame, we can't free
it right away, exposing us to the original bug.
Fortunately for us, the hardware provides a frame counter that is
increased each time the first line of a frame is being generated.
Associating the frame counter the image is supposed to go away to the
allocation, and then only deallocate buffers that have a counter below
or equal to the one we see when the deallocation code should prevent the
above race from occurring.
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
The RP1 chip has the Cadence GEM block, but wants the tx_clock
to always run at 125MHz, in the same way as sama7g5.
Add the relevant configuration.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The Raspberry Pi RP1 chip has the Cadence GEM ethernet
controller, so add a compatible string for it.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
DSI0 and DSI1 have different widths for the command FIFO (24bit
vs 32bit), but the driver was assuming the 32bit width of DSI1
in all cases.
DSI0 also wants the data packed as 24bit big endian, so the
formatting code needs updating.
Handle the difference via the variant structure.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Using increased bit depth for no reason increases power
consumption, and differs from the behaviour prior to the
conversion to use the HDMI helper functions.
Initialise the state max_bpc and requested_max_bpc to the
minimum value supported. This only affects Raspberry Pi,
as the other users of the helpers (rockchip/inno_hdmi and
sunx4i) only support a bit depth of 8.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
ws2812-pio-rp1 is a PIO-based driver for WS2812 LEDS. It creates a
character device in /dev, the default name of which is /dev/leds<n>,
where <n> is the instance number. The number of LEDS should be set
in the DT overlay, as should whether it is RGB or RGBW, and the default
brightness.
Write data to the /dev/* entry in a 4 bytes-per-pixel format in RGBW
order:
RR GG BB WW RR GG BB WW ...
The white values are ignored unless the rgbw flag is set for the device.
To change the brightness, write a single byte to offset 0, 255 being
full brightness and 0 being off.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Use the PIO hardware on RP1 to implement a PWM interface.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
pwm: rp1: use pwmchip_get_drvdata() instead of container_of()
The PWM framework may not embed struct pwm_chip within the driver’s
private data. Using container_of() can result in accessing invalid
memory or NULL pointers, especially after recent kernel changes.
Switch to pwmchip_get_drvdata() to reliably access the driver data.
This resolves kernel warnings and probe failures seen after updating
from kernel 6.12.28 to 6.12.34 [1]
While at it remove the now obsolete `struct pwm_chip chip` member from
`struct pwm_pio_rp1`.
[1] https://github.com/raspberrypi/linux/issues/6971
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
Provide remote access to the PIO hardware in RP1. There is a single
instance, with 4 state machines.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
misc: rp1-pio: Support larger data transfers
Add a separate IOCTL for larger transfer with a 32-bit data_bytes
field.
See: https://github.com/raspberrypi/utils/issues/107
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
misc: rp1-pio: More logical probe sequence
Sort the probe function initialisation into a more logical order.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
misc: rp1-pio: Minor cosmetic tweaks
No functional change.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
misc: rp1-pio: Add in-kernel DMA support
Add kernel-facing implementations of pio_sm_config_xfer and
pio_xm_xfer_data.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
misc: rp1-pio: Handle probe errors
Ensure that rp1_pio_open fails if the device failed to probe.
Link: https://github.com/raspberrypi/linux/issues/6593
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
misc: rp1-pio: SM_CONFIG_XFER32 = larger DMA bufs
Add an ioctl type - SM_CONFIG_XFER32 - that takes uints for the buf_size
and buf_count values.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
misc/rp1-pio: Fix copy/paste error in pio_rp1.h
As per the subject, there was a copy/paste error that caused
pio_sm_unclaim from a driver to result in a call to
pio_sm_claim. Fix it.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
misc: rp1-pio: Fix parameter checks wihout client
Passing bad parameters to an API call without a pio pointer will cause
a NULL pointer exception when the persistent error is set. Guard
against that.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
misc: rp1-pio: Convert floats to 24.8 fixed point
Floating point arithmetic is not supported in the kernel, so use fixed
point instead.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
misc: rp1-pio: Error out on incompatible firmware
If the RP1 firmware has reported an error then return that from the PIO
probe function, otherwise defer the probing.
Link: https://github.com/raspberrypi/linux/issues/6642
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
misc: rp1-pio: Demote fw probe error to warning
Support for the RP1 firmware mailbox API is rolling out to Pi 5 EEPROM
images. For most users, the fact that the PIO is not available is no
cause for alarm. Change the message to a warning, so that it does not
appear with "quiet" in cmdline.txt.
Link: https://github.com/raspberrypi/linux/issues/6642
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
misc: rp1-pio: Don't just reuse the same DMA buf
A missing pointer increment meant that not only was the same buffer
being reused again and again, there was also no protection against
using it simultaneously for multiple transfers. Fix that basic bug, and
also move a similar increment to before the transfer is started, which
feels less racy.
See: https://github.com/raspberrypi/linux/issues/6919
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The RP1 firmware runs a simple communications channel over some shared
memory and a mailbox. This driver provides access to that channel.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
firmware: rp1: Simplify rp1_firmware_get
Simplify the implementation of rp1_firmware_get, requiring its clients
to have a valid 'firmware' property. Also make it return NULL on error.
Link: https://github.com/raspberrypi/linux/issues/6593
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
firmware: rp1: Linger on firmware failure
To avoid pointless retries, let the probe function succeed if the
firmware interface is configured correctly but the firmware is
incompatible. The value of the private drvdata field holds the outcome.
Link: https://github.com/raspberrypi/linux/issues/6642
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
firmware: rp1: Rename to rp1-fw to avoid module name collision
There is already the driver in drivers/mfd/rp1.ko, so having
drivers/firmware/rp1.ko can cause issues when using modinfo
and similar, and we can get errors with "Module rp1 is already
loaded" when trying to load it.
Rename the module so that the name is unique.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
mailbox: rp1: Don't claim channels in of_xlate
The of_xlate method saves the calculated event mask in the con_priv
field. It also rejects subsequent attempt to use that channel because
the mask is non-zero, which causes a repeated instantiation of a client
driver to fail.
The of_xlate method is not meant to be a point of resource acquisition.
Leave the con_priv initialisation, but drop the test that it was
previously zero.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The Raspberry Pi RP1 includes 2 M3 cores running firmware. This driver
adds a mailbox communication channel to them via a doorbell and some
shared memory.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Attempting to start a non-idle channel causes an error message to be
logged, and is inefficient. Test for emptiness of the desc_issued list
before doing so.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The xHC may commence Host Initiated Data Moves for streaming endpoints -
see USB3.2 spec s8.12.1.4.2.4. However, this behaviour is typically
counterproductive as the submission of UAS URBs in {Status, Data,
Command} order and 1 outstanding IO per stream ID means the device never
enters Move Data after a HIMD for Status or Data stages with the same
stream ID. For OUT transfers this is especially inefficient as the host
will start transmitting multiple bulk packets as a burst, all of which
get NAKed by the device - wasting bandwidth.
Also, some buggy UAS adapters don't properly handle the EP flow control
state this creates - e.g. RTL9210.
Set Host Initiated Data Move Disable to always defer stream selection to
the device. xHC implementations may treat this field as "don't care,
forced to 1" anyway - xHCI 1.2 s4.12.1.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
SPI transfers are of defined length, unlike some UART traffic, so it is
safe to let the DMA controller choose a suitable memory width.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
For devices where transfer lengths are not known upfront, there is a
danger when the destination is wider than the source that partial words
can be lost at the end of a transfer. Ideally the controller would be
able to flush the residue, but it can't - it's not even possible to tell
that there is any.
Instead, allow the client driver to avoid the problem by setting a
smaller width.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Some connectors, particularly writeback, can implement flip
or transpose operations as writing back to memory.
Add a connector rotation property to control this.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Some hardware will implement transpose as a rotation operation,
which when combined with X and Y reflect can result in a rotation,
but is a discrete operation in its own right.
Add an option for transpose only.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The limit of 32 planes per DRM device is dictated by the use
of planes_mask returning a u32.
Change to a u64 such that 64 planes can be supported by a device.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The non-desktop property "Indicates the output should be ignored for
purposes of displaying a standard desktop environment or console."
That sounds like it should be true for all writeback and virtual
connectors as you shouldn't render a desktop to them, so set it
by default.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The DHT11 datasheet is pretty cryptic, but it does suggest that after
each integer value (humidity and temperature) there are "decimal"
values. Validate these as integers in the range 0-9 and treat them as
tenths of a unit.
Link: https://github.com/raspberrypi/linux/issues/6220
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
For platforms that have xHCI controllers attached over PCIe, and
non-coherent routes to main memory, a theoretical race exists between
posting new TRBs to a ring, and writing to the doorbell register.
In a contended system, write traffic from the CPU may be stalled before
the memory controller, whereas the CPU to Endpoint route is separate
and not likely to be contended. Similarly, the DMA route from the
endpoint to main memory may be separate and uncontended.
Therefore the xHCI can receive a doorbell write and find a stale view
of a transfer ring. In cases where only a single TRB is ping-ponged at
a time, this can cause the endpoint to not get polled at all.
Adding a readl() before the write forces a round-trip transaction
across PCIe, definitively serialising the CPU along the PCI
producer-consumer ordering rules.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
If a device frequently NAKs, it can exhaust the scheduled handshakes in
a frame. It will then not get polled by the controller until the next
frame interval. This is most noticeable on FS devices as the controller
schedules a small set of transactions only once per full-speed frame.
Setting the ENH_PER_NAK_FS/LS bits in the GUCTL1 register increases the
number of transactions that can be scheduled to Async (Control/Bulk)
endpoints in the respective frame time. In the FS case, this only
applies to FS devices directly connected to root ports.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Add two quirk properties that control whether or not the controller
issues many more handshakes to FS/HS Async endpoints in a single
(micro)frame. Enabling these can significantly increase throughput for
endpoints that frequently respond with NAKs.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
A user has reported that a card of this model from late 2021 doesn't
work, so extend the date range and make it match on all card sizes.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
As a workaround (and possibly a fix) for CPU spins observed on BCM2837,
use ptep_clear_flush_young instead of ptep_test_and_clear_young inside
lru_gen_look_around in order to expose PTE changes to the MMU. Note that
on architectures that don't require an explicit flush,
ptep_clear_flush_young just calls ptep_test_and_clear_young.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Some apps like linpack use numa_setpolicy to disable numa,
but that tends to have a significant performance hit for us.
If you have a cmdline.txt setting of numa_policy (to something other
than default), then lets ignore runtime changes and stick with
the cmdline.txt setting.
Not specifying numa_setpolicy in cmdline, or setting
numa_setpolicy=default(*) will allow runtime settings to work.
(*) easier to do when numa_setpolicy=interleave is set in DT.
Ignore logging for the first 40 seconds as there are some
expected switches during boot.
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
Show process name in set_mempolicy() ignored message
Signed-off-by: Trevor Man <tman_github@trejan.com>
To help work around certain memory controller limitations or similar, a
random NUMA allocation memory policy is added.
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Add iommu_dma_numa_policy= kernel parameter which can be used to modify
the NUMA allocation policy of remapped buffer allocations.
Policy is only used for devices which are not associated with a NUMA node.
Syntax identical to what tmpfs accepts as it's mpol argument is accepted.
Some examples:
iommu_dma_numa_policy=interleave
iommu_dma_numa_policy=interleave=skip-interleave
iommu_dma_numa_policy=bind:0-3,5,7,9-15
iommu_dma_numa_policy=bind=static:1-2
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Add numa_policy kernel argument to allow overriding the kernel's default
NUMA policy at boot time.
Syntax identical to what tmpfs accepts as it's mpol argument is accepted.
Some examples:
numa_policy=interleave
numa_policy=interleave=skip-interleave
numa_policy=bind:0-3,5,7,9-15
numa_policy=bind=static:1-2
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
The i.MX8MP makes calls on it's source device to determine
the link-frequency that should be configured on the CSI2 receiver.
When the source is behind a video mux, we need to pass this call through
to the connected device.
Map the control handler of the source device to the video-mux,
essentially proxying all controls on the mux to the device which has
it's link enabled.
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Add EXPORT_SYMBOL_GPL() for find_cpio_data() so that loadable modules
may also parse uncompressed cpio.
Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
The Sony IMX500 is a stacked 1/2.3-inch CMOS digital image sensor and
inbuilt AI processor with an active array CNN (Convolutional Neural
Network) inference engine. The native sensor size is 4056H x 3040V, and
the module also contains an in-built ISP for the CNN. The module is
programmable through an I2C interface with firmware and neural network
uploads being made over SPI. This driver supports imaging only.
Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
media: i2c: imx500: Inbuilt AI processor support
Add support for the IMX500's inbuilt AI processor. The IMX500 program
loader, AI processor firmware, DNN weights are accessed via the kernel's
firmware interface on 'open' and are transferred to the IMX500 over SPI.
Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
media: i2c: imx500: Enable LED during SPI transfers
The Raspberry Pi 'AI Camera' is equipped with an LED. Enable this LED
during SPI transfers to indicate to the end-user that progress is being
made during large tramsfers.
Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
drivers: media: imx500: Fixes for vblank control
Reduce the default/max framerate of the 2x2 binned mode to 30fps.
The current limit of 50fps can cause the sensor to produce corrupt
frames and cause missing framing events.
Also fixup the vblank control min/max/default/step paramters when
setting up.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: imx500: Simplify the vblank control init
Set the VBLANK control minimum and default values to IMX500_VBLANK_MIN
unconditionally everywhere.
Remove the mode specific framerate_default parameter, it is now unused.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: imx500: Enable LS correction
This correction is calibrated to approx 5000K.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
imx500: Fix for long exposure setup
The IMX500 (unlike the IMX477/IMX708) requires two regsiters to be set
for the exposure shift value to work correctly. The additional register
write (which was missing) is for the integration time shift.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: imx500: Enable sensor temperature monitoring
The register needs to be disabled before loading any firmware, otherwise
the upload fails for unknown reasons. Re-enable before starting the
sensor streaming.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: imx500: Add device id readback control
Add a new custom control V4L2_CID_USER_GET_IMX500_DEVICE_ID to allow
userland to query the device id from the IMX500 sensor eeprom.
Note that this device id can only be accessed when a network firmware
has been upoloaded to the device, so cannot be cached on probe.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: imx500: pm_runtime error paths
This change amends various error-paths in imx500_start_streaming() to
ensure that pm_runtime refcounts do not remain erroneously incremented
on failure.
Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
media: i2c: imx500: GPIO acquire/release semantics
When the imx500 driver is used as part of the 'AI Camera', the poweroff
state is never reached as the camera and gpio driver share a regulator.
By releasing the GPIOs when they are not in use, 'AI Camera' is able to
achieve a powered-down state.
Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
Add YAML device tree binding for the Sony IMX500 CMOS image sensor /
CNN inference engine. Also, add a MAINTAINERS entry.
Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
The check if the oscillator stop bit is set was reading from Control_1
register instead of the Seconds register.
This caused the Seconds register to be incorrectly changed if bit 7 of
Control_1 happens to be set.
Signed-off-by: Axel Hammarberg <axel.hammarberg@gmail.com>
In the same way that other subsystems support the setting of device
id numbers from Device Tree aliases, allow gpiochip numbers to be
derived from "gpiochip<n>" aliases.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The DW SPI interface has a 16-bit clock divider, where the bottom bit
of the divisor must be 0. Limit how low the clock speed can go to
prevent the clock divider from being truncated, as that could lead to
a much higher clock rate than requested.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Ensure the transmit FIFO has emptied before ending the transfer by
dropping the TX threshold to 0 when the last byte has been pushed into
the FIFO. Include a similar fix for the non-IRQ paths.
See: https://github.com/raspberrypi/linux/issues/6285
Fixes: 6014649de7 ("spi: dw: Save bandwidth with the TMOD_TO feature")
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Do an end-run around ASoC in lieu of not being able to easily find the
associated DMA controller capabilities.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
There's no real need to constrain MEM access widths to 32-bit (or
narrower), as the DMAC is intelligent enough to size memory accesses
appropriately. Wider accesses are more efficient.
Similarly, MEM burst lengths don't need to be a function of DEV burst
lengths - the DMAC packs/unpacks data into/from its internal channel
FIFOs appropriately. Longer accesses are more efficient.
However, the DMAC doesn't have complete support for unaligned accesses,
and blocks are always defined in integer multiples of SRC_WIDTH, so odd
source lengths or buffer alignments will prevent wide accesses being
used, as before.
There is an implicit requirement to limit requested DEV read burst
lengths to less than the hardware's maximum configured MSIZE - otherwise
RX data will be left over at the end of a block. There is no config
register that reports this value, so the AXI burst length parameter is
used to produce a facsimile of it. Warn if such a request arrives that
doesn't respect this.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Disabling the peripheral resets controller state which has a dangerous
side-effect of disabling the DMA handshake interface while it is active.
This can cause DMA channels to hang.
The error recovery pathway will wait for DMA to stop and reset the chip
anyway, so mask further FIFO interrupts and let the transfer finish
gracefully.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
TMOD_RO is the receive-only mode that doesn't require data in the
transmit FIFO in order to generate clock cycles. Using TMOD_RO when the
device doesn't care about the data sent to it saves CPU time and memory
bandwidth.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
TMOD_TO is the transmit-only mode that doesn't put data into the receive
FIFO. Using TMOD_TO when the user doesn't want the received data saves
CPU time and memory bandwidth.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The firmware advertises its features as a string of words separated by
spaces. Ensure that feature names are only matched in their entirety.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The snps,block-size DT property declares the maximum block size for each
channel of the dw-axi-dmac. However, the driver ignores these when
setting max_seg_size and uses MAX_BLOCK_SIZE (4096) instead.
To take advantage of the efficiencies of larger blocks, calculate the
minimum block size across all channels and use that instead.
See: https://github.com/raspberrypi/linux/issues/6256
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The Raspberry Pi RP2040 GPIO bridge is an I2C-attached device exposing
both a Tx-only SPI controller, and a GPIO controller.
Due to the relative difference in transfer rates between standard-mode
I2C and SPI, the GPIO bridge makes use of 12 MiB of non-volatile storage
to cache repeated transfers. This cache is arranged in ~8 KiB blocks and
is addressed by the MD5 digest of the data contained therein.
Optionally, this driver is able to take advantage of Raspberry Pi RP1
GPIOs to achieve faster than I2C data transfer rates.
Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
spi: rp2040-gpio-bridge: Add debugfs progress indicator
Useful for tracking upload progress via userspace.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
spi: rp2040-gpio-bridge: add missing MD5 dependency
rp2040-gpio-bridge relies on the md5 crypto driver. This dependency
cannot be determined automatically as rp2040-gpio-bridge does not
use any of md5's symbols directly.
Declare a soft 'pre' dependency on md5 to ensure that it is included and
loaded before rp2040-gpio-bridge.
Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
spi: rp2040-gpio-bridge: fix gpiod error handling
In some circumstances, devm_gpiod_get_array_optional() can return
PTR_ERR rather than NULL to indicate failure. Handle these cases.
Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
spi: rp2040-gpio-bridge: probe: Cfg fast_xfer clk
Fast transfer mode requires that the first bit of data is clocked with a
rising edge. This can cause extra bits of data to be clocked on hardware
where the clock signal uses a pull-up. This change ensures that clk is
driven low before fast data transfer mode is entered.
Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
Offset the backend dev-nodes starting at /dev/video20
onwards to maintain backward compatibility with the
pre-upstreamed kernel driver.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Add helpers to set and get vchiq driver data. vchiq_set_drvdata() and
vchiq_get_drvdata() wraps dev_set_drvdata() and dev_get_drvdata()
respectively.
Signed-off-by: Umang Jain <umang.jain@ideasonboard.com>
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Add version 4.17.1 of the Hailo PCIe device drivers.
Sourced from https://github.com/hailo-ai/hailort-drivers/
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: pcie: hailo: Fix include paths
An attempt to fix the include paths - they look reasonable, but the
GitHub auto-builds fail.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
drivers: media: pci: Update Hailo accelerator device driver to v4.18.0
Sourced from https://github.com/hailo-ai/hailort-drivers/
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: pci: Add wrapper after removal of follow_pfn
drivers: media: pci: Fix Hailo compile warnings
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
drivers: media: pci: Update Hailo accelerator device driver to v4.19
Sourced from https://github.com/hailo-ai/hailort-drivers/
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: pci: Update Hailo accelerator device driver to v4.20
Sourced from https://github.com/hailo-ai/hailort-drivers
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: pci: hailo: Fix kernel warning when calling find_vdma()
Calling this function without holding the mmap_read_lock causes the
kernel to throw an error message, spamming the dmesg logs when running
the Hailo hardware.
Fix it by adding the approprite lock/unlock functions around find_vdma().
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: pci: hailo: Better lock handling when calling find_vdma()
Due to possible instabilities, reduce the mmap read lock time to only
cover the call to find_vdma().
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Pass the DRM connector name to any configured backlight
device so that userspace can associate the two items.
Ideally this should be in drm_panel, but it is bridge/panel
that creates the drm_connector and therefore knows the name.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/bridge: panel: Ensure backlight is reachable
Ensure that the various options of modules vs builtin results
in being able to call into the backlight code.
https://github.com/raspberrypi/linux/issues/6198
Fixes: 573f8fd0ab ("drm/bridge: panel: Name an associated backlight device")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The naming of backlight devices is not terribly useful for
associating a backlight controller with a display (assuming
it is attached to one).
Add a sysfs node that will return a display name that can be set
by other subsystems.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Even when configured to use only gpiod CS lines, the DW SPI controller
still expects a bit to be set in the SER register, otherwise transfers
stall. For the csgpiod case, nominate bit 0 for the job.
See: https://github.com/raspberrypi/linux/issues/6159
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Reverts 8a4b2fc9c9 ("drm/bridge: tc358762: Split register programming from pre-enable to enable")
as we want the config commands sent before video starts.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The autodetection of resolution/timing by the TC358762 can lead
to the display being shifted by a pixel or two.
Program the TC358762 with the requested mode timing so that
it can reproduce it accurately.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
"rotation" is listed as a standard property of panels in panel-common.yaml,
therefore it would be logical to process that from within the core
code should a panel driver not implement the get_orientation hook.
Call of_drm_get_panel_orientation from
drm_connector_set_orientation_from_panel to get that information.
This removes the need for any boiler-plate in panel drivers for calling
drm_connector_set_orientation_from_panel or
drm_connector_set_panel_orientation.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
This code:
for_each_sg(sgl, sg, sg_len, i)
num_sgs += DIV_ROUND_UP(sg_dma_len(sg), axi_block_len);
determines how many hw_desc are allocated.
If sg_dma_len(sg)=0 we don't allocate for this sgl.
However in the next loop, we will increment loop
for this case, and loop gets higher than num_sgs
and we trample memory.
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
Newer versions of the DesignWare I2C block support the detection of
stuck signals, and a mechanism to recover from them. Add the required
software support to the driver.
This change was prompted by the observation that reading a single byte
from register 0 of a VEML7700 seems to cause it to issue an ACK too
early, and the controller to complain about losing arbitration. There
is a suspicion that this may be a more widespread problem, but at least
this patch prevents the bus from locking up.
See: https://github.com/raspberrypi/linux/issues/6057
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Recent Integral cards end up with corrupt sectors after a flash erase.
This covers sizes for the A2 range, which can't be differentiated from
the A1 range which might not have the same issue.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Only CMD38 with Arg=0x1 (Discard) is supported when in CQ mode, so
turn it off before issuing a non-discard erase op.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Cards with manufacture dates in 2019 and 2020 have been seen in the wild
that hang indefinitely if issued a cache flush command in CQ mode.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Samsung EVO Plus, Pro Plus and Evo Ultimate cards of this era appear to
have a broken cache-flush implementation when operating in CQ mode.
Unfortunately the cards seem to use a separate CID name string for every
variant and capacity, so nobble the cache feature for this MANFID, OEMID
and year. Turning this off seems to have negligible impact on
random-write throughput in non-CQ mode.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Posted write tracking introduced in the commit below raced with re-use
of the requests between completion and submission, potentially causing
underflow of the pending write count.
Fixes: e6c1e862b2 ("mmc: restrict posted write counts for SD cards in CQ mode")
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Command Queueing requires Write Cache and Power off Notification support
from the card - but using the write cache forms a contract with the host
whereby the card expects to be told about impending power-down.
The implication is that (for performance) the card can do unsafe things
with pending write data - including reordering what gets committed to
nonvolatile storage at what time.
Exposed SD slots and platforms powered by hotpluggable means (i.e.
Raspberry Pis) can't guarantee that surprise removal won't happen.
To limit the scope for cards to invent new ways to trash filesystems,
limit pending writes to 1 (equivalent to the non-CQ behaviour).
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
fixup: mmc: restrict posted write counts for SD cards in CQ mode
Leaving card->max_posted_writes unintialised was a bad thing to do.
Also, cqe_enable is 1 if hsq is enabled as hsq substitutes the cqhci
implementation with its own.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Recovery claims the MMC card so the card-detect work gets significantly
delayed - leading to lots of error recovery loops that can never do
anything but fail.
Explicitly detect the card after CQE has halted and bail if it's not
there.
Also ratelimit a not-very-descriptive warning - one occurrence in dmesg
is enough to signal that something is amiss.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
If the controller is being reset, then the CQE needs to be reset as well.
For removable cards, CQHCI_SSC1 must specify a polling mode (CBC=0)
otherwise it's possible that the controller stops emitting periodic
CMD13s on card removal, without raising an error status interrupt.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
This gains about 8-12% sequential write speed with the fastest SD/eMMC
cards, and Class A1/A2 card sequential performance is only assured with
a 4MiB write length.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
The attached PHY performs parameter validation, so the switch from HS200
to HS (before selecting HS400/HS400es) with a 200MHz clock fails to
update pad timings and results in CRC errors from the card.
Underclocking the interface is safe, so do that in the downgrade callback.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
The spec allows for up to two 512-byte pages to be allocated for the
Extension Register General Info block, so allocate accordingly.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Don't attempt to turn on CQ if the other mandatory features are not
indicated as supported by the card. Also make sure that the register write
actually stuck, as some cards claim support but never report back that
the queue engine is enabled.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Certain status bits in these registers may need polling outside of
SD-specific code. Export in sd_ops.h
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
The eMMC spec says that in certain circumstances the controller can't
respond to a halt request - in practice, this occurs if a CMD
timeout happens (card went away/crashed).
Clear the halt request by writing 0 to CQHCI_CTL. Also fix a logic error
testing for halt in cqhci_request.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
For unknown reasons the controller seems to reset the idle polling timer
interval on CQE enable/disable to 8 clocks which is extremely short.
Just use the reset value in the eMMC spec (4096 clock periods which at
200MHz is ~20uS).
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Add a LED_FULL trigger equivalent to mmc_start_request() in
mmc_cqe_start_req(), otherwise it stays off forever.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
The Performance Extension register is regularly accessed in a hot path
to do write cache flushes. Don't invoke kmalloc/kfree for every access,
preallocate a 512B buffer for this purpose.
Also remove an unused alloc in sd_enable_cache().
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Application class A2 cards require CQ to be enabled to realise their
stated performance figures. Add support to enable/disable card CQ via
the Performance Enhancement extension register, and cater for the slight
differences in command set versus eMMC.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Commit 7d239fbf9d broke 802.1X authentication by setting
profile->use_fwsup = NONE whenever PSK is not used. However
802.1X does not use PSK and requires profile->use_fwsup set
to 1X, or brcmf_cfg80211_set_pmk() fails. Fix this by checking
that profile->use_fwsup is not already set to 1X and avoid
setting it to NONE in that case.
Fixes: 7d239fbf9d (brcmfmac: Fix interoperating DPP and other encryption network access)
Fixes: https://github.com/raspberrypi/linux/issues/5964
1. If firmware supports 4-way handshake offload but not supports DPP
4-way offload, when user first connects encryption network, driver will
set "sup_wpa 1" to firmware, but it will further result in DPP
connection failure since firmware won't send EAPOL frame to host.
2. Fix DPP AP mode handling action frames.
3. For some firmware without fwsup support, the join procedure will be
skipped due to "sup_wpa" iovar returning not-support. Check the fwsup
feature before do such iovar.
Signed-off-by: Kurt Lee <kurt.lee@cypress.com>
Signed-off-by: Double Lo <double.lo@cypress.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
In deep sleep mode (DS1) ARM is off and once exit trigger comes than
mailbox Interrupt comes to host and whole reinitiation should be done
in the ARM to start TX/RX.
Also fix below issus for DS1 exit:
1. Sent Tx Control frame only after firmware redownload complete (check
F2 Ready before sending Tx Control frame to Firmware)
2. intermittent High DS1 TX Exit latency time (almost 3sec) ==> This is
fixed by skipping host Mailbox interrupt Multiple times (ulp state
mechanism)
3. RX GlOM save/restore in Firmware
4. Add ULP event enable & event_msgs_ext iovar configuration in FMAC
5. Add ULP_EVENT_RECV state machine for sbwad support
6. Support 2 Byte Shared memory read for DS1 Exit HUDI implementation
Signed-off-by: Praveen Babu C <pucn@cypress.com>
Signed-off-by: Naveen Gupta <nagu@cypress.com>
[Merge from 4.14.77 to 5.4.18; set BRCMF_SDIO_MAX_ACCESS_ERRORS to 20]
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
JIRA: SWWLAN-135583
JIRA: SWWLAN-136577
i2c_mux_add_adapter takes a force_nr parameter that allows an explicit
bus number to be associated with a channel. However, only i2c-mux-reg
and i2c-mux-gpio make use of it.
To help with situations where it is desirable to have a fixed, known
base address for the channels of a mux, create a "base-nr" property.
When force_nr is 0 and base-nr is set and non-zero, form a force_nr
value from the sum of base-nr and the channel ID.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
This patch adds the device ID for the BCM4343A2 module, found e.g. in
the Infineon (Cypress) CYW43439 chip. The required firmware file is
named 'BCM4343A2.hcd'.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
If enabled, DMA_BOUNCE_UNALIGNED_KMALLOC causes the swiotlb buffers
(64MB, by default) to be allocated, even on systems where the DMA
controller can reach all of RAM. This is a huge amount of RAM to
waste on a device with only 512MB to start with, such as the Zero 2 W.
See: https://github.com/raspberrypi/linux/issues/5975
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Add support for non-standard bus speeds by treating them as detuned
versions of the slowest standard speed not less than the requested
speed.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Calculate the HCNT and LCNT values for all modes using the rise and
fall times of SCL, the aim being a 50/50 mark/space ratio.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
There are three parkmode disable bits, one for each bus instance type.
Add FS/LS and parse the quirk out of DT. Also update the slightly
mangled quirk descriptions.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
There are three disable bits, one for each bus-instance type. Add a
quirk to cover the FS/LS type, and update the slightly mangled quirk
descriptions in the process.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
The forced conversion of native CS lines into software CS lines is done
whether or not the controller has been given any CS lines to use. This
breaks the use of the spi0-0cs overlay to prevent SPI from claiming any
CS lines, particularly with spidev which doesn't pass in the SPI_NO_CS
flag at creation.
Use the presence of an empty cs-gpios property as an indication that no
CS lines should be used, bypassing the native CS conversion code.
See: https://github.com/raspberrypi/linux/issues/5835
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
For CSI2 receivers that need to know the link frequency,
add it as a control to the driver.
Interlaced modes are 216Mbp/s or 108MHz, whilst going through
the I2P to deinterlace gives 432Mb/s or 216MHz.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
CSI2 devices are meant to use the 1Xnn formats rather than 2Xnn
such as MEDIA_BUS_FMT_UYVY8_2X8.
For devices with ADV7180_FLAG_MIPI_CSI2 set, use
MEDIA_BUS_FMT_UYVY8_1X16.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Pi 5 uses BL31 as its armstub file, so the reset goes via PSCI. Parse
any "reboot" parameter as a partition number to reboot into.
N.B. This code path is only used if reboot mode has been set to warm
or soft.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Add support for the ROHM BU64754 Motor Driver for Camera Autofocus. A
V4L2 Subdevice is registered and provides a single
V4L2_CID_FOCUS_ABSOLUTE control.
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Commit 7cd70656d1 ("drm/bridge: display-connector: implement
bus fmts callbacks") added use of drm_atomic_helper_bridge_*
functions, but didn't select the dependency of DRM_KMS_HELPER.
If nothing else selected that dependency it resulted in a
build failure.
Select the missing dependency.
Fixes: 7cd70656d1 ("drm/bridge: display-connector: implement bus fmts callbacks")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The mainline driver has implemented analogue gain using the control
V4L2_CID_GAIN instead of V4L2_CID_ANALOGUE_GAIN.
libcamera requires V4L2_CID_ANALOGUE_GAIN, and therefore fails.
Update the driver to use V4L2_CID_ANALOGUE_GAIN.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Step wise governor increases the mitigation level when the temperature
goes above a threshold and will decrease the mitigation when the
temperature falls below the threshold. If it were a case, where the
temperature hovers around a threshold, the mitigation will be applied
and removed at every iteration. This reaction to the temperature is
inefficient for performance.
The use of hysteresis temperature could avoid this ping-pong of
mitigation by relaxing the mitigation to happen only when the
temperature goes below this lower hysteresis value.
Signed-off-by: Ram Chandrasekar <rkumbako@codeaurora.org>
Signed-off-by: Lina Iyer <ilina@codeaurora.org>
drivers: thermal: step_wise: avoid throttling at hysteresis temperature after dropping below it
Signed-off-by: Serge Schneider <serge@raspberrypi.org>
Fix hysteresis support in gov_step_wise.c
Directly get hyst value instead of going through an
optional and, now, unimplemented function.
Signed-off-by: Jürgen Kreileder <jk@blackdown.de>
Users have reported log spam created by "Event Ring Full" xHC event
TRBs. These are caused by interrupt latency in conjunction with a very
busy set of devices on the bus. The errors are benign, but throughput
will suffer as the xHC will pause processing of transfers until the
event ring is drained by the kernel. Expand the number of event TRB slots
available by increasing the number of event ring segments in the ERST.
Controllers have a hardware-defined limit as to the number of ERST
entries they can process, so make the actual number in use
min(ERST_MAX_SEGS, hw_max).
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
With the new support for a chain of sys_off handlers, gpio-poweroff
does not disable a normal shutdown (though it does delay it). There
is therefore no need for the noisy WARN from the kernel.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Certain controllers (dwc-mshc) generate timeout conditions separately to
command-completion conditions, where the end result is interrupts are
separated in time depending on the current SDCLK frequency.
This causes spurious interrupts if SDCLK is slow compared to the CPU's
ability to process and return from interrupt. This occurs during card
probe with an empty slot where all commands that would generate a
response time out.
Add a quirk to squelch command response interrupts when a command
timeout interrupt is received.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
For situations where there are multiple DRM cards in a system,
add a query of DT for "drm_fb" designations for cards to set
their preferred /dev/fbN designation.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/fb_helper: Change query for FB designation from drm_fb to drm-fb
Fixes: 1216ea56c2 ("drm/fb-helper: Look up preferred fbdev node number from DT")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Add a flag custom_fb_num to denote that the client has
requested a specific fbdev node number via node.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Vision Components have made an OV9281 module which blocks reading
back the majority of registers to comply with NDAs, and in doing
so doesn't allow auto-increment register reading as used when
reading the chip ID.
Use two reads and manually combine the results.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Add binding for the new RTC driver for Raspberry Pi.
This platform has an RTC managed by firmware, and this RTC
driver provides the simple mailbox interface to access it.
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
dt: bindings: update rpi-rtc binding
Add property for bcm2712 firmware RTC driver charger control
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
This supports setting and reading the real time clock
and supports wakeup alarms.
To support wake up alarms you want this bootloader config:
POWER_OFF_ON_HALT=1
WAKE_ON_GPIO=0
You can test with:
echo +600 | sudo tee /sys/class/rtc/rtc0/wakealarm
sudo halt
That will halt (in an almost no power state),
then wake and restart after 10 minutes.
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
drivers: rtc-rpi: add battery charge circuit control and readback
Parse devicetree for a charger voltage and apply it. If nonzero and a
valid voltage, the firmware will enable charging, otherwise the charger
circuit is disabled.
Add sysfs attributes to read back the supported charge voltage range,
the measured battery voltage, and the charger setpoint.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
We currently see these regularly:
[ 25.157560] irq 31, desc: 00000000c15e6d2c, depth: 0, count: 0, unhandled: 0
[ 25.164658] ->handle_irq(): 00000000b1775675, brcmstb_l2_intc_irq_handle+0x0/0x1a8
[ 25.172352] ->irq_data.chip(): 00000000fea59f1c, gic_chip_mode1+0x0/0x108
[ 25.179166] ->action(): 000000003eda6d6f
[ 25.183096] ->action->handler(): 000000002c09e646, bad_chained_irq+0x0/0x58
[ 25.190084] IRQ_LEVEL set
[ 25.193142] IRQ_NOPROBE set
[ 25.196198] IRQ_NOREQUEST set
[ 25.199255] IRQ_NOTHREAD set
with:
$ cat /proc/interrupts | grep 31:
31: 1 0 0 0 GICv2 129 Level (null)
The interrupt is described in DT with IRQ_TYPE_LEVEL_HIGH
But the current compatible string uses the controller in edge triggered mode
(as that config matches our register layout).
Add a new compatible structure for level driven interrupt with our register layout.
We had already been using this compatible string in device tree, so no change needed
there.
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
Add a driver for BCM2712 IOMMUs.
There is a small driver for the Shared IOMMU TLB Cache.
Each IOMMU instance is a separate device.
IOMMUs are set up with a "pass-through" range covering
the lowest 40BGytes (which should cover all of SDRAM)
for the benefit of non-IOMMU-aware devices that share
a physical IOMMU; and translation for addresses in the
range 40GB to 42GB.
An optional parameter adds a DMA offset (which otherwise
would be lost?) to virtual addresses for DMA masters on a
bus such as PCIe.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
iommu: bcm2712-iommu: Map and unmap multiple pages in a single call
For efficiency, the map_pages() and unmap_pages() calls now pay
attention to their "count" argument.
Remove a special case for a "pass-through" address range, which
the DMA/IOMMU subsystem isn't told exists and should never use.
Fix a bug where we omitted to set *mapped to 0 in error cases.
Minor style fixes and tidying.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
iommu/bcm2712: don't allow building as module
Since bcm2712-iommu{,-cache}.c doesn't have usual module descriptors
such as `MODULE_LICENSE`, configuring this as 'M' fails the build with
`ERROR: modpost: missing MODULE_LICENSE() in <...>/bcm2712-iommu.o`.
Since it seems like the code is not intended to be built as a module
anyway (it registers the driver with `builtin_platform_driver()`), don't
allow building this code as a module.
Signed-off-by: Ratchanan Srirattanamet <peathot@hotmail.com>
iommu: bcm2712-iommu: Add locking; fix address offset; tidy
- Now using spin_lock_irqsave in map, unmap, sync and iova_to_phys.
- Simplify bounds checks as all allocations should be in aperture.
- Use iommu_iotlb_gather_add_range(); NB gather range is inclusive.
- Fix missing address offset in bcm2712_iommu_sync_all.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
The BCM2712 has a DMA-Lite controller that is basically a BCM2835-style
DMA controller that supports 40 bits DMA addresses.
We need it for HDMI audio to work, but this breaks BCM2835-38 so we
should rework this later.
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
dmaengine: bcm2835: Fix dma driver for BCM2835-38
The previous commit broke support on older devices.
Make the breaking parts of patch conditional on
the device being used.
Fixes: 6e1856ac7c39 ("dmaengine: bcm2835: HACK: Support DMA-Lite channels")
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
BCM2712 has 6 40-bit channels - DMA6 to DMA11. Add a new compatible
string to indicate that the current platform is BCM2712.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Formerly the delay was omitted as bit-banged SPI seldom achieved
even one Mbit/s; but some modern platforms can run faster, and
some SPI devices may need to be clocked slower.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
Formerly, if configured using DT, CS GPIOs were driven from spi.c
and it was possible for CS to be asserted (low) *before* starting
to drive SCK. CS GPIOs have been brought under control of this
driver in both ACPI and DT cases, with a fixup for GPIO polarity.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
BCM2712 has a PM block but neither ASB nor RPIVID_ASB. Use the absence
of the "asb" register range to indicate BCM2712 and its different PM
register range.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
BCM2712 lacks the "asb" and "rpivid_asb" register ranges, but still
requires the use of the bcm2835-power driver to reset the V3D block.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
drivers: hwmon: rp1-adc: check conversion validity before supplying value
The SAR ADC architecture may complete a conversion but instability in the
comparator can corrupt the result. Such corruption is signalled in the CS
ERR bit, asserted alongside each conversion result.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Add optional properties to tune the AXI interface -
cdns,aw2w-max-pipe, cdns,ar2r-max-pipe and cdns,use-aw2b-fill.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
This supports reading and writing OTP using the firmware
mailbox interface.
It needs supporting firmware to run.
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
Add support for the RP1 VEC hardware.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm: rp1: rp1-vec: Allow non-standard modes with various crops
Tweak sync timings in the advertised modelines.
Accept other, custom modes, provided they fit within the active
area of one of the existing hardware-supported TV modes.
Instead of always padding symmetrically, try to respect the user's
[hv]sync_start values, allowing the image to be shifted around
the screen (to fine-tune overscan correction).
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm/rp1: depends on, instead of select, MFD_RP1
According to kconfig-language.txt [1], select should be used only for
"non-visible symbols ... and for symbols with no dependencies". Since
MFD_RP1 both is visible and has a dependency, "select" should not be
used and "depends on" should be used instead.
In particular, this fixes the build of this kernel tree on NixOS, where
its kernel config system will try to answer 'M' to as many config as
possible.
[1] https://www.kernel.org/doc/html/latest/kbuild/kconfig-language.html
Signed-off-by: Ratchanan Srirattanamet <peathot@hotmail.com>
drm: rp1: Use tv_mode from the command line and fix for Linux 6.6
Use the standard enum drm_connector_tv_mode instead of a private
enum and switch from the legacy to the standard tv_mode property.
Remove the module parameter "tv_norm". Instead, get tv_mode from
the command line and make this the connector's default TV mode.
Don't restrict the choice of modes based on tv_mode, but interpret
nonstandard combinations as NTSC or PAL, depending on resolution.
Thus the default tv_mode=NTSC effectively means "Auto".
Tweak the advertised horizontal timings for 625/50 to match Rec.601
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm: rp1: VEC and DPI drivers: Fix bug #5901
Rework probe() to use devm_drm_dev_alloc(), embedding the DRM
device in the DPI or VEC device as now seems to be recommended.
Change order of resource allocation and driver initialization.
This prevents it trying to write to an unmapped register during
clean-up, which previously could crash.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm: rp1: vec: Support more video modes in the RP1 VEC driver
Support a wider range of pixel clock rates. The driver will round
pixclock up to 108MHz/n but tries to honour the desired image width
and position (of the centre of the display relative to HSYNC_STARTs).
This adds complexity but removes the need for separate 13.5MHz and
15.428MHz modes.
Support "fake" double-rate progressive modes (in which only every
2nd scanline is displayed). To work around aspect ratio issues.
Add Monochrome TV mode support. Add "vintage" modes (544x380i for
System A; 848x738i for System E) when configured for Monochrome.
Add a way to create a "custom" display mode from a module parameter.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm: rp1: rp1-vec: Add DRM_FORMAT_ARGB8888 and DRM_FORMAT_ABGR8888
Android requires this.
As the underlying hardware doesn't support alpha blending,
we ignore the alpha value.
Signed-off-by: Jan Kehren <jan.kehren@emteria.com>
drivers: drm: rp1-vec: Increase width limit, for PAL 16:9 @ 18MHz
There was no technical reason for the DRM mode's width limit of 848;
increase it to 960 (720*18MHz/13.5MHz) to support ~square pixels on
16:9 screens. Tweak the PAL active window to start slightly earlier.
(The maximum number of visible columns at 18MHz is about 942.)
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm/vc4: Make VEC progressive modes readily accessible
Add predefined modelines for the 240p (NTSC) and 288p (PAL) progressive
modes, and report them through vc4_vec_connector_get_modes().
Signed-off-by: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
drm/rp1-vec: Run DRM default client setup
Call drm_client_setup() to run the kernel's default client setup
for DRM. Set fbdev_probe in struct drm_driver, so that the client
setup can start the common fbdev client.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm: rp1: Enable VEC->GPIO output; cosmetic change to registers
In the VEC driver, enable mapping VEC (not DPI) to DPI GPIOs.
This is to support VEC output over GPIO on Raspberry Pi CM5.
It is harmless as DPI and VEC could not be used concurrently,
and the output is anyway conditional on pinctrl.
Also, tweak the style of VIDEO_OUT_CFG register definitions
(in both DPI and VEC drivers) to be more Linux-friendly.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
Add support for the RP1 DPI hardware.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm/rp1: depends on, instead of select, MFD_RP1
According to kconfig-language.txt [1], select should be used only for
"non-visible symbols ... and for symbols with no dependencies". Since
MFD_RP1 both is visible and has a dependency, "select" should not be
used and "depends on" should be used instead.
In particular, this fixes the build of this kernel tree on NixOS, where
its kernel config system will try to answer 'M' to as many config as
possible.
[1] https://www.kernel.org/doc/html/latest/kbuild/kconfig-language.html
Signed-off-by: Ratchanan Srirattanamet <peathot@hotmail.com>
drm: rp1: VEC and DPI drivers: Fix bug #5901
Rework probe() to use devm_drm_dev_alloc(), embedding the DRM
device in the DPI or VEC device as now seems to be recommended.
Change order of resource allocation and driver initialization.
This prevents it trying to write to an unmapped register during
clean-up, which previously could crash.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm: rp1: dpi: Add support for MEDIA_BUS_FMT_RGB565_1X24_CPADHI
This new format corresponds to the Raspberry Pi legacy DPI mode 3.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm: rp1: rp1-dpi: Add DRM_FORMAT_ARGB8888 and DRM_FORMAT_ABGR8888
Android requires this.
As the underlying hardware doesn't support alpha blending,
we ignore the alpha value.
Signed-off-by: Jan Kehren <jan.kehren@emteria.com>
drm: rp1: rp1-dpi: Add interlaced modes and PIO program to fix VSYNC
Implement interlaced modes by wobbling the base pointer and VFP width
for every field. This results in correct pixels but incorrect VSYNC.
Now use PIO to generate a fixed-up VSYNC by sampling DE and HSYNC.
This requires DPI's DE output to be mapped to GPIO1, which we check.
When DE is not exposed, the internal fixup is disabled. VSYNC/GPIO2
becomes a modified signal, designed to help an external device or
PIO program synthesize CSYNC or VSYNC.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm: rp1: rp1-dpi: Fix optional dependency on RP1_PIO
Add optional dependency to Kconfig, and conditionally compile
PIO-dependent code. Add a mode validation function to reject
interlaced modes when RP1_PIO is not present.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm: rp1: rp1-dpi: Add "rgb_order" property (to match VC4 DPI)
As on VC4, the OF property overrides the order implied by media
bus format. Only 4 of the 6 possible orders are supported. New
add-on hardware designs should not rely on this "legacy" feature.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm/rp1: DPI interlace: Improve precision of PIO-generated VSYNC
Instead of trying to minimize the delay between seeing HSYNC edge
and asserting VSYNC, try to predict the next HSYNC edge precisely.
This eliminates the round-trip delay but introduces mode-dependent
rounding error. HSYNC->VSYNC lag reduced from ~30ns to -5ns..+10ns
(plus up to 5ns synchronization jitter as before).
This may benefit e.g. SCART HATs, particularly those that generate
Composite Sync using a XNOR gate.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm/rp1-dpi: Run DRM default client setup
Call drm_client_setup() to run the kernel's default client setup
for DRM. Set fbdev_probe in struct drm_driver, so that the client
setup can start the common fbdev client.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/rp1/rp1_dpi: Move Composite Sync generation into the kernel
Move RP1 DPI's PIO-assisted Composite Sync generation code,
previously released as a separate utility, into the kernel driver.
There are 3 variants for progressive, generic interlaced and TV-
style interlaced CSync, alongside the existing VSync fixup.
Check that all of GPIOs 1-3 are mapped to DPI, so PIO won't try
to snoop on a missing output, or override another device's pins.
Add "force_csync" module parameter, for convenience of testing,
as few tools can set DRM_MODE_FLAG_CSYNC.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
drm: rp1: Enable VEC->GPIO output; cosmetic change to registers
In the VEC driver, enable mapping VEC (not DPI) to DPI GPIOs.
This is to support VEC output over GPIO on Raspberry Pi CM5.
It is harmless as DPI and VEC could not be used concurrently,
and the output is anyway conditional on pinctrl.
Also, tweak the style of VIDEO_OUT_CFG register definitions
(in both DPI and VEC drivers) to be more Linux-friendly.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
Add support for the RP1 DSI hardware.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm/rp1: depends on, instead of select, MFD_RP1
According to kconfig-language.txt [1], select should be used only for
"non-visible symbols ... and for symbols with no dependencies". Since
MFD_RP1 both is visible and has a dependency, "select" should not be
used and "depends on" should be used instead.
In particular, this fixes the build of this kernel tree on NixOS, where
its kernel config system will try to answer 'M' to as many config as
possible.
[1] https://www.kernel.org/doc/html/latest/kbuild/kconfig-language.html
Signed-off-by: Ratchanan Srirattanamet <peathot@hotmail.com>
DRM: rp1: rp1-dsi: Fix escape clock divider and timeouts.
Escape clock divider was fixed at 5, which is correct at 800Mbps/lane
but increasingly out of spec for higher rates. Compute it correctly.
High speed timeout was fixed at 5*512 == 2560 byte-clocks per lane.
Compute it conservatively to be 8/7 times the line period (assuming
there will be a transition to LP some time during each scanline?)
keeping the old value as a lower bound. Increase LPRX TO to 1024,
and BTA TO to 0xb00 (same value as in bridge/synopsys/dw-mipi-dsi).
(No change to LP_CMD_TIM. To do: compute this correctly.)
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm: rp1: rp1-dsi: Switch to PLL_SYS source for DPI when 8 * lanes > bpp
To support 4 lanes, re-parent DPI clock source between DSI byteclock
(using the new "variable sources" defined in clk-rp1) and PLL_SYS.
This is to cover cases in which byteclock < pixclock <= 200MHz.
Tidying: All frequencies now in Hz (not kHz), where DSI speed is now
represented by byteclock to simplify arithmetic. Clamp DPI and byte
clocks to their legal ranges; fix up HSTX timeout to avoid an unsafe
assumption that it would return to LP state for every scanline.
Because of RP1's clock topology, the ratio between DSI and DPI clocks
may not be exact with 3 or 4 lanes, leading to slightly irregular
timings each time DSI switches between HS and LP states. Tweak to
inhibit LP during Horizontal BP when sync pulses were requested.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm: rp1: rp1-dsi: Add DRM_FORMAT_ARGB8888 and DRM_FORMAT_ABGR8888
Android requires this.
As the underlying hardware doesn't support alpha blending,
we ignore the alpha value.
Signed-off-by: Jan Kehren <jan.kehren@emteria.com>
drivers: drm: rp1-dsi: Implement more DSI options and flags
Now implementing:
- Per-command selection of LP or HS for commands (previously LP)
- EoTp transmission option (previously EoTp was always disabled)
- Non-continuous clock option (previously always continuous)
- Per-command enabling of ACK request (in command mode only)
Make a plausible (and possibly correct) attempt to measure the
longest LP command that will fit into vertical blanking lines.
DON'T set both "Burst Mode" and "Sync Events" flags together.
This is redundant in the standard IP; in this RP1 variant it
would enable Sync Pulses but may break with some video timings.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
drm/rp1-dsi: Run DRM default client setup
Call drm_client_setup() to run the kernel's default client setup
for DRM. Set fbdev_probe in struct drm_driver, so that the client
setup can start the common fbdev client.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Don't assume that DMA addresses of devices are the same as their
physical addresses - convert correctly.
The CFG2 register layout is used when there are more than 8 channels,
but also when configured for more than 16 target peripheral devices
because the index of the handshake signal has to be made wider.
Reset the DMAC on probe
The driver goes to the trouble of tracking when transfers have been
paused, but then doesn't report that state when queried.
Not having APB registers is not an error - for most use cases it's
not even of interest, it's expected. Demote the message to debug level,
which is disabled by default.
Each channel has a descriptor pool, which is shared between transfers.
It is unsafe to treat the total number of descriptors allocated from a
pool as the number allocated to a specific transfer; doing so leads
to releasing buffers that shouldn't be released and walking off the
ends of descriptor lists. Instead, give each transfer descriptor its
own count.
Support partial transfers:
Some use cases involve streaming from a device where the transfer only
proceeds when the device's FIFO occupancy exceeds a certain threshold.
In such cases (e.g. when pulling data from a UART) it is important to
know how much data has been transferred so far, in order that remaining
bytes can be read from the FIFO directly by software.
Add the necessary code to provide this "residue" value with a finer,
sub-transfer granularity.
In order to prevent the occasional byte getting stuck in the DMA
controller's internal buffers, restrict the destination memory width
to the source register width.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
dmaengine: dw-axi-dmac: Fix a non-atomic update
dw_axi_dma_interrupt disables interrupts for the duration of the channel
handling. It does so by clearing a bit in the DMA_CFG register - an
action that involves a read-modify-write. That in itself would be safe
because there will be no further interrupts, hence no reentrancy, were
it the only bit of code accessing that register.
The only neighbour of INT_EN is DMAC_EN - the main enable for the block.
That's not the sort of thing you would expect to be modified during the
normal course of operation, but bizarrely it is set at the start of the
transfer of every block, in axi_chan_block_xfer_star, by a call to
axi_dma_enable. This can lead to INT_EN being accidentally cleared,
which causes all DMA transfers to time out.
One might think that the enabling was being delayed until the first
transfer, but the probe function calls axi_dma_resume which in turn
calls axi_dma_enable, so that isn't the case.
Fix the atomicity problem by removing the spurious call to
axi_dma_enable.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The SMBUS emulation code turns an SMBUS quick command into a zero-
length read. This controller can't do zero length accesses, but it
can do quick commands, so reverse the emulation. The alternative
would be to properly implement the SMBUS support but that is a lot
more work, and unnecessary just to get i2cdetect working.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Signed-off-by: Liam Fraser <liam@raspberrypi.com>
mmc: sdhci-of-dwcmshc: rp1 sdio changes
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
drivers: mmc: sdhci-of-dwcmshc: add RP1 dt ID and quirks
Differentiate the RP1 variant of the Designware MSHC controller(s).
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ARM: pl011: Add rs485 to the RP1 support
pl011_axi_probe, added for RP1 support, lacks the rs485 additions that
appeared during its development.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
tty/serial: pl011: restrict RX burst FIFO threshold
If the associated DMA controller has lower burst length support than the
level the FIFO is set to, then bytes will be left in the RX FIFO at the
end of a DMA block - requiring a round-trip through the timeout interrupt
handler rather than an end-of-block DMA interrupt.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
tty/serial: pl011: Also unregister pl011_axi_platform_driver
See: https://github.com/raspberrypi/linux/issues/6379
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
dwc3 allocates scratch and event buffers in the top-level driver. Hack the
probe function to set the DMA mask before trying to allocate these.
I think the event buffers are only used in device mode, but the scratch
buffers may be used if core hibernation is enabled.
usb: dwc3: add support for new DT quirks
Apply the optional axi-pipe-limit and dis-in-autoretry-quirk properties
during driver probe.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
phy: phy-brcm-usb: Add 2712 support
usb: dwc3: if the host controller instance number is present in DT, use it
If two instances of a dwc3 host controller are specified in devicetree,
then the probe order may be arbitrary which results in the device names
swapping on a per-boot basis.
If a "usb" alias with the instance number is specified, then use
that to construct the device name instead of autogenerating one.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
rp1 dwc3 changes
drivers: usb: dwc3: allow setting GTXTHRCFG on dwc_usb3.0 hardware
Equivalent register fields exist in the SuperSpeed Host version of the
hardware, so allow the use of TX thresholds if specified in devicetree.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
drivers: usb: dwc3: remove downstream quirk dis-in-autoretry
Upstream have unilaterally disabled the feature.
Partially reverts 6e9142a26ee0fdc3a5adc49ed6cedc0b16ec2ed1 (downstream)
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
macb: Add device tree properties that allow configuration of the AXI max pipeline register
net: macb: add support for ethtool interrupt moderation configuration
Only global throttling of rx or tx by time quanta is supported.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
macb: add platform device shutdown function. Prevents AXI master over PCIE from hanging when the host is rebooted.
net: macb: increase polling interval for MDIO completion
MDIO is a slow bus (single-digit MHz). Polling at 1us intervals
is a bit aggressive, so increase to 100us as the transaction
usually takes 100-200us to complete.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
net: macb: Several patches for RP1
64-bit RX fix
Also set DMA coherent mask
Add device tree properties that allow configuration of the AXI max
pipeline register
Add support for ethtool interrupt moderation configuration
Only global throttling of rx or tx by time quanta is supported.
Add platform device shutdown function. Prevents AXI master over PCIE
from hanging when the host is rebooted.
Increase polling interval for MDIO completion
MDIO is a slow bus (single-digit MHz). Polling at 1us intervals
is a bit aggressive, so increase to 100us as the transaction
usually takes 100-200us to complete.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
net: macb: Support the phy-reset-gpios property
Allow a PHY to be reset with an optional GPIO. The reset duration can
be specified in milliseconds - the default is 10ms.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
drivers: net: macb: close device on driver shutdown
Fix some suspicious locking and instead call into macb_close, which
deregisters and frees all resources the corresponding macb_open
claimed.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
net: macb: add hack to prevent TX stalls in a quiet system
See https://github.com/raspberrypi/linux-2712/issues/89
There is some critical window during TX where a further write to the
TSTART bit while TX is active does not cause newly queued TX descriptors
to be consumed.
For now "wait a bit, then try anyway" seems to work.
Requires further investigation, but this unsticks NFS reliably.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
net: macb: set default interrupt moderation for GEM hardware
Defaulting to intmod = 0 is antisocial, as the MAC can generate over
130,000 interrupts per second. 50us is a sensible default.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
reset_control_reset should not be used with shared reset controllers.
Add support for reset_control_assert and _deassert to get the desired
behaviour and avoid ugly warnings in the kernel log.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
BCM2712 has an SD Express capable SDHCI implementation and uses
the SDIO CFG register block present on other STB chips.
Add plumbing for SD Express handover and BCM2712-specific functions.
Due to the common bus infrastructure between BCM2711 and BCM2712,
the driver also needs to implement 32-bit IO accessors.
mmc: brcmstb: override card presence if broken-cd is set
Not just if the card is declared as nonremovable.
sdhci: brcmstb: align SD express switchover with SD spec v8.00
Part 1 of the Physical specification, figure 3-24, details the switch
sequence for cards initially probed as SD. Add a missing check for DAT2
level after switching VDD2 on.
sdhci: brcmstb: clean up SD Express probe and error handling
Refactor to avoid spurious error messages in dmesg if the requisite SD
Express DT nodes aren't present.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
mmc: sdhci-brcmstb: only use the delay line PHY for tuneable speeds
The MMC core has a 200MHz core clock which allows the use of DDR50 and
below without incremental phase tuning. SDR50/SDR104 and the EMMC HS200
speeds require tuning.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
mmc: sdhci-brcmstb: remove 32-bit accessors for BCM2712
The reason for adding these are lost to the mists of time (and for a
previous chip revision). Removing these accessors appears to have no ill
effect on production chips, so get rid of the unnecessary RMW cycles.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
drivers: mmc: sdhci-brcmstb: fix usage of SD_PIN_SEL on BCM2712
The SDIO_CFG register SD_PIN_SEL conflates two settings - whether eMMC
HS or SD UHS timings are applied to the interface, and whether or not
the card-detect line is functional. SD_PIN_SEL can only be changed when
the SD clock isn't running, so add a bcm2712-specific clock setup.
Toggling SD_PIN_SEL at runtime means the integrated card-detect feature
can't be used, so this controller needs a cd-gpios property.
Also fix conditionals for usage of the delay-line PHY - no-1-8-v will
imply no bits set in hsemmc_mask or uhs_mask, so remove it.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
drivers: sdhci-brcmstb: set CQE timer clock frequency
CQHCI keeps track of tags in flight with internal timers, so the clock
frequency driving the timer needs to be specified. The config registers
default to 0 (100kHz) which means timeouts will be significantly shorter
than they should be. Assume the timer clock comes from the controller
base clock.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
pinctrl: bcm2712: Reject invalid pulls
Reject attempts to set pulls on aon-sgpios, and fix pull shift
values.
pinctrl: bcm2712: Add 7712 support, fix 2712 count
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
pinctrl-bcm2712: add EMMC pins so pulls can be set
These pins have pad controls but not mux controls. They look enough like
GPIOs to squeeze in at the end of the list though.
pinctrl: bcm2712: correct BCM2712C0 AON_GPIO pad pull control offset
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
pinctrl: bcm2712: on C0 the regular GPIO pad control register moves too
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
pinctrl: bcm2712: Implement (partially) pinconf_get
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
pinctrl: bcm2712: Convert to generic pinconf
Remove the legacy brcm,* pin configuration support and replace it with
a proper generic pinconf interface, using named functions instead of
alt function numbers. This is nicer for users, less error-prone, and
immune to some of the C0->D0 changes.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
pinctrl: bcm2712: Remove vestigial pull parameter
Now the legacy brcm, pinconf parameters are no longer supported, this
custom pin config parameter is not needed.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
pinctrl: bcm2712: Guard against bad func numbers
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
pinctrl: bcm2712: A better attempt at D0 support
The BCM2712D0 sparse pinctrl maps play havoc with the old GPIO_REGS
macro, so make the bit positions explicit. And delete the unwanted
GPIO and pinmux declarations on D0.
Note that a Pi 5 with D0 requires a separate DTS file with "bcm2712d0"
compatible strings.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
pinctrl: bcm2712: Delete base register constants
BCM2712D0 deletes many GPIOs and their associated mux and pad bits,
so much so that the offsets to the start of the pad control registers
changes. Remove the constant offsets from the *GPIO_REGS macros,
compensating by adjusting the per-GPIO values.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
pinctrl: bcm2712: Fix for sparse GPIOs
BCM2712D0's sparse GPIO map revealed that it is not safe to treat
group_selector as the GPIO number - it is an index into the array of
pinctrl_pin_descs, and the "number" member says which GPIO it refers to.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
pinctrl: bcm2712: Fix for the first valid GPIO
A non-zero mux bit number is used to detect a valid entry in the
pin_regs tables, but GPIO 0 (GPIO 1 on D0) is a valid GPIO with a mux
bit number of zero, so add a high-bit on all valid entries to
distinguish this from an uninitialised row in the table.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
drivers: pinctrl: add BCM2712D0 EMMC pins
The pad control registers are concatenated onto the GPIO pad control
registers, as with previous steppings.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
gpio-brcmstb: Report the correct bank width
gpio: brcmstb: Use bank address as gpiochip label
If the path to the device node is used as gpiochip label then
gpio-brcmstb instances with multiple banks end up with duplicated
names. Instead, use a combination of the driver name with the physical
address of the bank, which is both unique and helpful for devmem
debugging.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
gpio: mmio: Add DIRECT mode for shared access
The generic MMIO GPIO library uses shadow registers for efficiency,
but this breaks attempts by raspi-gpio to change other GPIOs in the
same bank. Add a DIRECT mode that makes fewer assumptions about the
existing register contents, but note that genuinely simultaneous
accesses are likely to lose updates.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
gpio: brcmstb: Don't always clear interrupt mask
If the GPIO controller is not being used as an interrupt source
leave the interrupt mask register alone. On BCM2712 it might be used
to generate interrupts to the VPU firmware, and on other devices it
doesn't matter since no interrupts will be generated.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
gpio: brcmstb: Use dynamic GPIO base numbers
Forcing a gpiochip to have a fixed base number now leads to a warning
message. Remove the need to do so by calculating hwirq numbers based
on bank numbers.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Fixes: 3b0213d56e ("gpio: Add GPIO support for Broadcom STB SoCs")
For "Really Good Reasons" [1] the SPI core requires a match
between compatible device strings and the name in spi_device_id.
The ili9486 driver uses compatible strings "waveshare,rpi-lcd-35"
and "ozzmaker,piscreen", but "rpi-lcd-35" and "piscreen" are missing,
so add them.
Compatible string "ilitek,ili9486" is already used by
staging/fbtft/fb_ili9486, therefore leaving it present in ili9486 as an
spi_device_id causes the incorrect module to be loaded, therefore remove
this id.
[1] https://elixir.bootlin.com/linux/latest/source/drivers/spi/spi.c#L487
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Loading the regulatory database from the debian files fails with
"loaded regulatory.db is malformed or signature is missing/invalid"
due to missing certificates. Add these debian-specific certificates
from upstream to fix this error. See #5536 for details.
The certificates have been imported as following:
patch -p1 <<<$(
curl https://salsa.debian.org/kernel-team/linux/-/raw/\
master/debian/patches/debian/\
wireless-add-debian-wireless-regdb-certificates.patch
)
Signed-off-by: Nicolai Buchwitz <n.buchwitz@kunbus.com>
The integrated USB2.0 hub in the VL805 chipset has a bug where it
incorrectly determines the remaining available frame time before the
host next sends a SOF packet with an incremented frame_number.
See the USB2.0 specification sections 11.3 and 11.14.2.3.
The hub's non-periodic TT handler can transmit the IN/OUT handshake
token too late, so a following 64-byte DATA0/1 packet causes the ACK
handshake to collide with the propagated SOF. This causes port babble.
Avoid ringing doorbells for vulnerable endpoints during uFrame 7 if the
TR is Idle to stop one source of babble. An IN transfer for a Running TR
may happen at any time, so there's not much we can do about that.
Ideally a hub firmware update to properly implement frame timeouts is
needed, and to avoid spinning for up to 125us when submitting TDs to
Idle rings.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
xhci: constrain XHCI_VLI_HUB_TT_QUIRK to old firmware versions
VLI have a firmware update for the VL805 which resolves the incorrect
frame time calculation in the hub's TT. Limit applying the quirk to
known-bad firmwares.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
The VL805 can cause data corruption if a SS Bulk OUT endpoint enters a
flow-control condition and there are TRBs in the transfer ring that are
not an integral size of wMaxPacket and the endpoint is behind one or more
hubs.
This is frequently the case encountered when FAT32 filesystems are
present on mass-storage devices with cluster sizes of 1 sector, and the
filesystem is being written to with an aggregate of small files.
The initial implementation of this quirk separated TRBs that didn't
adhere to this limitation into two - the first a multiple of wMaxPacket
and the second the 512-byte remainder - in an attempt to force TD
fragments to align with packet boundaries. This reduced the incidence
rate of data corruption but did not resolve it.
The fix as recommended by VIA is to disable bursts if this sequence of
TRBs can occur.
Limit turning off bursts to just USB mass-storage devices by searching
the device's configuration for an interface with a class type of
USB_CLASS_MASS_STORAGE.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
The VL805 controller can't cope with the TR Dequeue Pointer for an endpoint
being set to a Link TRB. The hardware-maintained endpoint context ends up
stuck at the address of the Link TRB, leading to erroneous ring expansion
events whenever the enqueue pointer wraps to the dequeue position.
If the search for the end of the current TD and ring cycle state lands on
a Link TRB, move to the next segment.
Link: https://github.com/raspberrypi/linux/issues/3919
[6.5.y Fixup - move downstream quirk bits further along]
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
As of [1], using PPS_FETCH on a 64-bit ARM kernel with a 32-bit userland
is broken, returning a timeout. This is because the requested 4-byte
alignment for struct pps_ktime_compat (illegal on arm64) results in the
timeout flags field being uninitialised.
Make the hack specific to X86_64 builds with CONFIG_COMPAT defined.
[1] commit c2a49fe8ee ("pps: fix padding issue with PPS_FETCH for
ioctl_compat")
See: https://github.com/raspberrypi/linux/issues/5430
Fixes: c2a49fe8ee ("pps: fix padding issue with PPS_FETCH for ioctl_compat")
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
configuration of addresses of DMA slave interfaces should be done in
CPU physical addresses.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
configuration of addresses of DMA slave interfaces should be done in
CPU physical addresses.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
It has been observed that edge events can be lost when GPIO edges occur
close to each other. Investigation suggests this is due to a hardware
bug, although no mechanism has been identified.
Work around the event loss by moving the IRQ acknowledgement into the
main ISR, adding missing events by explicit level-change detection.
See: https://forums.raspberrypi.com/viewtopic.php?t=350295
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The kernel needs to recognise the default BDADDRs used by the Bluetooth
modems, so add a few more that we care about.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The kernel Bluetooth framework understands that devices may not
be programmed with valid Bluetooth addresses. It also has the ability
to override a Bluetooth address with the value of the local-bd-address
DT property, but it ignores the validity of the existing address when
doing so.
Add a new boolean property, fallback-bd-address, which indicates that
the given local-bd-address property should only be used if the device
does not already have a valid BDADDR.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The BCM2835 mini-UART has no modem status interrupt, causing all
transmission to stop, never to use, if a speed change ever happens
while the CTS signal is high.
Add a simple polling mechanism in order to allow recovery in that
situation.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Since [1], the fbdev deferred IO framework is careful to cancel
pending updates on close to prevent dirty pages being accessed after
they may have been reused. However, this is not necessary in the case
that the pagelist is empty, and drivers that don't make use of the
pagelist may have wanted updates cancelled for no good reason.
Avoid penalising fbdev drivers that don't make use of the pagelist by
making the cancelling of deferred IO on close conditional on there
being a non-empty pagelist.
See: https://github.com/raspberrypi/linux/issues/5398
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
[1] 3efc61d952 ("fbdev: Fix invalid page access after closing deferred I/O devices")
While waiting for random data, use sleeps that are proportional
to the amount of data expected. Prevent indefinite waits by
giving up if nothing is received for a second.
See: https://github.com/raspberrypi/linux/issues/5390
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The imx708 is a 12MP MIPI sensor with a 16:9 aspect ratio, here using
two CSI-2 lanes. It is a "quad Bayer" sensor with all 3 modes offering
10-bit output:
12MP: 4608x2592 up to 14.35fps (full FoV)
1080p: 2304x1296 up to 56.02fps (full FoV)
720p: 1536x864 up to 120.12fps (cropped)
This imx708 sensor driver is based heavily on the imx477 driver and
has been tested on the Raspberry Pi platform using libcamera.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drivers: media: imx708: Enable long exposure mode
Enable long exposure modes by using the long exposure shift register setting
in the imx708 sensor.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: i2c: imx708: Fix crop information
The 1536x864 mode contained incorrect crop information.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
drivers: media: i2c: imx708: Fix WIDE_DYNAMIC_RANGE control with long exposure
Setting V4L2_CID_WIDE_DYNAMIC_RANGE was causing the long exposure
shift count to be reset, which is incorrect if the user has already
changed the frame length to cause it to have a non-zero value.
Because it only updates control ranges and doesn't set any registers,
the control can also be applied when the sensor is not powered on.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
drivers: media: imx708: Increase usable link frequencies
Add support for three different usable link frequencies (default 450Mhz,
447Mhz, and 453MHz) for the IMX708 camera sensor. The choice of
frequency is handled thorugh the "link-frequency" overlay parameter.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: imx708: Remove unused control fields
Remove unused and redundant control fields from the state structure.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: imx708: Tidy-ups to address upstream review comments
This commit addresses vaious tidy-ups requesed for upstreaming the
IMX708 driver. Notably:
- Remove #define IMX708_NUM_SUPPLIES and use ARRAY_SIZE() directly
- Use dev_err_probe where possible in imx708_probe()
- Fix error handling paths in imx708_probe()
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: imx708: Follow the standard devicetree labels
Switch the system clock name from "xclk" to "inclk".
Use lower case lables for all regulator names.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drives: media: imx708: Put HFLIP and VFLIP controls in a cluster
Create a cluster for the HVLIP and VFLIP controls so they are treated
as a single composite control.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: imx708: Adjust broken line correction parameter
In full-resolution mode, the LPF_INTENSITY_EN and LPF_INTENSITY
registers control Quad Bayer Re-mosaic broken line correction.
Expose this as a module parameter "qbc_adjust": zero disables
the correction and values in the range 2 to 5 set its strength.
There is a trade-off between coloured and monochrome patterns.
The previous fixed value 4 could produce ladder/spots artefacts
in coloured textures. The new default value 2 may suit a wider
range of scenes.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
media: i2c: imx708: Squash fixes
media: i2c: imx708: Fix lockdep issues.
The driver had a lockdep_assert_held in imx708_get_format_code,
but the calls from enum_mbus_code and enum_frame_size didn't take
the mutex.
Likewise imx708_set_framing_limits calling __v4l2_ctrl_modify_range
had a lockdep, but when going through the probe function the mutex
hadn't been taken.
Fix both cases.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: i2c: Tweak default PDAF gain table in imx708 driver
After analyzing more Raspberry Pi V3 cameras, adjust the
default PDAF shield-pixel gain tables (they can still be
overridden by camera OTP where programmed).
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
Replace the existing imx708.yaml file with sony,imx708.yaml that follows
the latest devicetree conventions for camera sensors.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Add YAML devicetree binding for IMX708 CMOS image sensor.
Let's also add a MAINTAINERS entry for the binding and driver.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The power up/down sequence is already ramped. Extend this to
the first user movement as well, as this will generally avoid
the "tick" noises due to rapid movements and overshooting.
Subsequent movements are generally smaller and so don't cause
issues.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Uses the regulator notifier framework so that the current
focus position will be restored whenever any user of the
regulator powers it up. This means that should the VCM
and sensor share a common regulator then starting the sensor
will automatically restore the default position. If they
have independent regulators then it will behave be powered
up when the VCM subdev is opened.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The VCM driver will often be controlled via a regulator,
therefore add in the relevant DT hooks.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The DW9817 is effectively the same as DW9807 from a programming
interface, however it drives +/-100mA instead of 0-100mA. This means
that the power on ramp needs to take the lens from the midpoint, and
power off return it there. It also changes the default position for
the module.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The DW9817 is programmatically the same as DW9807, but
the output drive is a bi-directional -100 to +100mA
instead of 0-100mA.
Add the appropriate compativle string.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
On some switches, having EEE enabled causes the link to become
unstable. With this patch, adding 'genet.eee=N' to the kernel command
line will cause EEE to be disabled on the link.
See: https://github.com/raspberrypi/linux/issues/4289
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
As there isn't currently a defined mechanism for selecting an
external trigger mode on image sensors, copy the imx477
approach of using a module parameter to enable ext trig.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Whilst the adv7180 driver support s_routing, nothing else
does, and there is a missing lump of framework code to
define the mapping from connectors on a board to the inputs
they represent on the ADV7180.
Add a nasty hack to take a module parameter that is passed in
to s_routing on any call to G_STD, or S_STD (or subdev
g_input_status call).
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
There is no obligation for all source devices on a video-mux to
require the same bus configuration, so read the configuration
from the sink ports, and relay via get_mbus_config on the source
port.
If the sources support get_mbus_config, then call that first.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The BCM54213PE identifier is a RPI-specific addition.
Populate the remainder of the driver functions, including the
required probe routine.
Add a version of bcm54xx_suspend, from upstream.
Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Also check for which HDMI devices are connected and only create
devices for those that are present.
Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
snd_bcm2835: disable HDMI audio when vc4 is used (#3640)
Things don't work too well when both the vc4 driver and the firmware
driver are trying to control the same audio output:
[ 763.569406] bcm2835_audio bcm2835_audio: vchi message timeout, msg=5
Hence, when the vc4 HDMI driver is used, let it control audio. This is done
by introducing a new device tree property to the audio node, and
extending the vc4-kms-v3d overlays to set it appropriately.
Signed-off-by: Hristo Venev <hristo@venev.name>
staging: bcm2835-audio: Add disable-headphones flag
Add a property to allow the headphone output to be disabled. Use an
integer property rather than a boolean so that an overlay can clear it.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
staging: bcm2835-audio: Find compatible firmware node
Commit "ARM: dts: Adopt the upstream snd_bcm2835 handling" removed the
audio section from the DT and the driver can no longer access the
referenced firmware node 'brcm,firmware'. Fix that by searching for a
compatible firmware node instead, similar to drivers/gpu/drm/vc4.
Fixes: b9e62329e096 ("ARM: dts: Adopt the upstream snd_bcm2835 handling")
Signed-off-by: Juerg Haefliger <juergh@proton.me>
staging: bcm2835-audio: Fix firmware node refcounting
Decrement firmware node refcounts on all exit paths in set_hdmi_enables().
Signed-off-by: Juerg Haefliger <juergh@proton.me>
staging: bcm2835-audio: Log errors in case of firmware query failures
The driver queries the firmware for the number of detected HDMI displays
and their IDs. Log error messages if queries fail.
Signed-off-by: Juerg Haefliger <juergh@proton.me>
staging: bcm2835-audio: Fix unused enable_hdmi module parameter
The commit "Add HDMI1 facility to the driver." made the enable_hdmi module
parameter unused. Fix that by making it a global switch for all available
HDMI audio outputs.
Fixes: 755f336608 ("Add HDMI1 facility to the driver.")
Signed-off-by: Juerg Haefliger <juergh@proton.me>
staging: bcm2835-audio: Fix unused enable_headphones module parameter
Since commit "staging: bcm2835-audio: Add disable-headphones flag" the
enabling/disabling of the headphones output is solely determined by the
presence of the DT property 'brcm,disable-headphones' and the
enable_headphones module parameter is unused. Fix that by making it a
global switch.
Fixes: ee90e47d88 ("staging: bcm2835-audio: Add disable-headphones flag")
Signed-off-by: Juerg Haefliger <juergh@proton.me>
Add a driver for the Arducam 64MP camera sensor.
Whilst the sensor supports 2 or 4 CSI2 data lanes, this driver
currently only supports 2 lanes.
The following Bayer modes are currently available:
9152x6944 10-bit @ 2.7fps
4624x3472 10-bit (binned) @ 10fps
3840x2160 10-bit (cropped/binned) @ 20fps
2312x1736 10-bit (binned) @ 30fps
1920x1080 10-bit (cropped/binned) @ 60fps
1280x720 10-bit (cropped/binned) @ 120fps
Signed-off-by: Lee Jackson <info@arducam.com>
media: i2c: arducam_64mp: Advertise embedded data node on media pad 1
This commit updates the arducam_64mp driver to adverise support for
embedded data streams.
The arducam_64mp sensor subdevice overloads the media pad to differentiate
between image stream (pad 0) and embedded data stream (pad 1) when
performing the v4l2_subdev_pad_ops functions.
Signed-off-by: Lee Jackson <info@arducam.com>
media: i2c: arducam_64mp: Modify the line length of 1280x720 resolution
Arducam 64MP has specific requirements for the line length, and if these
conditions are not met, the camera will not function properly. Under the
previous configuration, once a stream off operation is performed, the
camera will not output any data, even if a stream on operation is
performed. This prevents us from switching from 1280x720 to another
resolution.
Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
media: i2c: arducam_64mp: Add 8000x6000 resolution
Added 8000x6000 10-bit (cropped) @ 3fps mode for Arducam 64MP
Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
media: i2c: arducam_64mp: Add PDAF support
Enable PDAF output for all modes, and also need to modify Embedded Line
Width to 11560 * 3 (two lines of Embedded Data + one line of PDAF).
Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
drivers: media: arducam_64mp: Add V4L2_CID_LINK_FREQ control
Add V4L2_CID_LINK_FREQ as a read-only control with a value of 456 Mhz.
This will be used by the CFE driver to corretly setup the DPHY timing
parameters in the CSI-2 block.
Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
[ I would like to pursue fixing this more directly first before actually
merging this, but I thought I'd send this to the list now anyway as a
the "backup" plan. If I can't figure out how to make headway on the
main plan in the next few days, it'll be easy to just do this. ]
Stephen reported that a static key warning splat appears during early
boot on systems that credit randomness from device trees that contain an
"rng-seed" property, because because setup_machine_fdt() is called
before jump_label_init() during setup_arch():
static_key_enable_cpuslocked(): static key '0xffffffe51c6fcfc0' used before call to jump_label_init()
WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xb0/0xb8
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0+ #224 44b43e377bfc84bc99bb5ab885ff694984ee09ff
pstate: 600001c9 (nZCv dAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : static_key_enable_cpuslocked+0xb0/0xb8
lr : static_key_enable_cpuslocked+0xb0/0xb8
sp : ffffffe51c393cf0
x29: ffffffe51c393cf0 x28: 000000008185054c x27: 00000000f1042f10
x26: 0000000000000000 x25: 00000000f10302b2 x24: 0000002513200000
x23: 0000002513200000 x22: ffffffe51c1c9000 x21: fffffffdfdc00000
x20: ffffffe51c2f0831 x19: ffffffe51c6fcfc0 x18: 00000000ffff1020
x17: 00000000e1e2ac90 x16: 00000000000000e0 x15: ffffffe51b710708
x14: 0000000000000066 x13: 0000000000000018 x12: 0000000000000000
x11: 0000000000000000 x10: 00000000ffffffff x9 : 0000000000000000
x8 : 0000000000000000 x7 : 61632065726f6665 x6 : 6220646573752027
x5 : ffffffe51c641d25 x4 : ffffffe51c13142c x3 : ffff0a00ffffff05
x2 : 40000000ffffe003 x1 : 00000000000001c0 x0 : 0000000000000065
Call trace:
static_key_enable_cpuslocked+0xb0/0xb8
static_key_enable+0x2c/0x40
crng_set_ready+0x24/0x30
execute_in_process_context+0x80/0x90
_credit_init_bits+0x100/0x154
add_bootloader_randomness+0x64/0x78
early_init_dt_scan_chosen+0x140/0x184
early_init_dt_scan_nodes+0x28/0x4c
early_init_dt_scan+0x40/0x44
setup_machine_fdt+0x7c/0x120
setup_arch+0x74/0x1d8
start_kernel+0x84/0x44c
__primary_switched+0xc0/0xc8
---[ end trace 0000000000000000 ]---
random: crng init done
Machine model: Google Lazor (rev1 - 2) with LTE
A trivial fix went in to address this on arm64, 73e2d827a5 ("arm64:
Initialize jump labels before setup_machine_fdt()"). But it appears that
fixing it on other platforms might not be so trivial. Instead, defer the
setting of the static branch until later in the boot process.
Fixes: f5bda35fba ("random: use static branch for crng_ready()")
Reported-by: Stephen Boyd <swboyd@chromium.org>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Phil Elwell <phil@raspberrypi.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
The driver had a number of issues, checkpatch warnings/errors,
and other limitations, so fix these up to make it usable.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
hwmon: emc2305: Add calls to initialise of cooling maps
Commit 46ef9d4ed2 ("hwmon: emc2305: fixups for driver submitted to
mailing lists") missed adding the call to thermal_of_cooling_device_register
required to configure any cooling maps for the device, hence stopping it
from actually ever changing speed.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
hwmon: emc2305: Change OF properties pwm-min & pwm-max to u8
There is no DT binding for emc2305 as mainline are still
discussing how to do a generic fan binding.
The 5.15 driver was reading the "emc2305," properties
"cooling-levels", "pwm-max", "pwm-min", and "pwm-channel" as u8.
The overlay was writing them as u16 (;) so it was working.
The 6.1 driver was reading as u32, which failed as there is
insufficient data.
As this is all downstream only, revert to u8 to match 5.15.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
It is quite common for the devm_thermal_zone_of_sensor_register
to need to defer, so avoid spamming the log by using
dev_err_probe instead of dev_err.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Add a driver for the Arducam Pivariety series CSI2 camera sensor.
Signed-off-by: Lee Jackson <info@arducam.com>
SQUASH: Fix VIDEO_ARDUCAM_PIVARIETY Kconfig entry
The cherry-pick from rpi-5.17.y put it in the wrong section, and failed
to update it for 5.18.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
media: i2c: arducam-pivariety: Add custom controls
Add support for strobe_shift, strobe_width and mode custom controls.
Signed-off-by: Lee Jackson <info@arducam.com>
media: i2c: arducam-pivariety: Fix mutex init and NULL pointer
The mutex used in arducam-pivariety was not properly initialized,
which could lead to undefined behavior. This also caused a NULL
pointer dereference under certain conditions.
This patch ensures the mutex is correctly initialized during probe
and prevents NULL pointer dereferences.
Signed-off-by: Yuriy Pasichnyk <yurijpasichnyk11@gmail.com>
Add YAML device tree binding for Arducam Pivariety CMOS image sensor, and
the relevant MAINTAINERS entries.
Signed-off-by: Lee Jackson <info@arducam.com>
On some platforms the cma area can be half the entire system memory,
meaning that allocations start happening in the cma area immediately.
This leads to fragmentation and subsequent fatal cma_alloc failures.
We introduce an "alloc_in_cma_threshold" parameter which requires that
this many sixteenths of the free pages must be in cma before it will
try to use them. By default this is set to 12, but the previous
behaviour can be restored by setting it to 8 on startup.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
Adds a driver for the Analog Devices AD5398 10 bit
I2C DAC which is commonly used for driving VCM lens
mechanisms.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: i2c: Rename ad5398 to ad5398_vcm
There's already a regulator module called ad5398 that exposes
this device through the regulator API. That is meaningless in
the terms that it uses and how it maps to V4L2, so a new driver
was added. However the module name collision wasn't noted, so
rename it now.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Add a binding for Analog Devices AD5398 10bit current
sinking DAC when used as a lens VCM driver.
FIXME: Convert to YAML
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Omnivision OV2311 is a CSI2 1600x1300 global shutter image sensor.
Add a driver for it.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: i2c: Update ov2311 Kconfig entry
Bring the OV2311 Kconfig declaration in line with upstream entries.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
media: i2c: ov2311: Fix uninitialized variable usage
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
"media: i2c: Remove .s_power() from ov7251" removed the call that
sent ov7251_global_init_setting to the sensor. Send it when starting
streaming.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The sck-idle-input property indicates that the spi-gpio driver should
return the SCK line to an input when the chip select signals are
inactive.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
https://github.com/raspberrypi/linux/issues/4440
Upstream has added additional device specific controls, so the
V4L2_CID_USER_BASE + 0x10e0 value that had been defined for use with
the ISP has been taken by something else (and +0x10f0 has been used as
well)
Duplicate the use on V4L2_CID_USER_BASE + 0x10e0 so that userspace
(libcamera) doesn't need to change. Once the driver is upstream, then
we'll update libcamera to adopt the new value as it then won't change.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Not all implementations wire up the enable GPIO and may just tie
it to a supply rail.
Make it optional.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The I2C to the Atmel is very fussy, and locks up easily on
Pi0-3 particularly on reads.
The LCD power status is controlled solely by this driver, so
rather than reading it back from the Atmel, use the cached
status last set.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
regulator/rpi-panel: Power off display on shutdown
Adds a shutdown function to turn off the backlight, bridge, and
touch controller on shutdown.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
regulator/rpi-panel: Remove the ID read
Reading from the Atmel has always been troublesome due to
clock stretching, and the driver does nothing with it anyway.
Remove the read and assume that if the overlay has been
configured (most likely through the firmware autodetection)
that the hardware is present.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
As happens occasionally, an upstream change has once again prevented
spidev from being loaded via Device Tree. We now need "spidev" to be
included in the new spi_device_id list, otherwise although the
spidev driver gets loaded no /dev/spidev*.* entries will appear.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
An unwanted side effect of enabling the BRCMDBG config setting is
redefining brcmf_info to be brcmf_err. This can be alarming to users
and makes it harder to spot real errors, so don't do it.
See: https://github.com/raspberrypi/linux/issues/4663
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
For cases where spare PWM outputs are available, but are desired
to be addressed a standard outputs instead.
Wraps a PWM channel as a new GPIO chip with the one output.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
pwm: gpio-pwm: follow pwm_apply_might_sleep() rename
Fixes: 03286093be68("drivers/gpio: Add a driver that wraps the PWM API as a GPIO controller")
Signed-off-by: Ratchanan Srirattanamet <peathot@hotmail.com>
Some platforms include a fan-speed register that reports RPM directly
as an alternative to counting interrupts from the fan tachometer input.
Add support for reading a register at a given offset (rpm-offset) within
a block declared in another node (rpm-regmap). This indirection allows
the usual address mapping to be performed, and for address sharing with
another driver.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Should we go through the timeout failure case with port_disable
not returning all buffers for whatever reason, the
buffers_with_vpu counter gets left at a non-zero value, which
will cause reference counting issues should the instance be
reused.
Reset the count when the port is enabled again, but before
any buffers have been sent to the VPU.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The firmware can only use I2C0 if the kernel isn't, therefore
with libcamera and DRM using it the PoE HAT fan control needs
to move to the kernel.
Add the option for the driver to be created by the PoE HAT core
MFD driver, and use the I2C regmap that provides to control fan
functions.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The Raspbery Pi PoE+ HAT exposes a fan controller and power
supply status reporting via a single I2C address.
Create an MFD device that allows loading of the relevant
sub-drivers, with a shared I2C regmap.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Serge Schneider <serge@raspberrypi.com>
power: rpi-poe: Drop CURRENT_AVG as it is not hardware averaged
As documented the _AVG parameters are meant to be hardware
averaged, but the implementation for the PoE+ HAT was done in
software in the firmware.
Drop the property.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
power: rpi-poe: Add option of being created by MFD or FW
The firmware can only use I2C0 if the kernel isn't, therefore
with libcamera and DRM using it the PoE HAT fan control needs
to move to the kernel.
Add the option for the driver to be created by the PoE HAT core
MFD driver, and use the I2C regmap that provides to control fan
functions.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
As we're wanting to wrap the image_fx component for deinterlacing,
add the deinterlace algorithm values to enum mmal_parameter_imagefx
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Adds enum mmal_interlace_type and struct
mmal_parameter_video_interlace_type to allow for querying the
interlacing mode on decoders.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Bindings for the panel-dsi specific additions to panel-simple.
Allow for DSI specific bus settings and panel timing
to be define in devicetree. Very similar to panel-dpi.
Signed-off-by: Timon Skerutsch <kernel@diodes-delight.com>
The Geekworm MZP280 panel is a 480x640 (portrait) panel with a
capacitive touch interface and a 40 pin header meant to interface
directly with the Raspberry Pi. The screen is 2.8 inches diagonally,
and there appear to be at least 4 distinct versions all with the same
panel timings.
Timings were derived from drivers posted on the github located here:
https://github.com/tianyoujian/MZDPI/tree/master/vga
Additional details about this panel family can be found here:
https://wiki.geekworm.com/2.8_inch_Touch_Screen_for_Pi_zero
Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
The regulator of the Waveshare DSI-TOUCH series panels is different.
Add a new driver for this regulator.
Signed-off-by: Waveshare_Team <support@waveshare.com>
drivers/regulator : Adjust power enable sequence
Avoid direct enabling of LCD power here.
Certain screens require immediate initialization after power-on
to prevent polarization.
Signed-off-by: Waveshare_Team <support@waveshare.com>
Waveshare sell a range of DSI panels of varying sizes, all
using a common MCU to control the panel and backlight.
Add a panel driver that supports these panels.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/panel: waveshare: Fix up timings for 10.1" panel
The 10.1" panel doesn't work with the timings defined. vc4
will always have been fixing up the timing due to the limited
integer divider, so compute the fixed up mode and use it
directly.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drivers/gpu/drm/panel:fix waveshare panel software restart/shutdown display is abnormal
Fixed the screen stays white when the user restarts or shuts down
Signed-off-by: eng33 <eng33@waveshare.com>
drivers/gpu/drm/panel:Modify the DSI mode to fix the problem that 7.9inch cannot be displayed
Signed-off-by: eng33 <eng33@waveshare.com>
drivers/gpu/drm/panel:Modified the timing of 11.9inch to fix the issue that 11.9inch was displayed abnormally
Signed-off-by: eng33 <eng33@waveshare.com>
Driver:add waveshare 4inch dsi lcd (C) driver
Signed-off-by: Eng33 <eng33@waveshare.net>
drivers:gpu:drm:panel: Added waveshare 5.0inch, 6.25inch, and 8.8inch dsi screen devices
Signed-off-by: eng33 <eng33@waveshare.com>
drm: panel: Added waveshare 13.3inch panel
Signed-off-by: eng33 <eng33@waveshare.com>
drm: panel: Added waveshare 7.0inch h dsi screen support
Signed-off-by: Waveshare_Team <support@waveshare.com>
drivers/gpu/drm/panel : Add the device for the Waveshare DSI-TOUCH series panels.
the driver are provided for the Waveshare DSI-TOUCH series panels,
modelled after the other Ilitek controller drivers,
but not limited to Ilitek series controllers.
The aim is to offer a more consistent operation and
experience for the Waveshare DSI-TOUCH series panels.
Signed-off-by: Waveshare_Team <support@waveshare.com>
drivers/gpu/drm/panel : Update display driver
1) Add LCD power control
2) Added support for:
A) Add support for 3.4-DSI-TOUCH-C
B) Add support for 4-DSI-TOUCH-C
C) Add support for 8-DSI-TOUCH-A
D) Add support for 9-DSI-TOUCH-B
E) Add support for 10.1-DSI-TOUCH-B
F) Add support for 12.3-DSI-TOUCH-A
Signed-off-by: Waveshare_Team <support@waveshare.com>
The Top DisplayOptoelectronics (TDO) T17B driver chip is used
in the TL040HDS20CT panel (found in the Pimoroni HyperPixel4
Square display) and potentially other displays.
The driver chip supports SPI for configuration and DPI
video data.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
This new panel uses the ILI9881C IC but needs an alternate
init sequence, and therefore requires a new compatible string.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Penk Chen <penk@cutiepi.io>
drm/panel: ilitek-ili9881c: Clean up on mipi_dsi_attach failure
mipi_dsi_attach is allowed to fail, and currently the probe
code doesn't clean up (mainly drm_panel_remove) if this happens.
Add cleanup code on failure.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/panel: panel-ilitek9881c: Add prepare_upstream_first flag
The panel sends MIPI DCS commands during prepare and is expecting
the bus to remain in LP-11 state in-between.
Set the prepare_upstream_first flag so that the upstream DSI host
is prepared / pre_enabled first, and therefore the bus is in a
defined state.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/panel: panel-ilitek9881c: Use cansleep methods
Use cansleep version of gpiod_set_value so external IO drivers (like
via I2C) can be used.
Signed-off-by: Mark Williams <mwp@mwp.id.au>
drm/panel: panel-ilitek9881c: Crystalfontz support
Add support for Crystalfontz CFAF7201280A0-050Tx panel.
Signed-off-by: Mark Williams <mwp@mwp.id.au>
drm/panel: ilitek-ili9881c: Allow configuration of the number of lanes
Not all panels use all 4 data lanes, so allow configuration based
on the compatible string.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/panel: ili9881: Add configuration for the new panels
Add configuration for the 5" and 7" Raspberry Pi 720x1280
DSI panels based on ili9881.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm: panel: ili9881: Correct symmetry on enable/disable return codes
ili9881c_enable is always returning 0.
ili9881c_disable was returning the error code from
mipi_dsi_dcs_set_display_off.
If non-zero, the drm_panel framework will leave the panel marked as
enabled, and not run the enable hook next time around. That isn't
helpful, particularly as we're expecting unprepare to disable
resets and regulators.
Change ili9881c_disable to match enable in always returning 0.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm: panel: ili9881: Add option to reconfigure setup commands
The driver is typically asking for LP commands, but then tries
to send set_display_[on|off] from enable/disable when the host
will be in HS mode.
It also sends shutdown commands just before it asserts reset and
disables the regulator, which is rather redundant.
Add an option to configure these two choices from the panel_desc.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Update panel-ilitek-ili9881c.c
Correcting display dimension typo
ILI9881C: Update timings for CFAF7201280A0-050TX
Update of ILI9881C CFAF7201280A0-050TX panel timing to work with the CM5.
Signed-off-by: Mark Williams <mark@crystalfontz.com>
drm/panel: ilitek-ili9881c: Restore lanes configuration for nwe080 panel
This config was missing with the forward porting of the rasp pi kernel to
6.12. Refer to https://github.com/raspberrypi/linux/issues/6856
Signed-off-by: Jack O'Brien <obri.jack.02@gmail.com>
Signed-off-by: Penk Chen <penk@cutiepi.io>
drm/panel: ilitek-ili9881c: Clean up on mipi_dsi_attach failure
mipi_dsi_attach is allowed to fail, and currently the probe
code doesn't clean up (mainly drm_panel_remove) if this happens.
Add cleanup code on failure.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/panel: panel-ilitek9881c: Add prepare_upstream_first flag
The panel sends MIPI DCS commands during prepare and is expecting
the bus to remain in LP-11 state in-between.
Set the prepare_upstream_first flag so that the upstream DSI host
is prepared / pre_enabled first, and therefore the bus is in a
defined state.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/panel: panel-ilitek9881c: Use cansleep methods
Use cansleep version of gpiod_set_value so external IO drivers (like
via I2C) can be used.
Signed-off-by: Mark Williams <mwp@mwp.id.au>
drm/panel: panel-ilitek9881c: Crystalfontz support
Add support for Crystalfontz CFAF7201280A0-050Tx panel.
Signed-off-by: Mark Williams <mwp@mwp.id.au>
drm/panel: ilitek-ili9881c: Allow configuration of the number of lanes
Not all panels use all 4 data lanes, so allow configuration based
on the compatible string.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/panel: ili9881: Add configuration for the new panels
Add configuration for the 5" and 7" Raspberry Pi 720x1280
DSI panels based on ili9881.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm: panel: ili9881: Correct symmetry on enable/disable return codes
ili9881c_enable is always returning 0.
ili9881c_disable was returning the error code from
mipi_dsi_dcs_set_display_off.
If non-zero, the drm_panel framework will leave the panel marked as
enabled, and not run the enable hook next time around. That isn't
helpful, particularly as we're expecting unprepare to disable
resets and regulators.
Change ili9881c_disable to match enable in always returning 0.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm: panel: ili9881: Add option to reconfigure setup commands
The driver is typically asking for LP commands, but then tries
to send set_display_[on|off] from enable/disable when the host
will be in HS mode.
It also sends shutdown commands just before it asserts reset and
disables the regulator, which is rather redundant.
Add an option to configure these two choices from the panel_desc.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Update panel-ilitek-ili9881c.c
Correcting display dimension typo
ILI9881C: Update timings for CFAF7201280A0-050TX
Update of ILI9881C CFAF7201280A0-050TX panel timing to work with the CM5.
Signed-off-by: Mark Williams <mark@crystalfontz.com>
drm/panel: ilitek-ili9881c: Restore lanes configuration for nwe080 panel
This config was missing with the forward porting of the rasp pi kernel to
6.12. Refer to https://github.com/raspberrypi/linux/issues/6856
Signed-off-by: Jack O'Brien <obri.jack.02@gmail.com>
There is no reason why the control GPIOs for the panel can not
be connected to I2C or similar GPIO interfaces that may need to
sleep, therefore switch from gpiod_set_value to
gpiod_set_value_cansleep calls to configure them.
Without that you get complaints from gpiolib every time the state
is changed.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm: panel: jdi-lt070me05000: Add prepare_upstream_first flag
The panel driver wants to send DCS commands from the prepare
hook, therefore the DSI host wants to be pre_enabled first.
Set the flag to achieve this.
https://forums.raspberrypi.com/viewtopic.php?t=354708
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The Raspberry Pi 7" 800x480 panel uses a Toshiba TC358762 DSI
to DPI bridge chip, so there is a requirement for the timings
to be specified for the end panel. Add such a definition.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/panel-simple: Populate bpc when using panel-dpi
panel-dpi doesn't know the bit depth, so in the same way that
DPI is guessed for the connector type, guess that it'll be 8bpc.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/panel-simple: Allow the bus format to be read from DT for panel-dpi
The "panel-dpi" compatible string configures panel from device tree,
but it doesn't provide any way of configuring the bus format (colour
representation), nor does it populate it.
Add a DT parameter "bus-format" that allows the MEDIA_BUS_FMT_xxx value
to be specified from device tree.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/panel: simple: add Geekworm MZP280 Panel
Add support for the Geekworm MZP280 Panel
Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
Acked-by: Maxime Ripard <maxime@cerno.tech>
drm/panel: simple: Add Innolux AT056tN53V1 5.6" VGA
Add support for the Innolux AT056tN53V1 5.6" VGA (640x480) TFT LCD
panel.
Signed-off-by: Joerg Quinten <aBUGSworstnightmare@gmail.com>
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
drm/panel: simple: Alter the timing for the Pi 7" DSI display
vc4 has always fixed up the timing, so the values defined have
never actually appeared on the wire.
The display appears to want a slightly longer HFP, so extend
the timings and recompute the clock to give the same frame rate.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/panel: add panel-dsi
Equivalent to panel-dpi for configuring a simple DSI panel with
device tree side timings and bus settings.
Motiviation is the same as for panel-dpi of wanting to support
new simple panels without needing to patch the kernel.
Signed-off-by: Timon Skerutsch <kernel@diodes-delight.com>
drm/panel-simple: Remove custom handling of orientation
The framework now handles reading orientation from DT, therefore
remove the custom get_orientation hook from panel-simple.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/panel-simple: Fix 7inch panel mode for misalignment
The 7inch panel is one line off the screen both horizontally
and vertically.
Alter the panel mode to correct this.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/panel-simple: Increase pixel clock on Pi 7inch panel
The Toshiba bridge is very fussy and doesn't like the CM3
output when being told to produce a 27.777MHz pixel clock, which
is an almost perfect match to the DSI link integer divider.
Increasing to 30MHz will switch the DSI link from 333MHz to 400MHz
and makes the bridge happy with the same video timing as works
on Pi4.
(Pi4 will be using a link frequency of 375MHz due to a 3GHz
parent PLL).
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
We now have the hardware I2C controller pinmuxed to the drive the
display I2C, but this controller does not support clock stretching.
The Atmel micro-controller in the panel requires clock stretching
to allow it to prepare any data to be read.
Split the rpi_touchscreen_i2c_read into two independent transactions with
a delay between them for the Atmel to prepare the data.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/panel/raspberrypi-ts: Insert delay before polling for startup state
In switching to the hardware I2C controller there is an issue
where we seem to not get back the correct state from the Pi
touchscreen.
Insert a delay before polling to avoid this condition.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/panel/raspberrypi-touchscreen: Handle I2C errors.
rpi_touchscreen_i2c_read returns any errors from i2c_transfer,
or the 8 bit received value.
Check for error values before trying to process the data as
valid.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm/panel/raspberrypi-touchscreen: Insert more delays.
This avoids failures in cases where the panel is enabled
or re-probed very soon after being disabled or probed.
These can occur because the Atmel device can mis-behave
over I2C for a few ms after any write to the POWERON register.
Add call to v4l2_ctrl_new_fwnode_properties to read and
create the fwnode based controls.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Whilst the hardware can't achieve the limits of level 4.2 under
all situations, it can exceed level 4.0.
Allow selection of levels 4.1 and 4.2.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The Adafruit Mini-PiTFT13 display needs offsets applying when rotated,
so use the "variant" mechanism to select a custom set_addr_win method
using a dedicated compatible string of "fbtft,minipitft13".
See: https://github.com/raspberrypi/firmware/issues/1524
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
DMABUFs are all handled by videobuf2, so there is no reason not
to enable support for them.
Note that this driver is still using the vmalloc allocator, so
the buffers it allocates will not be compatible with the codec
or ISP driver that require contiguous buffers. However this
driver should be able to import the buffers allocated by them.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
In order to simplify the driver slightly, use the same PLL
configuration, and hence pixel rate and link frequency (to be
added) for the full, 1080p, and binned modes.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
There are many registers in common between all the modes.
Pull those out into one common table.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
To make comparisons of the mode registers easier, put the registers
for the binned and VGA modes in the same order as the others.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The driver did expose V4L2_CID_HBLANK, but as a READ_ONLY control.
The sensor only uses the HTS register to control the line length,
so convert this control to read/write, with the appropriate ranges.
Adopt the old fixed values as the minimum values permitted in each
mode to avoid issues of it not streaming.
This should allow exposure times up to ~3 seconds (up from ~1sec).
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
v4l2_async_register_subdev doesn't bind in lens or flash drivers,
but v4l2_async_register_subdev_sensor does.
Switch to using v4l2_async_register_subdev_sensor.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The driver supported using GPIOs to control the shutdown line,
but no regulator control.
Add regulator hooks.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Add these missing V4L2 controls. Tested binned and full resolution
modes in all four orientations using Raspberry Pi running libcamera.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
Fixes the following v4l2-compliance failure:
fail: v4l2-test-controls.cpp(871): subscribe event for control 'User Controls' failed test
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
Trial and error reveals that the minimum vblank value appears to be 24
(the OV5647 data sheet does not give any clues). This fixes streaming
lock-ups in full resolution mode.
Fixes: 9b5a5ebedc ("media: i2c: ov5647: Add support for V4L2_CID_VBLANK")
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
The top offset in the pixel array is actually 6 (see page 3-1 of the
OV5647 data sheet).
Fixes: f2f7ad5ce5 ("media: i2c: ov5647: Selection compliance fixes")
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
Parse device properties and register controls for them using the V4L2
fwnode properties helpers.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Previously they were returning positive non-zero codes for success,
which were getting passed up the call stack. Since release 4.19,
do_dentry_open (fs/open.c) has been catching these and flagging an
error. (So this driver has been broken since that date.)
Fixes: 3c2472a [media] media: i2c: Add support for OV5647 sensor
Signed-off-by: David Plowman <david.plowman@raspberrypi.org>
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
The kernel modules aes-neon-blk and aes-neon-bs perform poorly, at least on
Cortex-A72 without crypto extensions. In fact, aes-arm64 outperforms them
on benchmarks, despite it being a simpler implementation (only accelerating
the single-block AES cipher).
For modes of operation where multiple cipher blocks can be processed in
parallel, aes-neon-bs outperforms aes-neon-blk by around 60-70% and aes-arm64
is another 10-20% faster still. But the difference is even more marked with
modes of operation with dependencies between neighbouring blocks, such as
CBC encryption, which defeat parallelism: in these cases, aes-arm64 is
typically around 250% faster than either aes-neon-blk or aes-neon-bs.
The key trade-off with aes-arm64 is that the look-up tables are situated in
RAM. This leaves them potentially open to cache timing attacks. The two other
modules, by contrast, load the look-up tables into NEON registers and so are
able to perform in constant time.
This patch aims to load aes-arm64 more often.
If none of the currently-loaded crypto modules implement a given algorithm,
a new one is typically selected for loading using a platform-neutral alias
describing the required algorithm. To enable users to still
load aes-neon-blk or aes-neon-bs if they really want them, while still
ensuring that aes-arm64 is usually selected, remove the aliases from
aes-neonbs-glue.c and aes-glue.c and apply them to aes-cipher-glue.c, but
still build the two NEON modules.
Since aes-glue.c can also be used to build aes-ce-blk, leave them enabled
if USE_V8_CRYPTO_EXTENSIONS is defined, to ensure they are selected if we
in future use a CPU which has the crypto extensions enabled.
Note that the algorithm priority specifiers are unchanged, so if
aes-neon-bs is loaded at the same time as aes-arm64, the former will be
used in preference. However, aes-neon-blk and aes-arm64 have tied priority,
so whichever module was loaded first will be used (assuming aes-neon-bs is
not loaded).
Signed-off-by: Ben Avison <bavison@riscosopen.org>
A relatively recent commit ([1]) contained optimisation for the PIO
SPI FIFO-filling functions. The commit message includes the phrase
"[t]he blind and counted loops are always called with nonzero count".
This is technically true, but it is still possible for count to become
zero before the loop is entered - if tfr->len is zero. Moving the loop
exit condition to the end of the loop saves a few cycles, but results
in a near-infinite loop should the revised count be zero on entry.
Strangely, zero-lengthed transfers aren't filtered by the SPI framework
and, even more strangely, the Python3 spidev library is triggering them
for no obvious reason.
Avoid the problem completely by bailing out of the main transfer
function early if trf->len is zero, although there may be a case for
moving the mitigation into the framework.
See: https://github.com/raspberrypi/linux/issues/4100
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
[1] 26751de25d ("spi: bcm2835: Micro-optimise FIFO loops")
Support has been added for the unpacked (16bpp) versions of
the MIPI raw 10, 12, and 14 formats, so add the 4CCs for them.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
DSI1 on BCM2711 doesn't require the DMA workaround that is used
on BCM2835/6/7, therefore it needs a new compatible string.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Not all systems have the interrupt line wired up, so switch to
polling the touchscreen off a timer if no interrupt line is
configured.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
input: edt-ft5x06: Handle unreliable TOUCH_UP events
The ft5x06 is unreliable in sending touch up events, so some
touch IDs can become stuck in the detected state.
Ensure that IDs that are unreported by the controller are
released.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
input: edt-ft5x06: Only look at the number of points reported
Register 0x02 in the FT5x06 is TD_STATUS containing the number
of valid touch points being reported.
Iterate over that number of points rather than all that are
supported on the device.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
input: edt-ft5x06: Only read data for number of points reported
Rather than always reading the maximum number of points supported
by the chip (which may be as high as 10), read the number of
active points first, and read data for just those.
In most cases this will result in less data on the I2C bus,
with only the maximum touch points taking more due to a second
read that has to configure the start address.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
input: edt-ft5x06: Fix patch reading only the number of points reported
Fix bad conflict resolution from upstream updates. Need to read
from tsdata->tdata_offset bytes, not from tsdata->offset.
Also fix logging of i2c read errors to cover both transactions.
Fixes: 7216fcfe2e ("input: edt-ft5x06: Only read data for number of points reported")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Input: edt-ft54x6: Clean up timer and workqueue on remove
If no interrupt is defined then a timer and workqueue are used
to poll the controller.
On remove these were not being cleaned up correctly.
Fixes: ca61fdaba7 "Input: edt-ft5x06: Poll the device if no interrupt is
configured."
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
input: touchscreen: edt-ft5x06: Suppress bogus data on startup
When polled without the use of IRQ, FT5x06 registers may return
undefined initial data, causing unwanted touches or event spamming.
A simple way to filter this out is to suppress touches until the
TD_STATUS register changes for the first time.
Increase the delay before first polling to 300ms, to avoid
transient I2C read flakiness that seems to occur after reset.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
input: edt-ft5x06: Include I2C details in names for the devices
libinput uses the input device name alone. If you have two
identical input devices, then there is no way to differentiate
between them, and in the case of touchscreens that means no
way to associate them with the appropriate display device.
Add the I2C bus and address to the start of the input device
name so that the name is always unique within the system.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
input: edt-ft5x06: Correct prefix length in snprintf
snprintf takes the length of the array that we can print into,
and has to fit the NULL terminator in there too.
Printing the prefix is generally "12-3456 " which is 8 desired
characters (the length of EDT_NAME_PREFIX_LEN) and the NULL.
The space is therefore being truncated to fit the NULL in.
Increase the length snprintf is allowed to use.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Define a new mailbox (SET_REBOOT_FLAGS) which may be used to
pass optional flags to the Raspberry Pi firmware that changes
the behaviour of the bootloader and firmware during a reboot.
Currently this just defines the 'tryboot' flag which causes
the firmware to load tryboot.txt instead config.txt. This
alternate configuration file can be used to specify the
path of an alternate firmware and kernels allowing a fallback
mechanism to be implemented for OS upgrades.
The gpio-fsm driver implements simple state machines that allow GPIOs
to be controlled in response to inputs from other GPIOs - real and
soft/virtual - and time delays. It can:
+ create dummy GPIOs for drivers that demand them,
+ drive multiple GPIOs from a single input, with optional delays,
+ add a debounce circuit to an input,
+ drive pattern sequences onto LEDs
etc.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
gpio-fsm: Fix a build warning
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
gpio-fsm: Rename 'num-soft-gpios' to avoid warning
As of 5.10, the Device Tree parser warns about properties that look
like references to "suppliers" of various services. "num-soft-gpios"
resembles a declaration of a GPIO called "num-soft", causing the value
to be interpreted as a phandle, the owner of which is checked for a
"#gpio-cells" property.
To avoid this warning, rename the gpio-fsm property to "num-swgpios".
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
gpio-fsm: Show state info in /sys/class/gpio-fsm
Add gpio-fsm sysfs entries under /sys/class/gpio-fsm. For each state
machine show the current state, which state (if any) will be entered
after a delay, and the current value of that delay.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
gpio-fsm: Fix shutdown timeout handling
The driver is intended to jump directly to a shutdown state in the
event of a timeout during shutdown, but the sense of the test was
inverted.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
gpio-fsm: Clamp the delay time to zero
The sysfs delay_ms value is calculated live, and it is possible for
the time left to appear to be negative briefly if the timer handling
hasn't completed. Ensure the displayed value never goes below zero,
for the sake of appearances.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
gpio-fsm: Sort functions into a more logical order
Move some functions into a more logical ordering. This change causes
no functional change and is essentially cosmetic.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
gpio_fsm: Rework the atomic-vs-non-atomic split
Partition the code to separate atomic and non-atomic methods so that
none of them have to handle both cases. The result avoids using deferred
work unless necessary, and should be easier to understand.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Driver for the BCM2835 ISP hardware block. This driver uses the MMAL
component to program the ISP hardware through the VC firmware.
The ISP component can produce two video stream outputs, and Bayer
image statistics. This can't be encompassed in a simple V4L2
M2M device, so create a new device that registers 4 video nodes.
This patch squashes all the development patches from the earlier
rpi-5.4.y branch into one
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
staging/bcm2835-isp: Add the unpacked (16bpp) raw formats
Now that the firmware supports the unpacked (16bpp) variants
of the MIPI raw formats, add the mappings.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835-isp: Log the number of excess supported formats
When logging that the firmware has provided more supported formats
than we had allocated storage for, log the number allocated and
returned.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: vc04_services: ISP: Add colour denoise control
Add colour denoise control to the bcm2835 driver through a new v4l2
control: V4L2_CID_USER_BCM2835_ISP_CDN.
Add the accompanying MMAL configuration structure definitions as well.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
bcm2835-isp: Allow formats with different colour spaces.
Each supported format now includes a mask showing the allowed colour
spaces, as well as a default colour space for when one was not
specified.
Additionally we translate the colour space to mmal format and pass it
over to the VideoCore.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
media: i2c: add ov9281 driver.
Change-Id: I7b77250bbc56d2f861450cf77271ad15f9b88ab1
Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
media: i2c: ov9281: fix mclk issue when probe multiple camera.
Takes the ov9281 part only from the Rockchip's patch.
Change-Id: I30e833baf2c1bb07d6d87ddb3b00759ab45a90e4
Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
media: i2c: ov9281: add enum_frame_interval function for iq tool 2.2 and hal3
Adds the ov9281 parts of the Rockchip patch adding enum_frame_interval to
a large number of drivers.
Change-Id: I03344cd6cf278dd7c18fce8e97479089ef185a5c
Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
media: i2c: ov9281: Fixup for recent kernel releases, and remove custom code
The Rockchip driver was based on a 4.4 kernel, and had several custom
Rockchip parts.
Update to 5.4 kernel APIs, with the relevant controls required by
libcamera, and remove custom Rockchip parts.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: i2c: ov9281: Read chip ID via 2 reads
Vision Components have made an OV9281 module which blocks reading
back the majority of registers to comply with NDAs, and in doing
so doesn't allow auto-increment register reading as used when
reading the chip ID.
Use two reads and manually combine the results.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: i2c: ov9281: Add support for 8 bit readout
The sensor supports 8 bit mode as well as 10bit, so add the
relevant code to allow selection of this.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: ov9281: Add 1280x720 and 640x480 modes
Breaks out common register set and adds the different registers
for 1280x720 (cropped) and 640x480 (skipped) modes
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Fixed picture line bug in all ov9281 modes
Signed-off-by: Mathias Anhalt <mathiasanhalt@web.de>
Added hflip and vflip controls to ov9281
Signed-off-by: Mathias Anhalt <mathiasanhalt@web.de>
media: i2c: ov9281: Remove override of subdev name
From the original Rockchip driver, the subdev was renamed
from the default to being "mov9281 <dev_name>" whereas the
default would have been "ov9281 <dev_name>".
Remove the override to drop back to the default rather than
a vendor custom string.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: v4l2-subdev: add subdev-wide state struct
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
media: i2c: ov9281: Add fwnode properties controls
Add call to v4l2_ctrl_new_fwnode_properties to read and
create the fwnode based controls.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: i2c: ov9281: Sensor should report RAW color space
Tested on Raspberry Pi running libcamera.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
Partial revert "media: i2c: add ov9281 driver."
This partially reverts commit 84e98e3a4f.
The commit had merged some changes to other drivers with adding the ov9281
driver. Only the ov9281 parts have been reverted.
staging/bcm2835-isp: Fix compiler warning
The result of dividing a u32 by a size_t is an unsigned int on arm32
and a long unsigned int on arm64. Use "%zu" (the size_t format) to
remove the build warning for 64-bit builds.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
staging: vc04_services: isp: Set the YUV420/YVU420 format stride to 64 bytes
The bcm2835 ISP requires the base address of all input/output planes to have 32
byte alignment. Using a Y stride of 32 bytes would not guarantee that the V
plane would fulfil this, e.g. a height of 650 lines would mean the V plane
buffer is not 32 byte aligned for YUV420 formats.
Having a Y stride of 64 bytes would ensure both U and V planes have a 32 byte
alignment, as the luma height will always be an even number of lines.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
vc04_services: isp: Report input node as wanting full range RAW color space
RAW color spaces are more usually reported as having full range
quantization.
Tested using libcamera.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
drivers: bcm2835_isp: Allow multiple users for the ISP driver.
Add a second (identical) set of device nodes to allow concurrent use of the ISP
hardware by another user. This change effectively creates a second state
structure (struct bcm2835_isp_dev) to maintain independent state for the second
user. Node and media entity names are appened with the instance index
appropriately.
Further users can be added by changing the BCM2835_ISP_NUM_INSTANCES define.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: bcm2835_isp: Fix div by 0 bug.
Fix a possible division by 0 bug when setting up the mmal port for the stats
port.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
staging/bcm2835-isp: Fix cleanup after init fail
bcm2835_isp_remove is called on an initialisation failure, but at that
point the drvdata hasn't been set. This causes a crash when e.g. using
the cutdown firmware (gpu_mem=16).
Move platform_set_drvdata before the instance probing loop to avoid the
problem.
See: https://github.com/raspberrypi/linux/issues/4774
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
bcm2835-v4l2-isp: Add missing lock initialization
ISP device allocation is dynamic hence the locks too.
struct mutex queue_lock is not initialized which result in bug.
Fixing same by initializing it.
[ 29.847138] INFO: trying to register non-static key.
[ 29.847156] The code is fine but needs lockdep annotation, or maybe
[ 29.847159] you didn't initialize this object before use?
[ 29.847161] turning off the locking correctness validator.
[ 29.847167] CPU: 1 PID: 343 Comm: v4l_id Tainted: G C 5.15.11-rt24-v8+ #8
[ 29.847187] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT)
[ 29.847194] Call trace:
[ 29.847197] dump_backtrace+0x0/0x1b8
[ 29.847227] show_stack+0x20/0x30
[ 29.847240] dump_stack_lvl+0x8c/0xb8
[ 29.847254] dump_stack+0x18/0x34
[ 29.847263] register_lock_class+0x494/0x4a0
[ 29.847278] __lock_acquire+0x80/0x1680
[ 29.847289] lock_acquire+0x214/0x3a0
[ 29.847300] mutex_lock_nested+0x70/0xc8
[ 29.847312] _vb2_fop_release+0x3c/0xa8 [videobuf2_v4l2]
[ 29.847346] vb2_fop_release+0x34/0x60 [videobuf2_v4l2]
[ 29.847367] v4l2_release+0xc8/0x108 [videodev]
[ 29.847453] __fput+0x8c/0x258
[ 29.847476] ____fput+0x18/0x28
[ 29.847487] task_work_run+0x98/0x180
[ 29.847502] do_notify_resume+0x228/0x3f8
[ 29.847515] el0_svc+0xec/0xf0
[ 29.847523] el0t_64_sync_handler+0x90/0xb8
[ 29.847531] el0t_64_sync+0x180/0x184
Signed-off-by: Padmanabha Srinivasaiah <treasure4paddy@gmail.com>
staging: vc04_services: isp: Permit all sRGB colour spaces on ISP outputs
ISP outputs actually support all colour spaces that are fundamentally
sRGB underneath, regardless of whether an RGB or YUV output format is
actually requested.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
drivers: staging: bcm2835-isp: Do not cleanup mmal vcsm buffer on stop_streaming
On stop_streaming() the vcsm buffer handle gets released by the buffer cleanup
code. This will subsequently cause and error if userland re-queues the same
buffer on the next start_streaming() call.
Remove this cleanup code and rely on the vb2_ops->buf_cleanup() call to do the
cleanups instead.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: staging: bcm2835-isp: Clear LS table handle in the firmware
When all nodes have stopped streaming, ensure the firmware has released its
handle on the LS table dmabuf. This is done by passing a null handle in the
LS params.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: staging: bcm2835-isp: Respect caller's stride value
The stride value reported for output image buffers should be at least
as large as any value that was passed in by the caller (subject to
correct alignment for the pixel format). If the value is zero (meaning
no value was passed), or is too small, the minimum acceptable value
will be substituted.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
staging: vc04_services: bcm2835-isp: Drop include Makefile directive
Drop the include directive. They can break the build, when one only
wants to build a subdirectory. Replace with "../" for the includes in
the bcm2835-isp instead.
The fix is equivalent to the four patches between 29d49a76c5
("staging: vc04_services: bcm2835-audio: Drop include Makefile
directive")...2529ca211402 ("staging: vc04_services: interface: Drop
include Makefile directive")
Fixes: c8f89c9551c1 ("staging: vc04_services: ISP: Add a more complex ISP processing component")
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
staging: vc04_services: bcm2835-v4l2-isp: Register with vchiq_bus_type
Register the bcm2835-v4l2-isp driver with the vchiq_bus_type instead of
using the platform driver/device.
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
staging: vc04_services: bcm2835-v4l2-isp: Explicitly set DMA mask
The platform model originally handled the DMA mask. Now that
we are on the vchiq_bus we need to explicitly set this.
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
drivers: media: bcm2835_isp: Cache LS table dmabuf
Clients such as libcamera do not change the LS table dmabuf on every
frame. In such cases instead of mapping/remapping the same dmabuf on
every frame to send to the firmware, cache the dmabuf once and only
update and remap if the dmabuf has been changed by the userland client.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
This file defines the userland interface to the bcm2835-isp driver
that will follow in a separate commit.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
uapi: bcm2835-isp: Add colour denoise configuration
Add a configuration structure for colour denoise to the bcm2835_isp
driver.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
This adds a V4L2 memory to memory device that wraps the MMAL
video decode and video_encode components for H264 and MJPEG encode
and decode, MPEG4, H263, and VP8 decode (and MPEG2 decode
if the appropriate licence has been purchased).
This patch squashes all the work done in developing the driver
on the Raspberry Pi rpi-5.4.y kernel branch.
Thanks to Kieran Bingham, Aman Gupta, Chen-Yu Tsai, and
Marek Behún for their contributions. Please refer to the
rpi-5.4.y branch for the full history.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835-codec: Ensure OUTPUT timestamps are always forwarded
The firmware by default tries to ensure that decoded frame
timestamps always increment. This is counter to the V4L2 API
which wants exactly the OUTPUT queue timestamps passed to the
CAPTURE queue buffers.
Disable the firmware option.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/vc04_services/codec: Add support for CID MPEG_HEADER_MODE
Control V4L2_CID_MPEG_VIDEO_HEADER_MODE controls whether the encoder
is meant to emit the header bytes as a separate packet or with the
first encoded frame.
Add support for it.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/vc04_services/codec: Clear last buf dequeued flag on START
It appears that the V4L2 M2M framework requires the driver to manually
call vb2_clear_last_buffer_dequeued on the CAPTURE queue during a
V4L2_DEC_CMD_START.
Add such a call.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/vc04-services/codec: Fix logical precedence issue
Two issues identified with operator precedence in logical
expressions. Fix them.
https://github.com/raspberrypi/linux/issues/4040
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
vc04_services: bcm2835-codec: Switch to s32fract
staging/bcm2835-codec: Add the unpacked (16bpp) raw formats
Now that the firmware supports the unpacked (16bpp) variants
of the MIPI raw formats, add the mappings.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835-codec: Log the number of excess supported formats
When logging that the firmware has provided more supported formats
than we had allocated storage for, log the number allocated and
returned.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835-codec: Add support for pixel aspect ratio
If the format is detected by the driver and a V4L2_EVENT_SOURCE_CHANGE
event is generated, then pass on the pixel aspect ratio as well.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835-codec: Implement additional g_selection calls for decode
v4l_cropcap calls our vidioc_g_pixelaspect function to get the pixel
aspect ratio, but also calls g_selection for V4L2_SEL_TGT_CROP_BOUNDS
and V4L2_SEL_TGT_CROP_DEFAULT. Whilst it allows for vidioc_g_pixelaspect
not to be implemented, it doesn't allow for either of the other two.
Add in support for the additional selection targets.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835-codec: Add VC-1 support.
Providing the relevant licence has been purchased, then Pi0-3
can decode VC-1.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835-codec: Fix support for levels 4.1 and 4.2
The driver said it supported H264 levels 4.1 and 4.2, but
was missing the V4L2 to MMAL mappings.
Add in those mappings.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835-codec: Set the colourspace appropriately for RGB formats
Video decode supports YUV and RGB formats. YUV needs to report SMPTE170M
or REC709 appropriately, whilst RGB should report SRGB.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835-codec: Pass corrupt frame flag.
MMAL has the flag MMAL_BUFFER_HEADER_FLAG_CORRUPTED but that
wasn't being passed through, so add it.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835-codec: Do not update crop from S_FMT after res change
During decode, setting the CAPTURE queue format was setting the crop
rectangle to the requested height before aligning up the format to
cater for simple clients that weren't expecting to deal with cropping
and the SELECTION API.
This caused problems on some resolution change events if the client
didn't also then use the selection API.
Disable the crop update after a resolution change.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
bcm2835: Allow compressed frames to set sizeimage (#4386)
Allow the user to set sizeimage in TRY_FMT and S_FMT if the format
flags have V4L2_FMT_FLAG_COMPRESSED set
Signed-off-by: John Cox <jc@kynesim.co.uk>
staging/bcm2835-codec: Change the default codec res to 32x32
In order to effectively guarantee that a V4L2_EVENT_SOURCE_CHANGE
event occurs, adopt a default resolution of 32x32 so that it
is incredibly unlikely to be decoding a stream of that resolution
and therefore failing to note a "change" requiring the event.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835-codec: Add support for decoding interlaced streams
The video decoder can support decoding interlaced streams, so add
the required plumbing to signal this correctly.
The encoder and ISP do NOT support interlaced data, so trying to
configure an interlaced format on those nodes will be rejected.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835-codec: Correct ENUM_FRAMESIZES stepsize to 2
Being YUV420 formats, the step size is always 2 to avoid part
chroma subsampling.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835-codec: Return buffers to QUEUED not ERROR state
Should start_streaming fail, or buffers be queued during
stop_streaming, they should be returned to the core as QUEUED
and not (as currently) as ERROR.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835_codec: Log MMAL flags in hex
The flags is a bitmask, so it's far easier to interpret as hex
data instead of decimal.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: bcm2835-codec: Allow custom specified strides/bytesperline.
If the client provides a bytesperline value in try_fmt/s_fmt then
validate it and correct if necessary.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835_codec: Add support for image_fx to deinterlace
Adds another /dev/video node wrapping image_fx doing deinterlace.
Co-developed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
staging/bcm2835-v4l2_codec: Fix for encode selection API
Matches correct behaviour from DECODE and DEINTERLACE
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
staging: bcm2835-codec: Allow decode res changed before STREAMON(CAPTURE)
The V4L2 stateful video decoder API requires that you can STREAMON
on only the OUTPUT queue, feed in buffers, and wait for the
SOURCE_CHANGE event.
This requires that we enable the MMAL output port at the same time
as the input port, because the output port is the one that creates
the SOURCE_CHANGED event.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835-codec: Do not send buffers to the VPU unless streaming
With video decode we now enable both input and output ports on
the component. This means that buffers will get passed to the VPU
earlier than desired if they are queued befoer STREAMON.
Check that the queue is streaming before sending buffers to the VPU.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: bcm2835-codec: Format changed should trigger drain
When a format changed event occurs, the spec says that it
triggers an implicit drain, and that needs to be signalled
via -EPIPE.
For BCM2835, the format changed event happens at the point
the format change occurs, so no further buffers exist from
before the resolution changed point. We therefore signal the
last buffer immediately.
We don't have a V4L2 available to us at this point, so set
the videobuf2 queue last_buffer_dequeued flag directly.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: bcm2835-codec: Signal the firmware to stop on all changes
The firmware defaults to not stopping video decode if only the
pixel aspect ratio or colourspace change. V4L2 requires us
to stop decoding on any change, therefore tell the firmware
of the desire for this alternate behaviour.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: bcm2835-codec: Queue flushed buffers instead of completing
When a buffer is returned on a port that is disabled, return it
to the videobuf2 QUEUED state instead of DONE which returns it
to the client.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: bcm2835_codec: Correct flushing code for refcounting
Completions don't reference count, so setting the completion
on the first buffer returned and then not reinitialising it
means that the flush function doesn't behave as intended.
Signal the completion when the last buffer is returned.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: bcm2835-codec: Ensure all ctrls are set on streamon
Currently the code was only setting some controls from
bcm2835_codec_set_ctrls, but it's simpler to use
v4l2_ctrl_handler_setup to avoid forgetting to adding new
controls to the list.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: bcm2835-codec: Add support for H&V Flips to ISP
The ISP can do H & V flips whilst resizing or converting
the image, so expose that via V4L2_CID_[H|V]FLIP.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
bcm2835-v4l2-codec: Remove advertised support of VP8
The support for this format by firmware is very limited
and won't be faster than the arm.
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
Pass V4L2_CID_MPEG_VIDEO_H264_MIN_QP/MAX_QP to bcm2835-v4l2-codec
Following raspberrypi/linux#4704. This is necessary to set up
quantization for variable bitrate to avoid video flickering.
staging/bcm2835-codec: bytesperline for YUV420/YVU420 needs to be 64
Matching https://github.com/raspberrypi/linux/pull/4419, the ISP
block (which is also used on the input of the encoder, and output
of the decoder) needs the base address of all planes to be aligned
to multiples of 32. This includes the chroma planes of YUV420 and
YVU420.
If the height is only a multiple of 2 (not 4), then you get an odd
number of lines in the second plane, which means the 3rd plane
starts at a multiple of bytesperline/2.
Set the minimum bytesperline alignment to 64 for those formats
so that the plane alignment is always right.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835-codec: Allow a different stride alignment per role
Deinterlace and decode aren't affected in the same way as encode
and ISP by the alignment requirement on 3 plane YUV420.
Decode would be affected, but it always aligns the height up to
a macroblock, and uses the selection API to reflect that.
Add in the facility to set the bytesperline alignment per role.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: vc04_services: codec: Add support for V4L2_PIX_FMT_RGBA32 format
We already support V4L2_PIX_FMT_BGR32 which is the same thing with red
and blue swapped, so it makes sense to include this variant as well.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
bcm2835-codec: Return empty buffers to the VPU instead of queueing to vbuf2
The encoder can skip frames totally should rate control overshoot
the target bitrate too far. In this situation it generates an
output buffer of length 0.
V4L2 treats a buffer of length 0 as an end of stream flag, which is
not appropriate in this case, therefore we can not return that buffer
to the client.
The driver was returning the buffer to videobuf2 in the QUEUED state,
however that buffer was then not dequeued again, so the number of
buffers was reduced each time this happened. In the pathological
case of using GStreamer's videotestsrc in mode 1 for noise, this happens
sufficiently frequently to totally stall the pipeline.
If the port is still enabled then return the buffer straight back to
the VPU rather than to videobuf2.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
vc04_services: bcm2835-codec: Add support for V4L2_PIX_FMT_NV12_COL128
V4L2_PIX_FMT_NV12_COL128 is supported by the ISP and the input of
video_encode, output of video_decode, and both input and output
of the ISP.
Add in the plumbing to support the format on those ports.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
vc04_services: bcm2835-codec: Set crop_height for compressed formats
In particular for the encoder where the CAPTURE format dictates
the parameters given to the codec we need to be able to set the
value passed as the crop_height for the compressed format.
There's no crop available for cropped modes, so always set
crop_height to the requested height.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
vc04_services: bcm2835-codec: Set port format from s_selection
s_selection allows the crop region of an uncompressed pixel
format to be specified, but it wasn't passing the setting on to
the firmware. Depending on call order this would potentially
mean that the crop wasn't actioned.
Set the port format on s_selection if we have a component created.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
bcm2835-codec: /dev/video31 as interface to image_encode JPEG encoder
Signed-off-by: Maxim Devaev <mdevaev@gmail.com>
bcm2835-v4l2-codec: support H.264 5.0 and 5.1 levels
vc04_services: bcm2835-codec: Remove redundant role check
vidioc_try_encoder_cmd checks the role, but the ioctl is disabled
for any roles in which it is invalid.
Remove the redundant check.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
vc04_services: bcm2835-codec: Allow encoder_cmd on ISP and deinterlace
ISP and deinterlace also need a mechanism for passing effectively
an EOS through the pipeline to signal when all buffers have been
processed.
VIDIOC_ENCODER_CMD does exactly this for encoders, so reuse the same
function for ISP and deinterlace.
(VIDIOC_DECODER_CMD is slightly different in that it also passes
details of when and how to stop, so is not as relevant).
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
vc04_services: bcm2835_codec: Allow larger images through the ISP
Whilst the codecs are restricted to 1920x1080 / 1080x1920, the ISP
isn't, but the limits advertised via V4L2 was 1920x1920 for all
roles.
Increase the limit to 16k x 16k for the ISP.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835-v4l2-codec: Enable selection ioctl for ISP
The ISP cases do nothing. Remove the break that separates them from the
deinterlace case so they now do the same as deinterlace. This enables
simple width & height setting, but does not enable setting left and
top coordinates.
Signed-off-by: John Cox <jc@kynesim.co.uk>
media: bcm2835-v4l2-codec: Add profile & level ctrls to decode
In order to support discovery of what profile & levels are supported by
stateful decoders implement the profile and level controls where they
are defined by V4L2.
Signed-off-by: John Cox <jc@kynesim.co.uk>
vc04_services: bcm2835_codec: Ignore READ_ONLY ctrls in s_ctrl
In adding the MPEG2/MPEG4/H264 level and profile controls to
the decoder, they weren't declared as read-only, nor handlers
added to bcm2835_codec_s_ctrl. That resulted in an error message
"Invalid control" being logged every time v4l2_ctrl_handler_setup
was called from bcm2835_codec_create_component.
Define those controls as read only, and exit early from s_ctrl
on read only controls.
Fixes: "media: bcm2835-v4l2-codec: Add profile & level ctrls to decode"
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
vc04_services: bcm2835_codec: Set MPEG2_LEVEL control to READ_ONLY
V4L2_CID_MPEG_VIDEO_MPEG2_LEVEL was missed from
"vc04_services: bcm2835_codec: Ignore READ_ONLY ctrls in s_ctrl"
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: bcm2835-codec: Add V4L2_CID_MPEG_VIDEO_B_FRAMES control
FFmpeg insists on trying to set V4L2_CID_MPEG_VIDEO_B_FRAMES to
0, and generates an error should it fail.
As our encoder doesn't support B frames, add a stub handler for
it to silence FFmpeg.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: bcm2835-codec: Add support for V4L2_CID_MPEG_VIDEO_GOP_SIZE
For H264, V4L2_CID_MPEG_VIDEO_H264_I_PERIOD is meant to be the intra
I-frame period, whilst V4L2_CID_MPEG_VIDEO_GOP_SIZE is the intra IDR
frame period.
The firmware encoder doesn't produce I-frames that aren't IDR as well,
therefore V4L2_CID_MPEG_VIDEO_GOP_SIZE is technically the correct
control, however users may have adopted V4L2_CID_MPEG_VIDEO_H264_I_PERIOD.
Add support for V4L2_CID_MPEG_VIDEO_GOP_SIZE controlling the encoder,
and have VIDIOC_S_CTRL for V4L2_CID_MPEG_VIDEO_H264_I_PERIOD update
the value for V4L2_CID_MPEG_VIDEO_GOP_SIZE (the reverse is not
implemented).
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: bcm2835-codec: Add missing alignment for V4L2_PIX_FMT_RGBA32
The patch adding image encode (JPEG) to the driver missed adding
the alignment constraint for V4L2_PIX_FMT_RGBA32, which meant
it ended up giving a stride and size of 0.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: bcm2835-codec: Downgrade the level for a debug message
The debug message from bcm2835_codec_buf_prepare when the buffer
size is incorrect can be a little spammy if the application isn't
careful on how it drives it, therefore drop the priority of the
message.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
vc04_services: bcm2835-codec: Correct alignment requirements for YUYV
The firmware wants the YUYV format stride alignment to be to a multiple
of 32pixels / 64 bytes. The kernel driver was configuring it to a multiple
of 16 pixels / 32 bytes, which then failed when it tried starting to
stream.
Correct the alignment requirements.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: bcm2835-codec: Fix up for 6.8 - use ignore_cap_streaming
Drops downstream patch to v4l2_mem2mem, and uses the new mainline
flag to achieve the same functionality
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: bcm2835-codec: 32bpp RGB formats need a 64byte alignment
The firmware needs 16 pixel alignment on RGBx 32bpp formats, which
would be 64 byte. The driver was only setting 32byte alignment.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: bcm2835_codec: Pass framerate to the component if set late
For video encoding, if the framerate was set after the component
was created, then it wasn't set correctly on the port, and an
old value was encoded in the bitstream.
Update the port status when the framerate is set.
https://github.com/raspberrypi/rpicam-apps/issues/664
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: vc04_services: bcm2835-codec: Drop include Makefile directive
Drop the include directive. They can break the build, when one only
wants to build a subdirectory. Replace with "../" for the includes in
the bcm2835-v4l2-codec instead.
The fix is equivalent to the four patches between 29d49a76c5
("staging: vc04_services: bcm2835-audio: Drop include Makefile
directive")...2529ca211402 ("staging: vc04_services: interface: Drop
include Makefile directive")
Fixes: afaec52747 ("staging: vc04_services: Add a V4L2 M2M codec driver")
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
staging: vc04_services: bcm2835-v4l2-codec: Register with vchiq_bus_type
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
staging: vc04_services: bcm2835-codec: Explicitly set DMA mask
The platform model originally handled the DMA mask. Now that
we are on the vchiq_bus we need to explicitly set this.
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
staging: bcm2835-codec: Disable HEADER_ON_OPEN for video encode
Video encode can defer generating the header until the first
frame is presented, which allows it to take the colourspace
information from the frame rather than just the format.
Enable that for the V4L2 driver now that the firmware populates
all the parameters.
https://github.com/raspberrypi/firmware/issues/1885
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: bcm2835-codec: Add support for H264 level 5.0 and 5.1
We do NOT claim to support decoding in real-time for these levels,
but can transcode some content, and handle 1920x1200.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
vc04_services: codec: Allocate the max number of buffers on the VPU
The VPU's API can't match the use of VIDIOC_CREATE_BUFS to add buffers
to the internal pool whilst a port is enabled, therefore allocate
the maximum number of buffers possible in V4L2 to avoid the issue.
As these are only buffer headers, the overhead is relatively small.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
vc04_services: vchiq-mmal: Add defines for mmal_es_format flags
There is a flags field in struct mmal_es_format, but the defines
for what the bits meant weren't included in the headers.
For V4L2_PIX_FMT_NV12_COL128 support we need them, so add them in.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
With the vc-sm-cma driver we can support zero copy of buffers between
the kernel and VPU. Add this support to mmal-vchiq.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
vc-sm-cma: fixed kbuild problem
error logs:
drivers/staging/vc04_services/vc-sm-cma/Kconfig:1:error: recursive dependency detected!
drivers/staging/vc04_services/vc-sm-cma/Kconfig:1: symbol BCM_VC_SM_CMA is selected by BCM2835_VCHIQ_MMAL
drivers/staging/vc04_services/vchiq-mmal/Kconfig:1: symbol BCM2835_VCHIQ_MMAL depends on BCM2835_VCHIQ
drivers/staging/vc04_services/Kconfig:14: symbol BCM2835_VCHIQ is selected by BCM_VC_SM_CMA
For a resolution refer to Documentation/kbuild/kconfig-language.rst
subsection "Kconfig recursive dependency limitations"
Tested-by: make ARCH=arm64 bcm2711_defconfig
Test platform: fedora 33
Branch: rpi-5.10.y
Add Broadcom VideoCore Shared Memory support.
This new driver allows contiguous memory blocks to be imported
into the VideoCore VPU memory map, and manages the lifetime of
those objects, only releasing the source dmabuf once the VPU has
confirmed it has finished with it.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: vcsm-cma: Fix memory leak from not detaching dmabuf
When importing there was a missing call to detach the buffer,
so each import leaked the sg table entry.
Actually the release process for both locally allocated and
imported buffers is identical, so fix them to both use the same
function.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/vc-sm-cma: Avoid log spamming on Pi0/1 over cache alias.
Pi 0/1 use the 0x80000000 cache alias as the ARM also sees the world
through the VPU L2 cache.
vc-sm-cma was trying to ensure it was in an uncached alias (0xc), and
complaining on every allocation if it weren't. Reduce this logging.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
vc-sm-cma: Restore correct cache maintainance operations
We have been using the more expensive flush operations rather than
invalidate and clean since kernel rpi-5.9.y
These are exposed with:
52f1453513 Re-expose some dmi APIs for use in VCSM
But I believe that commit was dropped when (non-cma) vc-sm was dropped,
and didn't get updated when the commit was restored
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
staging: vc04_services: Fix clang14 warning
Insert a break to fix a fallthrough warning from clang14. Since the
fallthrough was to another break, this is a cosmetic change.
See: https://github.com/raspberrypi/linux/issues/5078
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
vc04_services/vc-sm-cma: Handle upstream require vchiq_instance to be passed around
vc04_services/vc-sm-cma: Switch one-bit bitfields to bool
Clang 16 warns:
../drivers/staging/vc04_services/vc-sm-cma/vc_sm.c:816:19: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion]
buffer->imported = 1;
^ ~
../drivers/staging/vc04_services/vc-sm-cma/vc_sm.c:822:17: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion]
buffer->in_use = 1;
^ ~
2 warnings generated.
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
vc04_services: vcsm-cma: Detach from the correct dmabuf
Commit d3292daee3 ("dma-buf: Make locking consistent in dma_buf_detach()")
added checking that the same dmabuf for which dma_buf_attach
was called is passed into dma_buf_detach, which flagged up
that vcsm-cma was passing in the wrong dmabuf.
Correct this so that we don't get the WARN on every dma_buf
release.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: vc04_services: vc-sm-cma: Remove deprecated header
The vchiq_connected.h header was removed in f875976ecf ("staging:
vc04_services: Drop vchiq_connected.[ch] files") to simplify the
implementation.
Update the vc_sm driver accordingly which can still use the same
functions through the vchiq_arm.h header declarations.
Fixes: b1ab7a05eb6c ("staging: vc04_services: Add new vc-sm-cma driver")
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
staging: vc04_services: vc-sm-cma: Drop include Makefile directive
Drop the include directive. They can break the build, when one only
wants to build a subdirectory. Replace with "../" for the includes in
the vc_sm files instead.
The fix is equivalent to the four patches between 29d49a76c5
("staging: vc04_services: bcm2835-audio: Drop include Makefile
directive")...2529ca211402 ("staging: vc04_services: interface: Drop
include Makefile directive")
Fixes: b1ab7a05eb6c ("staging: vc04_services: Add new vc-sm-cma driver")
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
staging: vc04_services: vc-sm-cma: Register with vchiq_bus_type
Register the vcsm rive with the vchiq_bus_type instead of useing the
platform driver/device.
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
staging: vc04_services: vc-sm-cma: Explicitly set DMA mask
The platform model originally handled the DMA mask. Now that
we are on the vchiq_bus we need to explicitly set this.
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
staging: vc04_services: vc-sm-cma: Use [map|unmap]_attachment_unlocked
lockdep throws warnings when using libcamera as buffers are
mapped and unmapped as the dmabuf->resv lock hasn't been taken.
Switch to using the _unlocked variants so that the framework takes
the lock.
https://github.com/raspberrypi/linux/issues/6814
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: vc04_services: vc-sm-cma: Use a mutex instead of spinlock
There are no contexts where we should be calling the kernelid_map
IDR functions where we can't sleep, so switch from using a spinlock
to using a mutex.
https://github.com/raspberrypi/linux/issues/6815
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Increase the delay before entering the lower power state to 2 seconds
(the maximum allowed) in order to reduce the packet latencies,
particularly for inbound packets.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Display variants are intended as a replacement for the now-deleted
fbtft_device drivers. Drivers can register additional compatible
strings with a custom callback that can make the required changes
to the fbtft_display structure.
Start the ball rolling by adding adafruit18, adafruit18_green and
sainsmart18 displays.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The actpwr trigger is a meta trigger that cycles between an inverted
mmc0 and default-on. It is written in a way that could fairly easily
be generalised to support alternative sets of source triggers.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The upstream Unicam driver needs a set of userland changes to get
libcamera to run, and those aren't written or merged yet.
Move the "brcm,bcm2835-unicam" compatible from the upstream driver
to the old downstream version so that users can run libcamera
against 6.10.
Once the libcamera changes have been merged this can be reverted
to use the upstream driver.
If using the non-legacy compatible then assume we want to use
media-controller API for configuration.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Add a driver for the Unicam camera receiver block on BCM283x processors.
Compared to the bcm2835-camera driver present in staging, this driver
handles the Unicam block only (CSI-2 receiver), and doesn't depend on
the VC4 firmware running on the VPU.
The commit is made up of a series of changes cherry-picked from the
rpi-5.4.y branch of https://github.com/raspberrypi/linux/ with
additional enhancements, forward-ported to the mainline kernel.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reported-by: kbuild test robot <lkp@intel.com>
media: bcm2835-unicam: Add support for get_mbus_config to set num lanes
Use the get_mbus_config pad subdev call to allow a source to use
fewer than the number of CSI2 lanes defined in device tree.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835-unicam: Avoid gcc warning over {0} on endpoint
Older gcc versions object to = { 0 } initialisation if the first
elemtn in the structure is a substructure.
Use = { } to avoid this compiler warning.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835-unicam: Reinstate V4L2_CAP_READWRITE in the caps
v4l2-compliance throws a failure if the device doesn't advertise
V4L2_CAP_READWRITE but allows read or write operations.
We do support read, so reinstate the flag.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835-unicam: Ensure type is VIDEO_CAPTURE in [g|s]_selection
[g|s]_selection pass in a buffer type that needs to be validated
before passing on to the sensor subdev.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835: unicam: Set VPU min clock freq to 250Mhz.
When streaming with Unicam, the VPU must have a clock frequency of at
least 250Mhz. Otherwise, the input fifos could overrun, causing
image corruption.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: bcm2835-unicam: Drop WARN on uing direct cache alias
Pi 0&1 pass all ARM accesses through the VPU L2 cache, therefore
the dma-ranges property sets the cache alias bits to other
than the direct alias, hence this WARN was firing.
It was overprotective coding, so assume that everything is OK
with the dma-ranges, and remove the WARN.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835-unicam: Always service interrupts
From when bringing up the driver, there was a check in the isr
to ignore interrupts (claiming them handled) should the driver
not be streaming.
The VPU now will not register a camera driver if it finds a
CSI2 node enabled in device tree, therefore this flawed check is
redundant.
https://github.com/raspberrypi/linux/issues/3602
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835: unicam: Fix uninitialized warning
Signed-off-by: Jacko Dirks <jdirks.linuxdev@gmail.com>
media: bcm2835-unicam: Fixup review comments from Hans.
Updates the driver based on the upstream review comments from
Hans Verkuil at https://patchwork.linuxtv.org/patch/63531/
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835-unicam: Retain packing information on G_FMT
The change to retrieve the pixel format always on g_fmt didn't
check whether the native or unpacked version of the format
had been requested, and always returned the packed one.
Correct this so that the packing setting is retained whereever
possible.
Fixes "9d59e89 media: bcm2835-unicam: Re-fetch mbus code from subdev
on a g_fmt call"
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835-unicam: change minimum number of vb2_queue buffers to 1
Since the unicam driver was modified to write to a dummy buffer when no
user-supplied buffer is available, it can now write to and return a
buffer even when there's only a single one. Enable this by changing the
min_buffers_needed in the vb2_queue; it will be useful for enabling
still captures without allocating more memory than absolutely necessary.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
staging: vc04_services: ISP: Add a more complex ISP processing component
Driver for the BCM2835 ISP hardware block. This driver uses the MMAL
component to program the ISP hardware through the VC firmware.
The ISP component can produce two video stream outputs, and Bayer
image statistics. This can't be encompassed in a simple V4L2
M2M device, so create a new device that registers 4 video nodes.
This patch squashes all the development patches from the earlier
rpi-5.4.y branch into one
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
staging/bcm2835-isp: Add the unpacked (16bpp) raw formats
Now that the firmware supports the unpacked (16bpp) variants
of the MIPI raw formats, add the mappings.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging/bcm2835-isp: Log the number of excess supported formats
When logging that the firmware has provided more supported formats
than we had allocated storage for, log the number allocated and
returned.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
staging: vc04_services: ISP: Add colour denoise control
Add colour denoise control to the bcm2835 driver through a new v4l2
control: V4L2_CID_USER_BCM2835_ISP_CDN.
Add the accompanying MMAL configuration structure definitions as well.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
bcm2835-isp: Allow formats with different colour spaces.
Each supported format now includes a mask showing the allowed colour
spaces, as well as a default colour space for when one was not
specified.
Additionally we translate the colour space to mmal format and pass it
over to the VideoCore.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
media: i2c: add ov9281 driver.
Change-Id: I7b77250bbc56d2f861450cf77271ad15f9b88ab1
Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
media: i2c: ov9281: fix mclk issue when probe multiple camera.
Takes the ov9281 part only from the Rockchip's patch.
Change-Id: I30e833baf2c1bb07d6d87ddb3b00759ab45a90e4
Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
media: i2c: ov9281: add enum_frame_interval function for iq tool 2.2 and hal3
Adds the ov9281 parts of the Rockchip patch adding enum_frame_interval to
a large number of drivers.
Change-Id: I03344cd6cf278dd7c18fce8e97479089ef185a5c
Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
media: i2c: ov9281: Fixup for recent kernel releases, and remove custom code
The Rockchip driver was based on a 4.4 kernel, and had several custom
Rockchip parts.
Update to 5.4 kernel APIs, with the relevant controls required by
libcamera, and remove custom Rockchip parts.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: i2c: ov9281: Read chip ID via 2 reads
Vision Components have made an OV9281 module which blocks reading
back the majority of registers to comply with NDAs, and in doing
so doesn't allow auto-increment register reading as used when
reading the chip ID.
Use two reads and manually combine the results.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: i2c: ov9281: Add support for 8 bit readout
The sensor supports 8 bit mode as well as 10bit, so add the
relevant code to allow selection of this.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: ov9281: Add 1280x720 and 640x480 modes
Breaks out common register set and adds the different registers
for 1280x720 (cropped) and 640x480 (skipped) modes
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Fixed picture line bug in all ov9281 modes
Signed-off-by: Mathias Anhalt <mathiasanhalt@web.de>
Added hflip and vflip controls to ov9281
Signed-off-by: Mathias Anhalt <mathiasanhalt@web.de>
media: i2c: ov9281: Remove override of subdev name
From the original Rockchip driver, the subdev was renamed
from the default to being "mov9281 <dev_name>" whereas the
default would have been "ov9281 <dev_name>".
Remove the override to drop back to the default rather than
a vendor custom string.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: v4l2-subdev: add subdev-wide state struct
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
media: i2c: ov9281: Add fwnode properties controls
Add call to v4l2_ctrl_new_fwnode_properties to read and
create the fwnode based controls.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: i2c: ov9281: Sensor should report RAW color space
Tested on Raspberry Pi running libcamera.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
Partial revert "media: i2c: add ov9281 driver."
This partially reverts commit 84e98e3a4f.
The commit had merged some changes to other drivers with adding the ov9281
driver. Only the ov9281 parts have been reverted.
staging/bcm2835-isp: Fix compiler warning
The result of dividing a u32 by a size_t is an unsigned int on arm32
and a long unsigned int on arm64. Use "%zu" (the size_t format) to
remove the build warning for 64-bit builds.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
staging: vc04_services: isp: Set the YUV420/YVU420 format stride to 64 bytes
The bcm2835 ISP requires the base address of all input/output planes to have 32
byte alignment. Using a Y stride of 32 bytes would not guarantee that the V
plane would fulfil this, e.g. a height of 650 lines would mean the V plane
buffer is not 32 byte aligned for YUV420 formats.
Having a Y stride of 64 bytes would ensure both U and V planes have a 32 byte
alignment, as the luma height will always be an even number of lines.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
vc04_services: isp: Report input node as wanting full range RAW color space
RAW color spaces are more usually reported as having full range
quantization.
Tested using libcamera.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
drivers: bcm2835_isp: Allow multiple users for the ISP driver.
Add a second (identical) set of device nodes to allow concurrent use of the ISP
hardware by another user. This change effectively creates a second state
structure (struct bcm2835_isp_dev) to maintain independent state for the second
user. Node and media entity names are appened with the instance index
appropriately.
Further users can be added by changing the BCM2835_ISP_NUM_INSTANCES define.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: bcm2835_isp: Fix div by 0 bug.
Fix a possible division by 0 bug when setting up the mmal port for the stats
port.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
staging/bcm2835-isp: Fix cleanup after init fail
bcm2835_isp_remove is called on an initialisation failure, but at that
point the drvdata hasn't been set. This causes a crash when e.g. using
the cutdown firmware (gpu_mem=16).
Move platform_set_drvdata before the instance probing loop to avoid the
problem.
See: https://github.com/raspberrypi/linux/issues/4774
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
bcm2835-v4l2-isp: Add missing lock initialization
ISP device allocation is dynamic hence the locks too.
struct mutex queue_lock is not initialized which result in bug.
Fixing same by initializing it.
[ 29.847138] INFO: trying to register non-static key.
[ 29.847156] The code is fine but needs lockdep annotation, or maybe
[ 29.847159] you didn't initialize this object before use?
[ 29.847161] turning off the locking correctness validator.
[ 29.847167] CPU: 1 PID: 343 Comm: v4l_id Tainted: G C 5.15.11-rt24-v8+ #8
[ 29.847187] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT)
[ 29.847194] Call trace:
[ 29.847197] dump_backtrace+0x0/0x1b8
[ 29.847227] show_stack+0x20/0x30
[ 29.847240] dump_stack_lvl+0x8c/0xb8
[ 29.847254] dump_stack+0x18/0x34
[ 29.847263] register_lock_class+0x494/0x4a0
[ 29.847278] __lock_acquire+0x80/0x1680
[ 29.847289] lock_acquire+0x214/0x3a0
[ 29.847300] mutex_lock_nested+0x70/0xc8
[ 29.847312] _vb2_fop_release+0x3c/0xa8 [videobuf2_v4l2]
[ 29.847346] vb2_fop_release+0x34/0x60 [videobuf2_v4l2]
[ 29.847367] v4l2_release+0xc8/0x108 [videodev]
[ 29.847453] __fput+0x8c/0x258
[ 29.847476] ____fput+0x18/0x28
[ 29.847487] task_work_run+0x98/0x180
[ 29.847502] do_notify_resume+0x228/0x3f8
[ 29.847515] el0_svc+0xec/0xf0
[ 29.847523] el0t_64_sync_handler+0x90/0xb8
[ 29.847531] el0t_64_sync+0x180/0x184
Signed-off-by: Padmanabha Srinivasaiah <treasure4paddy@gmail.com>
staging: vc04_services: isp: Permit all sRGB colour spaces on ISP outputs
ISP outputs actually support all colour spaces that are fundamentally
sRGB underneath, regardless of whether an RGB or YUV output format is
actually requested.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
drivers: staging: bcm2835-isp: Do not cleanup mmal vcsm buffer on stop_streaming
On stop_streaming() the vcsm buffer handle gets released by the buffer cleanup
code. This will subsequently cause and error if userland re-queues the same
buffer on the next start_streaming() call.
Remove this cleanup code and rely on the vb2_ops->buf_cleanup() call to do the
cleanups instead.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: staging: bcm2835-isp: Clear LS table handle in the firmware
When all nodes have stopped streaming, ensure the firmware has released its
handle on the LS table dmabuf. This is done by passing a null handle in the
LS params.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: staging: bcm2835-isp: Respect caller's stride value
The stride value reported for output image buffers should be at least
as large as any value that was passed in by the caller (subject to
correct alignment for the pixel format). If the value is zero (meaning
no value was passed), or is too small, the minimum acceptable value
will be substituted.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
staging: vc04_services: bcm2835-isp: Drop include Makefile directive
Drop the include directive. They can break the build, when one only
wants to build a subdirectory. Replace with "../" for the includes in
the bcm2835-isp instead.
The fix is equivalent to the four patches between 29d49a76c5
("staging: vc04_services: bcm2835-audio: Drop include Makefile
directive")...2529ca211402 ("staging: vc04_services: interface: Drop
include Makefile directive")
Fixes: c8f89c9551c1 ("staging: vc04_services: ISP: Add a more complex ISP processing component")
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
staging: vc04_services: bcm2835-v4l2-isp: Register with vchiq_bus_type
Register the bcm2835-v4l2-isp driver with the vchiq_bus_type instead of
using the platform driver/device.
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
staging: vc04_services: bcm2835-v4l2-isp: Explicitly set DMA mask
The platform model originally handled the DMA mask. Now that
we are on the vchiq_bus we need to explicitly set this.
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
drivers: media: bcm2835_isp: Cache LS table dmabuf
Clients such as libcamera do not change the LS table dmabuf on every
frame. In such cases instead of mapping/remapping the same dmabuf on
every frame to send to the firmware, cache the dmabuf once and only
update and remap if the dmabuf has been changed by the userland client.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: bcm2835-unicam: Correctly handle error propagation for stream on
On a failure in start_streaming(), the error code would not propagate to
the calling function on all conditions. This would cause the userland
caller to not know of the failure.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: bcm2835-unicam: Return early from stop_streaming() if stopped
clk_disable_unprepare() is called unconditionally in stop_streaming().
This is incorrect in the cases where start_streaming() fails, and
unprepares all clocks as part of the failure cleanup. To avoid this,
ensure that clk_disable_unprepare() is only called in stop_streaming()
if the clocks are in a prepared state.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: bcm2835-unicam: Clear clock state when stopping streaming
Commit 65e08c4650 failed to clear the
clock state when the device stopped streaming. Fix this, as it might
again cause the same problems when doing an unprepare.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: bcm2835-unicam: Fix bug in buffer swapping logic
If multiple sets of interrupts occur simultaneously, it may be unsafe
to swap buffers, as the hardware may already be re-using the current
buffers. In such cases, avoid swapping buffers, and wait for the next
opportunity at the Frame End interrupt to signal completion.
Additionally, check the packet compare status when watching for frame
end for buffers swaps, as this could also signify a frame end event.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: bcm2835-unicam: Forward input status from subdevice
The vidioc_enum_input() v4l2 ioctl is capable of returning
sensor/input status as well. This is used in current
GStreamer HEAD for signal detection [1].
bcm2835-unicam does handle this syscall, but it didn't ask
the subdevice driver about the input status. The input then
appeared as always present.
This commit adds the necessary query. There is a precedent for
this - the R-Car VIN V4L2 driver does a similar call [2].
[1]: ce0be27caf/sys/v4l2/gstv4l2src.c (L553)
[2]: 7fb9d006d3/drivers/media/platform/rcar-vin/rcar-v4l2.c (L548)
Signed-off-by: Jakub Vaněk <linuxtardis@gmail.com>
media/bcm2835-unicam: Parse pad numbers correctly
The driver was making big assumptions about the source device
using pad 0 and 1, which doesn't follow for more complex
devices where Unicam's source device may be a sink device for
something else.
Read the pad numbers through media controller, and reference
them appropriately.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media/bcm2835-unicam: Add support for configuration via MC API
Adds Media Controller API support for more complex pipelines.
libcamera is about to switch to using this mechanism for configuring
sensors.
This can be enabled by either a module parameter, or device tree.
Various functions have been moved to group video-centric and
mc-centric functions together.
Based on a similar conversion done to ti-vpe.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835-unicam: Fixup for 5.18 and new get_mbus_config struct
The number of active CSI2 data lanes has moved within the struct
v4l2_mbus_config used by the get_mbus_config API call.
Update the driver to match the changes in mainline.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drivers: bcm2835_unicam: Add logging message when a frame is dropped.
If a dummy buffer is still active on a frame start, it indicates that this frame
will be dropped. The explicit logging helps users identify performance issues.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: bcm2835_unicam: Disable trigger mode operation
On a Pi3 B/B+ platform the imx219 sensor frequently generates a single corrupt
frame when the sensor first starts. This can either be a missing line, or
invalid samples within the line. This only occurrs using the Unicam kernel
driver.
Disabling trigger mode elimiates this corruption. Since trigger mode is a
legacy feature copied from the firmware driver and not expected to be needed,
remove it. Tested on the Raspberry Pi cameras and shows no ill effects.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: bcm2835-unicam: Set ret on error path in unicam_async_complete()
Clang warns:
drivers/media/platform/bcm2835/bcm2835-unicam.c:3109:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
if (!source_pads) {
^~~~~~~~~~~~
drivers/media/platform/bcm2835/bcm2835-unicam.c:3152:9: note: uninitialized use occurs here
return ret;
^~~
drivers/media/platform/bcm2835/bcm2835-unicam.c:3109:2: note: remove the 'if' if its condition is always false
if (!source_pads) {
^~~~~~~~~~~~~~~~~~~
drivers/media/platform/bcm2835/bcm2835-unicam.c:3091:9: note: initialize the variable 'ret' to silence this warning
int ret;
^
= 0
1 warning generated.
When the if condition is true, ret will be used uninitialized, which
could result in undesirable behavior. Set ret to -ENODEV on the error
path, which is a standard error code for the ->complete() callback.
Fixes: d056e86eb3 ("media/bcm2835-unicam: Parse pad numbers correctly")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
media: bcm2835-unicam: Handle a repeated frame start with no end
In the case of 2 frame starts being received with no frame end
between, the queued buffer held in next_frm was lost as the
pointer was overwritten with the dummy buffer.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835-unicam: Correctly handle FS + FE ISR condtion
If we get a simultaneous FS + FE interrupt for the same frame, it cannot be
marked as completed and returned to userland as the framebuffer will be refilled
by Unicam on the next sensor frame. Additionally, the timestamp will be set to 0
as the FS interrupt handling code will not have run yet.
To avoid these problems, the frame is considered dropped in the FE handler,
and will be returned to userland on the subsequent sensor frame.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: bcm2835-unicam: Fix for possible dummy buffer overrun
The Unicam hardware has been observed to cause a buffer overrun when using the
dummy buffer as a circular buffer. The conditions that cause the overrun are not
fully known, but it seems to occur when the memory bus is heavily loaded.
To avoid the overrun, program the hardware with a buffer size of 0 when using
the dummy buffer. This will cause overrun into the allocated dummy buffer, but
avoid out of bounds writes.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: bcm2835-unicam: Fix up start/stop api change
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
media: bcm2835-unicam: Use mipi-csi2.h header for data type values
The MIPI CSI2 data type ID values are now defined in the
mipi-csi2.h header, so use those defines instead of hard
coding them in the driver.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835-unicam: Add support for RAW16 formats
With the RAW16 formats now having a defined CSI2 data type ID,
they can be added to the driver.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835-unicam: Start and stop media_pipeline with same node
media_pipeline_start and media_pipeline_stop now validate that
the pipeline is being started and stopped with the same pipe
and pad handles.
When running with embedded metadata (eg imx477 and imx708), the
start typically happens from the metadata pad, whilst stop is
always from the image pad.
Always pass the image pad to media_pipeline_start to ensure
that the calls are balanced.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drivers: media: bcm2835_unicam: Improve frame sequence count handling
Ensure that the frame sequence counter is incremented only if a previous
frame start interrupt has occurred, or a frame start + frame end has
occurred simultaneously.
This corresponds the sequence number with the actual number of frames
produced by the sensor, not the number of frame buffers dequeued back
to userland.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
bcm2835-unicam: hacks to allow it to build
media: bcm2835-unicam: Fix up async notifier usage
Fixes "8a090fc3e549 bcm2835-unicam: hacks to allow it to build"
media: bcm2835-unicam: Add option for a GPIO to reflect FS/FE timing
The legacy stack had an option to have a GPIO track frame start and
end events to give basic synchronisation to the incoming image stream.
https://forums.raspberrypi.com/viewtopic.php?t=190314
Replicate this in the kernel Unicam driver.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835-unicam: Add support for 12bit mono packed format
Now that V4L2_PIX_FMT_Y12P is defined, allow passing raw 12bit
mono packed data through the peripheral.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835-unicam: Add support for 14bit mono sources
Now that V4L2_PIX_FMT_Y14 and V4L2_PIX_FMT_Y14P are defined,
allow passing 14bit mono data through the peripheral.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835-unicam: Add support for unpacked 14bit Bayer formats
Now that the 14bit non-packed Bayer formats are defined, add them
into the supported formats lookup table.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: bcm2835-unicam: Reinstate old downstream driver as legacy
Whilst the Unicam driver has now been upstreamed it only supports
configuration via Media Controller (not driven from the /dev/videoN
node), which makes life significantly harder for simple devices such
as mono sensors, and HDMI or analogue video to CSI2 bridge chips
(eg TC358743 and ADV7282M).
Fix up the downstream driver so that it builds, reinstate the links
from Kconfig and Makefile to it, and give it a new Kconfig name
(VIDEO_BCM2835_UNICAM_LEGACY).
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Upstream Linux deems using output GPIOs to generate IRQs as a bogus
use case, even though the BCM2835 GPIO controller is capable of doing
so. A number of users would like to make use of this facility, so
disable the checks.
See: https://github.com/raspberrypi/linux/issues/2527
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
V4L2 wishes to have the codec header bytes in the same buffer as the
first encoded frame, so it does become 1-in 1-out for encoding.
The firmware now has an option to do this, so enable it.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Add V4L2_META_FMT_BCM2835_ISP_STATS V4L2 format type.
This new format will be used by the BCM2835 ISP device to return
out ISP statistics for 3A.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
This patch adds MEDIA_BUS_FMT_SENSOR_DATA used by the bcm2835-unicam
driver to support CSI-2 embedded data streams from camera sensors.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Add V4L2_META_FMT_SENSOR_DATA format 4CC.
This new format will be used by the BCM2835 Unicam device to return
out camera sensor embedded data.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Commit f3186dd876 ("spi: Optionally use GPIO descriptors for CS GPIOs")
amended of_spi_parse_dt() to always set SPI_CS_HIGH for SPI slaves whose
Chip Select is defined by a "cs-gpios" devicetree property.
This change breaks drivers whose probe functions set the mode field of
the spi_device because in doing so they clear the SPI_CS_HIGH flag.
Fix by setting SPI_CS_HIGH in spi_setup (under the same conditions as
in of_spi_parse_dt()).
See also: 83b2a8fe43 ("spi: spidev: Fix CS polarity if GPIO descriptors are used")
Fixes: f3186dd876 ("spi: Optionally use GPIO descriptors for CS GPIOs")
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
SQUASH: spi: Demote SPI_CS_HIGH warning to KERN_DEBUG
This warning is unavoidable from a client's perspective and
doesn't indicate anything wrong (just surprising).
SQUASH with "spi: use_gpio_descriptor fixup moved to spi_setup"
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The DT bindings description of the Brcmstb PCIe device is described. This
node can be used by almost all Broadcom settop box chips, using
ARM, ARM64, or MIPS CPU architectures.
Signed-off-by: Jim Quinlan <jim2101024@gmail.com>
A failure in gpiochip_irqchip_add leads to a leak of a gpiochip. Fix
the leak with the use of devm_gpiochip_add_data.
Fixes: 85ae9e512f ("pinctrl: bcm2835: switch to GPIOLIB_IRQCHIP")
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
bcmn2835_isp is a platform driver dependent on vchiq,
therefore add the load/unload functions for it to vchiq.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
During a bulk transfer we request a DMA allocation to hold the
scatter-gather list. Most of the time, this allocation is small
(<< PAGE_SIZE), however it can be requested at a high enough frequency
to cause fragmentation and/or stress the CMA allocator (think time
spent in compaction here, or during allocations elsewhere).
Implement a pool to serve up small DMA allocations, falling back
to a coherent allocation if the request is greater than
VCHIQ_DMA_POOL_SIZE.
Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
The VCHIQ driver now loads the audio, camera, codec, and vc-sm
drivers as platform drivers. However they were not being given
the correct DMA configuration.
Call of_dma_configure with the parent (VCHIQ) parameters to be
inherited by the child.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
staging: vchiq: Use the old dma controller for OF config on platform devices
vchiq on Pi4 is no longer under the soc node, therefore it
doesn't get the dma-ranges for the VPU.
Switch to using the configuration of the old dma controller as
that will set the dma-ranges correctly.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
staging: vchiq_arm: Give vchiq children DT nodes
vchiq kernel clients are now instantiated as platform drivers rather
than using DT, but the children of the vchiq interface may still
benefit from access to DT properties. Give them the option of a
a sub-node of the vchiq parent for configuration and to allow
them to be disabled.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
staging: vchiq_arm: Add 36-bit address support
Conditional on a new compatible string, change the pagelist encoding
such that the top 24 bits are the pfn, leaving 8 bits for run length
(-1), giving a 36-bit address range.
Manage the split between addresses for the VPU and addresses for the
40-bit DMA controller with a dedicated DMA device pointer that on non-
BCM2711 platforms is the same as the main VCHIQ device. This allows
the VCHIQ node to stay in the usual place in the DT.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
staging: vchiq_arm: children inherit DMA config
Although it is no longer necessary for vchiq's children to have a
different DMA configuration to the parent, they do still need to
explicitly to have their DMA configuration set - to be that of the
parent.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
BCM54213PE is an Ethernet PHY that supports PTP hardware timestamping.
BCM54210PW ia another Ethernet PHY, but one without PTP support.
Unfortunately the two PHYs return the same ID when queried, so some
extra information is required to determine whether the PHY is PTP-
capable.
There are two Raspberry Pi products that use these PHYs - Pi 4B and
CM4 - and fortunately they use different PHY addresses, so use that as
a differentiator. Choose to treat a PHY with the same ID but another
address as a BCM54210PE, which seems more common.
See: https://github.com/raspberrypi/linux/issues/5104
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
It's really a function of the board whether or not to use this feature
as it may require MAC compatibility as well as interop testing.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
The last nibble is a revision ID, and the 54213pe is a later rev
than the 54210e. Running the 54210e setup code on a 54213pe results
in a broken RGMII interface.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
Add device tree entries and code to allow the specification of
the lighting modes for the LED's on the ethernet connector.
Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
net:phy:2711 Change the default ethernet LED actions
This should return default behaviour back to that of previous
releases.
net: phy: broadcom: Make LEDs 3+4 shadow LEDs 1+2
CM4 uses BCM54210PE, which supports 2 additional LEDs, choosing LED3
for the amber LED because it shows activity by default (LED4 is not
connected). However, this makes it uncontrollable by the eth_led<n>
dtparams which target LEDs 1+2.
Solve the problem by making LEDs 3+4 mirror LEDs 1+2 (which is much
simpler than adding baseboard-specific overrides, but comes with a
risk of making one of the LEDs redundant).
See: https://github.com/raspberrypi/linux/issues/5289
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Following the same pattern as bcm2835-camera and bcm2835-audio,
register the V4L2 codec driver as a platform driver
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Following the same pattern as bcm2835-camera and bcm2835-audio,
register the vcsm-cma driver as a platform driver
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The Infineon IRS1125 is a time of flight depth sensor that
has a CSI-2 interface.
Add a V4L2 subdevice driver for this device.
Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
media: irs1125: Using i2c_transfer for ic2 reads
Reading data over i2c is done by using i2c_transfer to ensure that this
operation can't be interrupted.
Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
media: irs1125: Refactoring and debug messages
Changed some variable names to comply with checkpatch --strict mode.
Debug messages added.
Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
media: irs1125: Atomic access to imager reconfiguration
Instead of changing the exposure and framerate settings for all sequences,
they can be changed for every sequence individually now. Therefore the
IRS1125_CID_SAFE_RECONFIG ctrl has been removed and replaced by
IRS1125_CID_SAFE_RECONFIG_S<seq_num>_EXPO and *_FRAME ctrls.
The consistency check in the sequence ctrl IRS1125_CID_SEQ_CONFIG
is removed.
Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
media: irs1125: Keep HW in sync after imager reset
When closing the video device, the irs1125 is put in power down state.
To keep V4L2 ctrls and the HW in sync, v4l2_ctrl_handler_setup is
called after power up.
The compound ctrl IRS1125_CID_MOD_PLL however has a default value
of all zeros, which puts the imager into a non responding state.
Thus, this ctrl is not written by the driver into HW after power up.
The userspace has to take care to write senseful data.
Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
media: i2c: add ov9281 driver.
Change-Id: I7b77250bbc56d2f861450cf77271ad15f9b88ab1
Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
media: i2c: ov9281: fix mclk issue when probe multiple camera.
Takes the ov9281 part only from the Rockchip's patch.
Change-Id: I30e833baf2c1bb07d6d87ddb3b00759ab45a90e4
Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
media: i2c: ov9281: add enum_frame_interval function for iq tool 2.2 and hal3
Adds the ov9281 parts of the Rockchip patch adding enum_frame_interval to
a large number of drivers.
Change-Id: I03344cd6cf278dd7c18fce8e97479089ef185a5c
Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
media: i2c: ov9281: Fixup for recent kernel releases, and remove custom code
The Rockchip driver was based on a 4.4 kernel, and had several custom
Rockchip parts.
Update to 5.4 kernel APIs, with the relevant controls required by
libcamera, and remove custom Rockchip parts.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: i2c: ov9281: Read chip ID via 2 reads
Vision Components have made an OV9281 module which blocks reading
back the majority of registers to comply with NDAs, and in doing
so doesn't allow auto-increment register reading as used when
reading the chip ID.
Use two reads and manually combine the results.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: i2c: ov9281: Add support for 8 bit readout
The sensor supports 8 bit mode as well as 10bit, so add the
relevant code to allow selection of this.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: ov9281: Add 1280x720 and 640x480 modes
Breaks out common register set and adds the different registers
for 1280x720 (cropped) and 640x480 (skipped) modes
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Fixed picture line bug in all ov9281 modes
Signed-off-by: Mathias Anhalt <mathiasanhalt@web.de>
Added hflip and vflip controls to ov9281
Signed-off-by: Mathias Anhalt <mathiasanhalt@web.de>
media: i2c: ov9281: Remove override of subdev name
From the original Rockchip driver, the subdev was renamed
from the default to being "mov9281 <dev_name>" whereas the
default would have been "ov9281 <dev_name>".
Remove the override to drop back to the default rather than
a vendor custom string.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: v4l2-subdev: add subdev-wide state struct
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
media: i2c: ov9281: Add fwnode properties controls
Add call to v4l2_ctrl_new_fwnode_properties to read and
create the fwnode based controls.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: i2c: ov9281: Sensor should report RAW color space
Tested on Raspberry Pi running libcamera.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
Partial revert "media: i2c: add ov9281 driver."
This partially reverts commit 84e98e3a4f.
The commit had merged some changes to other drivers with adding the ov9281
driver. Only the ov9281 parts have been reverted.
media: i2c: Update irs1125 Kconfig entry
Bring the IRS1125 Kconfig declaration in line with upstream entries.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Add name for greyworld to white_balance preset names.
This patch previously applied to v4l2-ctrl.c but that was split
and deleted.
Signed-off-by: John Cox <jc@kynesim.co.uk>
This is mainly used for the NoIR camera which has no IR
filter and can completely confuse normal AWB presets.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
Adds a simple greyworld white balance preset, mainly for use
with cameras without an IR filter (eg Raspberry Pi NoIR)
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
Through emperical testing, the sensor can crop upto a 96x88 window to
produce a valid Bayer frame. Adjust the ROIWH1_MIN ROIWV1_MIN
appropriately for this limit.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Add support for setting horizontal and/or vertial flips in the IMX296
sensor through the V4L2_CID_HFLIP and V4L2_CID_VFLIP controls.
Add a new helper function to return the media bus format code that
depends on the sensor flips.
Grab the V4L2_CID_HFLIP and V4L2_CID_VFLIP controls on stream on, and
release on stream off to ensure flips cannot be changed while the sensor
is streaming.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Set the gain delay to 1 frame in the sensor. This avoids any race
condition or ambiguity over when the setting is applied through
userland.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Add a helper function to setup the horizontal blanking control. Update
the control limits on set_format as the horizontal blanking time must
remain constant regardless of sensor output width.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Add a missing register write (MIPIC_AREA3W) when setting up a crop
window in the sensor to get this functionality working.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
In Fast Trigger mode (external shutter control), FE packet was
not sent at end of frame. Sony recommend this change to fix it.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
Don't assume the camera has been reset each time we start streaming,
but always write registers relating to trigger_mode, even in mode 0.
IMX477: Stop driving XVS on stop streaming, to avoid spurious pulses.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
Updated imx296 driver to support external trigger mode via XTR pin.
Added module parameter to control this mode.
Signed-off-by: Ben Benson <ben.benson@raspberrypi.com>
Disable enumerating and setting of the 2x2 binned mode entirely as it
does not seem to work for either mono or colour sensor variants.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
dt-bindings: media: i2c: Add IMX519 CMOS sensor binding
Add YAML device tree binding for IMX519 CMOS image sensor, and
the relevant MAINTAINERS entries.
Signed-off-by: Lee Jackson <info@arducam.com>
media: i2c: Add driver for IMX519 sensor
Adds a driver for the 16MPix IMX519 CSI2 sensor.
Whilst the sensor supports 2 or 4 CSI2 data lanes, this driver
currently only supports 2 lanes.
The following Bayer modes are currently available:
4656x3496 10-bit @ 10fps
3840x2160 10-bit (cropped) @ 21fps
2328x1748 10-bit (binned) @ 30fps
1920x1080 10-bit (cropped/binned) @ 60fps
1280x720 10-bit (cropped/binned) @ 120fps
Signed-off-by: Lee Jackson <info@arducam.com>
media: i2c: imx519: Advertise embedded data node on media pad 1
This commit updates the imx519 driver to adverise support for embedded
data streams.
The imx519 sensor subdevice overloads the media pad to differentiate
between image stream (pad 0) and embedded data stream (pad 1) when
performing the v4l2_subdev_pad_ops functions.
Signed-off-by: Lee Jackson <info@arducam.com>
media: i2c: imx519: Sensor should report RAW color space
Tested on Raspberry Pi running libcamera.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
media: i2c: Update imx519 Kconfig entry
Bring the IMX519 Kconfig declaration in line with the upstream entries.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
media: i2c: Add PDAF support for IMX519
Add PDAF support for IMX519, and reduce the pixel rate to 426666667,
link freq to 408000000.
Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
drivers: media: imx519: Add V4L2_CID_LINK_FREQ control
Add V4L2_CID_LINK_FREQ as a read-only control with a value of 408 Mhz.
This will be used by the CFE driver to corretly setup the DPHY timing
parameters in the CSI-2 block.
Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
media: i2c: imx519: Squash fixes
dt-bindings: media: i2c: Add IMX477 CMOS sensor binding
Add YAML device tree binding for IMX477 CMOS image sensor.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: Add driver for Sony IMX477 sensor
Adds a driver for the 12MPix Sony IMX477 CSI2 sensor.
Whilst the sensor supports 2 or 4 CSI2 data lanes, this driver
currently only supports 2 lanes.
The following Bayer modes are currently available:
4056x3040 12-bit @ 10fps
2028x1520 12-bit (binned) @ 40fps
2028x1050 12-bit (cropped/binned) @ 50fps
1012x760 10-bit (scaled) @ 120 fps
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: imx477: Add support for adaptive frame control
Use V4L2_CID_EXPOSURE_AUTO_PRIORITY to control if the driver should
automatically adjust the sensor frame length based on exposure time,
allowing variable frame rates and longer exposures.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: imx477: Return correct result on sensor id verification
The test should return -EIO if the register read id does not match
the expected sensor id.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: imx477: Parse and register properties
Parse device properties and register controls for them using the V4L2
fwnode properties helpers.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
media: i2c: imx477: Selection compliance fixes
To comply with the intended usage of the V4L2 selection target when
used to retrieve a sensor image properties, adjust the rectangles
returned by the imx477 driver.
The top/left crop coordinates of the TGT_CROP rectangle were set to
(0, 0) instead of (8, 16) which is the offset from the larger physical
pixel array rectangle. This was also a mismatch with the default values
crop rectangle value, so this is corrected. Found with v4l2-compliance.
While at it, add V4L2_SEL_TGT_CROP_BOUNDS support: CROP_DEFAULT and
CROP_BOUNDS have the same size as the non-active pixels are not readable
using the selection API. Found with v4l2-compliance.
This commit mirrors 543790f777 done for
the imx219 sensor.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: imx477: Remove auto frame length adjusting
The V4L2_CID_EXPOSURE_AUTO_PRIORITY was used to let the sensor control
frame length (effectively framerate) based on the requested exposure
time requested. Remove this feature as it is never used, and goes
against how V4L2 likes to handle exposure and vblank controls.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: imx477: Add very long exposure control to the driver
Add support for very long exposures by using the exposure multiplier
register. Userland does not need to pass any additional controls to
enable long exposures, it simply requests a larger vblank to extend the
exposure control range appropriately.
Currently, since hblank is fixed, a maximum of approximately 124 seconds
of exposure time can be used. In a future change, hblank could also be
controlled in userland to give over 200 seconds of exposure time.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: imx477: Fix crop height for 2028x1080 mode
The crop height for this mode was set at 2600 lines, it should be 2160
lines instead.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: imx477: Replace existing 1012x760 mode
The existing 1012x760 120 fps mode has significant IQ problem using
the internal sensor scaler. Replace this mode with a 1332x990 120 fps
mode instead. This new mode has a smaller field of view, but does not
suffer from the bad IQ of the original mode.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: imx477: Remove internal v4l2_mbus_framefmt from the state
The only field in this struct that is used is the format code, so
replace the struct with this single field.
Save the format code in imx477_set_pad_format() when setting up a new
mode so that imx477_get_pad_format() performs the right lookup.
Otherwise, this caused a bug where the mode lookup occurred on the
12-bit table rather than the 10-bit table.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: imx477: Remove unused function parameter
The struct imx477 *ctrl parameter is not used in the function
imx477_adjust_exposure_range(), so remove it.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: imx477: Fix for long exposure limit calculations
Do not scale IMX477_EXPOSURE_OFFSET with the long exposure factor during
the limit calculations. This allows larger exposure times, and does seem to be
what the sensor is doing internally.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: imx477: Extend driver to support imx378 sensor
The imx378 sensor is almost identical to the imx477 and can be
supported as a "compatible" sensor with just a few extra register
writes.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
media: i2c: imx477: Fix framerates for 1332x990 mode
The imx477 driver's line length for this mode had not been updated to
the value supplied to us by the sensor manufacturer. With this
correction the sensor delivers the framerates that are expected.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
media: i2c: imx477: Allow control of on-sensor DPC
A module parameter "dpc_enable" is added to allow the control of the
sensor's on-board DPC (Defective Pixel Correction) function.
This is a global setting to be configured before using the sensor;
there is no intention that this would ever be changed on-the-fly.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
media: i2c: imx477: Sensor should report RAW color space
Tested on Raspberry Pi running libcamera.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
media: i2c: imx477: Add vsync trigger_mode parameter
trigger_mode == 0 (default) => no effect / no registers written
trigger_mode == 1 => source
trigger_mode == 2 => sink
This can be set e.g. in /boot/cmdline.txt as imx477.trigger_mode=N
Signed-off-by: Jonas Jacob <jonas.jacob@neocortexvision.com>
media: i2c: Update imx477 Kconfig entry
Bring the IMX477 Kconfig declaration in line with upstream entries.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
media: i2c: imx477: Correct minimum exposure lines
The minimum number of exposure lines value (IMX477_EXPOSURE_MIN) was
previously 20 but this is not correct. The datasheet is not completely
explicit, however the new value of 4 has been tested with all the
sensor modes supported by this driver, and matches the lowest exposure
value of 114us that could be achieved wtih Raspberry Pi's legacy
firmware driver.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
media: i2c: imx477: Allow dynamic horizontal blanking control
Currently, the V4L2_CID_HBLANK control is marked as read-only. Remove this
restriction and allow userland to modify the control if needed.
Set the maximum limit of the line length to 0xfff0.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: imx477: Reset hblank on mode switch
Reset the hblank control to the minimum value on every mode switch. This is to
account for userland instances that do not yet control hblank, otherwise it
gets set to a non-optimal value.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: imx477: Do not unconditionally adjust hblank and vblank limits
On a mode change, only call imx477_set_framing_limits() to adjust the hblank
and vblank limits if the new mode is different from the existing mode. This
preserves any manual control values the user might have set.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
driver: media: i2c: imx477: Re-enable temperature sensor
The temperature sensor enable register write got lost at some point.
Re-enable it.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: imx477: Fix locking in imx477_init_controls()
The driver does not lock the imx477 mutex when calling
imx477_set_framing_limits(), leading to:
WARNING: CPU: 3 PID: 426 at drivers/media/v4l2-core/v4l2-ctrls-api.c:934 __v4l2_ctrl_modify_range+0x1a0/0x210 [
videodev]
Fix this by taking the lock.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
drivers: media: imx477: Disable the scaler
The horizontal scaler was enabled for the 2028x1520 and 2028x1080 modes,
with a scale factor of 1. It caused a single column of bad pixels on the
right edge of the image. Since scaling is not needed for these modes,
disable it entirely.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: imx477: Set horizontal binning when disabling the scaler
The horizontal scaler has been disabled but actually the sensor is not
binning horizontally, resulting in images that are stretched 2x
horizontally (missing the right half of the field of view completely).
Therefore we must additionally set the horizontal binning mode. There
is only marginal change in output quality and noise levels.
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
Fixes: f075893e9b ("drivers: media: imx477: Disable the scaler")
drivers: media: imx477: Add V4L2_CID_LINK_FREQ control
Add V4L2_CID_LINK_FREQ as a read-only control with a value of 450 Mhz.
This will be used by the CFE driver to corretly setup the DPHY timing
parameters in the CSI-2 block.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: imx477: Correctly set IMX477_PIXEL_RATE as a r/o control
This control is meant to be read-only, mark it as such.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
drivers: media: i2c: imx296,imx477: Configure tigger_mode every time
Don't assume the camera has been reset each time we start streaming,
but always write registers relating to trigger_mode, even in mode 0.
IMX477: Stop driving XVS on stop streaming, to avoid spurious pulses.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
media: i2c: imx477: Squash fixes
imx477: make trigger-mode more configurable
Allow trigger-mode to be overridden using device tree so that it can be
set per camera. Previously the mode could only be changed using a module
parameter, which would then affect all cameras.
Signed-off-by: Erik Botö <erik.boto@gmail.com>
drivers: media: imx477: Add V4L2_CID_LINK_FREQ control
Add V4L2_CID_LINK_FREQ as a read-only control with a value of 450 Mhz.
This will be used by the CFE driver to corretly setup the DPHY timing
parameters in the CSI-2 block.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
media: i2c: imx477: Add options for slightly modifying the link freq
The default link frequency of 450MHz has been noted to interfere
with GPS if they are in close proximty.
Add the option for 453 and 456MHz to move the signal slightly out
of the band. (447MHz can not be offered as corruption is then observed
on the 133x992 10bit mode).
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
fixup imx477 gps
media: i2c: imx477: Fix link frequency menu
"media: i2c: imx477: Add options for slightly modifying the link freq"
created a link frequency menu with 2 items in instead of one.
Correct this.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: i2c: imx477: Add further link frequency options
https://github.com/raspberrypi/linux/issues/6004 reports further
issues with GPS interference.
Untested, but adds further link frequency options.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: i2c: imx477: Fix lockdep errors
imx477_get_format_code has a lockdep_assert_held test, however
the call paths from enum_mbus_code and enum_frame_size don't
lock the mutex before calling it.
Add in the relevant mutex locking.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
media: i2c: imx477: Disable temperature sensor when enabling XVS
On IMX477 it appears that the on-chip temperature sensor causes
XVS (external sync out) to pulse every ~2ms when not streaming.
So now we do a little dance: Temperature sensor is enabled during
common register setup, giving it time to warm up (almost literally;
otherwise the first frame's reading might be 0C), disabled before
enabling sync out, then enabled again once the camera is streaming.
We already took care to disable XVS output in stop_streaming()
(though previously it wasn't understood why this was needed).
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
Some combinations of Pi 4Bs and Ethernet switches don't reliably get a
DCHP-assigned IP address, leaving the unit with a self=assigned 169.254
address. In the failure case, the Pi is left able to receive packets
but not send them, suggesting that the MAC<->PHY link is getting into
a bad state.
It has been found empirically that skipping a reset step by the genet
driver prevents the failures. No downsides have been discovered yet,
and unlike the forced renegotiation it doesn't increase the time to
get an IP address, so the workaround is enabled by default; add
genet.skip_umac_reset=n
to the command line to disable it.
See: https://github.com/raspberrypi/linux/issues/3108
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
These wireless mouse/keyboard combo remote control devices specify
multiple "wheel" events in their report descriptors. The wheel events
are incorrectly defined and apparently map to accelerometer data, leading
to spurious mouse scroll events being generated at an extreme rate when
the device is moved.
As a workaround, use HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE to mask
feeding the extra wheel events to the input subsystem.
See: https://github.com/raspberrypi/firmware/issues/1189
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
The v3d driver currently encounters a lot of MMU PTE exceptions, so
only log the first to avoid swamping the kernel log.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
My various attempts at re-enabling runtime PM have failed, so just
crank the clock down when V3D is idle to reduce power consumption.
Signed-off-by: Eric Anholt <eric@anholt.net>
drm/v3d: Plug dma_fence leak
The irq_fence and done_fence are given a reference that is never
released. The necessary dma_fence_put()s seem to have been
deleted in error in an earlier commit.
Fixes: 0b73676836b2 ("drm/v3d: Clock V3D down when not in use.")
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
v3d_drv: Handle missing clock more gracefully
Signed-off-by: popcornmix <popcornmix@gmail.com>
v3d_gem: Kick the clock so firmware knows we are using firmware clock interface
Setting the v3d clock to low value allows firmware to handle dvfs in case
where v3d hardware is not being actively used (e.g. console use).
Signed-off-by: popcornmix <popcornmix@gmail.com>
drm/v3d: Switch clock setting to new api
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
drm/v3d: Convert to new clock range API
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
drm/v3d: Correct clock settng calls to new APIs
There was a report that 6.12 kernel has lower benchmark
scores than 6.6.
I can confirm, and found it started with 6.8 kernel
which moved some code into a new file (v3d_submit.c)
and in two places the change to the clock api were missed.
The effect of the bug is the v3d clock sometimes
unwantedly drops to a lower rate.
With this patch the benchmark scores are good again.
Fixes: 86963038cb
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
drm/v3d: CPU job submissions shouldn't affect V3D GPU clock
We can avoid calling the v3d_clock_up_put and v3d_clock_up_get
when a job is submitted to a CPU queue. We don't need to change
the V3D core frequency to run a CPU job as it is executed on
the CPU. This way we avoid delaying timestamps CPU jobs by 4.5ms
that is the time that it takes the firmware to increase the V3D
core frequency.
Fixes: fe6a858096 ("drm/v3d: Correct clock settng calls to new APIs")
Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
Reviewed-by: Maíra Canal <mcanal@igalia.com>
The BCM2835 I2C blocks have a register to set the clock-stretch
timeout - how long the device is allowed to hold SCL low - in bus
cycles. The current driver doesn't write to the register, therefore
the default value of 64 cycles is being used for all devices.
Set the timeout to the value recommended for SMBus - 35ms.
See: https://github.com/raspberrypi/linux/issues/3064
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
i2c: bcm2835: Make clock-stretch timeout configurable
The default clock-stretch timeout is 35 mS, which works well for
SMBus, but there are some I2C devices which can stretch the clock even
longer. Rather than trying to prescribe a safe default for everyone,
allow the timeout to be configured.
Signed-off-by: Alex Crawford <raspberrypi/linux@code.acrawford.com>
i2c-bcm2835: Flush FIFOs cleanly on error
On error condition, note the error return code, but still
handle the FIFOs in the normal way rather than relying on
C_CLEAR flushing everything cleanly.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
i2c-bcm2835: Do not abort transfers on ERR if still active
If a transaction is aborted immediately on ERR being reported,
then the bus is not returned to the STOP condition, and devices
generally get very upset.
Handle the ERR and CLKT conditions only when TA is not set.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
i2c-bcm2835: Implement I2C_M_IGNORE_NAK
Now that transfers aren't aborted immediately (and uncleanly) on
errors, and the FIFOs are always drained after all transfers, we
can implement I2C_M_IGNORE_NAK by ignoring the returned error
value.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Make the BCM2711 a different machine, but keep it in board_bcm2835.
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
arm: bcm2835: Add bcm2838 compatible string.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
ARM: bcm: Switch board, clk and pinctrl to bcm2711 compatible
After the decision to use bcm2711 compatible for upstream, we should
switch all accepted compatibles to bcm2711. So we can boot with
one DTB the down- and the upstream kernel.
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
Setting both the Drop and Add bits on the input context prevents the
corruption of split transactions seen with the BCM2711 XHCI controller,
which is a dwc3 variant.
This is a downstream feature that allows usbhid to restrict polling
intervals on mice and keyboards, and was only tested on a VL805 which
didn't complain about the fact the endpoint got added twice.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
See https://github.com/raspberrypi/linux/issues/3981
An unknown unsafe memory access can result in the ep_state variable
in xhci_virt_ep being trampled with a stuck SET_DEQ_PENDING state
despite successful completion of a Set TR Deq Pointer command.
All URB enqueue/dequeue calls for the endpoint will fail in this state
so no transfers are possible until the device is reconnected.
As a workaround, clear the flag if we see it set and issue a new Set
TR Deq command anyway - this should be harmless, as a prior Set TR Deq
command will only have been issued in the Stopped state, and if the
endpoint is Running then the controller is required to ignore it and
respond with a Context State Error event TRB.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Must be called in a non-atomic context, after the endpoint
has been registered with the hardware via xhci_add_endpoint
and before the first URB is submitted for the endpoint.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
xHCI caches device and endpoint data after the interface is configured,
so an explicit command needs to be issued for any device driver wanting
to alter the polling interval of an endpoint.
Add usb_fixup_endpoint() to allow drivers to do this. The fixup must be
called after calculating endpoint bandwidth requirements but before any
URBs are submitted.
If polling intervals are shortened, any bandwidth reservations are no
longer valid but in practice polling intervals are only ever relaxed.
Limit the scope to interrupt transfers for now.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
There are several warts surrounding bcmgenet_mii_probe() as this
function is called from ndo_open, but it's calling registration-type
functions. The probe should be called at probe time and refactored
such that the PHY device data can be extracted to limit the scope
of this flag to Broadcom PHYs.
For now, pass this flag in as it puts our attached PHY into a low-power
state when disconnected.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
Set defaults for TX and RX packet coalescing to be equivalent to:
# ethtool -C eth0 tx-frames 10
# ethtool -C eth0 rx-usecs 50
This may be something we want to set via DT parameters in the
future.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
The HWRNG on the BCM2838 is compatible to iproc-rng200, so add the
support to this driver instead of bcm2835-rng.
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
hwrng: iproc-rng200: Correct SoC name
The Pi 4 SoC is called BCM2711, not BCM2838.
Fixes: "hwrng: iproc-rng200: Add BCM2838 support"
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The legacy peripherals can only address the first gigabyte of RAM, so
ensure that DMA allocations are restricted to that region.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
The ioremapping creates mappings within the vmalloc area. The
equivalent early function, create_mapping, now checks that the
requested explicit virtual address is between VMALLOC_START and
VMALLOC_END. As there is no reason to have any correlation between
the physical and virtual addresses, put the required mappings at
VMALLOC_START and above.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
The logic to drive the data line high to implement a strong pullup
assumed that the pin was already an output - setting a value does
not change an input.
See: https://github.com/raspberrypi/firmware/issues/1143
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
drivers: w1-gpio: add flag to force read-polling while delaying
On Pi 5, the link to RP1 will bounce in and out of L1 depending on
inactivity timers at both the RC and EP end. Unfortunately for
bitbashing 1-wire, this means that on an otherwise idle Pi 5 many of the
reads/writes to GPIO registers are delayed by up to 8us which causes
mis-sampling of read data and trashes write bits.
By issuing dummy reads at a rate greater than the link inactivity
timeout while spinning on a delay, PCIe stays in L0 which does not incur
additional latency.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
drivers: w1-gpio: Fixup uninitialised variable use in w1_gpio_probe
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
On error, vchiq_mmal_component_init could leave the
event context allocated for ports.
Clean them up in the error path.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
vchiq_mmal_component_init calls init_event_context for the
control port, but vchiq_mmal_component_finalise didn't free
it, causing a memory leak..
Add the free call.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
mmal_parameters.h hasn't been updated to reflect additions made
over the last few years. Update it to reflect the currently
supported parameters.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
The list of formats was copied before Bayer support was added.
The ISP supports Bayer and is being supported by the bcm2835_codec
driver, so add in the encodings for them.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
The MMAL client_component field is used with the event
mechanism to allow the client to identify the component for
which the event is generated.
The field is only 32bits in size, therefore we can't use a
pointer to the component in a 64 bit kernel.
Component handles are already held in an array per VCHI
instance, so use the array index as the client_component handle
to avoid having to create a new IDR for this purpose.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
videobuf2 only allowed exporting a dmabuf as a file descriptor,
but there are instances where having the struct dma_buf is
useful within the kernel.
Split the current implementation into two, one step which
exports a struct dma_buf, and the second which converts that
into an fd.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
Add the ability to send data to ports. This only supports
zero copy mode as the required bulk transfer setup calls
are not done.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
(Preparation for the codec driver).
The codec uses the event mechanism to report things such as
resolution changes. It is signalled by the cmd field of the buffer
being non-zero.
Add support for passing this information out to the client.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
Fixes up a checkpatch error "Avoid using bool structure members
because of possible alignment issues".
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
Document the DT bindings for the CSI2/CCP2 receiver peripheral
(known as Unicam) on BCM283x SoCs.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
Acked-by: Rob Herring <robh@kernel.org>
dt-bindings: bcm2835-unicam: Update documentation with new clock params
Update the documentation to reflect the new "VPU" clock needed
by the bcm2835-unicam driver.
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
New helper defines that allow printing of a FOURCC using
printf(V4L2_FOURCC_CONV, V4L2_FOURCC_CONV_ARGS(fourcc));
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
The ADV7282M can support YPbPr on AIN1-3, but this was
not selectable from the driver. Add it to the list of
supported input modes.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
The hardware default is differential CVBS on AIN1 & 2, which
isn't very useful.
Select the first input that is defined as valid for the
chip variant (typically CVBS_AIN1).
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
The bInterval is set to 4 (i.e. 8 microframes => 1ms) and the only bit
that the driver pays attention to is "link was reset". If there's a
flapping status bit in that endpoint data, (such as if PHY negotiation
needs a few tries to get a stable link) then polling at a slower rate
would act as a de-bounce.
See: https://github.com/raspberrypi/linux/issues/2447
Ethernet cables with faulty or missing pairs (specifically pairs C and
D) allow auto-negotiation to 1000Mbs, but do not support the successful
establishment of a link. Add a DT property, "microchip,downshift-after",
to configure the number of auto-negotiation failures after which it
falls back to 100Mbs. Valid values are 2, 3, 4, 5 and 0, where 0 means
never downshift.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
The driver already reported the firmware build date during probe.
The mailbox calls have been extended to also report the variant
1 = standard start.elf
2 = start_x.elf (includes camera stack)
3 = start_db.elf (includes assert logging)
4 = start_cd.elf (cutdown version for smallest memory footprint).
Log the variant during probe.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
firmware: raspberrypi: Report the fw git hash during probe
The firmware can now report the git hash from which it was built
via the mailbox, so report it during probe.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
ad83c7cb2f ("irqchip/irq-bcm2836: Add support for DT interrupt polarity")
changed the way that the BCM2836/7 local interrupts are mapped; instead
of being pre-mapped they are now mapped on-demand. A side effect of this
change is that the call to irq_of_parse_and_map from armctrl_of_init
creates a new mapping, forming a gap between the IRQs and the FIQs. This
gap breaks the FIQ<->IRQ mapping which up to now has been done by assuming:
1) that the value of FIQ_START is the same as the number of normal IRQs
that will be mapped (still true), and
2) that this value is also the offset between an IRQ and its equivalent
FIQ (which is no longer the case).
Remove both assumptions by measuring the interval between the last IRQ
and the last FIQ, passing it as the parameter to init_FIQ().
Fixes: https://github.com/raspberrypi/linux/issues/2432
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
Register for reboot notifications, sending RPI_FIRMWARE_NOTIFY_REBOOT
over the mailbox interface on reception.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
Reduces overhead when using X
usbhid: call usb_fixup_endpoint after mangling intervals
Lets the mousepoll override mechanism work with xhci.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
I2C busses can be assigned specific bus numbers using aliases in
Device Tree - string properties where the name is the alias and the
value is the path to the node. The current DT parameter mechanism
does not allow property names to be derived from a parameter value
in any way, so it isn't possible to generate unique or matching
aliases for nodes from an overlay that can generate multiple
instances, e.g. i2c-gpio.
Work around this limitation (at least temporarily) by allowing
the i2c adapter number to be initialised from the "reg" property
if present.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
There is a new test in __irq_startup that the IRQ is activated, which
hasn't been the case for FIQs since they bypass some of the usual setup.
Augment enable_fiq to include a call to irq_activate to avoid the
warning.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
Create a semi-static mapping for the USB registers early in the boot
process, before additional kernel threads are started, so all threads
will have the mappings from the start. This avoids the need for
data aborts to lazily update them.
See: https://github.com/raspberrypi/linux/issues/2450
Signed-off-by: Floris Bos <bos@je-eigen-domein.nl>
The VideoCore bootloader passes in Serial number and
Revision number through Device Tree. Make these available to
userspace through /proc/cpuinfo.
Mainline status:
There is a commit in linux-next that standardize passing the serial
number through Device Tree (string: /serial-number):
ARM: 8355/1: arch: Show the serial number from devicetree in cpuinfo
There was an attempt to do the same with the revision number, but it
didn't get in:
[PATCH v2 1/2] arm: devtree: Set system_rev from DT revision
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Uses the debugfs I/F to provide access to the AXI
bus performance monitors.
Requires the new mailbox peripheral access for access
to the VPU performance registers, system bus access
is done using direct register reads.
Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
raspberrypi_axi_monitor: suppress warning
Suppress the following warning by casting the pointer to and uintptr_t
before to u32:
Signed-off-by: Matteo Croce <mcroce@redhat.com>
perf/raspberry: Add support for 2712 axi performance monitors
Also handle 2711 correctly which has a different configuration
from 2835.
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
IRQ-CPU mapping is round robined on ARM64 to increase
concurrency and allow multiple interrupts to be serviced
at a time. This reduces the need for FIQ.
Signed-off-by: Michael Zoran <mzoran@crowfest.net>
drivers: irqchip: irq-bcm2835: Concurrency fix
The commit shown in Fixes: aims to improve interrupt throughput by
getting the handlers invoked on different CPU cores. It does so (*) by
using an irq_ack hook to change the interrupt routing.
Unfortunately, the IRQ status bits must be cleared at source, which only
happens once the interrupt handler has run - there is no easy way for
one core to claim one of the IRQs before sending the remainder to the
next core on the list, so waking another core immediately results in a
race with a chance of both cores handling the same IRQ. It is probably
for this reason that the routing change is deferred to irq_ack, but that
doesn't guarantee no clashes - after irq_ack is called, control returns
to bcm2836_chained_handler_irq which proceeds to check for other pending
IRQs at a time when the next core is probably doing the same thing.
Since the whole point of the original commit is to distribute the IRQ
handling, there is no reason to attempt to handle multiple IRQs in one
interrupt callback, so the problem can be solved (or at least made much
harder to reproduce) by changing a "while" into an "if", so that each
invocation only handles one IRQ.
(*) I'm not convinced it's as effective as claimed since irq_ack is
called _after_ the interrupt handler, but the author thought it made a
difference.
See: https://github.com/raspberrypi/linux/issues/5214https://github.com/raspberrypi/linux/pull/1794
Fixes: fd4c9785bd ("ARM64: Round-Robin dispatch IRQs between CPUs.")
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
irqchip: irq-bcm2836: Avoid prototype warning
Declare bcm2836_arm_irqchip_spin_gpu_irq in irq-bcm2836.h to avoid a
compiler warning about a missing prototype.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
This is a port of Pantelis Antoniou's v3 port that makes use of the
new upstreamed configfs support for binary attributes.
Original commit message:
Add a runtime interface to using configfs for generic device tree overlay
usage. With it its possible to use device tree overlays without having
to use a per-platform overlay manager.
Please see Documentation/devicetree/configfs-overlays.txt for more info.
Changes since v2:
- Removed ifdef CONFIG_OF_OVERLAY (since for now it's required)
- Created a documentation entry
- Slight rewording in Kconfig
Changes since v1:
- of_resolve() -> of_resolve_phandles().
Originally-signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
DT configfs: Fix build errors on other platforms
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
DT configfs: fix build error
There is an error when compiling rpi-4.6.y branch:
CC drivers/of/configfs.o
drivers/of/configfs.c:291:21: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types]
.default_groups = of_cfs_def_groups,
^
drivers/of/configfs.c:291:21: note: (near initialization for 'of_cfs_subsys.su_group.default_groups.next')
The .default_groups is linked list since commit
1ae1602de0.
This commit uses configfs_add_default_group to fix this problem.
Signed-off-by: Slawomir Stepien <sst@poczta.fm>
configfs: New of_overlay API
of: configfs: Use of_overlay_fdt_apply API call
The published API to the dynamic overlay application mechanism now
takes a Flattened Device Tree blob as input so that it can manage the
lifetime of the unflattened tree. Conveniently, the new API call -
of_overlay_fdt_apply - is virtually a drop-in replacement for
create_overlay, which can now be deleted.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
Add a virtual GPIO driver that uses the firmware mailbox interface to
request that the VPU toggles LEDs.
gpio: bcm-virt: Fix the get() method
The get() method does not understand the on-the-wire encoding of the
remote GPIO states, thinking they are simple on/off bits when they are
really pairs of 16-bit counts. Rewrite the get() handler to return the
value last written, which will eventually match the actual GPIO state
if there are no other changes.
See: https://github.com/raspberrypi/linux/issues/4638
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
bcm2835-virtgpio: Update for Linux 6.6
The gpio subsystem is happier if the gpiochip is given a parent, and
if it doesn't have a fixed base gpio number. While we're in here,
use the fact that the firmware node is the parent to locate it,
and use the devm_ version of rpi_firmware_get.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Add a mailbox-driven backlight controller for the Raspberry Pi DSI
touchscreen display. Requires updated GPU firmware to recognise the
mailbox request.
Signed-off-by: Gordon Hollingworth <gordon@raspberrypi.org>
Add Raspberry Pi firmware driver to the dependencies of backlight driver
Otherwise the backlight driver fails to build if the firmware
loading driver is not in the kernel
Signed-off-by: Alex Riesen <alexander.riesen@cetitec.com>
ASoC: Add support for Rpi-DAC
ASoC: Add prompt for ICS43432 codec
Without a prompt string, a config setting can't be included in a
defconfig. Give CONFIG_SND_SOC_ICS43432 a prompt so that Pi soundcards
can use the driver.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
Add IQaudIO Sound Card support for Raspberry Pi
Set a limit of 0dB on Digital Volume Control
The main volume control in the PCM512x DAC has a range up to
+24dB. This is dangerously loud and can potentially cause massive
clipping in the output stages. Therefore this sets a sensible
limit of 0dB for this control.
Allow up to 24dB digital gain to be applied when using IQAudIO DAC+
24db_digital_gain DT param can be used to specify that PCM512x
codec "Digital" volume control should not be limited to 0dB gain,
and if specified will allow the full 24dB gain.
Modify IQAudIO DAC+ ASoC driver to set card/dai config from dt
Add the ability to set the card name, dai name and dai stream name, from
dt config.
Signed-off-by: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>
IQaudIO: auto-mute for AMP+ and DigiAMP+
IQAudIO amplifier mute via GPIO22. Add dt params for "one-shot" unmute
and auto mute.
Revision 2, auto mute implementing HiassofT suggestion to mute/unmute
using set_bias_level, rather than startup/shutdown....
"By default DAPM waits 5 seconds (pmdown_time) before shutting down
playback streams so a close/stop immediately followed by open/start
doesn't trigger an amp mute+unmute."
Tested on both AMP+ (via DAC+) and DigiAMP+, with both options...
dtoverlay=iqaudio-dacplus,unmute_amp
"one-shot" unmute when kernel module loads.
dtoverlay=iqaudio-dacplus,auto_mute_amp
Unmute amp when ALSA device opened by a client. Mute, with 5 second delay
when ALSA device closed. (Re-opening the device within the 5 second close
window, will cancel mute.)
Revision 4, using gpiod.
Revision 5, clean-up formatting before adding mute code.
- Convert tab plus 4 space formatting to 2x tab
- Remove '// NOT USED' commented code
Revision 6, don't attempt to "one-shot" unmute amp, unless card is
successfully registered.
Signed-off-by: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>
ASoC: iqaudio-dac: fix S24_LE format
Remove set_bclk_ratio call so 24-bit data is transmitted in
24 bclk cycles.
Signed-off-by: Matthias Reichl <hias@horus.com>
ASoC: iqaudio-dac: use modern dai_link style
Signed-off-by: Matthias Reichl <hias@horus.com>
Added support for HiFiBerry DAC+
The driver is based on the HiFiBerry DAC driver. However HiFiBerry DAC+ uses
a different codec chip (PCM5122), therefore a new driver is necessary.
Add support for the HiFiBerry DAC+ Pro.
The HiFiBerry DAC+ and DAC+ Pro products both use the existing bcm sound driver with the DAC+ Pro having a special clock device driver representing the two high precision oscillators.
An addition bug fix is included for the PCM512x codec where by the physical size of the sample frame is used in the calculation of the LRCK divisor as it was found to be wrong when using 24-bit depth sample contained in a little endian 4-byte sample frame.
Limit PCM512x "Digital" gain to 0dB by default with HiFiBerry DAC+
24db_digital_gain DT param can be used to specify that PCM512x
codec "Digital" volume control should not be limited to 0dB gain,
and if specified will allow the full 24dB gain.
Add dt param to force HiFiBerry DAC+ Pro into slave mode
"dtoverlay=hifiberry-dacplus,slave"
Add 'slave' param to use HiFiBerry DAC+ Pro in slave mode,
with Pi as master for bit and frame clock.
Signed-off-by: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>
Fixed a bug when using 352.8kHz sample rate
Signed-off-by: Daniel Matuschek <daniel@hifiberry.com>
ASoC: pcm512x: revert downstream changes
This partially reverts commit 185ea05465
which was added by https://github.com/raspberrypi/linux/pull/1152
The downstream pcm512x changes caused a regression, it broke normal
use of the 24bit format with the codec, eg when using simple-audio-card.
The actual bug with 24bit playback is the incorrect usage
of physical_width in various drivers in the downstream tree
which causes 24bit data to be transmitted with 32 clock
cycles. So it's not the pcm512x that needs fixing, it's the
soundcard drivers.
Signed-off-by: Matthias Reichl <hias@horus.com>
ASoC: hifiberry_dacplus: fix S24_LE format
Remove set_bclk_ratio call so 24-bit data is transmitted in
24 bclk cycles.
Signed-off-by: Matthias Reichl <hias@horus.com>
ASoC: hifiberry_dacplus: transmit S24_LE with 64 BCLK cycles
Signed-off-by: Matthias Reichl <hias@horus.com>
hifiberry_dacplus: switch to snd_soc_dai_set_bclk_ratio
Signed-off-by: Matthias Reichl <hias@horus.com>
ASoC: hifiberry_dacplus: use modern dai_link style
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Add driver for rpi-proto
Forward port of 3.10.x driver from https://github.com/koalo
We are using a custom board and would like to use rpi 3.18.x
kernel. Patch works fine for our embedded system.
URL to the audio chip:
http://www.mikroe.com/add-on-boards/audio-voice/audio-codec-proto/
Playback tested with devicetree enabled.
Signed-off-by: Waldemar Brodkorb <wbrodkorb@conet.de>
ASoC: rpi-proto: use modern dai_link style
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Add Support for JustBoom Audio boards
justboom-dac: Adjust for ALSA API change
As of 4.4, snd_soc_limit_volume now takes a struct snd_soc_card *
rather than a struct snd_soc_codec *.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
ASoC: justboom-dac: fix S24_LE format
Remove set_bclk_ratio call so 24-bit data is transmitted in
24 bclk cycles.
Also remove hw_params as it's no longer needed.
Signed-off-by: Matthias Reichl <hias@horus.com>
ASoC: justboom-dac: use modern dai_link style
Signed-off-by: Matthias Reichl <hias@horus.com>
New AudioInjector.net Pi soundcard with low jitter audio in and out.
Contains the sound/soc/bcm ALSA machine driver and necessary alterations to the Kconfig and Makefile.
Adds the dts overlay and updates the Makefile and README.
Updates the relevant defconfig files to enable building for the Raspberry Pi.
Thanks to Phil Elwell (pelwell) for the review, simple-card concepts and discussion. Thanks to Clive Messer for overlay naming suggestions.
Added support for headphones, microphone and bclk_ratio settings.
This patch adds headphone and microphone capability to the Audio Injector sound card. The patch also sets the bit clock ratio for use in the bcm2835-i2s driver. The bcm2835-i2s can't handle an 8 kHz sample rate when the bit clock is at 12 MHz because its register is only 10 bits wide which can't represent the ch2 offset of 1508. For that reason, the rate constraint is added.
ASoC: audioinjector-pi-soundcard: use modern dai_link style
Signed-off-by: Hui Wang <hui.wang@canonical.com>
New driver for RRA DigiDAC1 soundcard using WM8741 + WM8804
ASoC: digidac1-soundcard: use modern dai_link style
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Add support for Dion Audio LOCO DAC-AMP HAT
Using dedicated machine driver and pcm5102a codec driver.
Signed-off-by: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>
ASoC: dionaudio_loco: use modern dai_link style
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Allo Piano DAC boards: Initial 2 channel (stereo) support (#1645)
Add initial 2 channel (stereo) support for Allo Piano DAC (2.0/2.1) boards,
using allo-piano-dac-pcm512x-audio overlay and allo-piano-dac ALSA ASoC
machine driver.
NB. The initial support is 2 channel (stereo) ONLY!
(The Piano DAC 2.1 will only support 2 channel (stereo) left/right output,
pending an update to the upstream pcm512x codec driver, which will have
to be submitted via upstream. With the initial downstream support,
provided by this patch, the Piano DAC 2.1 subwoofer outputs will
not function.)
Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
Signed-off-by: Clive Messer <clive.messer@digitaldreamtime.co.uk>
Tested-by: Clive Messer <clive.messer@digitaldreamtime.co.uk>
ASoC: allo-piano-dac: fix S24_LE format
Remove set_bclk_ratio call so 24-bit data is transmitted in
24 bclk cycles.
Also remove hw_params and ops as they are no longer needed.
Signed-off-by: Matthias Reichl <hias@horus.com>
ASoC: allo-piano-dac: use modern dai_link style
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Add support for Allo Piano DAC 2.1 plus add-on board for Raspberry Pi.
The Piano DAC 2.1 has support for 4 channels with subwoofer.
Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
Reviewed-by: Vijay Kumar B. <vijaykumar@zilogic.com>
Reviewed-by: Raashid Muhammed <raashidmuhammed@zilogic.com>
Add clock changes and mute gpios (#1938)
Also improve code style and adhere to ALSA coding conventions.
Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
Reviewed-by: Vijay Kumar B. <vijaykumar@zilogic.com>
Reviewed-by: Raashid Muhammed <raashidmuhammed@zilogic.com>
PianoPlus: Dual Mono & Dual Stereo features added (#2069)
allo-piano-dac-plus: Master volume added + fixes
Master volume added, which controls both DACs volumes.
See: https://github.com/raspberrypi/linux/pull/2149
Also fix initial max volume, default mode value, and unmute.
Signed-off-by: allocom <sparky-dev@allo.com>
ASoC: allo-piano-dac-plus: fix S24_LE format
Remove set_bclk_ratio call so 24-bit data is transmitted in
24 bclk cycles.
Signed-off-by: Matthias Reichl <hias@horus.com>
sound: bcm: Fix memset dereference warning
This warning appears with GCC 6.4.0 from toolchains.bootlin.com:
../sound/soc/bcm/allo-piano-dac-plus.c: In function ‘snd_allo_piano_dac_init’:
../sound/soc/bcm/allo-piano-dac-plus.c:711:30: warning: argument to ‘sizeof’ in ‘memset’ call is the same expression as the destination; did you mean to dereference it? [-Wsizeof-pointer-memaccess]
memset(glb_ptr, 0x00, sizeof(glb_ptr));
^
Suggested-by: Phil Elwell <phil@raspberrypi.org>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
ASoC: allo-piano-dac-plus: use modern dai_link style
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Add support for Allo Boss DAC add-on board for Raspberry Pi. (#1924)
Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
Reviewed-by: Deepak <deepak@zilogic.com>
Reviewed-by: BabuSubashChandar <babusubashchandar@zilogic.com>
Add support for new clock rate and mute gpios.
Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
Reviewed-by: Deepak <deepak@zilogic.com>
Reviewed-by: BabuSubashChandar <babusubashchandar@zilogic.com>
ASoC: allo-boss-dac: fix S24_LE format
Remove set_bclk_ratio call so 24-bit data is transmitted in
24 bclk cycles.
Signed-off-by: Matthias Reichl <hias@horus.com>
ASoC: allo-boss-dac: transmit S24_LE with 64 BCLK cycles
Signed-off-by: Matthias Reichl <hias@horus.com>
allo-boss-dac: switch to snd_soc_dai_set_bclk_ratio
Signed-off-by: Matthias Reichl <hias@horus.com>
ASoC: allo-boss-dac: use modern dai_link style
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Support for Blokas Labs pisound board
Pisound dynamic overlay (#1760)
Restructuring pisound-overlay.dts, so it can be loaded and unloaded dynamically using dtoverlay.
Print a logline when the kernel module is removed.
pisound improvements:
* Added a writable sysfs object to enable scripts / user space software
to blink MIDI activity LEDs for variable duration.
* Improved hw_param constraints setting.
* Added compatibility with S16_LE sample format.
* Exposed some simple placeholder volume controls, so the card appears
in volumealsa widget.
Add missing SND_PISOUND selects dependency to SND_RAWMIDI
Without it the Pisound module fails to compile.
See https://github.com/raspberrypi/linux/issues/2366
Updates for Pisound module code:
* Merged 'Fix a warning in DEBUG builds' (1c8b82b).
* Updating some strings and copyright information.
* Fix for handling high load of MIDI input and output.
* Use dual rate oversampling ratio for 96kHz instead of single
rate one.
Signed-off-by: Giedrius Trainavicius <giedrius@blokas.io>
Fixing memset call in pisound.c
Signed-off-by: Giedrius Trainavicius <giedrius@blokas.io>
Fix for Pisound's MIDI Input getting blocked for a while in rare cases.
There was a possible race condition which could lead to Input's FIFO queue
to be underflown, causing high amount of processing in the worker thread for
some period of time.
Signed-off-by: Giedrius Trainavicius <giedrius@blokas.io>
Fix for Pisound kernel module in Real Time kernel configuration.
When handler of data_available interrupt is fired, queue_work ends up
getting called and it can block on a spin lock which is not allowed in
interrupt context. The fix was to run the handler from a thread context
instead.
Pisound: Remove spinlock usage around spi_sync
ASoC: pisound: use modern dai_link style
Signed-off-by: Hui Wang <hui.wang@canonical.com>
ASoC: pisound: fix the parameter for spi_device_match
Signed-off-by: Hui Wang <hui.wang@canonical.com>
ASoC: Add driver for Cirrus Logic Audio Card
Note: due to problems with deferred probing of regulators
the following softdep should be added to a modprobe.d file
softdep arizona-spi pre: arizona-ldo1
Signed-off-by: Matthias Reichl <hias@horus.com>
ASoC: rpi-cirrus: use modern dai_link style
Signed-off-by: Matthias Reichl <hias@horus.com>
sound: Support for Dion Audio LOCO-V2 DAC-AMP HAT
Signed-off-by: Miquel Blauw <info@dionaudio.nl>
ASoC: dionaudio_loco-v2: fix S24_LE format
Remove set_bclk_ratio call so 24-bit data is transmitted in
24 bclk cycles.
Also remove hw_params and ops as they are no longer needed.
Signed-off-by: Matthias Reichl <hias@horus.com>
ASoC: dionaudio_loco-v2: use modern dai_link style
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Add support for Fe-Pi audio sound card. (#1867)
Fe-Pi Audio Sound Card is based on NXP SGTL5000 codec.
Mechanical specification of the board is the same the Raspberry Pi Zero.
3.5mm jacks for Headphone/Mic, Line In, and Line Out.
Signed-off-by: Henry Kupis <fe-pi@cox.net>
ASoC: fe-pi-audio: use modern dai_link style
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Add support for the AudioInjector.net Octo sound card
AudioInjector Octo: sample rates, regulators, reset
This patch adds new sample rates to the Audioinjector Octo sound card. The
new supported rates are (in kHz) :
96, 48, 32, 24, 16, 8, 88.2, 44.1, 29.4, 22.05, 14.7
Reference the bcm270x DT regulators in the overlay.
This patch adds a reset GPIO for the AudioInjector.net octo sound card.
Audioinjector octo : Make the playback and capture symmetric
This patch ensures that the sample rate and channel count of the audioinjector
octo sound card are symmetric.
audioinjector-octo: Add continuous clock feature
By user request, add a switch to prevent the clocks being stopped when
the stream is paused, stopped or shutdown. Provide access to the switch
by adding a 'non-stop-clocks' parameter to the audioinjector-addons
overlay.
See: https://github.com/raspberrypi/linux/issues/2409
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
sound: Fixes for audioinjector-octo under 4.19
1. Move the DT alias declaration to the I2C shim in the cases
where the shim is enabled. This works around a problem caused by a
4.19 commit [1] that generates DT/OF uevents for I2C drivers.
2. Fix the diagnostics in an error path of the soundcard driver to
correctly identify the reason for the failure to load.
3. Move the declaration of the clock node in the overlay outside
the I2C node to avoid warnings.
4. Sort the overlay nodes so that dependencies are only to earlier
fragments, in an attempt to get runtime dtoverlay application to
work (it still doesn't...)
See: https://github.com/Audio-Injector/Octo/issues/14
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
[1] af503716ac ("i2c: core: report OF style module alias for devices registered via OF")
ASoC: audioinjector-octo-soundcard: use modern dai_link style
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Driver support for Google voiceHAT soundcard.
ASoC: googlevoicehat-codec: Use correct device when grabbing GPIO
The fixup for the VoiceHAT in 4.18 incorrectly tried to find the
sdmode GPIO pin under the card device, not the codec device.
This failed, and therefore caused the device probe to fail.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
ASoC: googlevoicehat-codec: Reformat for kernel coding standards
Fix all whitespace, indentation, and bracing errors.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
ASoC: googlevoicehat-codec: Make driver function structure const
Make voicehat_component_driver a const structure.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
ASoC: googlevoicehat-codec: Only convert from ms to jiffies once
Minor optimisation and allows to become checkpatch clean.
A msec value is read out of DT or from a define, and convert once to
jiffies, rather than every time that it is used.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
Driver and overlay for Allo Katana DAC
Allo Katana DAC: Updated default values
Signed-off-by: Jaikumar <jaikumar@cem-solutions.com>
Added mute stream func
Signed-off-by: Jaikumar <jaikumar@cem-solutions.net>
codecs: Correct Katana minimum volume
Update Katana minimum volume to get the exact 0.5 dB value in each step.
Signed-off-by: Sudeep Kumar <sudeepkumar@cem-solutions.net>
ASoC: Add generic RPI driver for simple soundcards.
The RPI simple sound card driver provides a generic ALSA SOC card driver
supporting a variety of Pi HAT soundcards. The intention is to avoid
the duplication of code for cards that can't be fully supported by
the soc simple/graph cards but are otherwise almost identical.
This initial commit adds support for the ADAU1977 ADC, Google VoiceHat,
HifiBerry AMP, HifiBerry DAC and RPI DAC.
Signed-off-by: Tim Gover <tim.gover@raspberrypi.org>
ASoC: Use correct card name in rpi-simple driver
Use the specific card name from drvdata instead of the snd_rpi_simple
rpi-simple-soundcard: Use nicer driver name "RPi-simple"
Rename the driver from "RPI simple soundcard" to "RPi-simple" so that
the driver name won't be mangled allowing to be used unaltered as the
card conf filename.
ASoC: rpi-simple-soundcard: use modern dai_link style
Signed-off-by: Hui Wang <hui.wang@canonical.com>
ASoC: Add Kconfig and Makefile for sound/soc/bcm
Signed-off-by: popcornmix <popcornmix@gmail.com>
ASoC: Create a generic Pi Hat WM8804 driver
Reduce the amount of duplicated code by creating a generic driver for
Pi Hat digi cards using the WM8804 codec.
This replaces the
Allo DigiOne, Hifiberry Digi/Pro, JustBoom Digi and IQAudIO Digi
dedicate soundcard drivers with a generic driver.
There are no significant changes to the runtime behavior of the drivers
and end users should not have to change any configuration settings
after upgrading.
Minor changes
* Check the return value of snd_soc_component_update_bits
* Added some pr_debug tracing
* Various checkpatch tidyups
* Updated allodigi-one to use use 128FS at > 96 Khz. This appears to
be an omission in the original driver code so followed the Hifiberry
DAC driver approach.
ASoC: rpi-wm8804-soundcard: use modern dai_link style
Signed-off-by: Matthias Reichl <hias@horus.com>
rpi-wm8804-soundcard: drop PWRDN register writes
Since kernel 4.0 the PWRDN register bits are under DAPM
control from the wm8804 driver.
Drop code that modifies that register to avoid interfering
with DAPM.
Signed-off-by: Matthias Reichl <hias@horus.com>
rpi-wm8804-soundcard: configure wm8804 clocks only on rate change
This should avoid clicks when stopping and immediately afterwards
starting a stream with the same samplerate as before.
Signed-off-by: Matthias Reichl <hias@horus.com>
rpi-wm8804-soundcard: Fixed MCLKDIV for Allo Digione
The Allo Digione board wants a fixed MCLKDIV of 256.
See: https://github.com/raspberrypi/linux/issues/3296
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
ASoC: Add support for AudioSense-Pi add-on soundcard
AudioSense-Pi is a RPi HAT based on a TI's TLV320AIC32x4 stereo codec
This hardware provides multiple audio I/O capabilities to the RPi.
The codec connects to the RPi's SoC through the I2S Bus.
The following devices can be connected through a 3.5mm jack
1. Line-In: Plain old audio in from mobile phones, PCs, etc.,
2. Mic-In: Connect a microphone
3. Line-Out: Connect the output to a speaker
4. Headphones: Connect a Headphone w or w/o microphones
Multiple Inputs:
It supports the following combinations
1. Two stereo Line-Inputs and a microphone
2. One stereo Line-Input and two microphones
3. Two stereo Line-Inputs, a microphone and
one mono line-input (with h/w hack)
4. One stereo Line-Input, two microphones and
one mono line-input (with h/w hack)
Multiple Outputs:
Audio output can be routed to the headphones or
speakers (with additional hardware)
Signed-off-by: b-ak <anur.bhargav@gmail.com>
ASoC: audiosense-pi: use modern dai_link style
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Added driver for the HiFiBerry DAC+ ADC (#2694)
Signed-off-by: Daniel Matuschek <daniel@hifiberry.com>
hifiberry_dacplusadc: switch to snd_soc_dai_set_bclk_ratio
Signed-off-by: Matthias Reichl <hias@horus.com>
ASoC: hifiberry_dacplusadc: fix DAI link setup
The driver only defines a single DAI link and the code that tries
to setup the second (non-existent) DAI link looks wrong - using dmic
as a CPU/platform driver doesn't make any sense.
The DT overlay doesn't define a dmic property, so the code was never
executed (otherwise it would have resulted in a memory corruption).
So drop the offending code to prevent issues if a dmic property
should be added to the DT overlay.
Signed-off-by: Matthias Reichl <hias@horus.com>
ASoC: hifiberry_dacplusadc: use modern dai_link style
Signed-off-by: Matthias Reichl <hias@horus.com>
Audiophonics I-Sabre 9038Q2M DAC driver
Signed-off-by: Audiophonics <contact@audiophonics.fr>
ASoC: i-sabre-q2m: use modern dai_link style
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Added IQaudIO Pi-Codec board support (#2969)
Add support for the IQaudIO Pi-Codec board.
Signed-off-by: Gordon <gordon@iqaudio.com>
Fixed 48k timing issue
ASoC: iqaudio-codec: use modern dai_link style
Signed-off-by: Hui Wang <hui.wang@canonical.com>
adds the Hifiberry DAC+ADC PRO version
This adds the driver for the DAC+ADC PRO version of the Hifiberry soundcard with software controlled PCM1863 ADC
Signed-off-by: Joerg Schambacher joerg@i2audio.com
Add Hifiberry DAC+DSP soundcard driver (#3224)
Adds the driver for the Hifiberry DAC+DSP. It supports capture and
playback depending on the DSP firmware.
Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
Allow simultaneous use of JustBoom DAC and Digi
Signed-off-by: Johannes Krude <johannes@krude.de>
Pisound: MIDI communication fixes for scaled down CPU.
* Increased maximum SPI communication speed to avoid running too slow
when the CPU is scaled down and losing MIDI data.
* Keep track of buffer usage in millibytes for higher precision.
Signed-off-by: Giedrius Trainavičius <giedrius@blokas.io>
sound: Add the HiFiBerry DAC+HD version
This adds the driver for the DAC+HD version supporting HiFiBerry's
PCM179x based DACs. It also adds PLL control for clock generation.
Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
Fix master mode settings of HiFiBerry DAC+ADC PRO card (#3424)
This patch fixes the board DAI setting when in master-mode.
Wrong setting could have caused random pop noise.
Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
adds LED OFF feature to HiFiBerry DAC+ADC PRO sound card
This adds a DT overlay parameter 'leds_off' which allows
to switch off the onboard activity LEDs at all times
which has been requested by some users.
Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
adds LED OFF feature to HiFiBerry DAC+ADC sound card
This adds a DT overlay parameter 'leds_off' which allows
to switch off the onboard activity LEDs at all times
which has been requested by some users.
Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
adds LED OFF feature to HiFiBerry DAC+/DAC+PRO sound cards
This adds a DT overlay parameter 'leds_off' which allows
to switch off the onboard activity LEDs at all times
which has been requested by some users.
Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
pisound: Added reading Pisound board hardware revision and exposing it (#3425)
pisound: Added reading Pisound board hardware revision and exposing it in kernel log and sysfs file:
/sys/kernel/pisound/hw_version
Signed-off-by: Giedrius <giedrius@blokas.io>
Added driver for HiFiBerry Amp amplifier add-on board
The driver contains a low-level hardware driver for the TAS5713 and the
drivers for the Raspberry Pi I2S subsystem.
TAS5713: return error if initialisation fails
Existing TAS5713 driver logs errors during initialisation, but does not return
an error code. Therefore even if initialisation fails, the driver will still be
loaded, but won't work. This patch fixes this. I2C communication error will now
reported correctly by a non-zero return code.
HiFiBerry Amp: fix device-tree problems
Some code to load the driver based on device-tree-overlays was missing. This is added by this patch.
According to 5713 pdf doc CLOCK_CTRL is a readonly status register, and it behaves so. Remove useless setting
sound: pcm512x-codec: Adding 352.8kHz samplerate support
sound/soc: only first codec is master in multicodec setup
When using multiple codecs, at most one codec should generate the master
clock. All codecs except the first are therefore configured for slave
mode.
Signed-off-by: Johannes Krude <johannes@krude.de>
ASoC: Fix snd_soc_get_pcm_runtime usage
Commit [1] changed the snd_soc_get_pcm_runtime to take a dai_link
pointer instead of a string. Patch up the downstream drivers to use
the modified API.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
[1] 4468189ff3 ("ASoC: soc-core: find rtd via dai_link pointer at snd_soc_get_pcm_runtime()")
Add support for the AudioInjector.net Isolated sound card
This patch adds support for the Audio Injector Isolated sound card.
Signed-off-by: Matt Flax <flatmax@flatmax.org>
Add support for merus-amp soundcard and ma120x0p codec
Add 96KHz rate support to MA120X0P codec and make enable and mute gpio
pins optional.
Signed-off-by: AMuszkat <ariel.muszkat@gmail.com>
Fixes a problem with clock settings of HiFiBerry DAC+ADC PRO (#3545)
This patch fixes a problem of the re-calculation of
i2s-clock and -parameter settings when only the ADC is activated.
Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
configs: Enable the AD193x codecs
See: https://github.com/raspberrypi/linux/issues/2850
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
Switch to snd_soc_dai_set_bclk_ratio
Replaces obsolete function snd_soc_dai_set_tdm_slot
Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
Enhances the DAC+ driver to control the optional headphone amplifier
Probes on the I2C bus for TPA6130A2, if successful, it sets DT-parameter
'status' from 'disabled' to 'okay' using change_sets to enable
the headphone control.
Signed-off-by: Joerg Schambacher joerg@i2audio.com
Update Allo Piano Dac Driver
Add unique names to the individual dac coded drivers
Remove some of the codec controls that are not used.
Signed-off-by: Paul Hermann <paul@picoreplayer.org>
Fixes an onboard clock detection problem of the PRO versions
Increasing the sleep time after clock selection to 3-4ms
allows the correct detection of all combinations of DAC+ Pro
and DAC+ADC Pro sound cards and the various PI revisions.
Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
ASoC:ma120x0p: Increase maximum sample rate to 192KHz
Change the maximum sample rate for the amplifier to
192KHz as given in the Infineon specification.
Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
ASoC: ma120x0p: Remove unnecessary const specifier
Clang warns:
sound/soc/codecs/ma120x0p.c:891:14: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
static const SOC_VALUE_ENUM_SINGLE_DECL(pwr_mode_ctrl,
^
./include/sound/soc.h:362:2: note: expanded from macro 'SOC_VALUE_ENUM_SINGLE_DECL'
SOC_VALUE_ENUM_DOUBLE_DECL(name, xreg, xshift, xshift, xmask, xtexts, xvalues)
^
./include/sound/soc.h:359:2: note: expanded from macro 'SOC_VALUE_ENUM_DOUBLE_DECL'
const struct soc_enum name = SOC_VALUE_ENUM_DOUBLE(xreg, xshift_l, xshift_r, xmask, \
^
1 warning generated.
SOC_VALUE_ENUM_DOUBLE_DECL already has a const specifier. Remove the duplicate
const to clean up the warning.
Fixes: 42444979e7 ("Add support for all the downstream rpi sound card drivers")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
ASoC: bcm: allo-piano-dac-plus: Remove unnecessary const specifiers
Clang warns:
sound/soc/bcm/allo-piano-dac-plus.c:66:14: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
static const SOC_ENUM_SINGLE_DECL(allo_piano_mode_enum,
^
./include/sound/soc.h:355:2: note: expanded from macro 'SOC_ENUM_SINGLE_DECL'
SOC_ENUM_DOUBLE_DECL(name, xreg, xshift, xshift, xtexts)
^
./include/sound/soc.h:352:2: note: expanded from macro 'SOC_ENUM_DOUBLE_DECL'
const struct soc_enum name = SOC_ENUM_DOUBLE(xreg, xshift_l, xshift_r, \
^
sound/soc/bcm/allo-piano-dac-plus.c:75:14: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
static const SOC_ENUM_SINGLE_DECL(allo_piano_dual_mode_enum,
^
./include/sound/soc.h:355:2: note: expanded from macro 'SOC_ENUM_SINGLE_DECL'
SOC_ENUM_DOUBLE_DECL(name, xreg, xshift, xshift, xtexts)
^
./include/sound/soc.h:352:2: note: expanded from macro 'SOC_ENUM_DOUBLE_DECL'
const struct soc_enum name = SOC_ENUM_DOUBLE(xreg, xshift_l, xshift_r, \
^
sound/soc/bcm/allo-piano-dac-plus.c:96:14: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
static const SOC_ENUM_SINGLE_DECL(allo_piano_enum,
^
./include/sound/soc.h:355:2: note: expanded from macro 'SOC_ENUM_SINGLE_DECL'
SOC_ENUM_DOUBLE_DECL(name, xreg, xshift, xshift, xtexts)
^
./include/sound/soc.h:352:2: note: expanded from macro 'SOC_ENUM_DOUBLE_DECL'
const struct soc_enum name = SOC_ENUM_DOUBLE(xreg, xshift_l, xshift_r, \
^
3 warnings generated.
SOC_VALUE_ENUM_DOUBLE_DECL already has a const specifier. Remove the duplicate
const specifiers to clean up the warnings.
Fixes: 42444979e7 ("Add support for all the downstream rpi sound card drivers")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
rpi-simple-soundcard: Add Dion Audio KIWI streamer
Signed-off-by: Miquel Blauw <miquelblauw@hotmail.com>
rpi-simple-soundcard: adds definitions for the HiFiBerry AMP3 card
Uses Infineon MA120x0 amplifier and supports full sample rate of 192ksps.
Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
sound: soc: bcm: Added Sound card driver for Dacberry400 Audio card for Raspberry Pi 400
Added Sound card driver for DACberry400 Audio card.
Signed-off-by: Ashish Vara <ashishhvara@gmail.com>
ASoC:ma120x0p: Corrects the volume level display
Fixes the wrongly changed 'limiter volume' display back to -50dB minimum
and sets the correct minimum volume level to -144dB to be aligned with
the controls and display in alsamixer etc.
Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
ASoC: bcm: Fix Rpi-PROTO and audioinjector.net Pi
As of kernel 5.19 the WM8731 driver has separate I2C and SPI support
modules. Change the Kconfig definitions for the audioinjector.net Pi
and Rpi-PROTO soundcards to select SND_SOC_WM8731_I2C.
See: https://github.com/raspberrypi/linux/issues/5364
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASoC: adau1977: Add correct compatible strings
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASoC: bcm2835-i2s: Use phys addresses for DAI DMA
Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
configuration of addresses of DMA slave interfaces should be done in
CPU physical addresses.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
rpi sound cards: Fix Codec Zero rate switching
The Raspberry Pi Codec Zero (and IQaudIO Codec) don't notify the DA7213
codec when it needs to change PLL frequencies. As a result, audio can
be played at the wrong rate - play a 48kHz sound immediately after a
44.1kHz sound to see the effect, but in some configurations the codec
can lock into the wrong state and always get some rates wrong.
Add the necessary notification to fix the issue.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASoC: dwc: Support set_bclk_ratio
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASoC: dwc: Add DMACR handling
Add control of the DMACR register, which is required for paced DMA
(i.e. DREQ) support.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASOC: dwc: Improve DMA shutdown
Disabling the I2S interface with outstanding transfers prevents the
DMAC from shutting down, so keep it partially active after a stop.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASOC: dwc: Fix 16-bit audio handling
IMO the Synopsys datasheet could be clearer in this area, but it seems
that the DMA data ports (DMATX and DMARX) expect left and right samples
in alternate writes; if a stereo pair is pushed in a single 32-bit
write, the upper half is ignored, leading to double speed audio with a
confused stereo image. Make sure the necessary changes happen by
updating the DMA configuration data in the hw_params method.
The set_bclk_ratio change was made at a time when it looked like it
could be causing an error, but I think the division of responsibilities
is clearer this way (and the kernel log clearer without the info-level
message).
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASoC: bcm: Remove dependency on BCM2835 I2S
These soundcard drivers don't rely on a specific I2S interface, so
remove the dependency declarations.
See: https://github.com/raspberrypi/linux-2712/issues/111
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASoC: bcm: audioinjector_octo: Add soundcard "owner"
See: https://github.com/raspberrypi/linux/issues/5697
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Pisound: Don't export the button GPIO via sysfs GPIO class.
Signed-off-by: Giedrius Trainavičius <giedrius@blokas.io>
Pisound: Read out the SPI speed to use from the Device Tree.
Signed-off-by: Giedrius Trainavičius <giedrius@blokas.io>
ASoC: DACplus - fix 16bit sample support in clock consumer mode
The former code did not adjust the physical sample width when
in clock consumer mode and has taken the fixed 32 bit default.
This has caused the audio to be played at half its frequency due to
the fixed bclk_ratio of 64.
Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
ASoC: adds support for AMP4 Pro to the DAC Plus driver
The AMP4 Pro is a I2S master mode capable amplifier with
clean onboard clock generators.
We can share the card driver between TAS575x amplifiers
and the PCM512x DACs as they are SW compatible.
From a HW perspective though we need to limit the sample
rates to the standard audio rates to avoid running the
onboard clocks through the PLL. Using the PLL would require
even a different HW.
DAI/stream name are also set accordingly to allow the user
a convenient identification of the soundcard
Needs the pcm512x driver with TAS575x support (already in
upstream kernel).
Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
ASoC: DACplusADCPro - fix 16bit sample support in clock consumer mode
The former code did not adjust the physical sample width when in
clock consumer mode and has taken the fixed 32 bit default. This
has caused the audio to be played at half its frequency due to
the fixed bclk_ratio of 64.
Problem appears only on PI5 as on the former PIs the I2S module
did simply run at fixed 64x rate.
Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
Impliment driver support for Interlude Audio Digital Hat
Implementing driver support for
Interlude audio's WM8805 based digital hat
by leveraging existing drivers
ASOc: Add HiFiBerry DAC8X to the simple card driver
Defines the settings for the 8 channel version of the standard
DAC by overwriting the number of channels in the DAI defs.
It can run in 8ch mode only on PI5 using the 4 lane data output
of the designware I2S0 module.
Signed-off-by: j-schambacher <joerg@hifiberry.com>
ASoC: bcm: Use the correct sample width value
ALSA's concept of the physical width of a sample is how much memory it
occupies, including any padding. This not the same as the count of bits
of actual sample content. In particular, S24_LE has a width of 24 bits
but a physical width of 32 bits because there is a byte of padding with
each sample.
When calculating bclk_ratio, etc., it is width that matters, not
physical width. Correct the error that has been replicated across the
drivers for many Raspberry Pi-compatible soundcards.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASoC: dwc: Correct channel count reporting
The DWC I2S driver treats the channel count register values as if they
encode a power of two (2, 4, 8, 16), but they actually encode a
multiple of 2 (2, 4, 6, 8).
Also improve the error message when asked for an unsupported number
of channels.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASoC: Fix 16bit sample support for Hifiberry DACplusADC
Same issue as #5919.
'width' needs to be set independent of clocking mode.
Signed-off-by: j-schambacher <joerg@hifiberry.com>
allo-boss-dac mute output when changing parameters
Since I noticed that sometimes changing sample rates causes some digital
quirks and noises, I've changed the function to mute the output before
performing the changes and then unmute it when an error occurs or the
parameters got set.
Signed-off-by: Alessandro Marcon <marconalessandro04@gmail.com>
ASoC: bcm: Use power-of-2 bclk_ratios
The soundcard drivers originally used snd_pcm_format_physical_width,
but a later commit changed that to snd_pcm_format_width because the
in-memory sample storage width should not be a factor in determining
the bclk_ratio. However, the physical width rounds the sample bits up
to the nearest power of 2, which makes it easier to find integer clock
divisors.
Restore the old behaviour, but with an implementation that makes it
clear what is going on.
See: https://github.com/raspberrypi/linux/issues/6104
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASoC: bcm: Add "owner" info for more soundcards
See: https://github.com/raspberrypi/linux/issues/5697
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASoC: da7213: Add a set_bclk_ratio method
Following [1], it becomes harder for the CPU DAI to know the correct
BCLK ratio. We can either bake the same knowledge into the sound card
driver, or implement and use set_bclk_ratio on the codec. This commit
does the latter.
[1] commit c89e652e84 ("ASoC: da7213: Add support for mono, set
frame width to 32 when possible")
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
iqaudio-codec: Use the codec's new set_bclk_ratio
To ensure that the CPU DAI and codec agree over the BCLK ratio, impose
a fixed value of 64 on both of them.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASoC: add driver for new HiFiBerry ADC only board(s)
Adds the driver for the soon to be released first ADC only board.
It includes the same ADC controls as used by the DAC+ADC Pro driver.
Signed-off-by: j-schambacher <joerg@hifiberry.com>
ASoC: add HiFiBerry ADC8x 8-channel ADC to simple-card-driver
Definitions for the 8 channel ADC card. The card uses only
HW-controlled devices which allows the uses of the 'dummy-dai'.
It will run only on a PI5 as it requires the designware I2S0 module.
The necessary output lanes I2S0_DI[0..3] are claimed from within the
DT overlay.
Signed-off-by: j-schambacher <joerg@hifiberry.com>
sound/soc: dwc-i2s: choose FIFO thresholds based on DMA burst constraints
Valid ranges for the I2S peripheral's FIFO configuration include a depth
of 16 - unconditionally setting the burst length to 16 with a fifo
threshold of size/2 will cause under/overflows.
For DMA engines with restricted capabilities the requested burst length
and FIFO thresholds need to be adjusted downward accordingly.
Both the RX and TX FIFOs operate on "less-than" thresholds. Setting the
TX threshold to fifo_size minus burst means the FIFO is kept nearly-full.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
ASoC: allo-piano-dac-plus: Fix volume limit locking
Calling snd_soc_limit_volume from within a kcontrol put handler seems
to cause a deadlock as it attempts to claim a write lock that is already
held. Call snd_soc_limit_volume from the main initialisation code
instead, to avoid the recursive locking.
See: https://github.com/raspberrypi/linux/issues/6527
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASoC: allo-piano-dac-plus: Suppress -517 errors
Use dev_err_probe to simplify the code and suppress EPROBE_DEFER errors.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
soc: pcm3168a: Add DT binding to force clock consumer mode
ASoC cannot configure the codec correctly when the ADC and DAC share clock
lines and one of them is the clock producer. Add a DT binding that
overrides ASoC and forces the component into clock consumer mode.
Signed-off-by: Stephen Gordon <gordoste@iinet.net.au>
ASoC: pcm512x: Demote "No SCLK" to debug level
Designing a PCM512X-based soundcard with no external SCLK is a valid
choice supported by the driver. Don't alarm users with messages that
say "No SCLK, using BCLK: -2" - reclassify them as debug information.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASoC: allo-piano-dac-plus: Fix volume limiting
Controls which only exist when snd_soc_register_card returns can't be
modified before then. Move the setting of volume limits to just before
the end of the probe function.
Link: https://github.com/raspberrypi/linux/issues/6527
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASoC: allo-piano-dac-plus: Remove pointless code
The codec control Digital Playback Volume is one of the controls deleted
by the allo-piano-dac-plus driver. It is effectively replaced by the
soundcard controls Master Playback Volume and Subwoofer Playback Volume.
Delete the code that sets the volume limit on those codec controls - the
limits on the soundcard volume controls are sufficient.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
ASoC: adds ADC8x support to the Hifiberry DAC8x
The driver probes for the ADC8x which can be stacked on top
of the DAC8x. It enables a symmetric 8 channel capture using
the dummy-dai.
Signed-off-by: j-schambacher <joerg@hifiberry.com>
sound: soc: raspberrypi: RP1 Audio Out driver as an ASOC DAI
Only 48000Hz stereo 16-bit output is currently supported.
It requires some additional OF plumbing to connect it to a
"dummy" codec and generic sound card.
Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
Adding Pimidi kernel module.
Signed-off-by: Giedrius Trainavičius <giedrius@blokas.io>
Adding Pisound Micro kernel module
Signed-off-by: Giedrius Trainavičius <giedrius@blokas.io>
Pisound Micro: Fix for MIDI output under full load.
This fixes MIDI output of Pisound Micro after running for a while under
full load and increases timing stability.
Signed-off-by: Giedrius Trainavičius <giedrius@blokas.io>
ALSA: korg1212: replace del_timer with timer_delete
pisound-micro: Added pin_pull and pin_b_pull sysfs attributes for Pisound Micro.
These attributes are available only for GPIO input and Encoder elements.
Signed-off-by: Giedrius <giedrius@blokas.io>
Pisound Micro: Workaround for snd_soc_dai_set_tdm_slot with slots=0
Even though it's documented that specifying slots=0 can be used to disable
the TDM mode, error checking introduced in 6.12.31 version broke this,
therefore, for the time being, a workaround is to provide a xlate_tdm_slot_mask
operation implementation to return 0 instead of -EINVAL as it does in case
slots argument is 0.
Signed-off-by: Giedrius Trainavičius <giedrius@blokas.io>
Upstream chose to use BTN_DPAD_* and BTN_SELECT, whilst downstream
had used KEY_*.
Revert to the downstream map to avoid any regressions.
(Ideally this would be read from DT)
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
This patch adds the compatible string for the Sense HAT device to
the list of compatible strings in the simple_mfd_i2c driver so that
it can match against the device and load its children and their drivers
Co-developed-by: Mwesigwa Guma <mguma@redhat.com>
Signed-off-by: Mwesigwa Guma <mguma@redhat.com>
Co-developed-by: Joel Savitz <jsavitz@redhat.com>
Signed-off-by: Joel Savitz <jsavitz@redhat.com>
Signed-off-by: Charles Mirabile <cmirabil@redhat.com>
mfd: Add rpi_sense_core of compatible string
rpisense-fb: Set pseudo_pallete to prevent crash on fbcon takeover
Signed-off-by: Serge Schneider <serge@raspberrypi.com>
rpisense-fb: Add explicit fb_deferred_io_mmap hook
As of commit [1], introduced in 5.18, fbdev drivers that use
deferred IO and need mmap support must include an explicit fb_mmap
pointer to the fb_deferred_io_mmap.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
[1] 5905585103 ("fbdev: Put mmap for deferred I/O into drivers")
drivers: Remove downstream SenseHAT core and joystick drivers
Parts of a SenseHAT driver have been submitted upstream using the
simple-i2c-mfd framework. The joystick driver has been merged.
It's been noted that there are several issues with the downstream
joystick and core drivers, so remove these in favour of the upstream
approach, and fix up the FB driver to match.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Provide a __copy_from_user that uses memcpy. On BCM2708, use
optimised memcpy/memmove/memcmp/memset implementations.
arch/arm: Add mmiocpy/set aliases for memcpy/set
See: https://github.com/raspberrypi/linux/issues/1082
copy_from_user: CPU_SW_DOMAIN_PAN compatibility
The downstream copy_from_user acceleration must also play nice with
CONFIG_CPU_SW_DOMAIN_PAN.
See: https://github.com/raspberrypi/linux/issues/1381
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
Fix copy_from_user if BCM2835_FAST_MEMCPY=n
The change which introduced CONFIG_BCM2835_FAST_MEMCPY unconditionally
changed the behaviour of arm_copy_from_user. The page pinning code
is not safe on ARMv7 if LPAE & high memory is enabled and causes
crashes which look like PTE corruption.
Make __copy_from_user_memcpy conditional on CONFIG_2835_FAST_MEMCPY=y
which is really an ARMv6 / Pi1 optimization and not necessary on newer
ARM processors.
arm: fix mmap unlocks in uaccess_with_memcpy.c
This is a regression that was added with the commit 192a4e923e as of rpi-5.8.y, since that is when the move to the mmap locking API was introduced - d8ed45c5dc
The issue is that when the patch to improve performance for the __copy_to_user and __copy_from_user functions were added for the Raspberry Pi, some of the mmaps were incorrectly mapped to write instead of read. This would cause a verity of issues, and in my case, prevent the booting of a squashfs filesystem on rpi-5.8-y and above. An example of the panic you would see from this can be seen at https://pastebin.com/raw/jBz5xCzL
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Christopher Blake <chrisrblake93@gmail.com>
arch/arm: Add __memset alias to memset_rpi.S
memset_rpi.S is an optimised memset implementation, but doesn't define
__memset (which was just added to memset.S). As a result, building
for the BCM2835 platform causes a link failure.
Add __memset as yet another alias to our common implementation.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
arm: Fix custom rpi __memset32 and __memset64
See: https://github.com/raspberrypi/linux/issues/4798
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
arm: Fix annoying .eh_frame section warnings
Replace the cfi directives with the UNWIND equivalents. This prevents
the .eh_frame section from being created, eliminating the warnings.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The "input" trigger makes the associated GPIO an input. This is to support
the Raspberry Pi PWR LED, which is driven by external hardware in normal use.
N.B. pwr_led is not available on Model A or B boards.
leds-gpio: Implement the brightness_get method
The power LED uses some clever logic that means it is driven
by a voltage measuring circuit when configured as input, otherwise
it is driven by the GPIO output value. This patch wires up the
brightness_get method for leds-gpio so that user-space can monitor
the LED value via /sys/class/gpio/led1/brightness. Using the input
trigger this returns an indication of the system power health,
otherwise it is just whatever value the trigger has written most
recently.
See: https://github.com/raspberrypi/linux/issues/1064
Support booting without Device Tree.
Turn on USB power.
Load driver early because of lacking support for deferred probing
in many drivers.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
firmware: bcm2835: Don't turn on USB power
The raspberrypi-power driver is now used to turn on USB power.
This partly reverts commit:
firmware: bcm2835: Support ARCH_BCM270x
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Based on bcm2835-gpiomem.
We allow export of the "GPIO registers" to userspace via a chardev as
this allows for finer access control (e.g. users must be group gpio, root
not required).
This driver allows access to either rp1-gpiomem or gpiomem, depending on
which nodes are populated in devicetree.
RP1 has a different look-and-feel to BCM283x SoCs as it has split ranges
for IO controls and the parallel registered OE/IN/OUT access. To handle
this, the driver concatenates the ranges for an IO bank and the
corresponding RIO instance into a contiguous buffer.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Add module for accessing the mailbox property channel through
/dev/vcio. Was previously in bcm2708-vcio.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
char: vcio: Add compat ioctl handling
There was no compat ioctl handler, so 32 bit userspace on a
64 bit kernel failed as IOCTL_MBOX_PROPERTY used the size
of char*.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
char: vcio: Fail probe if rpi_firmware is not found.
Device Tree is now the only supported config mechanism, therefore
uncomment the block of code that fails the probe if the
firmware node can't be found.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
drivers: char: vcio: Use common compat header
The definition of compat_ptr is now common for most platforms, but
requires the inclusion of <linux/compat.h>.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
char: vcio: Rewrite as a firmware node child
The old vcio driver is a simple character device that manually locates
the firmware driver. Initialising it before the firmware driver causes
a failure, and no retries are attempted.
Rewrite vcio as a platform driver that depends on a DT node for its
instantiation and the location of the firmware driver, making use of
the miscdevice framework to reduce the code size.
N.B. Using miscdevice changes the udev SUBSYSTEM string, so a change
to the companion udev rule is required in order to continue to set
the correct device permissions, e.g.:
KERNEL="vcio", GROUP="video", MODE="0660"
See: https://github.com/raspberrypi/linux/issues/4620
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
i2c-bcm2708: fixed baudrate
Fixed issue where the wrong CDIV value was set for baudrates below 3815 Hz (for 250MHz bus clock).
In that case the computed CDIV value was more than 0xffff. However the CDIV register width is only 16 bits.
This resulted in incorrect setting of CDIV and higher baudrate than intended.
Example: 3500Hz -> CDIV=0x11704 -> CDIV(16bit)=0x1704 -> 42430Hz
After correction: 3500Hz -> CDIV=0x11704 -> CDIV(16bit)=0xffff -> 3815Hz
The correct baudrate is shown in the log after the cdiv > 0xffff correction.
Perform I2C combined transactions when possible
Perform I2C combined transactions whenever possible, within the
restrictions of the Broadcomm Serial Controller.
Disable DONE interrupt during TA poll
Prevent interrupt from being triggered if poll is missed and transfer
starts and finishes.
i2c: Make combined transactions optional and disabled by default
i2c: bcm2708: add device tree support
Add DT support to driver and add to .dtsi file.
Setup pins in .dts file.
i2c is disabled by default.
Signed-off-by: Noralf Tronnes <notro@tronnes.org>
bcm2708: don't register i2c controllers when using DT
The devices for the i2c controllers are in the Device Tree.
Only register devices when not using DT.
Signed-off-by: Noralf Tronnes <notro@tronnes.org>
I2C: Only register the I2C device for the current board revision
i2c_bcm2708: Fix clock reference counting
Fix grabbing lock from atomic context in i2c driver
2 main changes:
- check for timeouts in the bcm2708_bsc_setup function as indicated by this comment:
/* poll for transfer start bit (should only take 1-20 polls) */
This implies that the setup function can now fail so account for this everywhere it's called
- Removed the clk_get_rate call from inside the setup function as it locks a mutex and that's not ok since we call it from under a spin lock.
i2c-bcm2708: When using DT, leave the GPIO setup to pinctrl
i2c-bcm2708: Increase timeouts to allow larger transfers
Use the timeout value provided by the I2C_TIMEOUT ioctl when waiting
for completion. The default timeout is 1 second.
See: https://github.com/raspberrypi/linux/issues/260
i2c-bcm2708/BCM270X_DT: Add support for I2C2
The third I2C bus (I2C2) is normally reserved for HDMI use. Careless
use of this bus can break an attached display - use with caution.
It is recommended to disable accesses by VideoCore by setting
hdmi_ignore_edid=1 or hdmi_edid_file=1 in config.txt.
The interface is disabled by default - enable using the
i2c2_iknowwhatimdoing DT parameter.
bcm2708-spi: Don't use static pin configuration with DT
Also remove superfluous error checking - the SPI framework ensures the
validity of the chip_select value.
i2c-bcm2708: Remove non-DT support
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Set the BSC_CLKT clock streching timeout to 35ms as per SMBus specs.
Fixes i2c_bcm2708: Write to FIFO correctly - v2 (#1574)
* i2c: fix i2c_bcm2708: Clear FIFO before sending data
Make sure FIFO gets cleared before trying to send
data in case of a repeated start (COMBINED=Y).
* i2c: fix i2c_bcm2708: Only write to FIFO when not full
Check if FIFO can accept data before writing.
To avoid a peripheral read on the last iteration of a loop,
both bcm2708_bsc_fifo_fill and ~drain are changed as well.
Signed-off-by: Luke Wren <wren6991@gmail.com>
MISC: bcm2835: smi: use clock manager and fix reload issues
Use clock manager instead of self-made clockmanager.
Also fix some error paths that showd up during development
(especially missing release of dma resources on rmmod)
Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
bcm2835_smi: re-add dereference to fix DMA transfers
bcm2835_smi_dev: Fix handling of word-odd lengths
The read and write functions did not use the correct pointer offset
when dealing with an odd number of bytes after a DMA transfer. Also,
only handle the remaining odd bytes if the DMA transfer completed
successfully.
Submitted-by: @madimario (GitHub)
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
misc: bcm2835_smi: Use proper enum types for dma_{,un}map_single()
Clang warns:
drivers/misc/bcm2835_smi.c:692:4: warning: implicit conversion from enumeration type 'enum dma_transfer_direction' to different enumeration type 'enum dma_data_direction' [-Wenum-conversion]
DMA_MEM_TO_DEV);
^~~~~~~~~~~~~~~
./include/linux/dma-mapping.h:406:66: note: expanded from macro 'dma_map_single'
#define dma_map_single(d, a, s, r) dma_map_single_attrs(d, a, s, r, 0)
~~~~~~~~~~~~~~~~~~~~ ^
drivers/misc/bcm2835_smi.c:705:35: warning: implicit conversion from enumeration type 'enum dma_transfer_direction' to different enumeration type 'enum dma_data_direction' [-Wenum-conversion]
(inst->dev, phy_addr, n_bytes, DMA_MEM_TO_DEV);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~
./include/linux/dma-mapping.h:407:70: note: expanded from macro 'dma_unmap_single'
#define dma_unmap_single(d, a, s, r) dma_unmap_single_attrs(d, a, s, r, 0)
~~~~~~~~~~~~~~~~~~~~~~ ^
drivers/misc/bcm2835_smi.c:751:12: warning: implicit conversion from enumeration type 'enum dma_transfer_direction' to different enumeration type 'enum dma_data_direction' [-Wenum-conversion]
DMA_DEV_TO_MEM);
^~~~~~~~~~~~~~~
./include/linux/dma-mapping.h:406:66: note: expanded from macro 'dma_map_single'
#define dma_map_single(d, a, s, r) dma_map_single_attrs(d, a, s, r, 0)
~~~~~~~~~~~~~~~~~~~~ ^
drivers/misc/bcm2835_smi.c:761:50: warning: implicit conversion from enumeration type 'enum dma_transfer_direction' to different enumeration type 'enum dma_data_direction' [-Wenum-conversion]
dma_unmap_single(inst->dev, phy_addr, n_bytes, DMA_DEV_TO_MEM);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~
./include/linux/dma-mapping.h:407:70: note: expanded from macro 'dma_unmap_single'
#define dma_unmap_single(d, a, s, r) dma_unmap_single_attrs(d, a, s, r, 0)
~~~~~~~~~~~~~~~~~~~~~~ ^
4 warnings generated.
Use the proper enumerated type to clear up the warning. There is not
actually a bug here because the enumerated types have the same integer
value:
DMA_MEM_TO_DEV = DMA_TO_DEVICE = 1
DMA_DEV_TO_MEM = DMA_FROM_DEVICE = 2
Fixes: 93254d0f7b ("Add SMI driver")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
bcm2835-smi: Use phys addresses for slave DMA config
Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
configuration of addresses of DMA slave interfaces should be done in
CPU physical addresses.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Signed-off-by: popcornmix <popcornmix@gmail.com>
BCM270x: Move vc_mem
Make the vc_mem module available for ARCH_BCM2835 by moving it.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
char: vc_mem: Fix up compat ioctls for 64bit kernel
compat_ioctl wasn't defined, so 32bit user/64bit kernel
always failed.
VC_MEM_IOC_MEM_PHYS_ADDR was defined with parameter size
unsigned long, so the ioctl cmd changes between sizes.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
char: vc_mem: Fix all coding style issues.
Cleans up all checkpatch errors in vc_mem.c and vc_mem.h
No functional change to the code.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
char: vc_mem: Delete dead code
There are no error exists once device_create has succeeded, and
therefore no need to call device_destroy from vc_mem_init.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
char: broadcom: vc_mem: Fix preprocessor conditional
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
vc_mem: Add the DMA memcpy support from bcm2708_fb
bcm2708_fb is disabled by the vc4-kms-v3d overlay, which means that the
DMA memcpy support it provides is not available to allow vclog to read
the VC logs from the top 16MB on Pi 2 and Pi 3. Add the code to the
vc_mem driver, which will still be enabled.
It ought to be possible to do a proper DMA_MEM_TO_MEM copy via the
generic DMA customer API, but that can be a later step.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
See https://github.com/raspberrypi/linux/issues/5019
If an SD card has degraded performance such that IO operations time out
then the MMC block layer will leak SG DMA mappings in the swiotlb during
recovery. It retries the same SG and this causes the leak, as it is
mapped twice - once in sdhci_pre_req() and again during single-block
reads in sdhci_prepare_data().
Resetting the card (including power-cycling if a regulator for vmmc is
present) ought to be enough to recover a stuck state, so for now don't
try single-block reads in the recovery path.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
mmc: Disable CMD23 transfers on all cards
Pending wire-level investigation of these types of transfers
and associated errors on bcm2835-mmc, disable for now. Fallback of
CMD18/CMD25 transfers will be used automatically by the MMC layer.
Reported/Tested-by: Gellert Weisz <gellert@raspberrypi.org>
mmc: bcm2835-mmc: enable DT support for all architectures
Both ARCH_BCM2835 and ARCH_BCM270x are built with OF now.
Enable Device Tree support for all architectures.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
mmc: bcm2835-mmc: fix probe error handling
Probe error handling is broken in several places.
Simplify error handling by using device managed functions.
Replace pr_{err,info} with dev_{err,info}.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
bcm2835-mmc: Add locks when accessing sdhost registers
bcm2835-mmc: Add range of debug options for slowing things down
bcm2835-mmc: Add option to disable some delays
bcm2835-mmc: Add option to disable MMC_QUIRK_BLK_NO_CMD23
bcm2835-mmc: Default to disabling MMC_QUIRK_BLK_NO_CMD23
bcm2835-mmc: Adding overclocking option
Allow a different clock speed to be substitued for a requested 50MHz.
This option is exposed using the "overclock_50" DT parameter.
Note that the mmc interface is restricted to EVEN integer divisions of
250MHz, and the highest sensible option is 63 (250/4 = 62.5), the
next being 125 (250/2) which is much too high.
Use at your own risk.
bcm2835-mmc: Round up the overclock, so 62 works for 62.5Mhz
Also only warn once for each overclock setting.
mmc: bcm2835-mmc: Make available on ARCH_BCM2835
Make the bcm2835-mmc driver available for use on ARCH_BCM2835.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
BCM270x_DT: add bcm2835-mmc entry
Add Device Tree entry for bcm2835-mmc.
In non-DT mode, don't add the device in the board file.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
bcm2835-mmc: Don't overwrite MMC capabilities from DT
bcm2835-mmc: Don't override bus width capabilities from devicetree
Take out the force setting of the MMC_CAP_4_BIT_DATA host capability
so that the result read from devicetree via mmc_of_parse() is
preserved.
bcm2835-mmc: Only claim one DMA channel
With both MMC controllers enabled there are few DMA channels left. The
bcm2835-mmc driver only uses DMA in one direction at a time, so it
doesn't need to claim two channels.
See: https://github.com/raspberrypi/linux/issues/1327
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
bcm2835-mmc: New timer API
mmc: bcm2835-mmc: Support underclocking
Support underclocking of the SD bus using the max-frequency DT property
(which currently has no DT parameter). The sd_overclock parameter
already provides another way to achieve the same thing which should be
equivalent in end result, but it is a bug not to support max-frequency
as well.
See: https://github.com/raspberrypi/linux/issues/2350
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
mmc/bcm2835: Recover from MMC_SEND_EXT_CSD
If the user issues an "mmc extcsd read", the SD controller receives
what it thinks is a SEND_IF_COND command with an unexpected data block.
The resulting operations leave the FSM stuck in READWAIT, a state which
persists until the MMC framework resets the controller, by which point
the root filesystem is likely to have been unmounted.
A less heavyweight solution is to detect the condition and nudge the
FSM by asserting the (self-clearing) FORCE_DATA_MODE bit.
N.B. This workaround was essentially discovered by accident and without
a full understanding the inner workings of the controller, so it is
fortunate that the "fix" only modifies error paths.
See: https://github.com/raspberrypi/linux/issues/2728
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
bcm2835-mmc: Fix DMA channel leak
The BCM2835 MMC host driver requests a DMA channel on probe but neglects
to release the channel in the probe error path and on driver unbind.
I'm seeing this happen on every boot of the Compute Module 3: On first
driver probe, DMA channel 2 is allocated and then leaked with a "could
not get clk, deferring probe" message. On second driver probe, channel 4
is allocated.
Fix it.
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: Frank Pavlic <f.pavlic@kunbus.de>
bcm2835-mmc: Fix struct mmc_host leak on probe
The BCM2835 MMC host driver requests the bus address of the host's
register map on probe. If that fails, the driver leaks the struct
mmc_host allocated earlier.
Fix it.
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: Frank Pavlic <f.pavlic@kunbus.de>
bcm2835-mmc: Fix duplicate free_irq() on remove
The BCM2835 MMC host driver requests its interrupt as a device-managed
resource, so the interrupt is automatically freed after the driver is
unbound.
However on driver unbind, bcm2835_mmc_remove() frees the interrupt
explicitly to avoid invocation of the interrupt handler after driver
structures have been torn down.
The interrupt is thus freed twice, leading to a WARN splat in
__free_irq(). Fix by not requesting the interrupt as a device-managed
resource.
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: Frank Pavlic <f.pavlic@kunbus.de>
bcm2835-mmc: Handle mmc_add_host() errors
The BCM2835 MMC host driver calls mmc_add_host() but doesn't check its
return value. Errors occurring in that function are therefore not
handled. Fix it.
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: Frank Pavlic <f.pavlic@kunbus.de>
bcm2835-mmc: Deduplicate reset of driver data on remove
The BCM2835 MMC host driver sets the device's driver data pointer to
NULL on ->remove() even though the driver core subsequently does the
same in __device_release_driver(). Drop the duplicate assignment.
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: Frank Pavlic <f.pavlic@kunbus.de>
bcm2835_mmc: Remove vestigial threaded IRQ
With SDIO processing now managed by the MMC framework with a
workqueue, the bcm2835_mmc driver no longer needs a threaded
IRQ.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
Add missing dma_unmap_sg calls to free relevant swiotlb bounce buffers.
This prevents DMA leaks.
Signed-off-by: Yaroslav Rosomakho <yaroslavros@gmail.com>
Limit max_req_size under arm64 (or any other platform that uses swiotlb) to prevent potential buffer overflow due to bouncing.
Signed-off-by: Yaroslav Rosomakho <yaroslavros@gmail.com>
mmc: sdhci: Silence MMC warnings
When the MMC isn't plugged in, the driver will spam the console which is
pretty annoying when using NFS.
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
mmc: sdhci-iproc: Fix vmmc regulators on iProc
The Linux support for controlling card power via regulators appears to
be contentious. I would argue that the default behaviour is contrary to
the SDHCI spec - turning off the power writes a reserved value to the
SD Bus Voltage Select field of the Power Control Register, which
seems to kill the Arasan/iProc controller - but fortunately there is a
hook in sdhci_ops to override the behaviour. Borrow the implementation
from sdhci_arasan_set_power.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
bcm2835-mmc: uninitialized_var is no more
Revert "mmc: sdhci-iproc: Fix vmmc regulators on iProc"
This reverts commit aed19399a0.
Commit 6c92ae1e45 ("mmc: sdhci: Introduce sdhci_set_power_and_bus_voltage()")
introduced a generic helper that does the same thing so use that instead in
the following commit.
Signed-off-by: Juerg Haefliger <juergh@canonical.com>
mmc: sdhci-iproc: Fix vmmc regulators (pre-bcm2711)
The Linux support for controlling card power via regulators appears to
be contentious. I would argue that the default behaviour is contrary to
the SDHCI spec - turning off the power writes a reserved value to the
SD Bus Voltage Select field of the Power Control Register, which
seems to kill the Arasan/iProc controller - but fortunately there is a
hook in sdhci_ops to override the behaviour.
Signed-off-by: Juerg Haefliger <juergh@canonical.com>
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
bcm2835-mmc: Honor return value of mmc_of_parse()
bcm2835_mmc_probe() ignores errors returned by mmc_of_parse() and in
particular ignores -EPROBE_DEFER, which may be returned if the power
sequencing driver configured in the devicetree is compiled as a module.
The user-visible result is that access to the SDIO device fails because
its power sequencing requirements have not been observed. Fix it.
Signed-off-by: Lukas Wunner <lukas@wunner.de>
bcm2835-mmc: Use phys addresses for slave DMA config
Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
configuration of addresses of DMA slave interfaces should be done in
CPU physical addresses.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Add support for DMA controller of BCM2708 as used in the Raspberry Pi.
Currently it only supports cyclic DMA.
Signed-off-by: Florian Meier <florian.meier@koalo.de>
dmaengine: expand functionality by supporting scatter/gather transfers sdhci-bcm2708 and dma.c: fix for LITE channels
DMA: fix cyclic LITE length overflow bug
dmaengine: bcm2708: Remove chancnt affectations
Mirror bcm2835-dma.c commit 9eba5536a7:
chancnt is already filled by dma_async_device_register, which uses the channel
list to know how much channels there is.
Since it's already filled, we can safely remove it from the drivers' probe
function.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
dmaengine: bcm2708: overwrite dreq only if it is not set
dreq is set when the DMA channel is fetched from Device Tree.
slave_id is set using dmaengine_slave_config().
Only overwrite dreq with slave_id if it is not set.
dreq/slave_id in the cyclic DMA case is not touched, because I don't
have hardware to test with.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
dmaengine: bcm2708: do device registration in the board file
Don't register the device in the driver. Do it in the board file.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
dmaengine: bcm2708: don't restrict DT support to ARCH_BCM2835
Both ARCH_BCM2835 and ARCH_BCM270x are built with OF now.
Add Device Tree support to the non ARCH_BCM2835 case.
Use the same driver name regardless of architecture.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
BCM270x_DT: add bcm2835-dma entry
Add Device Tree entry for bcm2835-dma.
The entry doesn't contain any resources since they are handled
by the arch/arm/mach-bcm270x/dma.c driver.
In non-DT mode, don't add the device in the board file.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
bcm2708-dmaengine: Add debug options
BCM270x: Add memory and irq resources to dmaengine device and DT
Prepare for merging of the legacy DMA API arch driver dma.c
with bcm2708-dmaengine by adding memory and irq resources both
to platform file device and Device Tree node.
Don't use BCM_DMAMAN_DRIVER_NAME so we don't have to include mach/dma.h
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
dmaengine: bcm2708: Merge with arch dma.c driver and disable dma.c
Merge the legacy DMA API driver with bcm2708-dmaengine.
This is done so we can use bcm2708_fb on ARCH_BCM2835 (mailbox
driver is also needed).
Changes to the dma.c code:
- Use BIT() macro.
- Cutdown some comments to one line.
- Add mutex to vc_dmaman and use this, since the dev lock is locked
during probing of the engine part.
- Add global g_dmaman variable since drvdata is used by the engine part.
- Restructure for readability:
vc_dmaman_chan_alloc()
vc_dmaman_chan_free()
bcm_dma_chan_free()
- Restructure bcm_dma_chan_alloc() to simplify error handling.
- Use device irq resources instead of hardcoded bcm_dma_irqs table.
- Remove dev_dmaman_register() and code it directly.
- Remove dev_dmaman_deregister() and code it directly.
- Simplify bcm_dmaman_probe() using devm_* functions.
- Get dmachans from DT if available.
- Keep 'dma.dmachans' module argument name for backwards compatibility.
Make it available on ARCH_BCM2835 as well.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
dmaengine: bcm2708: set residue_granularity field
bcm2708-dmaengine supports residue reporting at burst level
but didn't report this via the residue_granularity field.
Without this field set properly we get playback issues with I2S cards.
dmaengine: bcm2708-dmaengine: Fix memory leak when stopping a running transfer
bcm2708-dmaengine: Use more DMA channels (but not 12)
1) Only the bcm2708_fb drivers uses the legacy DMA API, and
it requires a BULK-capable channel, so all other types
(FAST, NORMAL and LITE) can be made available to the regular
DMA API.
2) DMA channels 11-14 share an interrupt. The driver can't
handle this, so don't use channels 12-14 (12 was used, probably
because it appears to have an interrupt, but in reality that
interrupt is for activity on ANY channel). This may explain
a lockup encountered when running out of DMA channels.
The combined effect of this patch is to leave 7 DMA channels
available + channel 0 for bcm2708_fb via the legacy API.
See: https://github.com/raspberrypi/linux/issues/1110https://github.com/raspberrypi/linux/issues/1108
dmaengine: bcm2708: Make legacy API available for bcm2835-dma
bcm2708_fb uses the legacy DMA API, so in order to start using
bcm2835-dma, bcm2835-dma has to support the legacy API. Make this
possible by exporting bcm_dmaman_probe() and bcm_dmaman_remove().
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
dmaengine: bcm2708: Change DT compatible string
Both bcm2835-dma and bcm2708-dmaengine have the same compatible string.
So change compatible to "brcm,bcm2708-dma".
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
dmaengine: bcm2708: Remove driver but keep legacy API
Dropping non-DT support means we don't need this driver,
but we still need the legacy DMA API.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
bcm2708-dmaengine - Fix arm64 portability/build issues
dma-bcm2708: Fix module compilation of CONFIG_DMA_BCM2708
bcm2708-dmaengine.c defines functions like bcm_dma_start which are
defined as well in dma-bcm2708.h as inline versions when
CONFIG_DMA_BCM2708 is not defined. This works fine when
CONFIG_DMA_BCM2708 is built in, but when it is selected as module build
fails with redefinition errors because in the build system when
CONFIG_DMA_BCM2708 is selected as module, the macro becomes
CONFIG_DMA_BCM2708_MODULE.
This patch makes the header use CONFIG_DMA_BCM2708_MODULE too when
available.
Fixes https://github.com/raspberrypi/linux/issues/2056
Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
bcm2708-dmaengine: Use platform_get_irq
The platform driver framework no longer creates IRQ resources for
platform devices because they are expected to use platform_get_irq.
This causes the bcm2808_fb acceleration to fail.
Fix the problem by calling platform_get_irq as intended.
See: https://github.com/raspberrypi/linux/issues/5131
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Signed-off-by: popcornmix <popcornmix@gmail.com>
bcm2708_fb : Implement blanking support using the mailbox property interface
bcm2708_fb: Add pan and vsync controls
bcm2708_fb: DMA acceleration for fb_copyarea
Based on http://www.raspberrypi.org/phpBB3/viewtopic.php?p=62425#p62425
Also used Simon's dmaer_master module as a reference for tweaking DMA
settings for better performance.
For now busylooping only. IRQ support might be added later.
With non-overclocked Raspberry Pi, the performance is ~360 MB/s
for simple copy or ~260 MB/s for two-pass copy (used when dragging
windows to the right).
In the case of using DMA channel 0, the performance improves
to ~440 MB/s.
For comparison, VFP optimized CPU copy can only do ~114 MB/s in
the same conditions (hindered by reading uncached source buffer).
Signed-off-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>
bcm2708_fb: report number of dma copies
Add a counter (exported via debugfs) reporting the
number of dma copies that the framebuffer driver
has done, in order to help evaluate different
optimization strategies.
Signed-off-by: Luke Diamand <luked@broadcom.com>
bcm2708_fb: use IRQ for DMA copies
The copyarea ioctl() uses DMA to speed things along. This
was busy-waiting for completion. This change supports using
an interrupt instead for larger transfers. For small
transfers, busy-waiting is still likely to be faster.
Signed-off-by: Luke Diamand <luke@diamand.org>
bcm2708: Make ioctl logging quieter
video: fbdev: bcm2708_fb: Don't panic on error
No need to panic the kernel if the video driver fails.
Just print a message and return an error.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
fbdev: bcm2708_fb: Add ARCH_BCM2835 support
Add Device Tree support.
Pass the device to dma_alloc_coherent() in order to get the
correct bus address on ARCH_BCM2835.
Use the new DMA legacy API header file.
Including <mach/platform.h> is not necessary.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
BCM270x_DT: Add bcm2708-fb device
Add bcm2708-fb to Device Tree and don't add the
platform device when booting in DT mode.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Cleanup of bcm2708_fb file to kernel coding standards
Some minor change to function - remove a use of
in_atomic, plus replacing various debug messages
that manually specify the function name with
("%s",.__func__)
Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
video: bcm2708_fb: Try allocating on the ARM and passing to VPU
Currently the VPU allocates the contiguous buffer for the
framebuffer.
Try an alternate path first where we use dma_alloc_coherent
and pass the buffer to the VPU. Should the VPU firmware not
support that path, then free the buffer and revert to the
old behaviour of using the VPU allocation.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
Pulled in the multi frame buffer support from the Pi3 repo
fbdev: add FBIOCOPYAREA ioctl
Based on the patch authored by Ali Gholami Rudi at
https://lkml.org/lkml/2009/7/13/153
Provide an ioctl for userspace applications, but only if this operation
is hardware accelerated (otherwide it does not make any sense).
Signed-off-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>
bcm2708_fb: Add ioctl for reading gpu memory through dma
video: bcm2708_fb: Add compat_ioctl support.
When using a 64 bit kernel with 32 bit userspace we need
compat ioctl handling for FBIODMACOPY as one of the
parameters is a pointer.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
video: fbdev: bcm2708_fb: Use common compat header
The definition of compat_ptr is now common for most platforms, but
requires the inclusion of <linux/compat.h>.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
video: bcm2708_fb: Disable FB if no displays found
If the firmware hasn't detected a display, the driver would assume
one display was available, but because it had failed to retrieve the
display size it would try to allocate a zero-sized buffer.
Avoid the allocation failure by bailing out early if no display is
found.
See: https://github.com/raspberrypi/linux/issues/3598
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
bcm2708_fb: Fix a build warning
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
bcm2708_fb: Explicitly initialise the IOMEM ops
Prior to [1], an fb_ops member of 0 was intepreted as a request for a
default value. This saves source code but requires special handling by
the framework, slowing down all accesses for no runtime benefit.
Use the new __FB_DEFAULT_ macros to explicitly select default handlers
in the bcm2708_fb driver. Also remove the pointless wrappers around
cfb_fillrect and cfb_imageblit - call them directly.
Link: https://forums.raspberrypi.com/viewtopic.php?p=2286016#p2286016
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
[1] 8813e86f6d ("fbdev: Remove default file-I/O implementations")
Signed-off-by: popcornmix <popcornmix@gmail.com>
usb: dwc: fix lockdep false positive
Signed-off-by: Kari Suvanto <karis79@gmail.com>
usb: dwc: fix inconsistent lock state
Signed-off-by: Kari Suvanto <karis79@gmail.com>
Add FIQ patch to dwc_otg driver. Enable with dwc_otg.fiq_fix_enable=1. Should give about 10% more ARM performance.
Thanks to Gordon and Costas
Avoid dynamic memory allocation for channel lock in USB driver. Thanks ddv2005.
Add NAK holdoff scheme. Enabled by default, disable with dwc_otg.nak_holdoff_enable=0. Thanks gsh
Make sure we wait for the reset to finish
dwc_otg: fix bug in dwc_otg_hcd.c resulting in silent kernel
memory corruption, escalating to OOPS under high USB load.
dwc_otg: Fix unsafe access of QTD during URB enqueue
In dwc_otg_hcd_urb_enqueue during qtd creation, it was possible that the
transaction could complete almost immediately after the qtd was assigned
to a host channel during URB enqueue, which meant the qtd pointer was no
longer valid having been completed and removed. Usually, this resulted in
an OOPS during URB submission. By predetermining whether transactions
need to be queued or not, this unsafe pointer access is avoided.
This bug was only evident on the Pi model A where a device was attached
that had no periodic endpoints (e.g. USB pendrive or some wlan devices).
dwc_otg: Fix incorrect URB allocation error handling
If the memory allocation for a dwc_otg_urb failed, the kernel would OOPS
because for some reason a member of the *unallocated* struct was set to
zero. Error handling changed to fail correctly.
dwc_otg: fix potential use-after-free case in interrupt handler
If a transaction had previously aborted, certain interrupts are
enabled to track error counts and reset where necessary. On IN
endpoints the host generates an ACK interrupt near-simultaneously
with completion of transfer. In the case where this transfer had
previously had an error, this results in a use-after-free on
the QTD memory space with a 1-byte length being overwritten to
0x00.
dwc_otg: add handling of SPLIT transaction data toggle errors
Previously a data toggle error on packets from a USB1.1 device behind
a TT would result in the Pi locking up as the driver never handled
the associated interrupt. Patch adds basic retry mechanism and
interrupt acknowledgement to cater for either a chance toggle error or
for devices that have a broken initial toggle state (FT8U232/FT232BM).
dwc_otg: implement tasklet for returning URBs to usbcore hcd layer
The dwc_otg driver interrupt handler for transfer completion will spend
a very long time with interrupts disabled when a URB is completed -
this is because usb_hcd_giveback_urb is called from within the handler
which for a USB device driver with complicated processing (e.g. webcam)
will take an exorbitant amount of time to complete. This results in
missed completion interrupts for other USB packets which lead to them
being dropped due to microframe overruns.
This patch splits returning the URB to the usb hcd layer into a
high-priority tasklet. This will have most benefit for isochronous IN
transfers but will also have incidental benefit where multiple periodic
devices are active at once.
dwc_otg: fix NAK holdoff and allow on split transactions only
This corrects a bug where if a single active non-periodic endpoint
had at least one transaction in its qh, on frnum == MAX_FRNUM the qh
would get skipped and never get queued again. This would result in
a silent device until error detection (automatic or otherwise) would
either reset the device or flush and requeue the URBs.
Additionally the NAK holdoff was enabled for all transactions - this
would potentially stall a HS endpoint for 1ms if a previous error state
enabled this interrupt and the next response was a NAK. Fix so that
only split transactions get held off.
dwc_otg: Call usb_hcd_unlink_urb_from_ep with lock held in completion handler
usb_hcd_unlink_urb_from_ep must be called with the HCD lock held. Calling it
asynchronously in the tasklet was not safe (regression in
c4564d4a1a).
This change unlinks it from the endpoint prior to queueing it for handling in
the tasklet, and also adds a check to ensure the urb is OK to be unlinked
before doing so.
NULL pointer dereference kernel oopses had been observed in usb_hcd_giveback_urb
when a USB device was unplugged/replugged during data transfer. This effect
was reproduced using automated USB port power control, hundreds of replug
events were performed during active transfers to confirm that the problem was
eliminated.
USB fix using a FIQ to implement split transactions
This commit adds a FIQ implementaion that schedules
the split transactions using a FIQ so we don't get
held off by the interrupt latency of Linux
dwc_otg: fix device attributes and avoid kernel warnings on boot
dcw_otg: avoid logging function that can cause panics
See: https://github.com/raspberrypi/firmware/issues/21
Thanks to cleverca22 for fix
dwc_otg: mask correct interrupts after transaction error recovery
The dwc_otg driver will unmask certain interrupts on a transaction
that previously halted in the error state in order to reset the
QTD error count. The various fine-grained interrupt handlers do not
consider that other interrupts besides themselves were unmasked.
By disabling the two other interrupts only ever enabled in DMA mode
for this purpose, we can avoid unnecessary function calls in the
IRQ handler. This will also prevent an unneccesary FIQ interrupt
from being generated if the FIQ is enabled.
dwc_otg: fiq: prevent FIQ thrash and incorrect state passing to IRQ
In the case of a transaction to a device that had previously aborted
due to an error, several interrupts are enabled to reset the error
count when a device responds. This has the side-effect of making the
FIQ thrash because the hardware will generate multiple instances of
a NAK on an IN bulk/interrupt endpoint and multiple instances of ACK
on an OUT bulk/interrupt endpoint. Make the FIQ mask and clear the
associated interrupts.
Additionally, on non-split transactions make sure that only unmasked
interrupts are cleared. This caused a hard-to-trigger but serious
race condition when you had the combination of an endpoint awaiting
error recovery and a transaction completed on an endpoint - due to
the sequencing and timing of interrupts generated by the dwc_otg core,
it was possible to confuse the IRQ handler.
Fix function tracing
dwc_otg: whitespace cleanup in dwc_otg_urb_enqueue
dwc_otg: prevent OOPSes during device disconnects
The dwc_otg_urb_enqueue function is thread-unsafe. In particular the
access of urb->hcpriv, usb_hcd_link_urb_to_ep, dwc_otg_urb->qtd and
friends does not occur within a critical section and so if a device
was unplugged during activity there was a high chance that the
usbcore hub_thread would try to disable the endpoint with partially-
formed entries in the URB queue. This would result in BUG() or null
pointer dereferences.
Fix so that access of urb->hcpriv, enqueuing to the hardware and
adding to usbcore endpoint URB lists is contained within a single
critical section.
dwc_otg: prevent BUG() in TT allocation if hub address is > 16
A fixed-size array is used to track TT allocation. This was
previously set to 16 which caused a crash because
dwc_otg_hcd_allocate_port would read past the end of the array.
This was hit if a hub was plugged in which enumerated as addr > 16,
due to previous device resets or unplugs.
Also add #ifdef FIQ_DEBUG around hcd->hub_port_alloc[], which grows
to a large size if 128 hub addresses are supported. This field is
for debug only for tracking which frame an allocate happened in.
dwc_otg: make channel halts with unknown state less damaging
If the IRQ received a channel halt interrupt through the FIQ
with no other bits set, the IRQ would not release the host
channel and never complete the URB.
Add catchall handling to treat as a transaction error and retry.
dwc_otg: fiq_split: use TTs with more granularity
This fixes certain issues with split transaction scheduling.
- Isochronous multi-packet OUT transactions now hog the TT until
they are completed - this prevents hubs aborting transactions
if they get a periodic start-split out-of-order
- Don't perform TT allocation on non-periodic endpoints - this
allows simultaneous use of the TT's bulk/control and periodic
transaction buffers
This commit will mainly affect USB audio playback.
dwc_otg: fix potential sleep while atomic during urb enqueue
Fixes a regression introduced with eb1b482a. Kmalloc called from
dwc_otg_hcd_qtd_add / dwc_otg_hcd_qtd_create did not always have
the GPF_ATOMIC flag set. Force this flag when inside the larger
critical section.
dwc_otg: make fiq_split_enable imply fiq_fix_enable
Failing to set up the FIQ correctly would result in
"IRQ 32: nobody cared" errors in dmesg.
dwc_otg: prevent crashes on host port disconnects
Fix several issues resulting in crashes or inconsistent state
if a Model A root port was disconnected.
- Clean up queue heads properly in kill_urbs_in_qh_list by
removing the empty QHs from the schedule lists
- Set the halt status properly to prevent IRQ handlers from
using freed memory
- Add fiq_split related cleanup for saved registers
- Make microframe scheduling reclaim host channels if
active during a disconnect
- Abort URBs with -ESHUTDOWN status response, informing
device drivers so they respond in a more correct fashion
and don't try to resubmit URBs
- Prevent IRQ handlers from attempting to handle channel
interrupts if the associated URB was dequeued (and the
driver state was cleared)
dwc_otg: prevent leaking URBs during enqueue
A dwc_otg_urb would get leaked if the HCD enqueue function
failed for any reason. Free the URB at the appropriate points.
dwc_otg: Enable NAK holdoff for control split transactions
Certain low-speed devices take a very long time to complete a
data or status stage of a control transaction, producing NAK
responses until they complete internal processing - the USB2.0
spec limit is up to 500mS. This causes the same type of interrupt
storm as seen with USB-serial dongles prior to c8edb238.
In certain circumstances, usually while booting, this interrupt
storm could cause SD card timeouts.
dwc_otg: Fix for occasional lockup on boot when doing a USB reset
dwc_otg: Don't issue traffic to LS devices in FS mode
Issuing low-speed packets when the root port is in full-speed mode
causes the root port to stop responding. Explicitly fail when
enqueuing URBs to a LS endpoint on a FS bus.
Fix ARM architecture issue with local_irq_restore()
If local_fiq_enable() is called before a local_irq_restore(flags) where
the flags variable has the F bit set, the FIQ will be erroneously disabled.
Fixup arch_local_irq_restore to avoid trampling the F bit in CPSR.
Also fix some of the hacks previously implemented for previous dwc_otg
incarnations.
dwc_otg: fiq_fsm: Base commit for driver rewrite
This commit removes the previous FIQ fixes entirely and adds fiq_fsm.
This rewrite features much more complete support for split transactions
and takes into account several OTG hardware bugs. High-speed
isochronous transactions are also capable of being performed by fiq_fsm.
All driver options have been removed and replaced with:
- dwc_otg.fiq_enable (bool)
- dwc_otg.fiq_fsm_enable (bool)
- dwc_otg.fiq_fsm_mask (bitmask)
- dwc_otg.nak_holdoff (unsigned int)
Defaults are specified such that fiq_fsm behaves similarly to the
previously implemented FIQ fixes.
fiq_fsm: Push error recovery into the FIQ when fiq_fsm is used
If the transfer associated with a QTD failed due to a bus error, the HCD
would retry the transfer up to 3 times (implementing the USB2.0
three-strikes retry in software).
Due to the masking mechanism used by fiq_fsm, it is only possible to pass
a single interrupt through to the HCD per-transfer.
In this instance host channels would fall off the radar because the error
reset would function, but the subsequent channel halt would be lost.
Push the error count reset into the FIQ handler.
fiq_fsm: Implement timeout mechanism
For full-speed endpoints with a large packet size, interrupt latency
runs the risk of the FIQ starting a transaction too late in a full-speed
frame. If the device is still transmitting data when EOF2 for the
downstream frame occurs, the hub will disable the port. This change is
not reflected in the hub status endpoint and the device becomes
unresponsive.
Prevent high-bandwidth transactions from being started too late in a
frame. The mechanism is not guaranteed: a combination of bit stuffing
and hub latency may still result in a device overrunning.
fiq_fsm: fix bounce buffer utilisation for Isochronous OUT
Multi-packet isochronous OUT transactions were subject to a few bounday
bugs. Fix them.
Audio playback is now much more robust: however, an issue stands with
devices that have adaptive sinks - ALSA plays samples too fast.
dwc_otg: Return full-speed frame numbers in HS mode
The frame counter increments on every *microframe* in high-speed mode.
Most device drivers expect this number to be in full-speed frames - this
caused considerable confusion to e.g. snd_usb_audio which uses the
frame counter to estimate the number of samples played.
fiq_fsm: save PID on completion of interrupt OUT transfers
Also add edge case handling for interrupt transports.
Note that for periodic split IN, data toggles are unimplemented in the
OTG host hardware - it unconditionally accepts any PID.
fiq_fsm: add missing case for fiq_fsm_tt_in_use()
Certain combinations of bitrate and endpoint activity could
result in a periodic transaction erroneously getting started
while the previous Isochronous OUT was still active.
fiq_fsm: clear hcintmsk for aborted transactions
Prevents the FIQ from erroneously handling interrupts
on a timed out channel.
fiq_fsm: enable by default
fiq_fsm: fix dequeues for non-periodic split transactions
If a dequeue happened between the SSPLIT and CSPLIT phases of the
transaction, the HCD would never receive an interrupt.
fiq_fsm: Disable by default
fiq_fsm: Handle HC babble errors
The HCTSIZ transfer size field raises a babble interrupt if
the counter wraps. Handle the resulting interrupt in this case.
dwc_otg: fix interrupt registration for fiq_enable=0
Additionally make the module parameter conditional for wherever
hcd->fiq_state is touched.
fiq_fsm: Enable by default
dwc_otg: Fix various issues with root port and transaction errors
Process the host port interrupts correctly (and don't trample them).
Root port hotplug now functional again.
Fix a few thinkos with the transaction error passthrough for fiq_fsm.
fiq_fsm: Implement hack for Split Interrupt transactions
Hubs aren't too picky about which endpoint we send Control type split
transactions to. By treating Interrupt transfers as Control, it is
possible to use the non-periodic queue in the OTG core as well as the
non-periodic FIFOs in the hub itself. This massively reduces the
microframe exclusivity/contention that periodic split transactions
otherwise have to enforce.
It goes without saying that this is a fairly egregious USB specification
violation, but it works.
Original idea by Hans Petter Selasky @ FreeBSD.org.
dwc_otg: FIQ support on SMP. Set up FIQ stack and handler on Core 0 only.
dwc_otg: introduce fiq_fsm_spin(un|)lock()
SMP safety for the FIQ relies on register read-modify write cycles being
completed in the correct order. Several places in the DWC code modify
registers also touched by the FIQ. Protect these by a bare-bones lock
mechanism.
This also makes it possible to run the FIQ and IRQ handlers on different
cores.
fiq_fsm: fix build on bcm2708 and bcm2709 platforms
dwc_otg: put some barriers back where they should be for UP
bcm2709/dwc_otg: Setup FIQ on core 1 if >1 core active
dwc_otg: fixup read-modify-write in critical paths
Be more careful about read-modify-write on registers that the FIQ
also touches.
Guard fiq_fsm_spin_lock with fiq_enable check
fiq_fsm: Falling out of the state machine isn't fatal
This edge case can be hit if the port is disabled while the FIQ is
in the middle of a transaction. Make the effects less severe.
Also get rid of the useless return value.
squash: dwc_otg: Allow to build without SMP
usb: core: make overcurrent messages more prominent
Hub overcurrent messages are more serious than "debug". Increase loglevel.
usb: dwc_otg: Don't use dma_to_virt()
Commit 6ce0d20 changes dma_to_virt() which breaks this driver.
Open code the old dma_to_virt() implementation to work around this.
Limit the use of __bus_to_virt() to cases where transfer_buffer_length
is set and transfer_buffer is not set. This is done to increase the
chance that this driver will also work on ARCH_BCM2835.
transfer_buffer should not be NULL if the length is set, but the
comment in the code indicates that there are situations where this
might happen. drivers/usb/isp1760/isp1760-hcd.c also has a similar
comment pointing to a possible: 'usb storage / SCSI bug'.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
dwc_otg: Fix crash when fiq_enable=0
dwc_otg: fiq_fsm: Make high-speed isochronous strided transfers work properly
Certain low-bandwidth high-speed USB devices (specialist audio devices,
compressed-frame webcams) have packet intervals > 1 microframe.
Stride these transfers in the FIQ by using the start-of-frame interrupt
to restart the channel at the right time.
dwc_otg: Force host mode to fix incorrect compute module boards
dwc_otg: Add ARCH_BCM2835 support
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
dwc_otg: Simplify FIQ irq number code
Dropping ATAGS means we can simplify the FIQ irq number code.
Also add error checking on the returned irq number.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
dwc_otg: Remove duplicate gadget probe/unregister function
dwc_otg: Properly set the HFIR
Douglas Anderson reported:
According to the most up to date version of the dwc2 databook, the FRINT
field of the HFIR register should be programmed to:
* 125 us * (PHY clock freq for HS) - 1
* 1000 us * (PHY clock freq for FS/LS) - 1
This is opposed to older versions of the doc that claimed it should be:
* 125 us * (PHY clock freq for HS)
* 1000 us * (PHY clock freq for FS/LS)
and reported lower timing jitter on a USB analyser
dcw_otg: trim xfer length when buffer larger than allocated size is received
dwc_otg: Don't free qh align buffers in atomic context
dwc_otg: Enable the hack for Split Interrupt transactions by default
dwc_otg.fiq_fsm_mask=0xF has long been a suggestion for users with audio stutters or other USB bandwidth issues.
So far we are aware of many success stories but no failure caused by this setting.
Make it a default to learn more.
See: https://www.raspberrypi.org/forums/viewtopic.php?f=28&t=70437
Signed-off-by: popcornmix <popcornmix@gmail.com>
dwc_otg: Use kzalloc when suitable
dwc_otg: Pass struct device to dma_alloc*()
This makes it possible to get the bus address from Device Tree.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
dwc_otg: fix summarize urb->actual_length for isochronous transfers
Kernel does not copy input data of ISO transfers to userspace
if actual_length is set only in ISO transfers and not summarized
in urb->actual_length. Fixesraspberrypi/linux#903
fiq_fsm: Use correct states when starting isoc OUT transfers
In fiq_fsm_start_next_periodic() if an isochronous OUT transfer
was selected, no regard was given as to whether this was a single-packet
transfer or a multi-packet staged transfer.
For single-packet transfers, this had the effect of repeatedly sending
OUT packets with bogus data and lengths.
Eventually if the channel was repeatedly enabled enough times, this
would lock up the OTG core and no further bus transfers would happen.
Set the FSM state up properly if we select a single-packet transfer.
Fixes https://github.com/raspberrypi/linux/issues/1842
dwc_otg: make nak_holdoff work as intended with empty queues
If URBs reading from non-periodic split endpoints were dequeued and
the last transfer from the endpoint was a NAK handshake, the resulting
qh->nak_frame value was stale which would result in unnecessarily long
polling intervals for the first subsequent transfer with a fresh URB.
Fixup qh->nak_frame in dwc_otg_hcd_urb_dequeue and also guard against
a case where a single URB is submitted to the endpoint, a NAK was
received on the transfer immediately prior to receiving data and the
device subsequently resubmits another URB past the qh->nak_frame interval.
Fixes https://github.com/raspberrypi/linux/issues/1709
dwc_otg: fix split transaction data toggle handling around dequeues
See https://github.com/raspberrypi/linux/issues/1709
Fix several issues regarding endpoint state when URBs are dequeued
- If the HCD is disconnected, flush FIQ-enabled channels properly
- Save the data toggle state for bulk endpoints if the last transfer
from an endpoint where URBs were dequeued returned a data packet
- Reset hc->start_pkt_count properly in assign_and_init_hc()
dwc_otg: fix several potential crash sources
On root port disconnect events, the host driver state is cleared and
in-progress host channels are forcibly stopped. This doesn't play
well with the FIQ running in the background, so:
- Guard the disconnect callback with both the host spinlock and FIQ
spinlock
- Move qtd dereference in dwc_otg_handle_hc_fsm() after the early-out
so we don't dereference a qtd that has gone away
- Turn catch-all BUG()s in dwc_otg_handle_hc_fsm() into warnings.
dwc_otg: delete hcd->channel_lock
The lock serves no purpose as it is only held while the HCD spinlock
is already being held.
dwc_otg: remove unnecessary dma-mode channel halts on disconnect interrupt
Host channels are already halted in kill_urbs_in_qh_list() with the
subsequent interrupt processing behaving as if the URB was dequeued
via HCD callback.
There's no need to clobber the host channel registers a second time
as this exposes races between the driver and host channel resulting
in hcd->free_hc_list becoming corrupted.
dwcotg: Allow to build without FIQ on ARM64
Signed-off-by: popcornmix <popcornmix@gmail.com>
dwc_otg: make periodic scheduling behave properly for FS buses
If the root port is in full-speed mode, transfer times at 12mbit/s
would be calculated but matched against high-speed quotas.
Reinitialise hcd->frame_usecs[i] on each port enable event so that
full-speed bandwidth can be tracked sensibly.
Also, don't bother using the FIQ for transfers when in full-speed
mode - at the slower bus speed, interrupt frequency is reduced by
an order of magnitude.
Related issue: https://github.com/raspberrypi/linux/issues/2020
dwc_otg: fiq_fsm: Make isochronous compatibility checks work properly
Get rid of the spammy printk and local pointer mangling.
Also, there is a nominal benefit for using fiq_fsm for isochronous
transfers in FS mode (~1.1k IRQs per second vs 2.1k IRQs per second)
so remove the root port speed check.
dwc_otg: add module parameter int_ep_interval_min
Add a module parameter (defaulting to ignored) that clamps the polling rate
of high-speed Interrupt endpoints to a minimum microframe interval.
The parameter is modifiable at runtime as it is used when activating new
endpoints (such as on device connect).
dwc_otg: fiq_fsm: Add non-periodic TT exclusivity constraints
Certain hub types do not discriminate between pipe direction (IN or OUT)
when considering non-periodic transfers. Therefore these hubs get confused
if multiple transfers are issued in different directions with the same
device address and endpoint number.
Constrain queuing non-periodic split transactions so they are performed
serially in such cases.
Related: https://github.com/raspberrypi/linux/issues/2024
dwc_otg: Fixup change to DRIVER_ATTR interface
dwc_otg: Fix compilation warnings
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
USB_DWCOTG: Disable building dwc_otg as a module (#2265)
When dwc_otg is built as a module, build will fail with the following
error:
ERROR: "DWC_TASK_HI_SCHEDULE" [drivers/usb/host/dwc_otg/dwc_otg.ko] undefined!
scripts/Makefile.modpost:91: recipe for target '__modpost' failed
make[1]: *** [__modpost] Error 1
Makefile:1199: recipe for target 'modules' failed
make: *** [modules] Error 2
Even if the error is solved by including the missing
DWC_TASK_HI_SCHEDULE function, the kernel will panic when loading
dwc_otg.
As a workaround, simply prevent user from building dwc_otg as a module
as the current kernel does not support it.
See: https://github.com/raspberrypi/linux/issues/2258
Signed-off-by: Malik Olivier Boussejra <malik@boussejra.com>
dwc_otg: New timer API
dwc_otg: Fix removed ACCESS_ONCE->READ_ONCE
dwc_otg: don't unconditionally force host mode in dwc_otg_cil_init()
Add the ability to disable force_host_mode for those that want to use
dwc_otg in both device and host modes.
dwc_otg: Fix a regression when dequeueing isochronous transfers
In 282bed95 (dwc_otg: make nak_holdoff work as intended with empty queues)
the dequeue mechanism was changed to leave FIQ-enabled transfers to run
to completion - to avoid leaving hub TT buffers with stale packets lying
around.
This broke FIQ-accelerated isochronous transfers, as this then meant that
dozens of transfers were performed after the dequeue function returned.
Restore the state machine fence for isochronous transfers.
fiq_fsm: rewind DMA pointer for OUT transactions that fail (#2288)
See: https://github.com/raspberrypi/linux/issues/2140
dwc_otg: add smp_mb() to prevent driver state corruption on boot
Occasional crashes have been seen where the FIQ code dereferences
invalid/random pointers immediately after being set up, leading to
panic on boot.
The crash occurs as the FIQ code races against hcd_init_fiq() and
the hcd_init_fiq() code races against the outstanding memory stores
from dwc_otg_hcd_init(). Use explicit barriers after touching
driver state.
usb: dwc_otg: fix memory corruption in dwc_otg driver
[Upstream commit 51b1b64917]
The move from the staging tree to the main tree exposed a
longstanding memory corruption bug in the dwc2 driver. The
reordering of the driver initialization caused the dwc2 driver
to corrupt the initialization data of the sdhci driver on the
Raspberry Pi platform, which made the bug show up.
The error is in calling to_usb_device(hsotg->dev), since ->dev
is not a member of struct usb_device. The easiest fix is to
just remove the offending code, since it is not really needed.
Thanks to Stephen Warren for tracking down the cause of this.
Reported-by: Andre Heider <a.heider@gmail.com>
Tested-by: Stephen Warren <swarren@wwwdotorg.org>
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[lukas: port from upstream dwc2 to out-of-tree dwc_otg driver]
Signed-off-by: Lukas Wunner <lukas@wunner.de>
usb: dwb_otg: Fix unreachable switch statement warning
This warning appears with GCC 7.3.0 from toolchains.bootlin.com:
../drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c: In function ‘fiq_fsm_update_hs_isoc’:
../drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c:595:61: warning: statement will never be executed [-Wswitch-unreachable]
st->hctsiz_copy.b.xfersize = nrpackets * st->hcchar_copy.b.mps;
~~~~~~~~~~~~~~~~~^~~~
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
dwc_otg: fiq_fsm: fix incorrect DMA register offset calculation
Rationalise the offset and update all call sites.
Fixes https://github.com/raspberrypi/linux/issues/2408
dwc_otg: fix bug with port_addr assignment for single-TT hubs
See https://github.com/raspberrypi/linux/issues/2734
The "Hub Port" field in the split transaction packet was always set
to 1 for single-TT hubs. The majority of single-TT hub products
apparently ignore this field and broadcast to all downstream enabled
ports, which masked the issue. A subset of hub devices apparently
need the port number to be exact or split transactions will fail.
usb: dwc_otg: Clean up build warnings on 64bit kernels
No functional changes. Almost all are changes to logging lines.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
usb: dwc_otg: Use dma allocation for mphi dummy_send buffer
The FIQ driver used a kzalloc'ed buffer for dummy_send,
passing a kernel virtual address to the hardware block.
The buffer is only ever used for a dummy read, so it
should be harmless, but there is the chance that it will
cause exceptions.
Use a dma allocation so that we have a genuine bus address,
and read from that.
Free the allocation when done for good measure.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
dwc_otg: only do_split when we actually need to do a split
The previous test would fail if the root port was in fullspeed mode
and there was a hub between the FS device and the root port. While
the transfer worked, the schedule mangling performed for high-speed
split transfers would break leading to an 8ms polling interval.
dwc_otg: fix locking around dequeueing and killing URBs
kill_urbs_in_qh_list() is practically only ever called with the fiq lock
already held, so don't spinlock twice in the case where we need to cancel
an isochronous transfer.
Also fix up a case where the global interrupt register could be read with
the fiq lock not held.
Fixes the deadlock seen in https://github.com/raspberrypi/linux/issues/2907
ARM64/DWC_OTG: Port dwc_otg driver to ARM64
In ARM64, the FIQ mechanism used by this driver is not current
implemented. As a workaround, reqular IRQ is used instead
of FIQ.
In a separate change, the IRQ-CPU mapping is round robined
on ARM64 to increase concurrency and allow multiple interrupts
to be serviced at a time. This reduces the need for FIQ.
Tests Run:
This mechanism is most likely to break when multiple USB devices
are attached at the same time. So the system was tested under
stress.
Devices:
1. USB Speakers playing back a FLAC audio through VLC
at 96KHz.(Higher then typically, but supported on my speakers).
2. sftp transferring large files through the buildin ethernet
connection which is connected through USB.
3. Keyboard and mouse attached and being used.
Although I do occasionally hear some glitches, the music seems to
play quite well.
Signed-off-by: Michael Zoran <mzoran@crowfest.net>
usb: dwc_otg: Clean up interrupt claiming code
The FIQ/IRQ interrupt number identification code is scattered through
the dwc_otg driver. Rationalise it, simplifying the code and solving
an existing issue.
See: https://github.com/raspberrypi/linux/issues/2612
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
dwc_otg: Choose appropriate IRQ handover strategy
2711 has no MPHI peripheral, but the ARM Control block can fake
interrupts. Use the size of the DTB "mphi" reg block to determine
which is required.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
usb: host: dwc_otg: fix compiling in separate directory
The dwc_otg Makefile does not respect the O=path argument correctly:
include paths in CFLAGS are given relatively to object path, not source
path. Compiling in a separate directory yields #include errors.
Signed-off-by: Marek Behún <marek.behun@nic.cz>
dwc_otg: use align_buf for small IN control transfers (#3150)
The hardware will do a 4-byte write to memory on any IN packet received
that is between 1 and 3 bytes long. This tramples memory in the uvcvideo
driver, as it uses a sequence of 1- and 2-byte control transfers to
query the min/max/range/step of each individual camera control and
gives us buffers that are offsets into a struct.
Catch small control transfers in the data phase and use the align_buf
to bounce the correct number of bytes into the URB's buffer.
In general, short packets on non-control endpoints should be OK as URBs
should have enough buffer space for a wMaxPacket size transfer.
See: https://github.com/raspberrypi/linux/issues/3148
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
dwc_otg: Declare DMA capability with HCD_DMA flag
Following [1], USB controllers have to declare DMA capabilities in
order for them to be used by adding the HCD_DMA flag to their hc_driver
struct.
[1] 7b81cb6bdd ("usb: add a HCD_DMA flag instead of guestimating DMA capabilities")
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
dwc_otg: checking the urb->transfer_buffer too early (#3332)
After enable the HIGHMEM and VMSPLIT_3G, the dwc_otg driver doesn't
work well on Pi2/3 boards with 1G physical ram. Users experience
the failure when copying a file of 600M size to the USB stick. And
at the same time, the dmesg shows:
usb 1-1.1.2: reset high-speed USB device number 8 using dwc_otg
sd 0:0:0:0: [sda] tag#0 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK
blk_update_request: I/O error, dev sda, sector 3024048 op 0x1:(WRITE) flags 0x4000 phys_seg 15 prio class 0
When this happens, the sg_buf sent to the driver is located in the
highmem region, the usb_sg_init() in the core/message.c will leave
transfer_buffer to NULL if the sg_buf is in highmem, but in the
dwc_otg driver, it returns -EINVAL unconditionally if transfer_buffer
is NULL.
The driver can handle the situation of buffer to be NULL, if it is in
DMA mode, it will convert an address from transfer_dma.
But if the conversion fails or it is in the PIO mode, we should check
buffer and return -EINVAL if it is NULL.
BugLink: https://bugs.launchpad.net/bugs/1852510
Signed-off-by: Hui Wang <hui.wang@canonical.com>
dwc_otg: constrain endpoint max packet and transfer size on split IN
The hcd would unconditionally set the transfer length to the endpoint
packet size for non-isoc IN transfers. If the remaining buffer length
was less than the length of returned data, random memory would get
scribbled over, with bad effects if it crossed a page boundary.
Force a babble error if this happens by limiting the max transfer size
to the available buffer space. DMA will stop writing to memory on a
babble condition.
The hardware expects xfersize to be an integer multiple of maxpacket
size, so override hcchar.b.mps as well.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
dwc_otg: fiq_fsm: pause when cancelling split transactions
Non-periodic splits will DMA to/from the driver-provided transfer_buffer,
which may be freed immediately after the dequeue call returns. Block until
we know the transfer is complete.
A similar delay is needed when cleaning up disconnects, as the FIQ could
have started a periodic transfer in the previous microframe to the one
that triggered a disconnect.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
dwc_otg: fiq_fsm: add a barrier on entry into FIQ handler(s)
On BCM2835, there is no hardware guarantee that multiple outstanding
reads to different peripherals will complete in-order. The FIQ code
uses peripheral reads without barriers for performance, so in the case
where a read to a slow peripheral was issued immediately prior to FIQ
entry, the first peripheral read that the FIQ did could end up with
wrong read data returned.
Add dsb(sy) on entry so that all outstanding reads are retired.
The FIQ only issues reads to the dwc_otg core, so per-read barriers
in the handler itself are not required.
On BCM2836 and BCM2837 the barrier is not strictly required due to
differences in how the peripheral bus is implemented, but having
arch-specific handlers that introduce different latencies is risky.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
dwc_otg: whitelist_table is now productlist_table
dwc_otg: initialise sched_frame for periodic QHs that were parked
If a periodic QH has no remaining QTDs, then it is removed from all
periodic schedules. When re-adding, initialise the sched_frame and
start_split_frame from the current value of the frame counter.
See https://bugs.launchpad.net/raspbian/+bug/1819560
and
https://github.com/raspberrypi/linux/issues/3883
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
dwc_otg: Minimise header and fix build warnings
Delete a large amount of unused declaration from "usb.h", some of which
were causing build warnings, and get the module building cleanly.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
dwc-otg: fix clang -Wignored-attributes warning
warning: attribute declaration must precede definition
dwc-otg: fix clang -Wsometimes-uninitialized warning
warning: variable 'retval' is used uninitialized whenever 'if' condition is false
dwc-otg: fix clang -Wpointer-bool-conversion warning
warning: address of array 'desc->wMaxPacketSize' will always evaluate to 'true'
The wMaxPacketSize field is actually a two element array which content should
be accessed via the UGETW macro.
dwc_otg: fix an undeclared variable
Replace an undeclared variable used by DWC_DEBUGPL with the real endpoint address. DWC_DEBUGPL does nothing with DEBUG undefined so it did not go wrong before.
Signed-off-by: Zixuan Wang <wangzixuan@sjtu.edu.cn>
dwc_otg: Update NetBSD usb.h header licence
NetBSD have changed their licensing requirements such that the 2-clause
licence is preferred. Update usb.h in the downstream dwc_otg code
accordingly.
See https://www.netbsd.org/about/redistribution.html for more
information.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
dwc_otg: pay attention to qh->interval when rescheduling periodic queues
A regression introduced in https://github.com/raspberrypi/linux/pull/3887
meant that if the newly scheduled transfer immediately returned data, and
the driver resubmitted a single URB after every transfer, then the effective
polling interval would end up being approx 1ms.
Use the larger of SCHEDULE_SLOP or the configured endpoint interval.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
drivers: dwc_otg: Fix fallthrough warnings
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
drivers: usb: dwc_otg: fix reference passing when checking bandwidth
The pointer (struct usb_host_endpoint *)->hcpriv should contain a
reference to dwc_otg_qh_t if the driver has already seen a URB submitted
to this endpoint.
It then checks whether the qh exists and is already in a schedule in
order to decide whether to allocate periodic bandwidth or not. Passing a
pointer to an offset inside of struct usb_host_endpoint instead of just
the pointer means it dereferences bogus addresses.
Rationalise (delete) a variable while we're at it.
See https://github.com/raspberrypi/linux/issues/5189
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
drivers: dwc_otg: stop GCC from patching FIQ functions
Configuring GCC to use task stack protector canaries means it will
insert calls to check functions in FIQ code. This is bad, as a) the
FIQ's stack is banked and b) the failure invokes __stack_chk_fail which
eventually tries to call printk(). Printing to the console inside the
FIQ is generally fatal.
Add CFLAGS to stop this happening in FIQ code.
Also catch one function where notrace wasn't specified.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
dwc_otg: Avoid the use of align_buf for short packets
Recent kernels (from 6.5) fail to boot on Pi0-3.
This has been tracked down to the call to:
ret = usb_get_std_status(hdev, USB_RECIP_DEVICE, 0, &hubstatus);
returning garbage in hubstatus (it gets the uninitialised contents of
a kmalloc buffer that is not overwritten as expected).
As we don't have strong evidence that this code path has ever worked,
and it is causing a clear problem currently, lets disable it to
allow wider use of newer kernels.
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
drivers: dwc_otg: use C11 style variable array declarations
The kernel C standard changed in 5.18.
Remove a layer of indirection around the FIQ bounce buffers, be consistent
with pointers to FIQ bounce buffers, and remove open-coded 32-bit clamping
of DMA addresses.
Also remove a pointless fiq_state initialisation loop.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
drivers: dwc_otg: move FIQ locking functions to header file
Also declare as static inline, as they should be.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
drivers: dwc_otg: add ticket-based spinlock for ARM64
The ARM64 architecture uses qspinlock which has a fast and slow path.
This isn't ideal for all claimers of a lock operating in interrupt
context. Add a ticket-based lock similar to the armv6/7 implementation.
Based on an upstream patch that was abandoned in favour of qspinlock.
Link: https://patchwork.kernel.org/project/linux-arm-kernel/patch/1381330468-32625-2-git-send-email-will.deacon@arm.com/
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
drivers: dwc_otg: reduce loglevel for probe messages
Warning on normal behaviour isn't sensible and is spammy. Demote to info.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
drivers: dwc_otg: don't call disable_irq on the fake FIQ
The local spinlock protects the handlers from racing against each other
on separate cores, hard IRQs don't preempt each other, and
disabling/enabling the interrupt is more expensive than letting the fake
FIQ contend the spinlock.
So turn local_fiq_en/disable into no-ops.
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Signed-off-by: popcornmix <popcornmix@gmail.com>
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
bcm2709: Drop platform smp and timer init code
irq-bcm2836 handles this through these functions:
bcm2835_init_local_timer_frequency()
bcm2836_arm_irqchip_smp_init()
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
bcm270x: Use watchdog for reboot/poweroff
The watchdog driver already has support for reboot/poweroff.
Make use of this and remove the code from the platform files.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
board_bcm2835: Remove coherent dma pool increase - API has gone
Under some circumstances on BCM283x processors data loss can be
observed - a single byte missing from the TX output stream. These bytes
are always the last byte of a batch of 8 written from pl011_tx_chars
when from_irq is true, meaning that the FIFO full flag is not checked
before writing.
The transmit optimisation relies on the FIFO being half-empty when the
TX interrupt is raised. Instrumenting the driver further showed that
the failure case correlated with the TX FIFO full flag being set at the
point where the last byte was written to the data register, which
explains the data loss but not how the FIFO appeared to be prematurely
full. A possible explanation is that a FIFO write was in flight at the
time the interrupt was raised, but as yet there is no hypothesis as to
how this might occur.
In the absence of a clear understanding of the failure mechanism, avoid
the problem by checking the FIFO levels before writing the last byte of
the group, which will have minimal performance impact.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
The BCM2835 PL011 implementation seems to have a bug that can lead to a
transmission lockup if CTS changes frequently. A workaround was added to
the driver with a vendor-specific flag to enable it, but this flag is
currently not set for ARM implementations.
Add a "cts-event-workaround" property to Pi DTBs and use the presence
of that property to force the flag to be enabled in the driver.
See: https://github.com/raspberrypi/linux/issues/1280
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
The pl011 register accessor functions use the _relaxed versions of the
standard readl() and writel() functions, meaning that there are no
automatic memory barriers. When polling a FIFO status register to check
for fullness, it is necessary to ensure that any outstanding writes have
completed; otherwise the flags are effectively stale, making it possible
that the next write is to a full FIFO.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
The syscon node defines a register range that duplicates that used by
the local_intc node on bcm2836/7. Since irq-bcm2835 and irq-bcm2836 are
built in and always present together (both drivers are enabled by
CONFIG_ARCH_BCM2835), it is possible to replace the syscon usage with a
global variable that simplifies the code. Doing so does lose the
locking provided by regmap, but as only one side is using the regmap
interface (irq-bcm2835 uses readl and write) there is no loss of
atomicity.
See: https://github.com/raspberrypi/firmware/issues/926
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
This adds a debug module parameter to aid in debugging transfer issues
by printing info to the kernel log. When enabled, status values are
collected in the interrupt routine and msg info in
bcm2835_i2c_start_transfer(). This is done in a way that tries to avoid
affecting timing. Having printk in the isr can mask issues.
debug values (additive):
1: Print info on error
2: Print info on all transfers
3: Print messages before transfer is started
The value can be changed at runtime:
/sys/module/i2c_bcm2835/parameters/debug
Example output, debug=3:
[ 747.114448] bcm2835_i2c_xfer: msg(1/2) write addr=0x54, len=2 flags= [i2c1]
[ 747.114463] bcm2835_i2c_xfer: msg(2/2) read addr=0x54, len=32 flags= [i2c1]
[ 747.117809] start_transfer: msg(1/2) write addr=0x54, len=2 flags= [i2c1]
[ 747.117825] isr: remain=2, status=0x30000055 : TA TXW TXD TXE [i2c1]
[ 747.117839] start_transfer: msg(2/2) read addr=0x54, len=32 flags= [i2c1]
[ 747.117849] isr: remain=32, status=0xd0000039 : TA RXR TXD RXD [i2c1]
[ 747.117861] isr: remain=20, status=0xd0000039 : TA RXR TXD RXD [i2c1]
[ 747.117870] isr: remain=8, status=0x32 : DONE TXD RXD [i2c1]
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Christopher Alexander Tobias Schulze - May 2, 2015, 11:57 a.m.
This patch fixes a problem with VFP state save and restore related
to exception handling (panic with message "BUG: unsupported FP
instruction in kernel mode") present on VFP11 floating point units
(as used with ARM1176JZF-S CPUs, e.g. on first generation Raspberry
Pi boards). This patch was developed and discussed on
https://github.com/raspberrypi/linux/issues/859
A precondition to see the crashes is that floating point exception
traps are enabled. In this case, the VFP11 might determine that a FPU
operation needs to trap at a point in time when it is not possible to
signal this to the ARM11 core any more. The VFP11 will then set the
FPEXC.EX bit and store the trapped opcode in FPINST. (In some cases,
a second opcode might have been accepted by the VFP11 before the
exception was detected and could be reported to the ARM11 - in this
case, the VFP11 also sets FPEXC.FP2V and stores the second opcode in
FPINST2.)
If FPEXC.EX is set, the VFP11 will "bounce" the next FPU opcode issued
by the ARM11 CPU, which will be seen by the ARM11 as an undefined opcode
trap. The VFP support code examines the FPEXC.EX and FPEXC.FP2V bits
to decide what actions to take, i.e., whether to emulate the opcodes
found in FPINST and FPINST2, and whether to retry the bounced instruction.
If a user space application has left the VFP11 in this "pending trap"
state, the next FPU opcode issued to the VFP11 might actually be the
VSTMIA operation vfp_save_state() uses to store the FPU registers
to memory (in our test cases, when building the signal stack frame).
In this case, the kernel crashes as described above.
This patch fixes the problem by making sure that vfp_save_state() is
always entered with FPEXC.EX cleared. (The current value of FPEXC has
already been saved, so this does not corrupt the context. Clearing
FPEXC.EX has no effects on FPINST or FPINST2. Also note that many
callers already modify FPEXC by setting FPEXC.EN before invoking
vfp_save_state().)
This patch also addresses a second problem related to FPEXC.EX: After
returning from signal handling, the kernel reloads the VFP context
from the user mode stack. However, the current code explicitly clears
both FPEXC.EX and FPEXC.FP2V during reload. As VFP11 requires these
bits to be preserved, this patch disables clearing them for VFP
implementations belonging to architecture 1. There should be no
negative side effects: the user can set both bits by executing FPU
opcodes anyway, and while user code may now place arbitrary values
into FPINST and FPINST2 (e.g., non-VFP ARM opcodes) the VFP support
code knows which instructions can be emulated, and rejects other
opcodes with "unhandled bounce" messages, so there should be no
security impact from allowing reloading FPEXC.EX and FPEXC.FP2V.
Signed-off-by: Christopher Alexander Tobias Schulze <cat.schulze@alice-dsl.net>
reboot: Use power off rather than busy spinning when halt is requested
Busy spinning after halt is dumb
We've previously applied this patch to arch/arm
but it is currenltly missing in arch/arm64
Pi4 after "sudo halt" uses 520mA
Pi4 after "sudo shutdown now" uses 310mA
Make them both use the lower powered option
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
The Raspberry Pi firmware looks at the RSTS register to know which
partition to boot from. The reboot syscall command
LINUX_REBOOT_CMD_RESTART2 supports passing in a string argument.
Add support for passing in a partition number 0..63 to boot from.
Partition 63 is a special partiton indicating halt.
If the partition doesn't exist, the firmware falls back to partition 0.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Load driver early since at least bcm2708_fb doesn't support deferred
probing and even if it did, we don't want the video driver deferred.
Support the legacy DMA API which is needed by bcm2708_fb.
Don't mask out channel 2.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
bcm2835-dma: Add support for per-channel flags
Add the ability to interpret the high bits of the dreq specifier as
flags to be included in the DMA_CS register. The motivation for this
change is the ability to set the DISDEBUG flag for SD card transfers
to avoid corruption when using the VPU debugger.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
bcm2835-dma: Add proper 40-bit DMA support
BCM2711 has 4 DMA channels with a 40-bit address range, allowing them
to access the full 4GB of memory on a Pi 4.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
bcm2835-dma: Derive slave DMA addresses correctly
Slave addresses for DMA are meant to be supplied as physical addresses
(contrary to what struct snd_dmaengine_dai_dma_data does). It is up to
the DMA controller driver to perform the translation based on its own
view of the world, as described in Device Tree.
Now that the Pi Device Trees have the correct peripheral mappings,
replace the hacky address munging with phys_to_dma().
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
bcm2835-dma: Add NO_WAIT_RESP flag
Use bit 27 of the dreq value (the second cell of the DT DMA descriptor)
to request that the WAIT_RESP bit is not set.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
bcm2835-dma: Advertise the full DMA range
Unless the DMA mask is set wider than 32 bits, DMA mapping will use a
bounce buffer.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
bcm2835-dma: only reserve channel 0 if legacy dma driver is enabled
If CONFIG_DMA_BCM2708 isn't enabled there's no need to mask out
one of the already scarce DMA channels.
Signed-off-by: Matthias Reichl <hias@horus.com>
bcm2835-dma: Avoid losing CS flags after interrupt
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
bcm2835-dma: Add bcm2835-dma: Add DMA_WIDE_SOURCE and DMA_WIDE_DEST flags
Use (reserved) bits 24 and 25 of the dreq value
(the second cell of the DT DMA descriptor) to request
that wide source reads or wide dest writes are required
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
dmaengine: bcm2835: Fix position reporting for 40 bits channels
For 40 bits channels, the position is reported by reading the upper byte
in the SRCI/DESTI registers. However the driver adds that upper byte
with an 8-bits left shift, while it should be 32.
Fixes: 9a52a99183 ("bcm2835-dma: Add proper 40-bit DMA support")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
dmaengine: bcm2835: Use to_bcm2711_cbaddr where relevant
bcm2711_dma40_memcpy has some code strictly equivalent to the
to_bcm2711_cbaddr() function. Let's use it instead.
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
dmaengine: bcm2835: Fix descriptors usage for 40-bits channels
The bcm2835_dma_create_cb_chain() function is in charge of building up
the descriptors chain for a given transfer.
It was initially supporting only the BCM2835-style DMA controller, and
was later expanded to support controllers with 40-bits channels that use
a different descriptor layout.
However, some part of the function only use the old style descriptor,
even when building a chain of new-style descriptors, resulting in weird
bugs.
Fixes: 9a52a99183 ("bcm2835-dma: Add proper 40-bit DMA support")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
bcm2835-dma: Fix WAIT_RESP on memcpy
It goes in info not extra
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
bcm2835-dma: Fix dma_abort for 40-bit channels
It wasn't aborting the transfer and caused stop/start
of hdmi audio dma to be unreliable.
New sequence approved by Broadcom.
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
bcm2835-dma: Fix dma_abort for non-40bit channels
The sequence we were doing was not safe.
Clearing CS meant BCM2835_DMA_WAIT_FOR_WRITES was cleared
and so polling BCM2835_DMA_WAITING_FOR_WRITES has no benefit
Broadcom have provided a recommended sequence to abort
a dma lite channel, so switch to that.
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
bcm2835-dma: Support dma flags for multi-beat burst
Add a control bit to enable a multi-beat burst on a DMA.
This improves DMA performance and is required for HDMI audio.
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
bcm2835-dma: Need to keep PROT bits set in CS on 40bit controller
Resetting them to zero puts DMA channel into secure mode
which makes further accesses impossible
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
dmaengine: bcm2835: Delete vestigial code
The dedicated dma40 memcpy code is no longer used, and without a
prototype the kernel build fails. Delete it.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
An alternative strategy would be to use "rpi,spidev" instead, but that
would require many Raspberry Pi Device Tree changes.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
Add a duplicate irq range with an offset on the hwirq's so the
driver can detect that enable_fiq() is used.
Tested with downstream dwc_otg USB controller driver.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Reviewed-by: Eric Anholt <eric@anholt.net>
Acked-by: Stephen Warren <swarren@wwwdotorg.org>
Signed-off-by: popcornmix <popcornmix@gmail.com>
SQUASH: smsc95xx: Use dev_mod_addr to set MAC addr
Since adeef3e321 ("net: constify netdev->dev_addr") it has been
illegal to write to the dev_addr MAC address field. Later commits
have added explicit checks that it hasn't been modified by nefarious
means. The dev_addr_mod helper function is the accepted way to change
the dev_addr field, so use it.
Squash with 96c1def63ee1 ("Allow mac address to be set in smsc95xx").
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
DSI0 can take the clock from either PLLA or PLLD. PLLA is
the default muxing, but PLLD is considered the more stable.
Switch to using PLLD.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
This is controlled by firmware, see clk-raspberrypi.c
Signed-off-by: popcornmix <popcornmix@gmail.com>
clk-bcm2835: Remove VEC clock support
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
This falls under the same "we can reprogram glitch-free as long as we
pause generation" rule as updating the div/frac fields. This can be
used for runtime reclocking of V3D to manage power leakage.
Signed-off-by: Eric Anholt <eric@anholt.net>
The VPU is responsible for managing the core clock, usually under
direction from the bcm2835-cpufreq driver but not via the clk-bcm2835
driver. Since the core frequency can change without warning, it is
safer to report the maximum clock rate to users of the core clock -
I2C, SPI and the mini UART - to err on the safe side when calculating
clock divisors.
If the DT node for the clock driver includes a reference to the
firmware node, use the firmware API to query the maximum core clock
instead of reading the divider registers.
Prior to this patch, a "100KHz" I2C bus was sometimes clocked at about
160KHz. In particular, switching to the 4.9 kernel was likely to break
SenseHAT usage on a Pi3.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
clk: bcm2835: Pass DT node to rpi_firmware_get
The fw_node pointer has already been retrieved, and using it allows
us to remove a downstream patch to the firmware driver.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
The claim-clocks property can be used to prevent PLLs and dividers
from being marked as critical. It contains a vector of clock IDs,
as defined by dt-bindings/clock/bcm2835.h.
Use this mechanism to claim PLLD_DSI0, PLLD_DSI1, PLLH_AUX and
PLLH_PIX for the vc4_kms_v3d driver.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
The VPU configures and relies on several PLLs and dividers. Mark all
enabled dividers and their PLLs as CRITICAL to prevent the kernel from
switching them off.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
so that special/critical clocks can get enabled early on in the
boot process avoiding the risk of disabling a clock, pll_divider
or pll when a claiming driver fails to install propperly - maybe it needs to defer.
Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
clk: clk-bcm2835: Use %zd when printing size_t
The debug text for how many clocks have been registered
uses "%d" with a size_t. Correct it to "%zd".
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
Initialise rpi-firmware before clk-bcm2835
The IMA (Integrity Measurement Architecture) looks for a TPM (Trusted
Platform Module) having been registered when it initialises; otherwise
it assumes there is no TPM. It has been observed on BCM2835 that IMA
is initialised before TPM, and that initialising the BCM2835 clock
driver before the firmware driver has the effect of reversing this
order.
Change the firmware driver to initialise at core_initcall, delaying the
BCM2835 clock driver to postcore_initcall.
See: https://github.com/raspberrypi/linux/issues/3291https://github.com/raspberrypi/linux/pull/3297
Signed-off-by: Luke Hinds <lhinds@redhat.com>
Co-authored-by: Phil Elwell <phil@raspberrypi.org>
clk-bcm2835: use subsys_initcall for the clock driver when IMA is enabled
Co-authored-by: Davide Scovotto <scovottodavide@gmail.com>
Co-developed-by: Davide Scovotto <scovottodavide@gmail.com>
Signed-off-by: Davide Scovotto <scovottodavide@gmail.com>
Signed-off-by: Alberto Solavagione <albertosolavagione30@gmail.com>
[1] Removed the sc16is752-spi1 overlay, replacing it with an entry in
overlay_map.dts that invokes sc16is75x-spi with specific parameters.
This does not work because it fails to configure the SPI1 interface.
Most such overlays would require the respective SPI interface to have
already been configured using one of the spi<n>-<m> overlays, but it is
not possible to do that using overlay_map, and it is unreasonable to
suddenly impose that requirement on users.
Work around that specific problem by adding an extra parameter to
sc16is75x to configure SPI1. It's not ideal, but better than a complete
dedicated overlay.
Link: https://github.com/raspberrypi/linux/issues/6962
Fixes: ce20a8fdbf ("overlays: sc16is75x: Add generic SPI overlay")
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
[1] commit ce20a8fdbf ("overlays: sc16is75x: Add generic SPI overlay")
Add the bare minimum needed to boot BCM2708 from a Device Tree.
Signed-off-by: Noralf Tronnes <notro@tronnes.org>
BCM2708: DT: change 'axi' nodename to 'soc'
Change DT node named 'axi' to 'soc' so it matches ARCH_BCM2835.
The VC4 bootloader fills in certain properties in the 'axi' subtree,
but since this is part of an upstreaming effort, the name is changed.
Signed-off-by: Noralf Tronnes notro@tronnes.org
BCM2708_DT: Correct length of the peripheral space
Use dts-dirs feature for overlays.
The kernel makefiles have a dts-dirs target that is for vendor subdirectories.
Using this fixes the install_dtbs target, which previously did not install the overlays.
BCM270X_DT: configure I2S DMA channels
Signed-off-by: Matthias Reichl <hias@horus.com>
BCM270X_DT: switch to bcm2835-i2s
I2S soundcard drivers with proper devicetree support (i.e. not linking
to the cpu_dai/platform via name but to cpu/platform via of_node)
will work out of the box without any modifications.
When the kernel is compiled without devicetree support the platform
code will instantiate the bcm2708-i2s driver and I2S soundcard drivers
will link to it via name, as before.
Signed-off-by: Matthias Reichl <hias@horus.com>
SDIO-overlay: add poll_once-boolean parameter
Add paramter to toggle sdio-device-polling
done every second or once at boot-time.
Signed-off-by: Patrick Boettcher <patrick.boettcher@posteo.de>
BCM270X_DT: Make mmc overlay compatible with current firmware
The original DT overlay logic followed a merge-then-patch procedure,
i.e. parameters are applied to the loaded overlay before the overlay
is merged into the base DTB. This sequence has been changed to
patch-then-merge, in order to support parameterised node names, and
to protect against bad overlays. As a result, overrides (parameters)
must only target labels in the overlay, but the overlay can obviously target nodes in the base DTB.
mmc-overlay.dts (that switches back to the original mmc sdcard
driver) is the only overlay violating that rule, and this patch
fixes it.
bcm270x_dt: Use the sdhost MMC controller by default
The "mmc" overlay reverts to using the other controller.
squash: Add cprman to dt
BCM270X_DT: Use clk_core for I2C interfaces
BCM270X_DT: Use bcm283x.dtsi, bcm2835.dtsi and bcm2836.dtsi
The mainline Device Tree files are quite close to downstream now.
Let's use bcm283x.dtsi, bcm2835.dtsi and bcm2836.dtsi as base files
for our dts files.
Mainline dts files are based on these files:
bcm2835-rpi.dtsi
bcm2835.dtsi bcm2836.dtsi
bcm283x.dtsi
Current downstream are based on these:
bcm2708.dtsi bcm2709.dtsi bcm2710.dtsi
bcm2708_common.dtsi
This patch introduces this dependency:
bcm2708.dtsi bcm2709.dtsi
bcm2708-rpi.dtsi
bcm270x.dtsi
bcm2835.dtsi bcm2836.dtsi
bcm283x.dtsi
And:
bcm2710.dtsi
bcm2708-rpi.dtsi
bcm270x.dtsi
bcm283x.dtsi
bcm270x.dtsi contains the downstream bcm283x.dtsi diff.
bcm2708-rpi.dtsi is the downstream version of bcm2835-rpi.dtsi.
Other changes:
- The led node has moved from /soc/leds to /leds. This is not a problem
since the label is used to reference it.
- The clk_osc reg property changes from 6 to 3.
- The gpu nodes has their interrupt property set in the base file.
- the clocks label does not point to the /clocks node anymore, but
points to the cprman node. This is not a problem since the overlays
that use the clock node refer to it directly: target-path = "/clocks";
- some nodes now have 2 labels since mainline and downstream differs in
this respect: cprman/clocks, spi0/spi, gpu/vc4.
- some nodes doesn't have an explicit status = "okay" since they're not
disabled in the base file: watchdog and random.
- gpiomem doesn't need an explicit status = "okay".
- bcm2708-rpi-cm.dts got the hpd-gpios property from bcm2708_common.dtsi,
it's now set directly in that file.
- bcm2709-rpi-2-b.dts has the timer node moved from /soc/timer to /timer.
- Removed clock-frequency property on the bcm{2709,2710}.dtsi timer nodes.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
BCM270X_DT: Use raspberrypi-power to turn on USB power
Use the raspberrypi-power driver to turn on USB power.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
BCM270X_DT: Add a .dtbo target, use for overlays
Change the filenames and extensions to keep the pre-DDT style of
overlay (<name>-overlay.dtb) distinct from new ones that use a
different style of local fixups (<name>.dtbo), and to match other
platforms.
The RPi firmware uses the DDTK trailer atom to choose which type of
overlay to use for each kernel.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
BCM270X_DT: Don't generate "linux,phandle" props
The EPAPR standard says to use "phandle" properties to store phandles,
rather than the deprecated "linux,phandle" version. By default, dtc
generates both, but adding "-H epapr" causes it to only generate
"phandle"s, saving some space and clutter.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
BCM270X_DT: Add overlay for enc28j60 on SPI2
Works on SPI2 for compute module
BCM270X_DT: Add midi-uart0 overlay
MIDI requires 31.25kbaud, a baudrate unsupported by Linux. The
midi-uart0 overlay configures uart0 (ttyAMA0) to use a fake clock
so that requesting 38.4kbaud actually gets 31.25kbaud.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
BCM270X_DT: Add i2c-sensor overlay
The i2c-sensor overlay is a container for various pressure and
temperature sensors, currently bmp085 and bmp280. The standalone
bmp085_i2c-sensor overlay is now deprecated.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
BCM270X_DT: overlays/*-overlay.dtb -> overlays/*.dtbo (#1752)
We now create overlays as .dtbo files.
build: support for .dtbo files for dtb overlays
Kernel 4.4.6+ on RaspberryPi support .dtbo files for overlays, instead of .dtb.
Patch the kernel, which has faulty rules to generate .dtbo the way yocto does
Signed-off-by: Herve Jourdain <herve.jourdain@neuf.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
BCM270X: Drop position requirement for CMA in VC4 overlay.
No longer necessary since 2aefcd5761,
and will probably let peeople that want to choose a larger CMA
allocation (particularly on pi0/1).
Signed-off-by: Eric Anholt <eric@anholt.net>
BCM270X_DT: RPi Device Tree tidy
Use the upstream sdhost node, add thermal-zones, and factor out some
common elements.
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
kbuild: Silence unhelpful DTC warnings
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
BCM270X_DT: DT build rules no longer arch-specific
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
kbuild: Silence unavoidable dtc overlay warnings
Much effort has been put into finding ways to avoid warnings from dtc
about overlays, usually to do with the presence of #address-cells and
size-cells, but not exclusively so. Since the issues being warned about
are harmless, suppress the warnings to declutter the build output and
to avoid alarming users.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
overlays: Suppress another dtc warning
I'm sure the dtc warnings mean well, but overlays don't have enough
context for the checkers to give meaningful results.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
overlays: Use dtbs-list for overlay installation
Update the overlay build rules to use the dtbs-list mechanism. Also
include the README, and don't set the executable bits.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Margins may be implemented by scaling the planes, but as there
is no way of intercepting the set_property for a standard property,
and all planes are checked in drm_atomic_check_only before the
connectors, there's now way to add the planes into the state
from the driver.
If the margin properties change, add all corresponding planes to
the state.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The stuff never really worked, and leads to lots of fun because it
out-of-order frees atomic states. Which upsets KASAN, among other
things.
For async updates we now have a more solid solution with the
->atomic_async_check and ->atomic_async_commit hooks. Support for that
for msm and vc4 landed. nouveau and i915 have their own commit
routines, doing something similar.
For everyone else it's probably better to remove the use-after-free
bug, and encourage folks to use the async support instead. The
affected drivers which register a legacy cursor plane and don't either
use the new async stuff or their own commit routine are: amdgpu,
atmel, mediatek, qxl, rockchip, sti, sun4i, tegra, virtio, and vmwgfx.
Inspired by an amdgpu bug report.
v2: Drop RFC, I think with amdgpu converted over to use
atomic_async_check/commit done in
commit 674e78acae
Author: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Date: Wed Dec 5 14:59:07 2018 -0500
drm/amd/display: Add fast path for cursor plane updates
we don't have any driver anymore where we have userspace expecting
solid legacy cursor support _and_ they are using the atomic helpers in
their fully glory. So we can retire this.
v3: Paper over msm and i915 regression. The complete_all is the only
thing missing afaict.
v4: Rebased on recent kernel, added extra link for vc4 bug.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=199425
Link: https://lore.kernel.org/all/20220221134155.125447-9-maxime@cerno.tech/
Cc: mikita.lipski@amd.com
Cc: Michel Dänzer <michel@daenzer.net>
Cc: harry.wentland@amd.com
Cc: Rob Clark <robdclark@gmail.com>
Cc: "Kazlauskas, Nicholas" <nicholas.kazlauskas@amd.com>
Tested-by: Maxime Ripard <maxime@cerno.tech>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
mipi_dsi_attach can fail due to resources not being available
yet, therefore do not log error messages should they occur.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
The MIPI_DSI_MODE_* flags have fairly terse descriptions and no reference
to the DSI specification as to their exact meaning. Usage has therefore
been rather fluid.
Extend the descriptions and provide references to the part of the
MIPI DSI specification regarding what they mean.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
drm_crtc_legacy_gamma_set updates the gamma_lut blob unconditionally,
which leads to unnecessary reprogramming of hardware.
Check whether the blob contents has actually changed before
signalling that it has been updated.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
CI builds are done with debug info disabled, but this removes some
members from struct module. This causes builds to fail if there is an
ABI reference for the current ABI.
Define these members unconditionally, so that there is no ABI change.
When symbols from overlays are added to the live tree their paths must
be rebased. The translated symbol is normally the result of joining
the fragment-relative path (with a leading "/") to the target path
(either copied directly from the "target-path" property or resolved
from the phandle). This translation fails when the target is the root
node (a common case for Raspberry Pi overlays) because the resulting
path starts with a double slash. For example, if target-path is "/" and
the fragment adds a node called "newnode", the label associated with
that node will be assigned the path "//newnode", which can't be found
in the tree.
Fix the failure case by explicitly replacing a target path of "/" with
an empty string.
Fixes: d1651b03c2 ("of: overlay: add overlay symbols to live device tree")
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Use GitHubs issue form for bug reports.
- modern look
- user don't need to mess with given markdown parts while filling the issue template
Setup config.yml for general questions and problems with the Raspbian distribution packages.
Update issue templates (#2736)
Adding Pi 5 as a device to bug_report.yml
Update the Issue template
* Update config.yml - Raspbian -> Raspberry Pi OS
* Update config.yml
* .org to .com
* Update forum URL
Add Pi 500 and CM5 as a device to bug_report.yml
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
This is a copy of README with the tags added.
You can not delete the file README as then checkpatch complains
you aren't in a kernel tree.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
README: Show rpi-6.5.y build status
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
README: show rpi-6.6.y build status
Replace rpi-6.5.y with rpi-6.6.y in the build status list.
README: show rpi-6.12.y build status
Remove rpi-5.15.y build status since it doesn't appear to be built anymore, and add rpi-6.12.y build status.
This is currently running on defaults, so the --strict desired
for media drivers and similar won't be observed. That may be
possible to add later.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
.github: Add Github Workflow for KUnit
Now that we have some KUnit coverage, let's add a github actions file to
run them on each push or pull request.
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
.github/workflows: Add dtoverlaycheck workflow
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
.github/workflows: Create workflow to CI kernel builds
Builds the bcmrpi, bcm2709, bcm2711, and bcm2835 32 bit kernels,
and defconfig and bcm2711 64bit kernels, saving the artifacts for
7 days.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
.github: Skip broken Generic DRM/KMS Unit Tests
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
.github/workflows: Set warnings-as-errors for builds
To avoid code with build warnings being introduced into the tree, force
CONFIG_WERROR=y in the build workflow.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
.github/workflows: Correct kernel builds artifacts
Modify the kernel build workflow to create artifacts with the correct
names and structure, both as an example of what we expect and in case
anyone wants to use the output.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
.github/workflows: Switch to a matrix build
Remove the per-build duplication by putting build parameters in a
matrix.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
.github/workflows: Retain artifacts for 90 days
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
.github/workflows: Add a bcm2712 build configuration
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Update kernel-build.yml to use node.js 20
Upgrade the actions to v4 to get rid of the warning about migrating from node.js 16.
Update kunit.yml to use node.js 20
Bump actions/checkout to v4.
Update dtoverlaycheck.yml to node.js 20
.github/workflows: More jobs for kernel builds
Using the "cores * 1.5" heuristic, configure the kernel builds for the
4-core GitHub-hosted runners.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
workflows: Add arm64 bcm2711_rt build
Add a Github CI workflow bcm2711_rt_defconfig
Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
workflows: Remove the ARCH=arm bcm2711 build
As we will be moving Pi 4 support to kernel8.img only and dropping
kernel7l.img, the ARCH=arm bcm2711 defconfig has been deleted.
Remove the corresponding autobuild.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
workflows: Use bcm2709_defconfig for dtoverlaycheck
Now that ARCH=arm bcm2711_defconfig has been deleted, update
dtoverlaycheck to use bcm2709_defconfig.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
kunit: Use ubuntu-22.04 for arm64
There's a bug in the version of qemu used by Ubuntu 24.04 that kills
the arm64 KUnit test. Revert to Ubuntu 22.04 just for that test,
until ubuntu-latest updates to qemu 9.2.0+.
Link: https://bugzilla.suse.com/show_bug.cgi?id=1236310
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
workflows: Switch to overlaycheck's thorough mode
Now that the current trees are passing the thorough/try-all mode of
overlaycheck (mainly by excluding trying to apply the vl805 overlay
on a CM4S), use it in the build checks.
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
commit bf91f4bc9c upstream.
The blamed commit introduced the function lanphy_modify_page_reg which
as name suggests it, it modifies the registers. In the same commit we
have started to use this function inside the drivers. The problem is
that in the function lan8814_config_init we passed the wrong page number
when disabling the aneg towards host side. We passed extended page number
4(LAN8814_PAGE_COMMON_REGS) instead of extended page
5(LAN8814_PAGE_PORT_REGS)
Fixes: a0de636ed7 ("net: phy: micrel: Introduce lanphy_modify_page_reg")
Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250925064702.3906950-1-horatiu.vultur@microchip.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3f978e3f15 upstream.
In hfcsusb_probe(), the memory allocated for ctrl_urb gets leaked when
setup_instance() fails with an error code. Fix that by freeing the urb
before freeing the hw structure. Also change the error paths to use the
goto ladder style.
Compile tested only. Issue found using a prototype static analysis tool.
Fixes: 69f52adb2d ("mISDN: Add HFC USB driver")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Link: https://patch.msgid.link/20251030042524.194812-1-nihaal@cse.iitm.ac.in
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 9d7dfb95da ]
Add VMX exit handlers for SEAMCALL and TDCALL to inject a #UD if a non-TD
guest attempts to execute SEAMCALL or TDCALL. Neither SEAMCALL nor TDCALL
is gated by any software enablement other than VMXON, and so will generate
a VM-Exit instead of e.g. a native #UD when executed from the guest kernel.
Note! No unprivileged DoS of the L1 kernel is possible as TDCALL and
SEAMCALL #GP at CPL > 0, and the CPL check is performed prior to the VMX
non-root (VM-Exit) check, i.e. userspace can't crash the VM. And for a
nested guest, KVM forwards unknown exits to L1, i.e. an L2 kernel can
crash itself, but not L1.
Note #2! The Intel® Trust Domain CPU Architectural Extensions spec's
pseudocode shows the CPL > 0 check for SEAMCALL coming _after_ the VM-Exit,
but that appears to be a documentation bug (likely because the CPL > 0
check was incorrectly bundled with other lower-priority #GP checks).
Testing on SPR and EMR shows that the CPL > 0 check is performed before
the VMX non-root check, i.e. SEAMCALL #GPs when executed in usermode.
Note #3! The aforementioned Trust Domain spec uses confusing pseudocode
that says that SEAMCALL will #UD if executed "inSEAM", but "inSEAM"
specifically means in SEAM Root Mode, i.e. in the TDX-Module. The long-
form description explicitly states that SEAMCALL generates an exit when
executed in "SEAM VMX non-root operation". But that's a moot point as the
TDX-Module injects #UD if the guest attempts to execute SEAMCALL, as
documented in the "Unconditionally Blocked Instructions" section of the
TDX-Module base specification.
Cc: stable@vger.kernel.org
Cc: Kai Huang <kai.huang@intel.com>
Cc: Xiaoyao Li <xiaoyao.li@intel.com>
Cc: Rick Edgecombe <rick.p.edgecombe@intel.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20251016182148.69085-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 885df2d210 ]
Add support for the immediate forms of RDMSR and WRMSRNS (currently
Intel-only). The immediate variants are only valid in 64-bit mode, and
use a single general purpose register for the data (the register is also
encoded in the instruction, i.e. not implicit like regular RDMSR/WRMSR).
The immediate variants are primarily motivated by performance, not code
size: by having the MSR index in an immediate, it is available *much*
earlier in the CPU pipeline, which allows hardware much more leeway about
how a particular MSR is handled.
Intel VMX support for the immediate forms of MSR accesses communicates
exit information to the host as follows:
1) The immediate form of RDMSR uses VM-Exit Reason 84.
2) The immediate form of WRMSRNS uses VM-Exit Reason 85.
3) For both VM-Exit reasons 84 and 85, the Exit Qualification field is
set to the MSR index that triggered the VM-Exit.
4) Bits 3 ~ 6 of the VM-Exit Instruction Information field are set to
the register encoding used by the immediate form of the instruction,
i.e. the destination register for RDMSR, and the source for WRMSRNS.
5) The VM-Exit Instruction Length field records the size of the
immediate form of the MSR instruction.
To deal with userspace RDMSR exits, stash the destination register in a
new kvm_vcpu_arch field, similar to cui_linear_rip, pio, etc.
Alternatively, the register could be saved in kvm_run.msr or re-retrieved
from the VMCS, but the former would require sanitizing the value to ensure
userspace doesn't clobber the value to an out-of-bounds index, and the
latter would require a new one-off kvm_x86_ops hook.
Don't bother adding support for the instructions in KVM's emulator, as the
only way for RDMSR/WRMSR to be encountered is if KVM is emulating large
swaths of code due to invalid guest state, and a vCPU cannot have invalid
guest state while in 64-bit mode.
Signed-off-by: Xin Li (Intel) <xin@zytor.com>
[sean: minor tweaks, massage and expand changelog]
Link: https://lore.kernel.org/r/20250805202224.1475590-5-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Stable-dep-of: 9d7dfb95da ("KVM: VMX: Inject #UD if guest tries to execute SEAMCALL or TDCALL")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit ec400f6c2f ]
Rename "ecx" variables in {RD,WR}MSR and RDPMC helpers to "msr" and "pmc"
respectively, in anticipation of adding support for the immediate variants
of RDMSR and WRMSRNS, and to better document what the variables hold
(versus where the data originated).
No functional change intended.
Link: https://lore.kernel.org/r/20250805202224.1475590-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Stable-dep-of: 9d7dfb95da ("KVM: VMX: Inject #UD if guest tries to execute SEAMCALL or TDCALL")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 249d96b492 ]
Since snd_soc_suspend() is invoked through snd_soc_pm_ops->suspend(),
and snd_soc_pm_ops is associated with the soc_driver (defined in
sound/soc/soc-core.c), and there is no parent-child relationship between
the soc_driver and the DA7213 codec driver, the power management subsystem
does not enforce a specific suspend/resume order between the DA7213 driver
and the soc_driver.
Because of this, the different codec component functionalities, called from
snd_soc_resume() to reconfigure various functions, can race with the
DA7213 struct dev_pm_ops::resume function, leading to misapplied
configuration. This occasionally results in clipped sound.
Fix this by dropping the struct dev_pm_ops::{suspend, resume} and use
instead struct snd_soc_component_driver::{suspend, resume}. This ensures
the proper configuration sequence is handled by the ASoC subsystem.
Cc: stable@vger.kernel.org
Fixes: 431e040065 ("ASoC: da7213: Add suspend to RAM support")
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Link: https://patch.msgid.link/20251104114914.2060603-1-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 7d9f7d390f upstream.
Support for parsing PC source info in stacktraces (e.g. '(P)') was added
in commit 2bff77c665 ("scripts/decode_stacktrace.sh: fix decoding of
lines with an additional info"). However, this logic was placed after the
build ID processing. This incorrect order fails to parse lines containing
both elements, e.g.:
drm_gem_mmap_obj+0x114/0x200 [drm 03d0564e0529947d67bb2008c3548be77279fd27] (P)
This patch fixes the problem by extracting the PC source info first and
then processing the module build ID. With this change, the line above is
now properly parsed as such:
drm_gem_mmap_obj (./include/linux/mmap_lock.h:212 ./include/linux/mm.h:811 drivers/gpu/drm/drm_gem.c:1177) drm (P)
While here, also add a brief explanation the build ID section.
Link: https://lkml.kernel.org/r/20251030010347.2731925-1-cmllamas@google.com
Fixes: 2bff77c665 ("scripts/decode_stacktrace.sh: fix decoding of lines with an additional info")
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marc Rutland <mark.rutland@arm.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Matthieu Baerts <matttbe@kernel.org>
Cc: Miroslav Benes <mbenes@suse.cz>
Cc: Puranjay Mohan <puranjay@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 4a2fc4897b upstream.
With lines having a symbol to decode, the script was only trying to
preserve the alignment for the timestamps, but not the rest, nor when the
caller was set (CONFIG_PRINTK_CALLER=y).
With this sample ...
[ 52.080924] Call Trace:
[ 52.080926] <TASK>
[ 52.080931] dump_stack_lvl+0x6f/0xb0
... the script was producing the following output:
[ 52.080924] Call Trace:
[ 52.080926] <TASK>
[ 52.080931] dump_stack_lvl (arch/x86/include/asm/irqflags.h:19)
(dump_stack_lvl is no longer aligned with <TASK>: one missing space)
With this other sample ...
[ 52.080924][ T48] Call Trace:
[ 52.080926][ T48] <TASK>
[ 52.080931][ T48] dump_stack_lvl+0x6f/0xb0
... the script was producing the following output:
[ 52.080924][ T48] Call Trace:
[ 52.080926][ T48] <TASK>
[ 52.080931][ T48] dump_stack_lvl (arch/x86/include/asm/irqflags.h:19)
(the misalignment is clearer here)
That's because the script had a workaround for CONFIG_PRINTK_TIME=y only,
see the previous comment called "Format timestamps with tabs".
To always preserve spaces, they need to be recorded along the words. That
is what is now done with the new 'spaces' array.
Some notes:
- 'extglob' is needed only for this operation, and that's why it is set
in a dedicated subshell.
- 'read' is used with '-r' not to treat a <backslash> character in any
special way, e.g. when followed by a space.
- When a word is removed from the 'words' array, the corresponding space
needs to be removed from the 'spaces' array as well.
With the last sample, we now have:
[ 52.080924][ T48] Call Trace:
[ 52.080926][ T48] <TASK>
[ 52.080931][ T48] dump_stack_lvl (arch/x86/include/asm/irqflags.h:19)
(the alignment is preserved)
Link: https://lkml.kernel.org/r/20250908-decode_strace_indent-v1-2-28e5e4758080@kernel.org
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Tested-by: Carlos Llamas <cmllamas@google.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Elliot Berman <quic_eberman@quicinc.com>
Cc: Luca Ceresoli <luca.ceresoli@bootlin.com>
Cc: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 74207de2ba upstream.
Patch series "Fix SIGBUS semantics with large folios", v3.
Accessing memory within a VMA, but beyond i_size rounded up to the next
page size, is supposed to generate SIGBUS.
Darrick reported[1] an xfstests regression in v6.18-rc1. generic/749
failed due to missing SIGBUS. This was caused by my recent changes that
try to fault in the whole folio where possible:
19773df031 ("mm/fault: try to map the entire file folio in finish_fault()")
357b92761d ("mm/filemap: map entire large folio faultaround")
These changes did not consider i_size when setting up PTEs, leading to
xfstest breakage.
However, the problem has been present in the kernel for a long time -
since huge tmpfs was introduced in 2016. The kernel happily maps
PMD-sized folios as PMD without checking i_size. And huge=always tmpfs
allocates PMD-size folios on any writes.
I considered this corner case when I implemented a large tmpfs, and my
conclusion was that no one in their right mind should rely on receiving a
SIGBUS signal when accessing beyond i_size. I cannot imagine how it could
be useful for the workload.
But apparently filesystem folks care a lot about preserving strict SIGBUS
semantics.
Generic/749 was introduced last year with reference to POSIX, but no real
workloads were mentioned. It also acknowledged the tmpfs deviation from
the test case.
POSIX indeed says[3]:
References within the address range starting at pa and
continuing for len bytes to whole pages following the end of an
object shall result in delivery of a SIGBUS signal.
The patchset fixes the regression introduced by recent changes as well as
more subtle SIGBUS breakage due to split failure on truncation.
This patch (of 2):
Accesses within VMA, but beyond i_size rounded up to PAGE_SIZE are
supposed to generate SIGBUS.
Recent changes attempted to fault in full folio where possible. They did
not respect i_size, which led to populating PTEs beyond i_size and
breaking SIGBUS semantics.
Darrick reported generic/749 breakage because of this.
However, the problem existed before the recent changes. With huge=always
tmpfs, any write to a file leads to PMD-size allocation. Following the
fault-in of the folio will install PMD mapping regardless of i_size.
Fix filemap_map_pages() and finish_fault() to not install:
- PTEs beyond i_size;
- PMD mappings across i_size;
Make an exception for shmem/tmpfs that for long time intentionally
mapped with PMDs across i_size.
Link: https://lkml.kernel.org/r/20251027115636.82382-1-kirill@shutemov.name
Link: https://lkml.kernel.org/r/20251027115636.82382-2-kirill@shutemov.name
Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
Fixes: 6795801366 ("xfs: Support large folios")
Reported-by: "Darrick J. Wong" <djwong@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Dave Chinner <david@fromorbit.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 852b644acb upstream.
The 'run_tests' function is executed in the background, but killing its
associated PID would not kill the children tasks running in the
background.
To properly kill all background tasks, 'kill -- -PID' could be used, but
this requires kill from procps-ng. Instead, all children tasks are
listed using 'ps', and 'kill' is called with all PIDs of this group.
Fixes: 31ee4ad86a ("selftests: mptcp: join: stop transfer when check is done (part 1)")
Cc: stable@vger.kernel.org
Fixes: 04b57c9e09 ("selftests: mptcp: join: stop transfer when check is done (part 2)")
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-6-a4332c714e10@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 290493078b upstream.
In rare cases, when the test environment is very slow, some userspace
tests can fail because some expected events have not been seen.
Because the tests are expecting a long on-going connection, and they are
not waiting for the end of the transfer, it is fine to make the
connection longer. This connection will be killed at the end, after the
verifications, so making it longer doesn't change anything, apart from
avoid it to end before the end of the verifications
To play it safe, all userspace tests not waiting for the end of the
transfer are now sharing a longer file (128KB) at slow speed.
Fixes: 4369c198e5 ("selftests: mptcp: test userspace pm out of transfer")
Cc: stable@vger.kernel.org
Fixes: b2e2248f36 ("selftests: mptcp: userspace pm create id 0 subflow")
Fixes: e3b47e460b ("selftests: mptcp: userspace pm remove initial subflow")
Fixes: b9fb176081 ("selftests: mptcp: userspace pm send RM_ADDR for ID 0")
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-4-a4332c714e10@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ee79980f7a upstream.
MPTCP Join "fastclose server" selftest is sometimes failing because the
client output file doesn't have the expected size, e.g. 296B instead of
1024B.
When looking at a packet trace when this happens, the server sent the
expected 1024B in two parts -- 100B, then 924B -- then the MP_FASTCLOSE.
It is then strange to see the client only receiving 296B, which would
mean it only got a part of the second packet. The problem is then not on
the networking side, but rather on the data reception side.
When mptcp_connect is launched with '-f -1', it means the connection
might stop before having sent everything, because a reset has been
received. When this happens, the program was directly stopped. But it is
also possible there are still some data to read, simply because the
previous 'read' step was done with a buffer smaller than the pending
data, see do_rnd_read(). In this case, it is important to read what's
left in the kernel buffers before stopping without error like before.
SIGPIPE is now ignored, not to quit the app before having read
everything.
Fixes: 6bf41020b7 ("selftests: mptcp: update and extend fastclose test-cases")
Cc: stable@vger.kernel.org
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-5-a4332c714e10@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6457595db9 upstream.
In rare cases, when the test environment is very slow, some userspace
tests can fail because some expected events have not been seen.
Because the tests are expecting a long on-going connection, and they are
not waiting for the end of the transfer, it is fine to make the
connection longer. This connection will be killed at the end, after the
verifications, so making it longer doesn't change anything, apart from
avoid it to end before the end of the verifications
To play it safe, all endpoints tests not waiting for the end of the
transfer are now sharing a longer file (128KB) at slow speed.
Fixes: 69c6ce7b6e ("selftests: mptcp: add implicit endpoint test case")
Cc: stable@vger.kernel.org
Fixes: e274f71540 ("selftests: mptcp: add subflow limits test-cases")
Fixes: b5e2fb832f ("selftests: mptcp: add explicit test case for remove/readd")
Fixes: e06959e9ee ("selftests: mptcp: join: test for flush/re-add endpoints")
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-3-a4332c714e10@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit aea73bae66 upstream.
Some of these 'remove' tests rarely fail because a subflow has been
reset instead of cleanly removed. This can happen when one extra subflow
which has never carried data is being closed (FIN) on one side, while
the other is sending data for the first time.
To avoid such subflows to be used right at the end, the backup flag has
been added. With that, data will be only carried on the initial subflow.
Fixes: d2c4333a80 ("selftests: mptcp: add testcases for removing addrs")
Cc: stable@vger.kernel.org
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-2-a4332c714e10@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 63c643aa7b upstream.
The "fallback due to TCP OoO" was never printed because the stat_ooo_now
variable was checked twice: once in the parent if-statement, and one in
the child one. The second condition was then always true then, and the
'else' branch was never taken.
The idea is that when there are more ACK + MP_CAPABLE than expected, the
test either fails if there was no out of order packets, or a notice is
printed.
Fixes: 69ca3d29a7 ("mptcp: update selftest for fallback due to OoO")
Cc: stable@vger.kernel.org
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-1-a4332c714e10@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit fccac54b0d upstream.
Limit the workaround for the lack of the proper splash-screen handover
handling to the legacy ARM 32bit systems and replace forcing a sync_state
by explicite power domain shutdown. This approach lets compiler to
optimize it out on newer ARM 64bit systems.
Suggested-by: Ulf Hansson <ulf.hansson@linaro.org>
Fixes: 0745658aeb ("pmdomain: samsung: Fix splash-screen handover by enforcing a sync_state")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit bbde14682e upstream.
of_get_child_by_name() returns a node pointer with refcount incremented, we
should use of_node_put() on it when not needed anymore. Add the missing
of_node_put() to avoid refcount leak.
Fixes: 721cabf6c6 ("soc: imx: move PGC handling to a new GPC driver")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 7458f72cc2 upstream.
If of_genpd_add_provider_onecell() fails during probe, the previously
created generic power domains are not removed, leading to a memory leak
and potential kernel crash later in genpd_debug_add().
Add proper error handling to unwind the initialized domains before
returning from probe to ensure all resources are correctly released on
failure.
Example crash trace observed without this fix:
| Unable to handle kernel paging request at virtual address fffffffffffffc70
| CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc1 #405 PREEMPT
| Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform
| pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
| pc : genpd_debug_add+0x2c/0x160
| lr : genpd_debug_init+0x74/0x98
| Call trace:
| genpd_debug_add+0x2c/0x160 (P)
| genpd_debug_init+0x74/0x98
| do_one_initcall+0xd0/0x2d8
| do_initcall_level+0xa0/0x140
| do_initcalls+0x60/0xa8
| do_basic_setup+0x28/0x40
| kernel_init_freeable+0xe8/0x170
| kernel_init+0x2c/0x140
| ret_from_fork+0x10/0x20
Fixes: 898216c97e ("firmware: arm_scmi: add device power domain support using genpd")
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 994dec1099 upstream.
First, we can't assume pipe == crtc index. If a pipe is fused off in
between, it no longer holds. intel_crtc_for_pipe() is the only proper
way to get from a pipe to the corresponding crtc.
Second, drivers aren't supposed to access or index drm->vblank[]
directly. There's drm_crtc_vblank_crtc() for this.
Use both functions to fix the pipe to vblank conversion.
Fixes: f02658c46c ("drm/i915/psr: Add mechanism to notify PSR of pipe enable/disable")
Cc: Jouni Högander <jouni.hogander@intel.com>
Cc: stable@vger.kernel.org # v6.16+
Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
Link: https://patch.msgid.link/20251106200000.1455164-1-jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
(cherry picked from commit 2750f6765d6974f7e163c5d540a96c8703f6d8dd)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 22a36e660d upstream.
Certain multi-GPU configurations (especially GFX12) may hit
data corruption when a DCC-compressed VRAM surface is shared across GPUs
using peer-to-peer (P2P) DMA transfers.
Such surfaces rely on device-local metadata and cannot be safely accessed
through a remote GPU’s page tables. Attempting to import a DCC-enabled
surface through P2P leads to incorrect rendering or GPU faults.
This change disables P2P for DCC-enabled VRAM buffers that are contiguous
and allocated on GFX12+ hardware. In these cases, the importer falls back
to the standard system-memory path, avoiding invalid access to compressed
surfaces.
Future work could consider optional migration (VRAM→System→VRAM) if a
performance regression is observed when `attach->peer2peer = false`.
Tested on:
- Dual RX 9700 XT (Navi4x) setup
- GNOME and Wayland compositor scenarios
- Confirmed no corruption after disabling P2P under these conditions
v2: Remove check TTM_PL_VRAM & TTM_PL_FLAG_CONTIGUOUS.
v3: simplify for upsteam and fix ip version check (Alex)
Suggested-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 9dff2bb709e6fbd97e263fd12bf12802d2b5a0cf)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6623c5f9fd upstream.
Fix a potential deadlock caused by inconsistent spinlock usage
between interrupt and process contexts in the userq fence driver.
The issue occurs when amdgpu_userq_fence_driver_process() is called
from both:
- Interrupt context: gfx_v11_0_eop_irq() -> amdgpu_userq_fence_driver_process()
- Process context: amdgpu_eviction_fence_suspend_worker() ->
amdgpu_userq_fence_driver_force_completion() -> amdgpu_userq_fence_driver_process()
In interrupt context, the spinlock was acquired without disabling
interrupts, leaving it in {IN-HARDIRQ-W} state. When the same lock
is acquired in process context, the kernel detects inconsistent
locking since the process context acquisition would enable interrupts
while holding a lock previously acquired in interrupt context.
Kernel log shows:
[ 4039.310790] inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
[ 4039.310804] kworker/7:2/409 [HC0[0]:SC0[0]:HE1:SE1] takes:
[ 4039.310818] ffff9284e1bed000 (&fence_drv->fence_list_lock){?...}-{3:3},
[ 4039.310993] {IN-HARDIRQ-W} state was registered at:
[ 4039.311004] lock_acquire+0xc6/0x300
[ 4039.311018] _raw_spin_lock+0x39/0x80
[ 4039.311031] amdgpu_userq_fence_driver_process.part.0+0x30/0x180 [amdgpu]
[ 4039.311146] amdgpu_userq_fence_driver_process+0x17/0x30 [amdgpu]
[ 4039.311257] gfx_v11_0_eop_irq+0x132/0x170 [amdgpu]
Fix by using spin_lock_irqsave()/spin_unlock_irqrestore() to properly
manage interrupt state regardless of calling context.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit ded3ad780cf97a04927773c4600823b84f7f3cc2)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d15deafab5 upstream.
Over allocation of save area is not fatal, only under allocation is.
ROCm has various components that independently claim authority over save
area size.
Unless KFD decides to claim single authority, relax size checks.
Signed-off-by: Jonathan Kim <jonathan.kim@amd.com>
Reviewed-by: Philip Yang <philip.yang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 15bd4958fe38e763bc17b607ba55155254a01f55)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c367af440e upstream.
data_reloc_print_warning_inode() calls btrfs_get_fs_root() to obtain
local_root, but fails to release its reference when paths_from_inode()
returns an error. This causes a potential memory leak.
Add a missing btrfs_put_root() call in the error path to properly
decrease the reference count of local_root.
Fixes: b9a9a85059 ("btrfs: output affected files when relocation fails")
CC: stable@vger.kernel.org # 6.6+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit bfe3d755ef upstream.
When logging that a new name exists, we skip updating the inode's
last_log_commit field to prevent a later explicit fsync against the inode
from doing nothing (as updating last_log_commit makes btrfs_inode_in_log()
return true). We are detecting, at btrfs_log_inode(), that logging a new
name is happening by checking the logging mode is not LOG_INODE_EXISTS,
but that is not enough because we may log parent directories when logging
a new name of a file in LOG_INODE_ALL mode - we need to check that the
logging_new_name field of the log context too.
An example scenario where this results in an explicit fsync against a
directory not persisting changes to the directory is the following:
$ mkfs.btrfs -f /dev/sdc
$ mount /dev/sdc /mnt
$ touch /mnt/foo
$ sync
$ mkdir /mnt/dir
# Write some data to our file and fsync it.
$ xfs_io -c "pwrite -S 0xab 0 64K" -c "fsync" /mnt/foo
# Add a new link to our file. Since the file was logged before, we
# update it in the log tree by calling btrfs_log_new_name().
$ ln /mnt/foo /mnt/dir/bar
# fsync the root directory - we expect it to persist the dentry for
# the new directory "dir".
$ xfs_io -c "fsync" /mnt
<power fail>
After mounting the fs the entry for directory "dir" does not exists,
despite the explicit fsync on the root directory.
Here's why this happens:
1) When we fsync the file we log the inode, so that it's present in the
log tree;
2) When adding the new link we enter btrfs_log_new_name(), and since the
inode is in the log tree we proceed to updating the inode in the log
tree;
3) We first set the inode's last_unlink_trans to the current transaction
(early in btrfs_log_new_name());
4) We then eventually enter btrfs_log_inode_parent(), and after logging
the file's inode, we call btrfs_log_all_parents() because the inode's
last_unlink_trans matches the current transaction's ID (updated in the
previous step);
5) So btrfs_log_all_parents() logs the root directory by calling
btrfs_log_inode() for the root's inode with a log mode of LOG_INODE_ALL
so that new dentries are logged;
6) At btrfs_log_inode(), because the log mode is LOG_INODE_ALL, we
update root inode's last_log_commit to the last transaction that
changed the inode (->last_sub_trans field of the inode), which
corresponds to the current transaction's ID;
7) Then later when user space explicitly calls fsync against the root
directory, we enter btrfs_sync_file(), which calls skip_inode_logging()
and that returns true, since its call to btrfs_inode_in_log() returns
true and there are no ordered extents (it's a directory, never has
ordered extents). This results in btrfs_sync_file() returning without
syncing the log or committing the current transaction, so all the
updates we did when logging the new name, including logging the root
directory, are not persisted.
So fix this by but updating the inode's last_log_commit if we are sure
we are not logging a new name (if ctx->logging_new_name is false).
A test case for fstests will follow soon.
Reported-by: Vyacheslav Kovalevsky <slava.kovalevskiy.2014@gmail.com>
Link: https://lore.kernel.org/linux-btrfs/03c5d7ec-5b3d-49d1-95bc-8970a7f82d87@gmail.com/
Fixes: 130341be7f ("btrfs: always update the logged transaction when logging new names")
CC: stable@vger.kernel.org # 6.1+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 5fea61aa1c upstream.
scrub_raid56_parity_stripe() allocates a bio with bio_alloc(), but
fails to release it on some error paths, leading to a potential
memory leak.
Add the missing bio_put() calls to properly drop the bio reference
in those error cases.
Fixes: 1009254bf2 ("btrfs: scrub: use scrub_stripe to implement RAID56 P/Q scrub")
CC: stable@vger.kernel.org # 6.6+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6a1ab50135 upstream.
The stripe offset calculation in the zoned code for raid0 and raid10
wrongly uses map->stripe_size to calculate it. In fact, map->stripe_size is
the size of the device extent composing the block group, which always is
the zone_size on the zoned setup.
Fix it by using BTRFS_STRIPE_LEN and BTRFS_STRIPE_LEN_SHIFT. Also, optimize
the calculation a bit by doing the common calculation only once.
Fixes: c0d90a79e8 ("btrfs: zoned: fix alloc_offset calculation for partly conventional block groups")
CC: stable@vger.kernel.org # 6.17+
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 94f54924b9 upstream.
When a block group contains both conventional zone and sequential zone, the
capacity of the block group is wrongly set to the block group's full
length. The capacity should be calculated in btrfs_load_block_group_* using
the last allocation offset.
Fixes: 568220fa96 ("btrfs: zoned: support RAID0/1/10 on top of raid stripe tree")
CC: stable@vger.kernel.org # v6.12+
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 281326be67 upstream.
The current single-bit error injection mechanism flips bits directly in ECC RAM
by performing write and read operations. When the ECC RAM is actively used by
the Ethernet or USB controller, this approach sometimes trigger a false
double-bit error.
Switch both Ethernet and USB EDAC devices to use the INTTEST register
(altr_edac_a10_device_inject_fops) for single-bit error injection, similar to
the existing double-bit error injection method.
Fixes: 064acbd4f4 ("EDAC, altera: Add Stratix10 peripheral support")
Signed-off-by: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Dinh Nguyen <dinguyen@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251111081333.1279635-1-niravkumarlaxmidas.rabara@altera.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 4e67526840 upstream.
Now we use virtual addresses to fill CSR_MERRENTRY/CSR_TLBRENTRY, but
hardware hope physical addresses. Now it works well because the high
bits are ignored above PA_BITS (48 bits), but explicitly use physical
addresses can avoid potential bugs. So fix it.
Cc: stable@vger.kernel.org
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ce5ad03e45 upstream.
Now there 5 places which calculate max_pfn & max_low_pfn:
1. in fdt_setup() for FDT systems;
2. in memblock_init() for ACPI systems;
3. in init_numa_memory() for NUMA systems;
4. in arch_mem_init() to recalculate for "mem=" cmdline;
5. in paging_init() to recalculate for NUMA systems.
Since memblock_init() is called both for ACPI and FDT systems, move the
calculation out of the for_each_efi_memory_desc() loop can eliminate the
first case. The last case is very questionable (may be derived from the
MIPS/Loongson code) and breaks the "mem=" cmdline, so should be removed.
And then the NUMA version of paging_init() can be also eliminated.
After consolidation there are 3 places of calculation:
1. in memblock_init() for both ACPI and FDT systems;
2. in init_numa_memory() to recalculate for NUMA systems;
3. in arch_mem_init() to recalculate for the "mem=" cmdline.
For all cases the calculation is:
max_pfn = PFN_DOWN(memblock_end_of_DRAM());
max_low_pfn = min(PFN_DOWN(HIGHMEM_START), max_pfn);
Cc: stable@vger.kernel.org
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 56b3c85e15 upstream.
When livepatch is attached to the same function as bpf trampoline with
a fexit program, bpf trampoline code calls register_ftrace_direct()
twice. The first time will fail with -EAGAIN, and the second time it
will succeed. This requires register_ftrace_direct() to unregister
the address on the first attempt. Otherwise, the bpf trampoline cannot
attach. Here is an easy way to reproduce this issue:
insmod samples/livepatch/livepatch-sample.ko
bpftrace -e 'fexit:cmdline_proc_show {}'
ERROR: Unable to attach probe: fexit:vmlinux:cmdline_proc_show...
Fix this by cleaning up the hash when register_ftrace_function_nolock hits
errors.
Also, move the code that resets ops->func and ops->trampoline to the error
path of register_ftrace_direct(); and add a helper function reset_direct()
in register_ftrace_direct() and unregister_ftrace_direct().
Fixes: d05cb47066 ("ftrace: Fix modification of direct_function hash while in use")
Cc: stable@vger.kernel.org # v6.6+
Reported-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
Closes: https://lore.kernel.org/live-patching/c5058315a39d4615b333e485893345be@crowdstrike.com/
Cc: Steven Rostedt (Google) <rostedt@goodmis.org>
Cc: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-and-tested-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
Signed-off-by: Song Liu <song@kernel.org>
Reviewed-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20251027175023.1521602-2-song@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit fdf302e6be upstream.
Starting with Rust 1.91.0 (released 2025-10-30), in upstream commit
ab91a63d403b ("Ignore intrinsic calls in cross-crate-inlining cost model")
[1][2], `bindings.o` stops containing DWARF debug information because the
`Default` implementations contained `write_bytes()` calls which are now
ignored in that cost model (note that `CLIPPY=1` does not reproduce it).
This means `gendwarfksyms` complains:
RUSTC L rust/bindings.o
error: gendwarfksyms: process_module: dwarf_get_units failed: no debugging information?
There are several alternatives that would work here: conditionally
skipping in the cases needed (but that is subtle and brittle), forcing
DWARF generation with e.g. a dummy `static` (ugly and we may need to
do it in several crates), skipping the call to the tool in the Kbuild
command when there are no exports (fine) or teaching the tool to do so
itself (simple and clean).
Thus do the last one: don't attempt to process files if we have no symbol
versions to calculate.
[ I used the commit log of my patch linked below since it explained the
root issue and expanded it a bit more to summarize the alternatives.
- Miguel ]
Cc: stable@vger.kernel.org # Needed in 6.17.y.
Reported-by: Haiyue Wang <haiyuewa@163.com>
Closes: https://lore.kernel.org/rust-for-linux/b8c1c73d-bf8b-4bf2-beb1-84ffdcd60547@163.com/
Suggested-by: Miguel Ojeda <ojeda@kernel.org>
Link: https://lore.kernel.org/rust-for-linux/CANiq72nKC5r24VHAp9oUPR1HVPqT+=0ab9N0w6GqTF-kJOeiSw@mail.gmail.com/
Link: ab91a63d40 [1]
Link: https://github.com/rust-lang/rust/pull/145910 [2]
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Tested-by: Haiyue Wang <haiyuewa@163.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20251110131913.1789896-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3cd2018e15 upstream.
Since commit d24cfee7f6 ("spi: Fix acpi deferred irq probe"), the
acpi_dev_gpio_irq_get() call gets delayed till spi_probe() is called
on the SPI device.
If there is no driver for the SPI device then the move to spi_probe()
results in acpi_dev_gpio_irq_get() never getting called. This may
cause problems by leaving the GPIO pin floating because this call is
responsible for setting up the GPIO pin direction and/or bias according
to the values from the ACPI tables.
Re-add the removed acpi_dev_gpio_irq_get() in acpi_register_spi_device()
to ensure the GPIO pin is always correctly setup, while keeping the
acpi_dev_gpio_irq_get() call added to spi_probe() to deal with
-EPROBE_DEFER returns caused by the GPIO controller not having a driver
yet.
Link: https://bbs.archlinux.org/viewtopic.php?id=302348
Fixes: d24cfee7f6 ("spi: Fix acpi deferred irq probe")
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hansg@kernel.org>
Link: https://patch.msgid.link/20251102190921.30068-1-hansg@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 79280191c2 upstream.
cifs_pick_channel iterates candidate channels using cur. The
reconnect-state test mistakenly used a different variable.
This checked the wrong slot and would cause us to skip a healthy channel
and to dispatch on one that needs reconnect, occasionally failing
operations when a channel was down.
Fix by replacing for the correct variable.
Fixes: fc43a8ac39 ("cifs: cifs_pick_channel should try selecting active channels")
Cc: stable@vger.kernel.org
Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 59b0afd01b upstream.
The qm_get_qos_value() function calls bus_find_device_by_name() which
increases the device reference count, but fails to call put_device()
to balance the reference count and lead to a device reference leak.
Add put_device() calls in both the error path and success path to
properly balance the reference count.
Found via static analysis.
Fixes: 22d7a6c39c ("crypto: hisilicon/qm - add pci bdf number check")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Longfang Liu <liulongfang@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 00fbff75c5 upstream.
When crashkernel is configured with a high reservation, shrinking its
value below the low crashkernel reservation causes two issues:
1. Invalid crashkernel resource objects
2. Kernel crash if crashkernel shrinking is done twice
For example, with crashkernel=200M,high, the kernel reserves 200MB of high
memory and some default low memory (say 256MB). The reservation appears
as:
cat /proc/iomem | grep -i crash
af000000-beffffff : Crash kernel
433000000-43f7fffff : Crash kernel
If crashkernel is then shrunk to 50MB (echo 52428800 >
/sys/kernel/kexec_crash_size), /proc/iomem still shows 256MB reserved:
af000000-beffffff : Crash kernel
Instead, it should show 50MB:
af000000-b21fffff : Crash kernel
Further shrinking crashkernel to 40MB causes a kernel crash with the
following trace (x86):
BUG: kernel NULL pointer dereference, address: 0000000000000038
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
<snip...>
Call Trace: <TASK>
? __die_body.cold+0x19/0x27
? page_fault_oops+0x15a/0x2f0
? search_module_extables+0x19/0x60
? search_bpf_extables+0x5f/0x80
? exc_page_fault+0x7e/0x180
? asm_exc_page_fault+0x26/0x30
? __release_resource+0xd/0xb0
release_resource+0x26/0x40
__crash_shrink_memory+0xe5/0x110
crash_shrink_memory+0x12a/0x190
kexec_crash_size_store+0x41/0x80
kernfs_fop_write_iter+0x141/0x1f0
vfs_write+0x294/0x460
ksys_write+0x6d/0xf0
<snip...>
This happens because __crash_shrink_memory()/kernel/crash_core.c
incorrectly updates the crashk_res resource object even when
crashk_low_res should be updated.
Fix this by ensuring the correct crashkernel resource object is updated
when shrinking crashkernel memory.
Link: https://lkml.kernel.org/r/20251101193741.289252-1-sourabhjain@linux.ibm.com
Fixes: 16c6006af4 ("kexec: enable kexec_crash_size to support two crash kernel regions")
Signed-off-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Acked-by: Baoquan He <bhe@redhat.com>
Cc: Zhen Lei <thunder.leizhen@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit e8c73eb7db upstream.
The user calls fsconfig twice, but when the program exits, free() only
frees ctx->source for the second fsconfig, not the first.
Regarding fc->source, there is no code in the fs context related to its
memory reclamation.
To fix this memory leak, release the source memory corresponding to ctx
or fc before each parsing.
syzbot reported:
BUG: memory leak
unreferenced object 0xffff888128afa360 (size 96):
backtrace (crc 79c9c7ba):
kstrdup+0x3c/0x80 mm/util.c:84
smb3_fs_context_parse_param+0x229b/0x36c0 fs/smb/client/fs_context.c:1444
BUG: memory leak
unreferenced object 0xffff888112c7d900 (size 96):
backtrace (crc 79c9c7ba):
smb3_fs_context_fullpath+0x70/0x1b0 fs/smb/client/fs_context.c:629
smb3_fs_context_parse_param+0x2266/0x36c0 fs/smb/client/fs_context.c:1438
Reported-by: syzbot+72afd4c236e6bc3f4bac@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=72afd4c236e6bc3f4bac
Cc: stable@vger.kernel.org
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 1a58d865f4 upstream.
The bus_find_device_by_name() function returns a device pointer with an
incremented reference count, but the original code was missing put_device()
calls in some return paths, leading to reference count leaks.
Fix this by ensuring put_device() is called before function exit after
bus_find_device_by_name() succeeds
This follows the same pattern used elsewhere in the kernel where
bus_find_device_by_name() is properly paired with put_device().
Found via static analysis and code review.
Fixes: 4f8ef33dd4 ("ASoC: soc_sdw_utils: skip the endpoint that doesn't present")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Link: https://patch.msgid.link/20251029071804.8425-1-linmq006@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 05a1fc5efd upstream.
The PCM stream data in USB-audio driver is transferred over USB URB
packet buffers, and each packet size is determined dynamically. The
packet sizes are limited by some factors such as wMaxPacketSize USB
descriptor. OTOH, in the current code, the actually used packet sizes
are determined only by the rate and the PPS, which may be bigger than
the size limit above. This results in a buffer overflow, as reported
by syzbot.
Basically when the limit is smaller than the calculated packet size,
it implies that something is wrong, most likely a weird USB
descriptor. So the best option would be just to return an error at
the parameter setup time before doing any further operations.
This patch introduces such a sanity check, and returns -EINVAL when
the packet size is greater than maxpacksize. The comparison with
ep->packsize[1] alone should suffice since it's always equal or
greater than ep->packsize[0].
Reported-by: syzbot+bfd77469c8966de076f7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=bfd77469c8966de076f7
Link: https://lore.kernel.org/690b6b46.050a0220.3d0d33.0054.GAE@google.com
Cc: Lizhi Xu <lizhi.xu@windriver.com>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20251109091211.12739-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 82420bd4e1 upstream.
After restructuring and splitting the HDMI codec driver code, each
HDMI codec driver contains the own build_controls and build_pcms ops.
A copy-n-paste error put the wrong entries for nvhdmi-mcp driver; both
build_controls and build_pcms are swapped. Unfortunately both
callbacks have the very same form, and the compiler didn't complain
it, either. This resulted in a NULL dereference because the PCM
instance hasn't been initialized at calling the build_controls
callback.
Fix it by passing the proper entries.
Fixes: ad781b550f ("ALSA: hda/hdmi: Rewrite to new probe method")
Cc: <stable@vger.kernel.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=220743
Link: https://patch.msgid.link/20251106104647.25805-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 1c2a936edd upstream.
Since commit 78524b05f1 ("mm, swap: avoid redundant swap device
pinning"), the common helper for allocating and preparing a folio in the
swap cache layer no longer tries to get a swap device reference
internally, because all callers of __read_swap_cache_async are already
holding a swap entry reference. The repeated swap device pinning isn't
needed on the same swap device.
Caller of VMA readahead is also holding a reference to the target entry's
swap device, but VMA readahead walks the page table, so it might encounter
swap entries from other devices, and call __read_swap_cache_async on
another device without holding a reference to it.
So it is possible to cause a UAF when swapoff of device A raced with
swapin on device B, and VMA readahead tries to read swap entries from
device A. It's not easy to trigger, but in theory, it could cause real
issues.
Make VMA readahead try to get the device reference first if the swap
device is a different one from the target entry.
Link: https://lkml.kernel.org/r/20251111-swap-fix-vma-uaf-v1-1-41c660e58562@tencent.com
Fixes: 78524b05f1 ("mm, swap: avoid redundant swap device pinning")
Suggested-by: Huang Ying <ying.huang@linux.alibaba.com>
Signed-off-by: Kairui Song <kasong@tencent.com>
Acked-by: Chris Li <chrisl@kernel.org>
Cc: Baoquan He <bhe@redhat.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2f6ce7e714 upstream.
Patch series "mm/damon: fixes for the jiffies-related issues", v2.
On 32-bit systems, the kernel initializes jiffies to "-5 minutes" to make
jiffies wrap bugs appear earlier. However, this may cause the
time_before() series of functions to return unexpected values, resulting
in DAMON not functioning as intended. Meanwhile, similar issues exist in
some specific user operation scenarios.
This patchset addresses these issues. The first patch is about the
DAMON_STAT module, and the second patch is about the core layer's sysfs.
This patch (of 2):
In DAMON_STAT's damon_stat_damon_call_fn(), time_before_eq() is used to
avoid unnecessarily frequent stat update.
On 32-bit systems, the kernel initializes jiffies to "-5 minutes" to make
jiffies wrap bugs appear earlier. However, this causes time_before_eq()
in DAMON_STAT to unexpectedly return true during the first 5 minutes after
boot on 32-bit systems (see [1] for more explanation, which fixes another
jiffies-related issue before). As a result, DAMON_STAT does not update
any monitoring results during that period, which becomes more confusing
when DAMON_STAT_ENABLED_DEFAULT is enabled.
There is also an issue unrelated to the system's word size[2]: if the user
stops DAMON_STAT just after last_refresh_jiffies is updated and restarts
it after 5 seconds or a longer delay, last_refresh_jiffies will retain an
older value, causing time_before_eq() to return false and the update to
happen earlier than expected.
Fix these issues by making last_refresh_jiffies a global variable and
initializing it each time DAMON_STAT is started.
Link: https://lkml.kernel.org/r/20251030020746.967174-2-yanquanmin1@huawei.com
Link: https://lkml.kernel.org/r/20250822025057.1740854-1-ekffu200098@gmail.com [1]
Link: https://lore.kernel.org/all/20251028143250.50144-1-sj@kernel.org/ [2]
Fixes: fabdd1e911 ("mm/damon/stat: calculate and expose estimated memory bandwidth")
Signed-off-by: Quanmin Yan <yanquanmin1@huawei.com>
Suggested-by: SeongJae Park <sj@kernel.org>
Reviewed-by: SeongJae Park <sj@kernel.org>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: ze zuo <zuoze1@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 0d6c356dd6 upstream.
When emitting the order of the allocation for a hash table,
alloc_large_system_hash() unconditionally subtracts PAGE_SHIFT from log
base 2 of the allocation size. This is not correct if the allocation size
is smaller than a page, and yields a negative value for the order as seen
below:
TCP established hash table entries: 32 (order: -4, 256 bytes, linear) TCP
bind hash table entries: 32 (order: -2, 1024 bytes, linear)
Use get_order() to compute the order when emitting the hash table
information to correctly handle cases where the allocation size is smaller
than a page:
TCP established hash table entries: 32 (order: 0, 256 bytes, linear) TCP
bind hash table entries: 32 (order: 0, 1024 bytes, linear)
Link: https://lkml.kernel.org/r/20251028191020.413002-1-isaacmanjarres@google.com
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 895b4c0c79 upstream.
Pde is erased from subdir rbtree through rb_erase(), but not set the node
to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE()
set the erased node to EMPTY, then pde_subdir_next() will return NULL to
avoid uaf access.
We found an uaf issue while using stress-ng testing, need to run testcase
getdent and tun in the same time. The steps of the issue is as follows:
1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current
pde is tun3;
2) in the [time windows] unregister netdevice tun3 and tun2, and erase
them from rbtree. erase tun3 first, and then erase tun2. the
pde(tun2) will be released to slab;
3) continue to getdent process, then pde_subdir_next() will return
pde(tun2) which is released, it will case uaf access.
CPU 0 | CPU 1
-------------------------------------------------------------------------
traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2
sys_getdents64() |
iterate_dir() |
proc_readdir() |
proc_readdir_de() | snmp6_unregister_dev()
pde_get(de); | proc_remove()
read_unlock(&proc_subdir_lock); | remove_proc_subtree()
| write_lock(&proc_subdir_lock);
[time window] | rb_erase(&root->subdir_node, &parent->subdir);
| write_unlock(&proc_subdir_lock);
read_lock(&proc_subdir_lock); |
next = pde_subdir_next(de); |
pde_put(de); |
de = next; //UAF |
rbtree of dev_snmp6
|
pde(tun3)
/ \
NULL pde(tun2)
Link: https://lkml.kernel.org/r/20251025024233.158363-1-albin_yang@163.com
Signed-off-by: Wei Yang <albinwyang@tencent.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: wangzijie <wangzijie1@honor.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit a9da90e618 upstream.
While connecting, the MAC address can already no longer be
changed. The change is already rejected if netif_carrier_ok(),
but of course that's not true yet while connecting. Check for
auth_data or assoc_data, so the MAC address cannot be changed.
Also more comprehensively check that there are no stations on
the interface being changed - if any peer station is added it
will know about our address already, so we cannot change it.
Cc: stable@vger.kernel.org
Fixes: 3c06e91b40 ("wifi: mac80211: Support POWERED_ADDR_CHANGE feature")
Link: https://patch.msgid.link/20251105154119.f9f6c1df81bb.I9bb3760ede650fb96588be0d09a5a7bdec21b217@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit dd4adb986a upstream.
The tracing selftest "event-filter-function.tc" was failing because it
first runs the "sample_events" function that triggers the kmem_cache_free
event and it looks at what function was used during a call to "ls".
But the first time it calls this, it could trigger events that are used to
pull pages into the page cache.
The rest of the test uses the function it finds during that call to see if
it will be called in subsequent "sample_events" calls. But if there's no
need to pull pages into the page cache, it will not trigger that function
and the test will fail.
Call the "sample_events" twice to trigger all the page cache work before
it calls it to find a function to use in subsequent checks.
Cc: stable@vger.kernel.org
Fixes: eb50d0f250 ("selftests/ftrace: Choose target function for filter test from samples")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6f86d0534f upstream.
When a page fault occurs in a secret memory file created with
`memfd_secret(2)`, the kernel will allocate a new folio for it, mark the
underlying page as not-present in the direct map, and add it to the file
mapping.
If two tasks cause a fault in the same page concurrently, both could end
up allocating a folio and removing the page from the direct map, but only
one would succeed in adding the folio to the file mapping. The task that
failed undoes the effects of its attempt by (a) freeing the folio again
and (b) putting the page back into the direct map. However, by doing
these two operations in this order, the page becomes available to the
allocator again before it is placed back in the direct mapping.
If another task attempts to allocate the page between (a) and (b), and the
kernel tries to access it via the direct map, it would result in a
supervisor not-present page fault.
Fix the ordering to restore the direct map before the folio is freed.
Link: https://lkml.kernel.org/r/20251031120955.92116-1-lance.yang@linux.dev
Fixes: 1507f51255 ("mm: introduce memfd_secret system call to create "secret" memory areas")
Signed-off-by: Lance Yang <lance.yang@linux.dev>
Reported-by: Google Big Sleep <big-sleep-vuln-reports@google.com>
Closes: https://lore.kernel.org/linux-mm/CAEXGt5QeDpiHTu3K9tvjUTPqo+d-=wuCNYPa+6sWKrdQJ-ATdg@mail.gmail.com/
Acked-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 49c8d2c1f9 upstream.
commit efa95b01da ("netpoll: fix use after free") incorrectly
ignored the refcount and prematurely set dev->npinfo to NULL during
netpoll cleanup, leading to improper behavior and memory leaks.
Scenario causing lack of proper cleanup:
1) A netpoll is associated with a NIC (e.g., eth0) and netdev->npinfo is
allocated, and refcnt = 1
- Keep in mind that npinfo is shared among all netpoll instances. In
this case, there is just one.
2) Another netpoll is also associated with the same NIC and
npinfo->refcnt += 1.
- Now dev->npinfo->refcnt = 2;
- There is just one npinfo associated to the netdev.
3) When the first netpolls goes to clean up:
- The first cleanup succeeds and clears np->dev->npinfo, ignoring
refcnt.
- It basically calls `RCU_INIT_POINTER(np->dev->npinfo, NULL);`
- Set dev->npinfo = NULL, without proper cleanup
- No ->ndo_netpoll_cleanup() is either called
4) Now the second target tries to clean up
- The second cleanup fails because np->dev->npinfo is already NULL.
* In this case, ops->ndo_netpoll_cleanup() was never called, and
the skb pool is not cleaned as well (for the second netpoll
instance)
- This leaks npinfo and skbpool skbs, which is clearly reported by
kmemleak.
Revert commit efa95b01da ("netpoll: fix use after free") and adds
clarifying comments emphasizing that npinfo cleanup should only happen
once the refcount reaches zero, ensuring stable and correct netpoll
behavior.
Cc: <stable@vger.kernel.org> # 3.17.x
Cc: Jay Vosburgh <jv@jvosburgh.net>
Fixes: efa95b01da ("netpoll: fix use after free")
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251107-netconsole_torture-v10-1-749227b55f63@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 9a6b60cb14 upstream.
Because kthread_stop did not stop sc_task properly and returned -EINTR,
the sc_timer was not properly closed, ultimately causing the problem [1]
reported by syzbot when freeing sci due to the sc_timer not being closed.
Because the thread sc_task main function nilfs_segctor_thread() returns 0
when it succeeds, when the return value of kthread_stop() is not 0 in
nilfs_segctor_destroy(), we believe that it has not properly closed
sc_timer.
We use timer_shutdown_sync() to sync wait for sc_timer to shutdown, and
set the value of sc_task to NULL under the protection of lock
sc_state_lock, so as to avoid the issue caused by sc_timer not being
properly shutdowned.
[1]
ODEBUG: free active (active state 0) object: 00000000dacb411a object type: timer_list hint: nilfs_construction_timeout
Call trace:
nilfs_segctor_destroy fs/nilfs2/segment.c:2811 [inline]
nilfs_detach_log_writer+0x668/0x8cc fs/nilfs2/segment.c:2877
nilfs_put_super+0x4c/0x12c fs/nilfs2/super.c:509
Link: https://lkml.kernel.org/r/20251029225226.16044-1-konishi.ryusuke@gmail.com
Fixes: 3f66cc261c ("nilfs2: use kthread_create and kthread_stop for the log writer thread")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+24d8b70f039151f65590@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=24d8b70f039151f65590
Tested-by: syzbot+24d8b70f039151f65590@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Cc: <stable@vger.kernel.org> [6.12+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 9fd7bb5083 upstream.
In DAMON's damon_sysfs_repeat_call_fn(), time_before() is used to compare
the current jiffies with next_update_jiffies to determine whether to
update the sysfs files at this moment.
On 32-bit systems, the kernel initializes jiffies to "-5 minutes" to make
jiffies wrap bugs appear earlier. However, this causes time_before() in
damon_sysfs_repeat_call_fn() to unexpectedly return true during the first
5 minutes after boot on 32-bit systems (see [1] for more explanation,
which fixes another jiffies-related issue before). As a result, DAMON
does not update sysfs files during that period.
There is also an issue unrelated to the system's word size[2]: if the
user stops DAMON just after next_update_jiffies is updated and restarts
it after 'refresh_ms' or a longer delay, next_update_jiffies will retain
an older value, causing time_before() to return false and the update to
happen earlier than expected.
Fix these issues by making next_update_jiffies a global variable and
initializing it each time DAMON is started.
Link: https://lkml.kernel.org/r/20251030020746.967174-3-yanquanmin1@huawei.com
Link: https://lkml.kernel.org/r/20250822025057.1740854-1-ekffu200098@gmail.com [1]
Link: https://lore.kernel.org/all/20251029013038.66625-1-sj@kernel.org/ [2]
Fixes: d809a7c64b ("mm/damon/sysfs: implement refresh_ms file internal work")
Suggested-by: SeongJae Park <sj@kernel.org>
Reviewed-by: SeongJae Park <sj@kernel.org>
Signed-off-by: Quanmin Yan <yanquanmin1@huawei.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: ze zuo <zuoze1@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ac1499fcd4 upstream.
The sit driver's packet transmission path calls: sit_tunnel_xmit() ->
update_or_create_fnhe(), which lead to fnhe_remove_oldest() being called
to delete entries exceeding FNHE_RECLAIM_DEPTH+random.
The race window is between fnhe_remove_oldest() selecting fnheX for
deletion and the subsequent kfree_rcu(). During this time, the
concurrent path's __mkroute_output() -> find_exception() can fetch the
soon-to-be-deleted fnheX, and rt_bind_exception() then binds it with a
new dst using a dst_hold(). When the original fnheX is freed via RCU,
the dst reference remains permanently leaked.
CPU 0 CPU 1
__mkroute_output()
find_exception() [fnheX]
update_or_create_fnhe()
fnhe_remove_oldest() [fnheX]
rt_bind_exception() [bind dst]
RCU callback [fnheX freed, dst leak]
This issue manifests as a device reference count leak and a warning in
dmesg when unregistering the net device:
unregister_netdevice: waiting for sitX to become free. Usage count = N
Ido Schimmel provided the simple test validation method [1].
The fix clears 'oldest->fnhe_daddr' before calling fnhe_flush_routes().
Since rt_bind_exception() checks this field, setting it to zero prevents
the stale fnhe from being reused and bound to a new dst just before it
is freed.
[1]
ip netns add ns1
ip -n ns1 link set dev lo up
ip -n ns1 address add 192.0.2.1/32 dev lo
ip -n ns1 link add name dummy1 up type dummy
ip -n ns1 route add 192.0.2.2/32 dev dummy1
ip -n ns1 link add name gretap1 up arp off type gretap \
local 192.0.2.1 remote 192.0.2.2
ip -n ns1 route add 198.51.0.0/16 dev gretap1
taskset -c 0 ip netns exec ns1 mausezahn gretap1 \
-A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q &
taskset -c 2 ip netns exec ns1 mausezahn gretap1 \
-A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q &
sleep 10
ip netns pids ns1 | xargs kill
ip netns del ns1
Cc: stable@vger.kernel.org
Fixes: 67d6d681e1 ("ipv4: make exception cache less predictible")
Signed-off-by: Chuang Wang <nashuiliang@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20251111064328.24440-1-nashuiliang@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit a073d637c8 upstream.
Now if the PTE/PMD is dirty with _PAGE_DIRTY but without _PAGE_MODIFIED,
after {pte,pmd}_modify() we lose _PAGE_DIRTY, then {pte,pmd}_dirty()
return false and lead to data loss. This can happen in certain scenarios
such as HW PTW doesn't set _PAGE_MODIFIED automatically, so here we need
_PAGE_MODIFIED to record the dirty status (_PAGE_DIRTY).
The new modification involves checking whether the original PTE/PMD has
the _PAGE_DIRTY flag. If it exists, the _PAGE_MODIFIED bit is also set,
ensuring that the {pte,pmd}_dirty() interface can always return accurate
information.
Cc: stable@vger.kernel.org
Co-developed-by: Liupu Wang <wangliupu@loongson.cn>
Signed-off-by: Liupu Wang <wangliupu@loongson.cn>
Signed-off-by: Tianyang Zhang <zhangtianyang@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit eeeeaafa62 upstream.
CSR.FWPC and CSR.MWPC are 32bit registers, so use csr_read32() rather
than csr_read64() to read the values of FWPC/MWPC.
Cc: stable@vger.kernel.org
Fixes: edffa33c7b ("LoongArch: Add hardware breakpoints/watchpoints support")
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 43a9e6a10b upstream.
1. Use phys_addr_t instead of u64, which can work for both 32/64 bits.
2. Check whether the input physical address is above TO_PHYS_MASK (and
return NULL if yes) for the DMW version.
Note: In theory early_ioremap() also need the TO_PHYS_MASK checking, but
the UEFI BIOS pass some DMW virtual addresses.
Cc: stable@vger.kernel.org
Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 91a5409002 upstream.
maple_tree tracepoints contain pointers to function names. Such a pointer
is saved when a tracepoint logs an event. There's no guarantee that it's
still valid when the event is parsed later and the pointer is dereferenced.
The kernel warns about these unsafe pointers.
event 'ma_read' has unsafe pointer field 'fn'
WARNING: kernel/trace/trace.c:3779 at ignore_event+0x1da/0x1e4
Mark the function names as tracepoint_string() to fix the events.
One case that doesn't work without my patch would be trace-cmd record
to save the binary ringbuffer and trace-cmd report to parse it in
userspace. The address of __func__ can't be dereferenced from
userspace but tracepoint_string will add an entry to
/sys/kernel/tracing/printk_formats
Link: https://lkml.kernel.org/r/20251030155537.87972-1-martin@kaiser.cx
Fixes: 54a611b605 ("Maple Tree: add new data structure")
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Acked-by: Liam R. Howlett <Liam.Howlett@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 4da4e4bde1 upstream.
The `len` member of the sk_buff is an unsigned int. This is cast to
`ssize_t` (a signed type) for the first sk_buff in the comparison,
but not the second sk_buff. On 32-bit systems, this can result in
an integer underflow for certain values because unsigned arithmetic
is being used.
This appears to be an oversight: if the intention was to use unsigned
arithmetic, then the first cast would have been omitted. The change
ensures both len values are cast to `ssize_t`.
The underflow causes an issue with ktls when multiple TLS PDUs are
included in a single TCP segment. The mainline kernel does not use
strparser for ktls anymore, but this is still useful for other
features that still use strparser, and for backporting.
Signed-off-by: Nate Karstens <nate.karstens@garmin.com>
Cc: stable@vger.kernel.org
Fixes: 43a0c6751a ("strparser: Stream parser for messages")
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20251106222835.1871628-1-nate.karstens@garmin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit f5548c318d upstream.
Currently, scan_get_next_rmap_item() walks every page address in a VMA to
locate mergeable pages. This becomes highly inefficient when scanning
large virtual memory areas that contain mostly unmapped regions, causing
ksmd to use large amount of cpu without deduplicating much pages.
This patch replaces the per-address lookup with a range walk using
walk_page_range(). The range walker allows KSM to skip over entire
unmapped holes in a VMA, avoiding unnecessary lookups. This problem was
previously discussed in [1].
Consider the following test program which creates a 32 TiB mapping in the
virtual address space but only populates a single page:
#include <unistd.h>
#include <stdio.h>
#include <sys/mman.h>
/* 32 TiB */
const size_t size = 32ul * 1024 * 1024 * 1024 * 1024;
int main() {
char *area = mmap(NULL, size, PROT_READ | PROT_WRITE,
MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0);
if (area == MAP_FAILED) {
perror("mmap() failed\n");
return -1;
}
/* Populate a single page such that we get an anon_vma. */
*area = 0;
/* Enable KSM. */
madvise(area, size, MADV_MERGEABLE);
pause();
return 0;
}
$ ./ksm-sparse &
$ echo 1 > /sys/kernel/mm/ksm/run
Without this patch ksmd uses 100% of the cpu for a long time (more then 1
hour in my test machine) scanning all the 32 TiB virtual address space
that contain only one mapped page. This makes ksmd essentially deadlocked
not able to deduplicate anything of value. With this patch ksmd walks
only the one mapped page and skips the rest of the 32 TiB virtual address
space, making the scan fast using little cpu.
Link: https://lkml.kernel.org/r/20251023035841.41406-1-pedrodemargomes@gmail.com
Link: https://lkml.kernel.org/r/20251022153059.22763-1-pedrodemargomes@gmail.com
Link: https://lore.kernel.org/linux-mm/423de7a3-1c62-4e72-8e79-19a6413e420c@redhat.com/ [1]
Fixes: 31dbd01f31 ("ksm: Kernel SamePage Merging")
Signed-off-by: Pedro Demarchi Gomes <pedrodemargomes@gmail.com>
Co-developed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Reported-by: craftfever <craftfever@airmail.cc>
Closes: https://lkml.kernel.org/r/020cf8de6e773bb78ba7614ef250129f11a63781@murena.io
Suggested-by: David Hildenbrand <david@redhat.com>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: xu xin <xu.xin16@zte.com.cn>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 98a5fd31cb upstream.
When the per-IP connection limit is exceeded in ksmbd_kthread_fn(),
the code sets ret = -EAGAIN and continues the accept loop without
closing the just-accepted socket. That leaks one socket per rejected
attempt from a single IP and enables a trivial remote DoS.
Release client_sk before continuing.
This bug was found with ZeroPath.
Cc: stable@vger.kernel.org
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8a7348a9ed upstream.
nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find
the various exported filesystems using LOOKUP requests from a known root
filehandle. NFSv3 uses the MOUNT protocol to find those exported
filesystems and so is not given access to the pseudo root filesystem.
If a v3 (or v2) client uses a filehandle from that filesystem,
nfsd_set_fh_dentry() will report an error, but still stores the export
in "struct svc_fh" even though it also drops the reference (exp_put()).
This means that when fh_put() is called an extra reference will be dropped
which can lead to use-after-free and possible denial of service.
Normal NFS usage will not provide a pseudo-root filehandle to a v3
client. This bug can only be triggered by the client synthesising an
incorrect filehandle.
To fix this we move the assignments to the svc_fh later, after all
possible error cases have been detected.
Reported-and-tested-by: tianshuo han <hantianshuo233@gmail.com>
Fixes: ef7f6c4904 ("nfsd: move V4ROOT version check to nfsd_set_fh_dentry()")
Signed-off-by: NeilBrown <neil@brown.name>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8a4821412c upstream.
The current scheme for handling LBRV when nested is used is very
complicated, especially when L1 does not enable LBRV (i.e. does not set
LBR_CTL_ENABLE_MASK).
To avoid copying LBRs between VMCB01 and VMCB02 on every nested
transition, the current implementation switches between using VMCB01 or
VMCB02 as the source of truth for the LBRs while L2 is running. If L2
enables LBR, VMCB02 is used as the source of truth. When L2 disables
LBR, the LBRs are copied to VMCB01 and VMCB01 is used as the source of
truth. This introduces significant complexity, and incorrect behavior in
some cases.
For example, on a nested #VMEXIT, the LBRs are only copied from VMCB02
to VMCB01 if LBRV is enabled in VMCB01. This is because L2's writes to
MSR_IA32_DEBUGCTLMSR to enable LBR are intercepted and propagated to
VMCB01 instead of VMCB02. However, LBRV is only enabled in VMCB02 when
L2 is running.
This means that if L2 enables LBR and exits to L1, the LBRs will not be
propagated from VMCB02 to VMCB01, because LBRV is disabled in VMCB01.
There is no meaningful difference in CPUID rate in L2 when copying LBRs
on every nested transition vs. the current approach, so do the simple
and correct thing and always copy LBRs between VMCB01 and VMCB02 on
nested transitions (when LBRV is disabled by L1). Drop the conditional
LBRs copying in __svm_{enable/disable}_lbrv() as it is now unnecessary.
VMCB02 becomes the only source of truth for LBRs when L2 is running,
regardless of LBRV being enabled by L1, drop svm_get_lbr_vmcb() and use
svm->vmcb directly in its place.
Fixes: 1d5a1b5860 ("KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running")
Cc: stable@vger.kernel.org
Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev>
Link: https://patch.msgid.link/20251108004524.1600006-4-yosry.ahmed@linux.dev
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit fbe5e5f030 upstream.
svm_update_lbrv() is called when MSR_IA32_DEBUGCTLMSR is updated, and on
nested transitions where LBRV is used. It checks whether LBRV enablement
needs to be changed in the current VMCB, and if it does, it also
recalculate intercepts to LBR MSRs.
However, there are cases where intercepts need to be updated even when
LBRV enablement doesn't. Example scenario:
- L1 has MSR_IA32_DEBUGCTLMSR cleared.
- L1 runs L2 without LBR_CTL_ENABLE (no LBRV).
- L2 sets DEBUGCTLMSR_LBR in MSR_IA32_DEBUGCTLMSR, svm_update_lbrv()
sets LBR_CTL_ENABLE in VMCB02 and disables intercepts to LBR MSRs.
- L2 exits to L1, svm_update_lbrv() is not called on this transition.
- L1 clears MSR_IA32_DEBUGCTLMSR, svm_update_lbrv() finds that
LBR_CTL_ENABLE is already cleared in VMCB01 and does nothing.
- Intercepts remain disabled, L1 reads to LBR MSRs read the host MSRs.
Fix it by always recalculating intercepts in svm_update_lbrv().
Fixes: 1d5a1b5860 ("KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running")
Cc: stable@vger.kernel.org
Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev>
Link: https://patch.msgid.link/20251108004524.1600006-3-yosry.ahmed@linux.dev
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit dc55b3c3f6 upstream.
The APM lists the DbgCtlMsr field as being tracked by the VMCB_LBR clean
bit. Always clear the bit when MSR_IA32_DEBUGCTLMSR is updated.
The history is complicated, it was correctly cleared for L1 before
commit 1d5a1b5860 ("KVM: x86: nSVM: correctly virtualize LBR msrs when
L2 is running"). At that point svm_set_msr() started to rely on
svm_update_lbrv() to clear the bit, but when nested virtualization
is enabled the latter does not always clear it even if MSR_IA32_DEBUGCTLMSR
changed. Go back to clearing it directly in svm_set_msr().
Fixes: 1d5a1b5860 ("KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running")
Reported-by: Matteo Rizzo <matteorizzo@google.com>
Reported-by: evn@google.com
Co-developed-by: Jim Mattson <jmattson@google.com>
Signed-off-by: Jim Mattson <jmattson@google.com>
Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev>
Link: https://patch.msgid.link/20251108004524.1600006-2-yosry.ahmed@linux.dev
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3f9eacf4f0 upstream.
32bit ID registers aren't getting much love these days, and are
often missed in updates. One of these updates broke restoring
a GICv2 guest on a GICv3 machine.
Instead of performing a piecemeal fix, just bite the bullet
and make all 32bit ID regs fully writable. KVM itself never
relies on them for anything, and if the VMM wants to mess up
the guest, so be it.
Fixes: 5cb57a1aff ("KVM: arm64: Zero ID_AA64PFR0_EL1.GIC when no GICv3 is presented to the guest")
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Cc: stable@vger.kernel.org
Reviewed-by: Oliver Upton <oupton@kernel.org>
Link: https://patch.msgid.link/20251030122707.2033690-2-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ae431059e7 upstream.
When unbinding a memslot from a guest_memfd instance, remove the bindings
even if the guest_memfd file is dying, i.e. even if its file refcount has
gone to zero. If the memslot is freed before the file is fully released,
nullifying the memslot side of the binding in kvm_gmem_release() will
write to freed memory, as detected by syzbot+KASAN:
==================================================================
BUG: KASAN: slab-use-after-free in kvm_gmem_release+0x176/0x440 virt/kvm/guest_memfd.c:353
Write of size 8 at addr ffff88807befa508 by task syz.0.17/6022
CPU: 0 UID: 0 PID: 6022 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
kvm_gmem_release+0x176/0x440 virt/kvm/guest_memfd.c:353
__fput+0x44c/0xa70 fs/file_table.c:468
task_work_run+0x1d4/0x260 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xe9/0x130 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x2bd/0xfa0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbeeff8efc9
</TASK>
Allocated by task 6023:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
poison_kmalloc_redzone mm/kasan/common.c:397 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:414
kasan_kmalloc include/linux/kasan.h:262 [inline]
__kmalloc_cache_noprof+0x3e2/0x700 mm/slub.c:5758
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
kvm_set_memory_region+0x747/0xb90 virt/kvm/kvm_main.c:2104
kvm_vm_ioctl_set_memory_region+0x6f/0xd0 virt/kvm/kvm_main.c:2154
kvm_vm_ioctl+0x957/0xc60 virt/kvm/kvm_main.c:5201
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6023:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:252 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284
kasan_slab_free include/linux/kasan.h:234 [inline]
slab_free_hook mm/slub.c:2533 [inline]
slab_free mm/slub.c:6622 [inline]
kfree+0x19a/0x6d0 mm/slub.c:6829
kvm_set_memory_region+0x9c4/0xb90 virt/kvm/kvm_main.c:2130
kvm_vm_ioctl_set_memory_region+0x6f/0xd0 virt/kvm/kvm_main.c:2154
kvm_vm_ioctl+0x957/0xc60 virt/kvm/kvm_main.c:5201
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Deliberately don't acquire filemap invalid lock when the file is dying as
the lifecycle of f_mapping is outside the purview of KVM. Dereferencing
the mapping is *probably* fine, but there's no need to invalidate anything
as memslot deletion is responsible for zapping SPTEs, and the only code
that can access the dying file is kvm_gmem_release(), whose core code is
mutually exclusive with unbinding.
Note, the mutual exclusivity is also what makes it safe to access the
bindings on a dying gmem instance. Unbinding either runs with slots_lock
held, or after the last reference to the owning "struct kvm" is put, and
kvm_gmem_release() nullifies the slot pointer under slots_lock, and puts
its reference to the VM after that is done.
Reported-by: syzbot+2479e53d0db9b32ae2aa@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68fa7a22.a70a0220.3bf6c6.008b.GAE@google.com
Tested-by: syzbot+2479e53d0db9b32ae2aa@syzkaller.appspotmail.com
Fixes: a7800aa80e ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory")
Cc: stable@vger.kernel.org
Cc: Hillf Danton <hdanton@sina.com>
Reviewed-By: Vishal Annapurve <vannapurve@google.com>
Link: https://patch.msgid.link/20251104011205.3853541-1-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 237e74bfa2 upstream.
VM fails to boot with 256 vCPUs, the detailed command is
qemu-system-loongarch64 -smp 256
and there is an error reported as follows:
KVM_LOONGARCH_EXTIOI_INIT_NUM_CPU failed: Invalid argument
There is typo issue in function kvm_eiointc_ctrl_access() when set
max supported vCPUs.
Cc: stable@vger.kernel.org
Fixes: 47256c4c8b ("LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_eiointc_ctrl_access()")
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d3c9515e4f upstream.
When timer is fired in oneshot mode, CSR.TVAL will stop with value -1
rather than 0. However when the register CSR.TVAL is restored, it will
continue to count down rather than stop there.
Now the method is to write 0 to CSR.TVAL, wait to count down for 1 cycle
at least, which is 10ns with a timer freq 100MHz, and then retore timer
interrupt status. Here add 2 cycles delay to assure that timer interrupt
is injected.
With this patch, timer selftest case passes to run always.
Cc: stable@vger.kernel.org
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 5001bcf86e upstream.
On LoongArch system, guest PMU hardware is shared by guest and host but
PMU interrupt is separated. PMU is pass-through to VM, and there is PMU
context switch when exit to host and return to guest.
There is optimiation to check whether PMU is enabled by guest. If not,
it is not necessary to return to guest. However, if it is enabled, PMU
context for guest need switch on. Now KVM_REQ_PMU notification is set
on vCPU context switch, but it is missing if there is no vCPU context
switch while PMU is used by guest VM, so fix it.
Cc: <stable@vger.kernel.org>
Fixes: f4e40ea9f7 ("LoongArch: KVM: Add PMU support for guest")
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit a78eb69d60 ]
In uclogic_params_ugee_v2_init_event_hooks(), the memory allocated for
event_hook is not freed in the next error path. Fix that by freeing it.
Fixes: a251d6576d ("HID: uclogic: Handle wireless device reconnection")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 53f731f5bb ]
Use a scope-based cleanup helper for the buffer allocated with kmalloc()
in ntrig_report_version() to simplify the cleanup logic and prevent
memory leaks (specifically the !hid_is_usb()-case one).
[jkosina@suse.com: elaborate on the actual existing leak]
Fixes: 185c926283 ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()")
Signed-off-by: Masami Ichikawa <masami256@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 6504297872 ]
The VBUS supply regulator is currently assigned to the PHY node.
This causes the VBUS to be always on, even when the controller
needs to be switched to peripheral mode.
Fix the OTG role switching by adding a connector node and moving
the VBUS supply regulator to that node. This way the VBUS gets
correctly switched according to the current role.
Fixes: 946ab10e3f ("arm64: dts: Add support for Kontron OSM-S i.MX8MP SoM and BL carrier board")
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit ec4daace64 ]
The gpio0_mipi_csi DT nodes are enabled by default, but they are
dependent on the irqsteer_csi nodes, which are not enabled. This causes
the gpio0_mipi_csi GPIOs to be probe deferred. Since these GPIOs can be
used independently of the CSI controller, enable irqsteer_csi by default
too to prevent them from being deferred and to ensure they work out of
the box.
Fixes: 2217f82437 ("arm64: dts: imx8: add capture controller for i.MX8's img subsystem")
Signed-off-by: João Paulo Gonçalves <joao.goncalves@toradex.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit f31e261712 ]
Rename the 'ssi2' and 'aud3' nodes to 'mux-ssi2' and 'mux-aud3' in the
audmux configuration of imx51-zii-rdu1.dts to comply with the naming
convention in imx-audmux.yaml.
This fixes the following dt-schema warning:
imx51-zii-rdu1.dtb: audmux@83fd0000 (fsl,imx51-audmux): 'aud3', 'ssi2'
do not match any of the regexes: '^mux-[0-9a-z]*$', '^pinctrl-[0-9]+$'
Fixes: ceef0396f3 ("ARM: dts: imx: add ZII RDU1 board")
Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 62bf7708fe ]
The 'report-rate-hz' property for the edt-ft5x06 driver was added and
handled in the Linux kernel by me with patches [1] and [2] for this
specific board.
The v1 upstream version, which was the one applied to the customer's
kernel, used the 'report-rate' property, which was written directly to
the controller register. During review, the 'hz' suffix was added,
changing its handling so that writing the value directly to the register
was no longer possible for the M06 controller.
Once the patches were accepted in mainline, I did not reapply them to
the customer's kernel, and when upstreaming the DTS for this board, I
forgot to correct the 'report-rate-hz' property value.
The property must be set to 60 because this board uses the M06 controller,
which expects the report rate in units of 10 Hz, meaning the actual value
written to the register is 6.
[1] 625f829586 ("dt-bindings: input: touchscreen: edt-ft5x06: add report-rate-hz")
[2] 5bcee83a40 ("Input: edt-ft5x06 - set report rate by dts property")
Fixes: ffea3cac94 ("ARM: dts: imx6ul: support Engicam MicroGEA RMM board")
Co-developed-by: Michael Trimarchi <michael@amarulasolutions.com>
Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b3fd04e23f ]
Unify the naming of the existing GPU OPP table nodes found in the RK3588
and RK3588J SoC dtsi files with the other SoC's GPU OPP nodes, following
the more "modern" node naming scheme.
Fixes: a7b2070505 ("arm64: dts: rockchip: Split GPU OPPs of RK3588 and RK3588j")
Signed-off-by: Dragan Simic <dsimic@manjaro.org>
[opp-table also is way too generic on systems with like 4-5 opp-tables]
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 3c723f4497 ]
Couple of independent fixes:
1. Wire in SIGSEGV handler that terminates the test with a failure code.
2. Use "--lock-cgroup" instead of "-g"; "-g" was proposed but never
merged. See commit 4d1792d0a2 ("perf lock contention: Add
--lock-cgroup option")
3. Call cleanup() on every normal exit so trap_cleanup() doesn't mistake
it for an unexpected signal and emit a false-negative "Unexpected
signal in main" message.
Before patch:
# ./perf test -vv "lock contention"
85: kernel lock contention analysis test:
--- start ---
test child forked, pid 610711
Testing perf lock record and perf lock contention
Testing perf lock contention --use-bpf
Testing perf lock record and perf lock contention at the same time
Testing perf lock contention --threads
Testing perf lock contention --lock-addr
Testing perf lock contention --lock-cgroup
Unexpected signal in test_aggr_cgroup
---- end(0) ----
85: kernel lock contention analysis test : Ok
After patch:
# ./perf test -vv "lock contention"
85: kernel lock contention analysis test:
--- start ---
test child forked, pid 602637
Testing perf lock record and perf lock contention
Testing perf lock contention --use-bpf
Testing perf lock record and perf lock contention at the same time
Testing perf lock contention --threads
Testing perf lock contention --lock-addr
Testing perf lock contention --lock-cgroup
Testing perf lock contention --type-filter (w/ spinlock)
Testing perf lock contention --lock-filter (w/ tasklist_lock)
Testing perf lock contention --callstack-filter (w/ unix_stream)
[Skip] Could not find 'unix_stream'
Testing perf lock contention --callstack-filter with task aggregation
[Skip] Could not find 'unix_stream'
Testing perf lock contention --cgroup-filter
Testing perf lock contention CSV output
---- end(0) ----
85: kernel lock contention analysis test : Ok
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ananth Narayan <ananth.narayan@amd.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sandipan Das <sandipan.das@amd.com>
Cc: Santosh Shukla <santosh.shukla@amd.com>
Cc: Tycho Andersen <tycho@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit a09e5967ad ]
This is one more remnant of the BUILD_NONDISTRO series to make building
with binutils-devel opt-in due to license incompatibility.
In this case just the references at link time were still in place, which
make building the test-all.bin file fail, which wasn't detected before
probably because the last test was done with binutils-devel available,
doh.
Now:
$ rpm -q binutils-devel
package binutils-devel is not installed
$ file /tmp/build/perf-tools/feature/test-all.bin
/tmp/build/perf-tools/feature/test-all.bin: ELF 64-bit LSB executable, x86-64, version 1 (SYSV),
dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2,
BuildID[sha1]=4b5388a346b51f1b993f0b0dbd49f4570769b03c, for GNU/Linux 3.2.0, not stripped
$
Fixes: 970ae86307 ("perf build: The bfd features are opt-in, stop testing for them by default")
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 85c894a80a ]
With commit f0d0f978f3 ("perf header: Don't write empty BPF/BTF
info"), the write_bpf_( prog_info() | btf() ) functions exit without
writing anything if env->bpf_prog.(infos| btfs)_cnt is zero.
process_bpf_( prog_info() | btf() ), however, still expect a "count"
value to exist in the data file. If btf information is empty, for
example, process_bpf_btf will read garbage or some other data as the
number of btf nodes in the data file. As a result, the data file will
not be processed correctly.
Instead, write the count to the data file and exit if it is zero.
Fixes: f0d0f978f3 ("perf header: Don't write empty BPF/BTF info")
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Thomas Falcon <thomas.falcon@intel.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 78f0e33cd6 ]
grab_requested_mnt_ns was changed to return error codes on failure, but
its callers were not updated to check for error pointers, still checking
only for a NULL return value.
This commit updates the callers to use IS_ERR() or IS_ERR_OR_NULL() and
PTR_ERR() to correctly check for and propagate errors.
This also makes sure that the logic actually works and mount namespace
file descriptors can be used to refere to mounts.
Christian Brauner <brauner@kernel.org> says:
Rework the patch to be more ergonomic and in line with our overall error
handling patterns.
Fixes: 7b9d14af87 ("fs: allow mount namespace fd")
Cc: Christian Brauner <brauner@kernel.org>
Signed-off-by: Andrei Vagin <avagin@google.com>
Link: https://patch.msgid.link/20251111062815.2546189-1-avagin@google.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 90f601b497 ]
bm_register_write() opens an executable file using open_exec(), which
internally calls do_open_execat() and denies write access on the file to
avoid modification while it is being executed.
However, when an error occurs, bm_register_write() closes the file using
filp_close() directly. This does not restore the write permission, which
may cause subsequent write operations on the same file to fail.
Fix this by calling exe_file_allow_write_access() before filp_close() to
restore the write permission properly.
Fixes: e7850f4d84 ("binfmt_misc: fix possible deadlock in bm_register_write")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Link: https://patch.msgid.link/20251105022923.1813587-1-zilin@seu.edu.cn
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 97315e7c90 ]
This was supposed to pass "onenand" instead of "&onenand" with the
ampersand. Passing a random stack address which will be gone when the
function ends makes no sense. However the good thing is that the pointer
is never used, so this doesn't cause a problem at run time.
Fixes: e23abf4b77 ("mtd: OneNAND: S5PC110: Implement DMA interrupt method")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 330e2c5148 ]
When a process tries to access an entry in /afs, normally what happens is
that an automount dentry is created by ->lookup() and then triggered, which
jumps through the ->d_automount() op. Currently, afs_dynroot_lookup() does
not do cell DNS lookup, leaving that to afs_d_automount() to perform -
however, it is possible to use access() or stat() on the automount point,
which will always return successfully, have briefly created an afs_cell
record if one did not already exist.
This means that something like:
test -d "/afs/.west" && echo Directory exists
will print "Directory exists" even though no such cell is configured. This
breaks the "west" python module available on PIP as it expects this access
to fail.
Now, it could be possible to make afs_dynroot_lookup() perform the DNS[*]
lookup, but that would make "ls --color /afs" do this for each cell in /afs
that is listed but not yet probed. kafs-client, probably wrongly, preloads
the entire cell database and all the known cells are then listed in /afs -
and doing ls /afs would be very, very slow, especially if any cell supplied
addresses but was wholly inaccessible.
[*] When I say "DNS", actually read getaddrinfo(), which could use any one
of a host of mechanisms. Could also use static configuration.
To fix this, make the following changes:
(1) Create an enum to specify the origination point of a call to
afs_lookup_cell() and pass this value into that function in place of
the "excl" parameter (which can be derived from it). There are six
points of origination:
- Cell preload through /proc/net/afs/cells
- Root cell config through /proc/net/afs/rootcell
- Lookup in dynamic root
- Automount trigger
- Direct mount with mount() syscall
- Alias check where YFS tells us the cell name is different
(2) Add an extra state into the afs_cell state machine to indicate a cell
that's been initialised, but not yet looked up. This is separate from
one that can be considered active and has been looked up at least
once.
(3) Make afs_lookup_cell() vary its behaviour more, depending on where it
was called from:
If called from preload or root cell config, DNS lookup will not happen
until we definitely want to use the cell (dynroot mount, automount,
direct mount or alias check). The cell will appear in /afs but stat()
won't trigger DNS lookup.
If the cell already exists, dynroot will not wait for the DNS lookup
to complete. If the cell did not already exist, dynroot will wait.
If called from automount, direct mount or alias check, it will wait
for the DNS lookup to complete.
(4) Make afs_lookup_cell() return an error if lookup failed in one way or
another. We try to return -ENOENT if the DNS says the cell does not
exist and -EDESTADDRREQ if we couldn't access the DNS.
Reported-by: Markus Suvanto <markus.suvanto@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220685
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/1784747.1761158912@warthog.procyon.org.uk
Fixes: 1d0b929fc0 ("afs: Change dynroot to create contents on demand")
Tested-by: Markus Suvanto <markus.suvanto@gmail.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
commit 44e8241c51 upstream.
On big endian arm kernels, the arm optimized Curve25519 code produces
incorrect outputs and fails the Curve25519 test. This has been true
ever since this code was added.
It seems that hardly anyone (or even no one?) actually uses big endian
arm kernels. But as long as they're ostensibly supported, we should
disable this code on them so that it's not accidentally used.
Note: for future-proofing, use !CPU_BIG_ENDIAN instead of
CPU_LITTLE_ENDIAN. Both of these are arch-specific options that could
get removed in the future if big endian support gets dropped.
Fixes: d8f1308a02 ("crypto: arm/curve25519 - wire up NEON implementation")
Cc: stable@vger.kernel.org
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20251104054906.716914-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 14473a1f88 ]
The irq_domain_free_irqs() helper requires that the irq_domain_ops->free
callback is implemented. Otherwise, the kernel reports the warning message
"NULL pointer, cannot free irq" when irq_dispose_mapping() is invoked to
release the per-HART local interrupts.
Set irq_domain_ops->free to irq_domain_free_irqs_top() to cure that.
Fixes: 832f15f426 ("RISC-V: Treat IPIs as normal Linux IRQs")
Signed-off-by: Nick Hu <nick.hu@sifive.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://patch.msgid.link/20251114-rv-intc-fix-v1-1-a3edd1c1a868@sifive.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b0c8e6d3d8 ]
The usage pattern for widen_imprecise_scalars() looks as follows:
prev_st = find_prev_entry(env, ...);
queued_st = push_stack(...);
widen_imprecise_scalars(env, prev_st, queued_st);
Where prev_st is an ancestor of the queued_st in the explored states
tree. This ancestor is not guaranteed to have same allocated stack
depth as queued_st. E.g. in the following case:
def main():
for i in 1..2:
foo(i) // same callsite, differnt param
def foo(i):
if i == 1:
use 128 bytes of stack
iterator based loop
Here, for a second 'foo' call prev_st->allocated_stack is 128,
while queued_st->allocated_stack is much smaller.
widen_imprecise_scalars() needs to take this into account and avoid
accessing bpf_verifier_state->frame[*]->stack out of bounds.
Fixes: 2793a8b015 ("bpf: exact states comparison for iterator convergence checks")
Reported-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20251114025730.772723-1-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 4ef9274362 ]
syzbot found that cls_bpf_classify() is able to change
tc_skb_cb(skb)->drop_reason triggering a warning in sk_skb_reason_drop().
WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline]
WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214
struct tc_skb_cb has been added in commit ec624fe740 ("net/sched:
Extend qdisc control block with tc control block"), which added a wrong
interaction with db58ba4592 ("bpf: wire in data and data_end for
cls_act_bpf").
drop_reason was added later.
Add bpf_prog_run_data_pointers() helper to save/restore the net_sched
storage colliding with BPF data_meta/data_end.
Fixes: ec624fe740 ("net/sched: Extend qdisc control block with tc control block")
Reported-by: syzbot <syzkaller@googlegroups.com>
Closes: https://lore.kernel.org/netdev/6913437c.a70a0220.22f260.013b.GAE@google.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20251112125516.1563021-1-edumazet@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 0a4a18e888 ]
The MODULE_PARM_DESC string for the "active" parameter is missing a
space and has an extraneous trailing ']' character. Correct these.
Before patch:
$ modinfo -p ./drm_client_lib.ko
active:Choose which drm client to start, default isfbdev] (string)
After patch:
$ modinfo -p ./drm_client_lib.ko
active:Choose which drm client to start, default is fbdev (string)
Fixes: f7b42442c4 ("drm/log: Introduce a new boot logger to draw the kmsg on the screen")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20251112010920.2355712-1-rdunlap@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 214291cbaa ]
The following lockdep splat was observed while kernel auto-online a CXL
memory region:
======================================================
WARNING: possible circular locking dependency detected
6.17.0djtest+ #53 Tainted: G W
------------------------------------------------------
systemd-udevd/3334 is trying to acquire lock:
ffffffff90346188 (hmem_resource_lock){+.+.}-{4:4}, at: hmem_register_resource+0x31/0x50
but task is already holding lock:
ffffffff90338890 ((node_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x2e/0x70
which lock already depends on the new lock.
[..]
Chain exists of:
hmem_resource_lock --> mem_hotplug_lock --> (node_chain).rwsem
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
rlock((node_chain).rwsem);
lock(mem_hotplug_lock);
lock((node_chain).rwsem);
lock(hmem_resource_lock);
The lock ordering can cause potential deadlock. There are instances
where hmem_resource_lock is taken after (node_chain).rwsem, and vice
versa.
Split out the target update section of hmat_register_target() so that
hmat_callback() only envokes that section instead of attempt to register
hmem devices that it does not need to.
[ dj: Fix up comment to be closer to 80cols. (Jonathan) ]
Fixes: cf8741ac57 ("ACPI: NUMA: HMAT: Register "soft reserved" memory as an "hmem" device")
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Tested-by: Smita Koralahalli <Smita.KoralahalliChannabasappa@amd.com>
Reviewed-by: Smita Koralahalli <Smita.KoralahalliChannabasappa@amd.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Link: https://patch.msgid.link/20251105235115.85062-3-dave.jiang@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 7132f7e025 ]
When the BO pointer provided to amdgpu_bo_create_kernel() points to
non-NULL, amdgpu_bo_create_kernel() takes it as a hint to pin that address
rather than allocate a new BO.
This functionality is never desired for allocating ISP buffers. A new BO
should always be created when isp_kernel_buffer_alloc() is called, per the
description for isp_kernel_buffer_alloc().
Ensure this by zeroing *bo right before the amdgpu_bo_create_kernel() call.
Fixes: 55d42f6169 ("drm/amd/amdgpu: Add helper functions for isp buffers")
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Reviewed-by: Pratap Nirujogi <pratap.nirujogi@amd.com>
Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 73c8c29baac7f0c7e703d92eba009008cbb5228e)
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 632108ec07 ]
In snd_usb_create_streams(), for UAC version 3 devices, the Interface
Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this
call fails, a fallback routine attempts to obtain the IAD from the next
interface and sets a BADD profile. However, snd_usb_mixer_controls_badd()
assumes that the IAD retrieved from usb_ifnum_to_if() is always valid,
without performing a NULL check. This can lead to a NULL pointer
dereference when usb_ifnum_to_if() fails to find the interface descriptor.
This patch adds a NULL pointer check after calling usb_ifnum_to_if() in
snd_usb_mixer_controls_badd() to prevent the dereference.
This issue was discovered by syzkaller, which triggered the bug by sending
a crafted USB device descriptor.
Fixes: 17156f23e9 ("ALSA: usb: add UAC3 BADD profiles support")
Signed-off-by: Haein Lee <lhi0729@kaist.ac.kr>
Link: https://patch.msgid.link/vwhzmoba9j2f.vwhzmob9u9e2.g6@dooray.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b623390045 ]
The utimes01 and utime06 tests fail when delegated timestamps are
enabled, specifically in subtests that modify the atime and mtime
fields using the 'nobody' user ID.
The problem can be reproduced as follow:
# echo "/media *(rw,no_root_squash,sync)" >> /etc/exports
# export -ra
# mount -o rw,nfsvers=4.2 127.0.0.1:/media /tmpdir
# cd /opt/ltp
# ./runltp -d /tmpdir -s utimes01
# ./runltp -d /tmpdir -s utime06
This issue occurs because nfs_setattr does not verify the inode's
UID against the caller's fsuid when delegated timestamps are
permitted for the inode.
This patch adds the UID check and if it does not match then the
request is sent to the server for permission checking.
Fixes: e12912d941 ("NFSv4: Add support for delegated atime and mtime attributes")
Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 1f214e9c3a ]
The Smatch static checker noted that in _nfs4_proc_lookupp(), the flag
RPC_TASK_TIMEOUT is being passed as an argument to nfs4_init_sequence(),
which is clearly incorrect.
Since LOOKUPP is an idempotent operation, nfs4_init_sequence() should
not ask the server to cache the result. The RPC_TASK_TIMEOUT flag needs
to be passed down to the RPC layer.
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Reported-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Fixes: 76998ebb91 ("NFSv4: Observe the NFS_MOUNT_SOFTREVAL flag in _nfs4_proc_lookupp")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit aae9db5739 ]
1) finish_no_open() takes ERR_PTR() as dentry now.
2) caller of ->atomic_open() will call d_lookup_done() itself, no
need to do it here.
Reviewed-by: NeilBrown <neil@brown.name>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Stable-dep-of: 85d2c2392a ("NFSv2/v3: Fix error handling in nfs_atomic_open_v23()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit fb2cba0854 ]
If the TLS security policy is of type RPC_XPRTSEC_TLS_X509, then the
cert_serial and privkey_serial fields need to match as well since they
define the client's identity, as presented to the server.
Fixes: 90c9550a8d ("NFS: support the kernel keyring for TLS")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 8ab523ce78 ]
The default setting for the transport security policy must be
RPC_XPRTSEC_NONE, when using a TCP or RDMA connection without TLS.
Conversely, when using TLS, the security policy needs to be set.
Fixes: 6c0a8c5fcf ("NFS: Have struct nfs_client carry a TLS policy field")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 7aca00d950 ]
Don't try to add an RDMA transport to a client that is already marked as
being a TCP/TLS transport.
Fixes: 04a1526366 ("pnfs/flexfiles: connect to NFSv3 DS using TLS if MDS connection uses TLS")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 6b6eddc63c ]
The probe function enables regulators at the beginning
but fails to disable them in its error handling path.
If any operation after enabling the regulators fails,
the probe will exit with an error, leaving the regulators
permanently enabled, which could lead to a resource leak.
Add a proper error handling path to call regulator_bulk_disable()
before returning an error.
Fixes: 9a397f4736 ("ASoC: cs4271: add regulator consumer support")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20251105062246.1955-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 636f4618b1 ]
In the commit referenced by the Fixes tag,
devm_gpiod_get_optional() was replaced by manual
GPIO management, relying on the regulator core to release the
GPIO descriptor. However, this approach does not account for the
error path: when regulator registration fails, the core never
takes over the GPIO, resulting in a resource leak.
Add gpiod_put() before returning on regulator registration failure.
Fixes: 5e6f3ae5c1 ("regulator: fixed: Let core handle GPIO descriptor")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20251028172828.625-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 2d0e88f3fd ]
io_buffer_register_bvec() currently uses blk_rq_nr_phys_segments() as
the number of bvecs in the request. However, bvecs may be split into
multiple segments depending on the queue limits. Thus, the number of
segments may overestimate the number of bvecs. For ublk devices, the
only current users of io_buffer_register_bvec(), virt_boundary_mask,
seg_boundary_mask, max_segments, and max_segment_size can all be set
arbitrarily by the ublk server process.
Set imu->nr_bvecs based on the number of bvecs the rq_for_each_bvec()
loop actually yields. However, continue using blk_rq_nr_phys_segments()
as an upper bound on the number of bvecs when allocating imu to avoid
needing to iterate the bvecs a second time.
Link: https://lore.kernel.org/io-uring/20251111191530.1268875-1-csander@purestorage.com/
Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Fixes: 27cb27b6d5 ("io_uring: add support for kernel registered bvecs")
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 90918e3b64 ]
Sequence adjustment may be required for FTP traffic with PASV/EPSV modes.
due to need to re-write packet payload (IP, port) on the ftp control
connection. This can require changes to the TCP length and expected
seq / ack_seq.
The easiest way to reproduce this issue is with PASV mode.
Example ruleset:
table inet ftp_nat {
ct helper ftp_helper {
type "ftp" protocol tcp
l3proto inet
}
chain prerouting {
type filter hook prerouting priority 0; policy accept;
tcp dport 21 ct state new ct helper set "ftp_helper"
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority -100; policy accept;
tcp dport 21 dnat ip prefix to ip daddr map {
192.168.100.1 : 192.168.13.2/32 }
}
chain postrouting {
type nat hook postrouting priority 100 ; policy accept;
tcp sport 21 snat ip prefix to ip saddr map {
192.168.13.2 : 192.168.100.1/32 }
}
}
Note that the ftp helper gets assigned *after* the dnat setup.
The inverse (nat after helper assign) is handled by an existing
check in nf_nat_setup_info() and will not show the problem.
Topoloy:
+-------------------+ +----------------------------------+
| FTP: 192.168.13.2 | <-> | NAT: 192.168.13.3, 192.168.100.1 |
+-------------------+ +----------------------------------+
|
+-----------------------+
| Client: 192.168.100.2 |
+-----------------------+
ftp nat changes do not work as expected in this case:
Connected to 192.168.100.1.
[..]
ftp> epsv
EPSV/EPRT on IPv4 off.
ftp> ls
227 Entering passive mode (192,168,100,1,209,129).
421 Service not available, remote server has closed connection.
Kernel logs:
Missing nfct_seqadj_ext_add() setup call
WARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_seqadj.c:41
[..]
__nf_nat_mangle_tcp_packet+0x100/0x160 [nf_nat]
nf_nat_ftp+0x142/0x280 [nf_nat_ftp]
help+0x4d1/0x880 [nf_conntrack_ftp]
nf_confirm+0x122/0x2e0 [nf_conntrack]
nf_hook_slow+0x3c/0xb0
..
Fix this by adding the required extension when a conntrack helper is assigned
to a connection that has a nat binding.
Fixes: 1a64edf54f ("netfilter: nft_ct: add helper set support")
Signed-off-by: Andrii Melnychenko <a.melnychenko@vyos.io>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit e060088db0 ]
l2cap_chan_put() is exported, so export also l2cap_chan_hold() for
modules.
l2cap_chan_hold() has use case in net/bluetooth/6lowpan.c
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 4b747cc628 ]
Commit ac4e04d9e3 ("cpufreq: intel_pstate: Unchecked MSR aceess in
legacy mode") introduced a check for feature X86_FEATURE_IDA to verify
turbo mode support. Although this is the correct way to check for turbo
mode support, it causes issues on some platforms that disable turbo
during OS boot, but enable it later [1]. Before adding this feature
check, users were able to get turbo mode frequencies by writing 0 to
/sys/devices/system/cpu/intel_pstate/no_turbo post-boot.
To restore the old behavior on the affected systems while still
addressing the unchecked MSR issue on some Skylake-X systems, check
X86_FEATURE_IDA only immediately before updates of MSR_IA32_PERF_CTL
that may involve setting the Turbo Engage Bit (bit 32).
Fixes: ac4e04d9e3 ("cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode")
Reported-by: Aaron Rainbolt <arainbolt@kfocus.org>
Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2122531 [1]
Tested-by: Aaron Rainbolt <arainbolt@kfocus.org>
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
[ rjw: Subject adjustment, changelog edits ]
Link: https://patch.msgid.link/20251111010840.141490-1-srinivas.pandruvada@linux.intel.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 0fce758706 ]
per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online
CPU via acpi_soft_cpu_online() --> __acpi_processor_start() -->
acpi_cppc_processor_probe().
However the function cppc_perf_ctrs_in_pcc() checks if the CPPC
perf-ctrs are in a PCC region for all the present CPUs, which breaks
when the kernel is booted with "nosmt=force".
Hence, limit the check only to the online CPUs.
Fixes: ae2df912d1 ("ACPI: CPPC: Disable FIE if registers in PCC regions")
Reviewed-by: "Mario Limonciello (AMD) (kernel.org)" <superm1@kernel.org>
Signed-off-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
Link: https://patch.msgid.link/20251107074145.2340-5-gautham.shenoy@amd.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 8821c8e80a ]
per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online
CPUs via acpi_soft_cpu_online() --> __acpi_processor_start() -->
acpi_cppc_processor_probe().
However the function cppc_allow_fast_switch() checks for the validity
of the _CPC object for all the present CPUs. This breaks when the
kernel is booted with "nosmt=force".
Check fast_switch capability only on online CPUs
Fixes: 15eece6c5b ("ACPI: CPPC: Fix NULL pointer dereference when nosmp is used")
Reviewed-by: "Mario Limonciello (AMD) (kernel.org)" <superm1@kernel.org>
Signed-off-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
Link: https://patch.msgid.link/20251107074145.2340-4-gautham.shenoy@amd.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b2c26c82f7 ]
For HSRv0, the path_id has the following meaning:
- 0000: PRP supervision frame
- 0001-1001: HSR ring identifier
- 1010-1011: Frames from PRP network (A/B, with RedBoxes)
- 1111: HSR supervision frame
Follow the IEC 62439-3:2010 standard more closely by setting the right
path_id for HSRv0 supervision frames (actually, it is correctly set when
the frame is constructed, but hsr_set_path_id() overwrites it) and set a
fixed HSR ring identifier of 1. The ring identifier seems to be generally
unused and we ignore it anyways on reception, but some fixed identifier is
definitely better than using one identifier in one direction and a wrong
identifier in the other.
This was also the behavior before commit f266a683a4 ("net/hsr: Better
frame dispatch") which introduced the alternating path_id. This was later
moved to hsr_set_path_id() in commit 451d8123f8 ("net: prp: add packet
handling support").
The IEC 62439-3:2010 also contains 6 unused bytes after the MacAddressA in
the HSRv0 supervision frames. Adjust a TODO comment accordingly.
Fixes: f266a683a4 ("net/hsr: Better frame dispatch")
Fixes: 451d8123f8 ("net: prp: add packet handling support")
Signed-off-by: Felix Maurer <fmaurer@redhat.com>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://patch.msgid.link/ea0d5133cd593856b2fa673d6e2067bf1d4d1794.1762876095.git.fmaurer@redhat.com
Tested-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 0eff2eaa53 ]
The purpose of commit 703eec1b24 ("virtio_net: fixing XDP for fully
checksummed packets handling") is to record the flags in advance, as
their value may be overwritten in the XDP case. However, the flags
recorded under big mode are incorrect, because in big mode, the passed
buf does not point to the rx buffer, but rather to the page of the
submitted buffer. This commit fixes this issue.
For the small mode, the commit c11a49d58a ("virtio_net: Fix mismatched
buf address when unmapping for small packets") fixed it.
Tested-by: Alyssa Ross <hi@alyssa.is>
Fixes: 703eec1b24 ("virtio_net: fixing XDP for fully checksummed packets handling")
Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Link: https://patch.msgid.link/20251111090828.23186-1-xuanzhuo@linux.alibaba.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 1a222625b4 ]
One of the factors of a link's grade is the channel load, which is
calculated from the AP's bss load element.
The current code takes this element from the beacon for an active link,
and from bss->ies for an inactive link.
bss->ies is set to either the beacon's ies or to the probe response
ones, with preference to the probe response (meaning that if there was
even one probe response, the ies of it will be stored in bss->ies and
won't be overiden by the beacon ies).
The probe response can be very old, i.e. from the connection time,
where a beacon is updated before each link selection (which is
triggered only after a passive scan).
In such case, the bss load element in the probe response will not
include the channel load caused by the STA, where the beacon will.
This will cause the inactive link to always have a lower channel
load, and therefore an higher grade than the active link's one.
This causes repeated link switches, causing the throughput to drop.
Fix this by always taking the ies from the beacon, as those are for
sure new.
Fixes: d1e879ec60 ("wifi: iwlwifi: add iwlmld sub-driver")
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20251110145652.b493dbb1853a.I058ba7309c84159f640cc9682d1bda56dd56a536@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 0345552a65 ]
After commit 100dfa74cad9 ("inet: dev_queue_xmit() llist adoption")
I started seeing many qdisc requeues on IDPF under high TX workload.
$ tc -s qd sh dev eth1 handle 1: ; sleep 1; tc -s qd sh dev eth1 handle 1:
qdisc mq 1: root
Sent 43534617319319 bytes 268186451819 pkt (dropped 0, overlimits 0 requeues 3532840114)
backlog 1056Kb 6675p requeues 3532840114
qdisc mq 1: root
Sent 43554665866695 bytes 268309964788 pkt (dropped 0, overlimits 0 requeues 3537737653)
backlog 781164b 4822p requeues 3537737653
This is caused by try_bulk_dequeue_skb() being only limited by BQL budget.
perf record -C120-239 -e qdisc:qdisc_dequeue sleep 1 ; perf script
...
netperf 75332 [146] 2711.138269: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1292 skbaddr=0xff378005a1e9f200
netperf 75332 [146] 2711.138953: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1213 skbaddr=0xff378004d607a500
netperf 75330 [144] 2711.139631: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1233 skbaddr=0xff3780046be20100
netperf 75333 [147] 2711.140356: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1093 skbaddr=0xff37800514845b00
netperf 75337 [151] 2711.141037: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1353 skbaddr=0xff37800460753300
netperf 75337 [151] 2711.141877: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1367 skbaddr=0xff378004e72c7b00
netperf 75330 [144] 2711.142643: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1202 skbaddr=0xff3780045bd60000
...
This is bad because :
1) Large batches hold one victim cpu for a very long time.
2) Driver often hit their own TX ring limit (all slots are used).
3) We call dev_requeue_skb()
4) Requeues are using a FIFO (q->gso_skb), breaking qdisc ability to
implement FQ or priority scheduling.
5) dequeue_skb() gets packets from q->gso_skb one skb at a time
with no xmit_more support. This is causing many spinlock games
between the qdisc and the device driver.
Requeues were supposed to be very rare, lets keep them this way.
Limit batch sizes to /proc/sys/net/core/dev_weight (default 64) as
__qdisc_run() was designed to use.
Fixes: 5772e9a346 ("qdisc: bulk dequeue support for qdiscs with TCQ_F_ONETXQUEUE")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Acked-by: Jesper Dangaard Brouer <hawk@kernel.org>
Link: https://patch.msgid.link/20251109161215.2574081-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit e5eba42f01 ]
Currently, CQs without a completion function are assigned the
mlx5_add_cq_to_tasklet function by default. This is problematic since
only user CQs created through the mlx5_ib driver are intended to use
this function.
Additionally, all CQs that will use doorbells instead of polling for
completions must call mlx5_cq_arm. However, the default CQ creation flow
leaves a valid value in the CQ's arm_db field, allowing FW to send
interrupts to polling-only CQs in certain corner cases.
These two factors would allow a polling-only kernel CQ to be triggered
by an EQ interrupt and call a completion function intended only for user
CQs, causing a null pointer exception.
Some areas in the driver have prevented this issue with one-off fixes
but did not address the root cause.
This patch fixes the described issue by adding defaults to the create CQ
flow. It adds a default dummy completion function to protect against
null pointer exceptions, and it sets an invalid command sequence number
by default in kernel CQs to prevent the FW from sending an interrupt to
the CQ until it is armed. User CQs are responsible for their own
initialization values.
Callers of mlx5_core_create_cq are responsible for changing the
completion function and arming the CQ per their needs.
Fixes: cdd04f4d4d ("net/mlx5: Add support to create SQ and CQ for ASO")
Signed-off-by: Akiva Goldberger <agoldberger@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Acked-by: Leon Romanovsky <leon@kernel.org>
Link: https://patch.msgid.link/1762681743-1084694-1-git-send-email-tariqt@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit a315b723e8 ]
Completion queues (CQs) in mlx5 use the same global doorbell, which may
become contended when accessed concurrently from many cores.
This patch prepares the CQ management code for supporting different
doorbells per CQ. This will be used in downstream patches to allow
separate doorbells to be used by channels CQs.
The main change is moving the 'uar' pointer from struct mlx5_core_cq to
struct mlx5e_cq, as the uar page to be used is better off stored
directly there. Other users of mlx5_core_cq also store the UAR to be
used separately and therefore the pointer being removed is dead weight
for them. As evidence, in this patch there are two users which set the
mcq.uar pointer but didn't use it, Software Steering and old Innova CQ
creation code. Instead, they rang the doorbell directly from another
pointer.
The 'uar' pointer added to struct mlx5e_cq remains in a hot cacheline
(as before), because it may get accessed for each packet.
Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: e5eba42f01 ("mlx5: Fix default values in create CQ")
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit aa4595d0ad ]
The global doorbell is used for more than just Ethernet resources, so
move it out of mlx5e_hw_objs into a common place (mlx5_priv), to avoid
non-Ethernet modules (e.g. HWS, ASO) depending on Ethernet structs.
Use this opportunity to consolidate it with the 'uar' pointer already
there, which was used as an RX doorbell. Underneath the 'uar' pointer is
identical to 'bfreg->up', so store a single resource and use that
instead.
For CQ doorbells, care is taken to always use bfreg->up->index instead
of bfreg->index, which may refer to a subsequent UAR page from the same
ALLOC_UAR batch on some NICs.
This paves the way for cleanly supporting multiple doorbells in the
Ethernet driver.
Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: e5eba42f01 ("mlx5: Fix default values in create CQ")
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit a7bf4d5063 ]
The previous calculation used roundup() which caused an overflow for
rates between 25.5Gbps and 26Gbps.
For example, a rate of 25.6Gbps would result in using 100Mbps units with
value of 256, which would overflow the 8 bits field.
Simplify the upper_limit_mbps calculation by removing the
unnecessary roundup, and adjust the comparison to use <= to correctly
handle the boundary condition.
Fixes: d8880795da ("net/mlx5e: Implement DCBNL IEEE max rate")
Signed-off-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Nimrod Oren <noren@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1762681073-1084058-4-git-send-email-tariqt@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 485e0626e5 ]
This handles PA Sync Lost event which previously was assumed to be
handled with BIG Sync Lost but their lifetime are not the same thus why
there are 2 different events to inform when each sync is lost.
Fixes: b2a5f2e1c1 ("Bluetooth: hci_event: Add support for handling LE BIG Sync Lost event")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 60e6489f8e ]
Quang Le reported that the AF_UNIX GC could garbage-collect a
receive queue of an alive in-flight socket, with a nice repro.
The repro consists of three stages.
1)
1-a. Create a single cyclic reference with many sockets
1-b. close() all sockets
1-c. Trigger GC
2)
2-a. Pass sk-A to an embryo sk-B
2-b. Pass sk-X to sk-X
2-c. Trigger GC
3)
3-a. accept() the embryo sk-B
3-b. Pass sk-B to sk-C
3-c. close() the in-flight sk-A
3-d. Trigger GC
As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices,
and unix_walk_scc() groups them into two different SCCs:
unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START)
unix_sk(sk-X)->vertex->scc_index = 3
Once GC completes, unix_graph_grouped is set to true.
Also, unix_graph_maybe_cyclic is set to true due to sk-X's
cyclic self-reference, which makes close() trigger GC.
At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and
links it to unix_unvisited_vertices.
unix_update_graph() is called at 3-a. and 3-b., but neither
unix_graph_grouped nor unix_graph_maybe_cyclic is changed
because both sk-B's listener and sk-C are not in-flight.
3-c decrements sk-A's file refcnt to 1.
Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast()
is finally called and iterates 3 sockets sk-A, sk-B, and sk-X:
sk-A -> sk-B (-> sk-C)
sk-X -> sk-X
This is totally fine. All of them are not yet close()d and
should be grouped into different SCCs.
However, unix_vertex_dead() misjudges that sk-A and sk-B are
in the same SCC and sk-A is dead.
unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong!
&&
sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree
^-- 1 in-flight count for sk-B
-> sk-A is dead !?
The problem is that unix_add_edge() does not initialise scc_index.
Stage 1) is used for heap spraying, making a newly allocated
vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START)
set by unix_walk_scc() at 1-c.
Let's track the max SCC index from the previous unix_walk_scc()
call and assign the max + 1 to a new vertex's scc_index.
This way, we can continue to avoid Tarjan's algorithm while
preventing misjudgments.
Fixes: ad081928a8 ("af_unix: Avoid Tarjan's algorithm if unnecessary.")
Reported-by: Quang Le <quanglex97@gmail.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20251109025233.3659187-1-kuniyu@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit d4b00d132d ]
The am65_cpsw_iet_verify_wait() function attempts verification 20 times,
toggling the AM65_CPSW_PN_IET_MAC_LINKFAIL bit in each iteration. When
the LINKFAIL bit transitions from 1 to 0, the MAC merge layer initiates
the verification process and waits for the timeout configured in
MAC_VERIFY_CNT before automatically retransmitting. The MAC_VERIFY_CNT
register is configured according to the user-defined verify/response
timeout in am65_cpsw_iet_set_verify_timeout_count(). As per IEEE 802.3
Clause 99, the hardware performs this automatic retry up to 3 times.
Current implementation toggles LINKFAIL after the user-configured
verify/response timeout in each iteration, forcing the hardware to
restart verification instead of respecting the MAC_VERIFY_CNT timeout.
This bypasses the hardware's automatic retry mechanism.
Fix this by moving the LINKFAIL bit toggle outside the retry loop and
reducing the retry count from 20 to 3. The software now only monitors
the status register while the hardware autonomously handles the 3
verification attempts at proper MAC_VERIFY_CNT intervals.
Fixes: 49a2eb9068 ("net: ethernet: ti: am65-cpsw-qos: Add Frame Preemption MAC Merge support")
Signed-off-by: Aksh Garg <a-garg7@ti.com>
Link: https://patch.msgid.link/20251106092305.1437347-3-a-garg7@ti.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 49b3916465 ]
The CPSW module uses the MAC_VERIFY_CNT bit field in the
CPSW_PN_IET_VERIFY_REG_k register to set the verify/response timeout
count. This register specifies the number of clock cycles to wait before
resending a verify packet if the verification fails.
The verify/response timeout count, as being set by the function
am65_cpsw_iet_set_verify_timeout_count() is hardcoded for 125MHz
clock frequency, which varies based on PHY mode and link speed.
The respective clock frequencies are as follows:
- RGMII mode:
* 1000 Mbps: 125 MHz
* 100 Mbps: 25 MHz
* 10 Mbps: 2.5 MHz
- QSGMII/SGMII mode: 125 MHz (all speeds)
Fix this by adding logic to calculate the correct timeout counts
based on the actual PHY interface mode and link speed.
Fixes: 49a2eb9068 ("net: ethernet: ti: am65-cpsw-qos: Add Frame Preemption MAC Merge support")
Signed-off-by: Aksh Garg <a-garg7@ti.com>
Link: https://patch.msgid.link/20251106092305.1437347-2-a-garg7@ti.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 3072f00bba ]
In tls_handshake_accept(), a netlink message is allocated using
genlmsg_new(). In the error handling path, genlmsg_cancel() is called
to cancel the message construction, but the message itself is not freed.
This leads to a memory leak.
Fix this by calling nlmsg_free() in the error path after genlmsg_cancel()
to release the allocated memory.
Fixes: 2fd5532044 ("net/handshake: Add a kernel API for requesting a TLSv1.3 handshake")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
Link: https://patch.msgid.link/20251106144511.3859535-1-zilin@seu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit ec33f2e5a2 ]
The current CLC proposal message construction uses a mix of
`ini->smc_type_v1/v2` and `pclc_base->hdr.typev1/v2` to decide whether
to include optional extensions (IPv6 prefix extension for v1, and v2
extension). This leads to a critical inconsistency: when
`smc_clc_prfx_set()` fails - for example, in IPv6-only environments with
only link-local addresses, or when the local IP address and the outgoing
interface’s network address are not in the same subnet.
As a result, the proposal message is assembled using the stale
`ini->smc_type_v1` value—causing the IPv6 prefix extension to be
included even though the header indicates v1 is not supported.
The peer then receives a malformed CLC proposal where the header type
does not match the payload, and immediately resets the connection.
The fix ensures consistency between the CLC header flags and the actual
payload by synchronizing `ini->smc_type_v1` with `pclc_base->hdr.typev1`
when prefix setup fails.
Fixes: 8c3dca341a ("net/smc: build and send V2 CLC proposal")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Link: https://patch.msgid.link/20251107024029.88753-1-alibuda@linux.alibaba.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 762e7e174d ]
Broadcom switches locally terminate link local traffic and do not
forward it, so we should not mark it as offloaded.
In some situations we still want/need to flood this traffic, e.g. if STP
is disabled, or it is explicitly enabled via the group_fwd_mask. But if
the skb is marked as offloaded, the kernel will assume this was already
done in hardware, and the packets never reach other bridge ports.
So ensure that link local traffic is never marked as offloaded, so that
the kernel can forward/flood these packets in software if needed.
Since the local termination in not configurable, check the destination
MAC, and never mark packets as offloaded if it is a link local ether
address.
While modern switches set the tag reason code to BRCM_EG_RC_PROT_TERM
for trapped link local traffic, they also set it for link local traffic
that is flooded (01:80:c2:00:00:10 to 01:80:c2:00:00:2f), so we cannot
use it and need to look at the destination address for them as well.
Fixes: 964dbf186e ("net: dsa: tag_brcm: add support for legacy tags")
Fixes: 0e62f543be ("net: dsa: Fix duplicate frames flooded by learning")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251109134635.243951-1-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 1534ff7775 ]
syzbot reported a possible shift-out-of-bounds [1]
Blamed commit added rto_alpha_max and rto_beta_max set to 1000.
It is unclear if some sctp users are setting very large rto_alpha
and/or rto_beta.
In order to prevent user regression, perform the test at run time.
Also add READ_ONCE() annotations as sysctl values can change under us.
[1]
UBSAN: shift-out-of-bounds in net/sctp/transport.c:509:41
shift exponent 64 is too large for 32-bit type 'unsigned int'
CPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
ubsan_epilogue lib/ubsan.c:233 [inline]
__ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494
sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509
sctp_check_transmitted+0x11c4/0x1c30 net/sctp/outqueue.c:1502
sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338
sctp_cmd_process_sack net/sctp/sm_sideeffect.c:840 [inline]
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline]
Fixes: b58537a1f5 ("net: sctp: fix permissions for rto_alpha and rto_beta knobs")
Reported-by: syzbot+f8c46c8b2b7f6e076e99@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/690c81ae.050a0220.3d0d33.014e.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20251106111054.3288127-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 41bf23338a ]
Contrary to what was stated on d36349ea73 ("Bluetooth: hci_conn:
Fix running bis_cleanup for hci_conn->type PA_LINK") the PA_LINK does
in fact needs to run bis_cleanup in order to terminate the PA Sync,
since that is bond to the listening socket which is the entity that
controls the lifetime of PA Sync, so if it is closed/released the PA
Sync shall be terminated, terminating the PA Sync shall not result in
the BIG Sync being terminated since once the later is established it
doesn't depend on the former anymore.
If the use user wants to reconnect/rebind a number of BIS(s) it shall
keep the socket open until it no longer needs the PA Sync, which means
it retains full control of the lifetime of both PA and BIG Syncs.
Fixes: d36349ea73 ("Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK")
Fixes: a7bcffc673 ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 98454bc812 ]
disconnect_all_peers() calls sleeping function (l2cap_chan_close) under
spinlock. Holding the lock doesn't actually do any good -- we work on a
local copy of the list, and the lock doesn't protect against peer->chan
having already been freed.
Fix by taking refcounts of peer->chan instead. Clean up the code and
old comments a bit.
Take devices_lock instead of RCU, because the kfree_rcu();
l2cap_chan_put(); construct in chan_close_cb() does not guarantee
peer->chan is necessarily valid in RCU.
Also take l2cap_chan_lock() which is required for l2cap_chan_close().
Log: (bluez 6lowpan-tester Client Connect - Disable)
------
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:575
...
<TASK>
...
l2cap_send_disconn_req (net/bluetooth/l2cap_core.c:938 net/bluetooth/l2cap_core.c:1495)
...
? __pfx_l2cap_chan_close (net/bluetooth/l2cap_core.c:809)
do_enable_set (net/bluetooth/6lowpan.c:1048 net/bluetooth/6lowpan.c:1068)
------
Fixes: 9030582963 ("Bluetooth: 6lowpan: Converting rwlocks to use RCU")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b454505bf5 ]
Bluetooth 6lowpan.c confuses BDADDR_LE and ADDR_LE_DEV address types,
e.g. debugfs "connect" command takes the former, and "disconnect" and
"connect" to already connected device take the latter. This is due to
using same value both for l2cap_chan_connect and hci_conn_hash_lookup_le
which take different dst_type values.
Fix address type passed to hci_conn_hash_lookup_le().
Retain the debugfs API difference between "connect" and "disconnect"
commands since it's been like this since 2015 and nobody apparently
complained.
Fixes: f5ad4ffceb ("Bluetooth: 6lowpan: Use hci_conn_hash_lookup_le() when possible")
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 3b78f50918 ]
Bluetooth 6lowpan.c netdev has header_ops, so it must set link-local
header for RX skb, otherwise things crash, eg. with AF_PACKET SOCK_RAW
Add missing skb_reset_mac_header() for uncompressed ipv6 RX path.
For the compressed one, it is done in lowpan_header_decompress().
Log: (BlueZ 6lowpan-tester Client Recv Raw - Success)
------
kernel BUG at net/core/skbuff.c:212!
Call Trace:
<IRQ>
...
packet_rcv (net/packet/af_packet.c:2152)
...
<TASK>
__local_bh_enable_ip (kernel/softirq.c:407)
netif_rx (net/core/dev.c:5648)
chan_recv_cb (net/bluetooth/6lowpan.c:294 net/bluetooth/6lowpan.c:359)
------
Fixes: 18722c2470 ("Bluetooth: Enable 6LoWPAN support for BT LE devices")
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 55fb52ffdd ]
mesh_send_done timer is not canceled when hdev is removed, which causes
crash if the timer triggers after hdev is gone.
Cancel the timer when MGMT removes the hdev, like other MGMT timers.
Should fix the BUG: sporadically seen by BlueZ test bot
(in "Mesh - Send cancel - 1" test).
Log:
------
BUG: KASAN: slab-use-after-free in run_timer_softirq+0x76b/0x7d0
...
Freed by task 36:
kasan_save_stack+0x24/0x50
kasan_save_track+0x14/0x30
__kasan_save_free_info+0x3a/0x60
__kasan_slab_free+0x43/0x70
kfree+0x103/0x500
device_release+0x9a/0x210
kobject_put+0x100/0x1e0
vhci_release+0x18b/0x240
------
Fixes: b338d91703 ("Bluetooth: Implement support for Mesh")
Link: https://lore.kernel.org/linux-bluetooth/67364c09.0c0a0220.113cba.39ff@mx.google.com/
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit fe4b3a34e9 ]
It's used to work around an objtool issue since commit abb2a55722
("LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference"), but
it's then passed to bindgen and cause an error because Clang does not
have this option.
Fixes: abb2a55722 ("LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference")
Acked-by: Miguel Ojeda <ojeda@kernel.org>
Tested-by: Mingcong Bai <jeffbai@aosc.io>
Signed-off-by: Xi Ruoyao <xry111@xry111.site>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit a0de636ed7 ]
As the name suggests this function modifies the register in an
extended page. It has the same parameters as phy_modify_mmd.
This function was introduce because there are many places in the
code where the registers was read then the value was modified and
written back. So replace all this code with this function to make
it clear.
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
Link: https://patch.msgid.link/20250818075121.1298170-3-horatiu.vultur@microchip.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Stable-dep-of: 96a9178a29 ("net: phy: micrel: lan8814 fix reset of the QSGMII interface")
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 57531b3416 ]
It seems that most of the tests prepare the interfaces once before the test
run (setup_prepare()), rely on setup_wait() to wait for link and only then
run the test(s).
local_termination brings the physical interfaces down and up during test
run but never wait for them to come up. If the auto-negotiation takes
some seconds, first test packets are being lost, which leads to
false-negative test results.
Use setup_wait() in run_test() to make sure auto-negotiation has been
completed after all simple_if_init() calls on physical interfaces and test
packets will not be lost because of the race against link establishment.
Fixes: 90b9566aa5 ("selftests: forwarding: add a test for local_termination.sh")
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Link: https://patch.msgid.link/20251106161213.459501-1-alexander.sverdlin@siemens.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 9065b96875 ]
When reporting tx completion using ieee80211_tx_status_xxx() family of
functions, the status part of the struct ieee80211_tx_info nested in the
skb is used to report things like transmit rates & retry count to mac80211
On the TX data path, this is correctly memset to 0 before calling
ieee80211_tx_status_ext(), but on the tx mgmt path this was not done.
This leads to mac80211 treating garbage values as valid transmit counters
(like tx retries for example) and accounting them as real statistics that
makes their way to userland via station dump.
The same issue was resolved in ath12k by commit 9903c0986f ("wifi:
ath12k: Add memset and update default rate value in wmi tx completion")
Tested-on: QCN9074 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1
Fixes: d5c65159f2 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Nicolas Escande <nico.escande@gmail.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20251104083957.717825-1-nico.escande@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit ed80cc4667 ]
The Logitech G502 Hero Wireless's high resolution scrolling resets after
being unplugged without notifying the driver, causing extremely slow
scrolling.
The only indication of this is a battery update packet, so add a quirk to
detect when the device is unplugged and re-enable the scrolling.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=218037
Signed-off-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 437c23357d ]
There might be many reasons why a user is resizing a ring, e.g. moving
to huge pages or for some memory compaction using IORING_SETUP_NO_MMAP.
Don't bypass resizing, the user will definitely be surprised seeing 0
while the rings weren't actually moved to a new place.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 82ebecdc74 ]
We found an infinite loop bug in the exFAT file system that can lead to a
Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is
malformed, the following system calls — SYS_openat, SYS_ftruncate, and
SYS_pwrite64 — can cause the kernel to hang.
Root cause analysis shows that the size validation code in exfat_find()
does not check whether dentry.stream.valid_size is negative. As a result,
the system calls mentioned above can succeed and eventually trigger the DoS
issue.
This patch adds a check for negative dentry.stream.valid_size to prevent
this vulnerability.
Co-developed-by: Seunghun Han <kkamagui@gmail.com>
Signed-off-by: Seunghun Han <kkamagui@gmail.com>
Co-developed-by: Jihoon Kwon <jimmyxyz010315@gmail.com>
Signed-off-by: Jihoon Kwon <jimmyxyz010315@gmail.com>
Signed-off-by: Jaehun Gou <p22gone@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 1141ed5234 ]
This patch adds ALWAYS_POLL quirk for the VRS R295 steering wheel joystick.
This device reboots itself every 8-10 seconds if it is not polled.
Signed-off-by: Oleg Makarenko <oleg@makarenk.ooo>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 9ff022f382 ]
I noticed xfstests generic/193 and generic/355 started failing against
knfsd after commit e7a8ebc305 ("NFSD: Offer write delegation for OPEN
with OPEN4_SHARE_ACCESS_WRITE").
I ran those same tests against ONTAP (which has had write delegation
support for a lot longer than knfsd) and they fail there too... so
while it's a new failure against knfsd, it isn't an entirely new
failure.
Add the NFS_INO_REVAL_FORCED flag so that the presence of a delegation
doesn't keep the inode from being revalidated to fetch the updated mode.
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b73bc6a51f ]
Some third-party controllers, such as the PB Tails CHOC, won't always
respond quickly on startup. Since this packet is needed for probe, and only
once during probe, let's just wait an extra second, which makes connecting
consistent.
Signed-off-by: Vicki Pfau <vi@endrift.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 0be4253bf8 ]
The Cooler Master Mice Dongle includes a vendor defined HID interface
alongside its mouse interface. Not polling it will cause the mouse to
stop responding to polls on any interface once woken up again after
going into power saving mode.
Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and
the Dongle's PID.
Signed-off-by: Tristan Lobb <tristan.lobb@it-lobb.de>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 7a84394f02 ]
The setting of delay_retrans is applied to synchronous RPC operations
because the retransmit count is stored in same struct nfs4_exception
that is passed each time an error is checked. However, for asynchronous
operations (READ, WRITE, LOCKU, CLOSE, DELEGRETURN), a new struct
nfs4_exception is made on the stack each time the task callback is
invoked. This means that the retransmit count is always zero and thus
delay_retrans never takes effect.
Apply delay_retrans to these operations by tracking and updating their
retransmit count.
Change-Id: Ieb33e046c2b277cb979caa3faca7f52faf0568c9
Signed-off-by: Joshua Watt <jpewhacker@gmail.com>
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 9bb3baa9d1 ]
Since the last renewal time was initialized to 0 and jiffies start
counting at -5 minutes, any clients connected in the first 5 minutes
after a reboot would have their renewal timer set to a very long
interval. If the connection was idle, this would result in the client
state timing out on the server and the next call to the server would
return NFS4ERR_BADSESSION.
Fix this by initializing the last renewal time to the current jiffies
instead of 0.
Signed-off-by: Joshua Watt <jpewhacker@gmail.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 883f309add ]
Previously, APU platforms (and other scenarios with uninitialized VRAM managers)
triggered a NULL pointer dereference in `ttm_resource_manager_usage()`. The root
cause is not that the `struct ttm_resource_manager *man` pointer itself is NULL,
but that `man->bdev` (the backing device pointer within the manager) remains
uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully
set up VRAM manager structures. When `ttm_resource_manager_usage()` attempts to
acquire `man->bdev->lru_lock`, it dereferences the NULL `man->bdev`, leading to
a kernel OOPS.
1. **amdgpu_cs.c**: Extend the existing bandwidth control check in
`amdgpu_cs_get_threshold_for_moves()` to include a check for
`ttm_resource_manager_used()`. If the manager is not used (uninitialized
`bdev`), return 0 for migration thresholds immediately—skipping VRAM-specific
logic that would trigger the NULL dereference.
2. **amdgpu_kms.c**: Update the `AMDGPU_INFO_VRAM_USAGE` ioctl and memory info
reporting to use a conditional: if the manager is used, return the real VRAM
usage; otherwise, return 0. This avoids accessing `man->bdev` when it is
NULL.
3. **amdgpu_virt.c**: Modify the vf2pf (virtual function to physical function)
data write path. Use `ttm_resource_manager_used()` to check validity: if the
manager is usable, calculate `fb_usage` from VRAM usage; otherwise, set
`fb_usage` to 0 (APUs have no discrete framebuffer to report).
This approach is more robust than APU-specific checks because it:
- Works for all scenarios where the VRAM manager is uninitialized (not just APUs),
- Aligns with TTM's design by using its native helper function,
- Preserves correct behavior for discrete GPUs (which have fully initialized
`man->bdev` and pass the `ttm_resource_manager_used()` check).
v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian)
Reviewed-by: Christian König <christian.koenig@amd.com>
Suggested-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit ee70bacef1 ]
The interrupt handler offloads the microphone detection logic to
nau8821_jdet_work(), which implies a sleep operation. However, before
being able to process any subsequent hotplug event, the interrupt
handler needs to wait for any prior scheduled work to complete.
Move the sleep out of jdet_work by converting it to a delayed work.
This eliminates the undesired blocking in the interrupt handler when
attempting to cancel a recently scheduled work item and should help
reducing transient input reports that might confuse user-space.
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-5-f7b0e2543f09@collabora.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit d90ad28e8a ]
These syscalls call to vfs_fileattr_get/set functions which return
ENOIOCTLCMD if filesystem doesn't support setting file attribute on an
inode. For syscalls EOPNOTSUPP would be more appropriate return error.
Signed-off-by: Andrey Albershteyn <aalbersh@kernel.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 69a8b62a7a ]
Similar to the ARM64 commit 3505f30fb6a9s ("ARM64 / ACPI: If we chose
to boot from acpi then disable FDT"), let's not do DT hardware probing
if ACPI is enabled in early boot. This avoids errors caused by
repeated driver probing.
Signed-off-by: Han Gao <rabenda.cn@gmail.com>
Link: https://lore.kernel.org/r/20250910112401.552987-1-rabenda.cn@gmail.com
[pjw@kernel.org: cleaned up patch description and subject]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit ae9e9f3d67 ]
openSBI v1.7 adds harts checks for ipi operations. Especially it
adds comparison between hmask passed as an argument from linux
and mask of online harts (from openSBI side). If they don't
fit each other the error occurs.
When cpu is offline, cpu_online_mask is explicitly cleared in
__cpu_disable. However, there is no explicit clearing of
mm_cpumask. mm_cpumask is used for rfence operations that
call openSBI RFENCE extension which uses ipi to remote harts.
If hart is offline there may be error if mask of linux is not
as mask of online harts in openSBI.
this patch adds explicit clearing of mm_cpumask for offline hart.
Signed-off-by: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru
[pjw@kernel.org: rewrote subject line for clarity]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 9818af18db ]
Per Nathan, clang catches unused "static inline" functions in C files
since commit 6863f5643d ("kbuild: allow Clang to find unused static
inline functions for W=1 build").
Linus said:
> So I entirely ignore W=1 issues, because I think so many of the extra
> warnings are bogus.
>
> But if this one in particular is causing more problems than most -
> some teams do seem to use W=1 as part of their test builds - it's fine
> to send me a patch that just moves bad warnings to W=2.
>
> And if anybody uses W=2 for their test builds, that's THEIR problem..
Here is the change to bump the warning from W=1 to W=2.
Fixes: 6863f5643d ("kbuild: allow Clang to find unused static inline functions for W=1 build")
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com
[nathan: Adjust comment as well]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 0ec364c0c9 ]
Since commit a166563e7e ("arm64: mm: support large block mapping when
rodata=full"), __change_memory_common has more chance to fail due to
memory allocation failure when splitting page table. So check the return
value of set_memory_rox(), then bail out if it fails otherwise we may have
RW memory mapping for kprobes insn page.
Fixes: 195a1b7d83 ("arm64: kprobes: call set_memory_rox() for kprobe page")
Reviewed-by: Ryan Roberts <ryan.roberts@arm.com>
Reviewed-by: Dev Jain <dev.jain@arm.com>
Signed-off-by: Yang Shi <yang@os.amperecomputing.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 7bdd91abf0 ]
Enabling ASPM causes randoms hangs on Tahiti and Oland on Zen4.
It's unclear if this is a platform-specific or GPU-specific issue.
Disable ASPM on SI for the time being.
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 5c05bcf6ae ]
On various SI GPUs, a flickering can be observed near the bottom
edge of the screen when using a single 4K 60Hz monitor over DP.
Disabling MCLK switching works around this problem.
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 9d73b107a6 ]
This commit is necessary for DC to function well with chips
that use the legacy power management code, ie. SI and KV.
Communicate display information from DC to the legacy PM code.
Currently DC uses pm_display_cfg to communicate power management
requirements from the display code to the DPM code.
However, the legacy (non-DC) code path used different fields
and therefore could not take into account anything from DC.
Change the legacy display code to fill the same pm_display_cfg
struct as DC and use the same in the legacy DPM code.
To ease review and reduce churn, this commit does not yet
delete the now unneeded code, that is done in the next commit.
v2:
Rebase.
Fix single_display in amdgpu_dpm_pick_power_state.
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b515dcb0dc ]
This commit adds the pixel_clock field to the display config
struct so that power management (DPM) can use it.
We currently don't have a proper bandwidth calculation on old
GPUs with DCE 6-10 because dce_calcs only supports DCE 11+.
So the power management (DPM) on these GPUs may need to make
ad-hoc decisions for display based on the pixel clock.
Also rename sym_clock to pixel_clock in dm_pp_single_disp_config
to avoid confusion with other code where the sym_clock refers to
the DisplayPort symbol clock.
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b09cb2996c ]
commit c760bcda83 ("drm/amd: Check whether secure display TA loaded
successfully") attempted to fix extra messages, but failed to port the
cleanup that was in commit 5c6d52ff4b ("drm/amd: Don't try to enable
secure display TA multiple times") to prevent multiple tries.
Add that to the failure handling path even on a quick failure.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4679
Fixes: c760bcda83 ("drm/amd: Check whether secure display TA loaded successfully")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 4104c0a454f6a4d1e0d14895d03c0e7bdd0c8240)
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 4cb5ac2626 ]
Shrikanth noted that the per-cpu reference counter was still some 10%
slower than the old immutable option (which removes the reference
counting entirely).
Further optimize the per-cpu reference counter by:
- switching from RCU to preempt;
- using __this_cpu_*() since we now have preempt disabled;
- switching from smp_load_acquire() to READ_ONCE().
This is all safe because disabling preemption inhibits the RCU grace
period exactly like rcu_read_lock().
Having preemption disabled allows using __this_cpu_*() provided the
only access to the variable is in task context -- which is the case
here.
Furthermore, since we know changing fph->state to FR_ATOMIC demands a
full RCU grace period we can rely on the implied smp_mb() from that to
replace the acquire barrier().
This is very similar to the percpu_down_read_internal() fast-path.
The reason this is significant for PowerPC is that it uses the generic
this_cpu_*() implementation which relies on local_irq_disable() (the
x86 implementation relies on it being a single memop instruction to be
IRQ-safe). Switching to preempt_disable() and __this_cpu*() avoids
this IRQ state swizzling. Also, PowerPC needs LWSYNC for the ACQUIRE
barrier, not having to use explicit barriers safes a bunch.
Combined this reduces the performance gap by half, down to some 5%.
Fixes: 760e6f7bef ("futex: Remove support for IMMUTABLE")
Reported-by: Shrikanth Hegde <sshegde@linux.ibm.com>
Tested-by: Shrikanth Hegde <sshegde@linux.ibm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://patch.msgid.link/20251106092929.GR4067720@noisy.programming.kicks-ass.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b540de9e3b ]
Fix refcount leak in `smb2_set_path_attr` when path conversion fails.
Function `cifs_get_writable_path` returns `cfile` with its reference
counter `cfile->count` increased on success. Function `smb2_compound_op`
would decrease the reference counter for `cfile`, as stated in its
comment. By calling `smb2_rename_path`, the reference counter of `cfile`
would leak if `cifs_convert_path_to_utf16` fails in `smb2_set_path_attr`.
Fixes: 8de9e86c67 ("cifs: create a helper to find a writeable handle by path name")
Acked-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Shuhao Fu <sfual@cse.ust.hk>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 3362692fea ]
commit 978fa2f6d0 ("drm/amd/display: Use scaling for non-native
resolutions on eDP") started using the GPU scaler hardware to scale
when a non-native resolution was picked on eDP. This scaling was done
to fill the screen instead of maintain aspect ratio.
The idea was supposed to be that if a different scaling behavior is
preferred then the compositor would request it. The not following
aspect ratio behavior however isn't desirable, so adjust it to follow
aspect ratio and still try to fill screen.
Note: This will lead to black bars in some cases for non-native
resolutions. Compositors can request the previous behavior if desired.
Fixes: 978fa2f6d0 ("drm/amd/display: Use scaling for non-native resolutions on eDP")
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4538
Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 825df7ff4bb1a383ad4827545e09aec60d230770)
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 90b75e12a6 ]
These were not set so soft recovery was inadvertantly
disabled.
Fixes: 6ac55eab4f ("drm/amdgpu: move reset support type checks into the caller")
Reviewed-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1972763505d728c604b537180727ec8132e619df)
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 7d44ad6b43 ]
When tick values are large, the multiplication by NSEC_PER_SEC is larger
than 64 bits and results in bad conversions.
The issue is seen in PMU busyness counters that look like they have
wrapped around due to bad conversion. i915 PMU implementation returns
monotonically increasing counters. If a count is lesser than previous
one, it will only return the larger value until the smaller value
catches up. The user will see this as zero delta between two
measurements even though the engines are busy.
Fix it by using mul_u64_u32_div()
Fixes: 77cdd054dd ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu")
Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14955
Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Link: https://lore.kernel.org/r/20251016000350.1152382-2-umesh.nerlige.ramappa@intel.com
(cherry picked from commit 2ada9cb1df3f5405a01d013b708b1b0914efccfe)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
[Rodrigo: Added the Fixes tag while cherry-picking to fixes]
Signed-off-by: Sasha Levin <sashal@kernel.org>
description:Create a report to help us fix your issue
body:
- type:markdown
attributes:
value:|
**Is this the right place for my bug report?**
This repository contains the Linux kernel used on the Raspberry Pi.
If you believe that the issue you are seeing is kernel-related, this is the right place.
If not, we have other repositories for the GPU firmware at [github.com/raspberrypi/firmware](https://github.com/raspberrypi/firmware) and Raspberry Pi userland applications at [github.com/raspberrypi/userland](https://github.com/raspberrypi/userland).
If you have problems with the Raspbian distribution packages, report them in the [github.com/RPi-Distro/repo](https://github.com/RPi-Distro/repo).
If you simply have a question, then [the Raspberry Pi forums](https://www.raspberrypi.org/forums) are the best place to ask it.
- type:textarea
id:description
attributes:
label:Describe the bug
description:|
Add a clear and concise description of what you think the bug is.
validations:
required:true
- type:textarea
id:reproduce
attributes:
label:Steps to reproduce the behaviour
description:|
List the steps required to reproduce the issue.
validations:
required:true
- type:dropdown
id:model
attributes:
label:Device (s)
description:Onwhich device you are facing the bug?
multiple:true
options:
- Raspberry Pi Zero
- Raspberry Pi Zero W/WH
- Raspberry Pi Zero 2 W
- Raspberry Pi 1 Mod. A
- Raspberry Pi 1 Mod. A+
- Raspberry Pi 1 Mod. B
- Raspberry Pi 1 Mod. B+
- Raspberry Pi 2 Mod. B
- Raspberry Pi 2 Mod. B v1.2
- Raspberry Pi 3 Mod. A+
- Raspberry Pi 3 Mod. B
- Raspberry Pi 3 Mod. B+
- Raspberry Pi 4 Mod. B
- Raspberry Pi 400
- Raspberry Pi 5
- Raspberry Pi 500
- Raspberry Pi 500+
- Raspberry Pi CM0
- Raspberry Pi CM1
- Raspberry Pi CM3
- Raspberry Pi CM3 Lite
- Raspberry Pi CM3+
- Raspberry Pi CM3+ Lite
- Raspberry Pi CM4
- Raspberry Pi CM4 Lite
- Raspberry Pi CM5
- Raspberry Pi CM5 Lite
- Other
validations:
required:true
- type:textarea
id:system
attributes:
label:System
description:|
Copy and paste the URL returned from `raspinfo | pastebinit` into this section.
Alternatively, add answers to the following questions:
* Which OS and version (`cat /etc/rpi-issue`)?
* Which firmware version (`vcgencmd version`)?
* Which kernel version (`uname -a`)?
validations:
required:true
- type:textarea
id:logs
attributes:
label:Logs
description:|
If applicable, add the relevant output from `dmesg` or similar.
about:"Please do not use GitHub for asking questions. If you simply have a question, then the Raspberry Pi forums are the best place to ask it. Thanks in advance for helping us keep the issue tracker clean!"
- name:"⛔ Problems with Raspberry Pi OS packages"
url:https://github.com/RPi-Distro/repo
about:"If you have problems with a Raspberry Pi OS package, please report them at https://github.com/RPi-Distro/repo."
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
