[PATCH v4 0/6] ARM: dts: qcom: msm8960: expressatt: Add more peripherals

[PATCH v4 0/6] ARM: dts: qcom: msm8960: expressatt: Add more peripherals

[Rudraksha Gupta via B4 Relay]

Intro:
=================
The following is now working on the Samsung Galaxy Express SGH-I437, an
old 2012 Android phone:
- Light Sensor
    - Proximity is currently floating, even though it matches downstream
      GPIO pin
- Magnetometer
    - Regardless of orientation:
        - X axis seems to always be negative
        - Y and Z axis seems to always be positive
- NFC
- Accelerometer

Tests:
=================
Light Sensor
=================
// no external light on sensor
samsung-expressatt:~$ doas monitor-sensor --light
doas (user@samsung-expressatt) password: 
    Waiting for iio-sensor-proxy to appear
+++ iio-sensor-proxy appeared
=== Has ambient light sensor (value: 0.000000, unit: lux)
    Light changed: 7.000000 (lux)

// external light shining on sensor
samsung-expressatt:~$ doas monitor-sensor --light
doas (user@samsung-expressatt) password: 
    Waiting for iio-sensor-proxy to appear
+++ iio-sensor-proxy appeared
=== Has ambient light sensor (value: 0.000000, unit: lux)
    Light changed: 318.000000 (lux)
    Light changed: 390.000000 (lux)
    Light changed: 421.000000 (lux)

=================
NFC
=================
samsung-expressatt:~$ sudo nfctool -d nfc0 -1 -p
doas (user@samsung-expressatt) password: 
nfc0:
          Tags: [ ]
          Devices: [ ]
          Protocols: [ Felica MIFARE Jewel ISO-DEP NFC-DEP ]
          Powered: Yes
          RF Mode: None
          lto: 150
          rw: 15
          miux: 2047

Start polling on nfc0 as initiator

Targets found for nfc0
  Tags: [ tag0 ]
  Devices: [ ]

=================
Magnetometer
=================
// no matter the orientation x is always negative and y and z are always
// positive. The values seem to be changing during rotation, but for some
// reason the magnitude is extremely large
/sys/bus/iio/devices/iio:device1 # cat in_magn_x_raw && cat \
in_magn_y_raw && cat in_magn_z_raw
-441672
1223706
3275580

=================
Accelerometer
=================
// Rotating the device with `monitor-sensor --accel` running yields the
// correct output:
https://gitlab.freedesktop.org/hadess/iio-sensor-proxy

More Information:
=================
- Device page:
https://wiki.postmarketos.org/wiki/Samsung_Galaxy_Express_SGH-I437_(samsung-expressatt)
- Downstream kernel (uses board files):
https://github.com/LineageOS/android_kernel_samsung_d2/blob/stable/cm-12.0-YNG4N/arch/arm/mach-msm/board-express.c

Note: These patches were assisted with AI (specifically Claude) as it
was easily able to translate the old board file into a DTS format that
mainline understands.

Signed-off-by: Rudraksha Gupta <guptarud@gmail.com>
---
Changes in v4:
- corrected accelerometer's mount matrix
- fix a nullptr issue in the accelerometer's driver code
- Link to v3: https://lore.kernel.org/r/20251122-expressatt_nfc_accel_magn_light-v3-0-78d198632360@gmail.com

Changes in v3:
- More formatting changes
- Remove output-low on nfc_enable
- Resolved TODO mount matrix for accelerometer. My tests are above.
- Will try to eventually solve the following problems:
    - Couldn't figure out the mount matrix for magnetometer
    - Proximity is a floating value even though the downstream kernel
      matches the GPIO pin
- Link to v2: https://lore.kernel.org/r/20251121-expressatt_nfc_accel_magn_light-v2-0-54ce493cc6cf@gmail.com

Changes in v2:
- Fixed formatting issues
- Use GSBI instead of i2c-gpio
- Remove regulator-always-on
- Link to v1: https://lore.kernel.org/r/20251119-expressatt_nfc_accel_magn_light-v1-0-636f16f05cf4@gmail.com

---
Rudraksha Gupta (6):
      ARM: dts: qcom: msm8960: Add GSBI2 & GSBI7
      ARM: dts: qcom: msm8960: expressatt: Add Light/Proximity Sensor
      ARM: dts: qcom: msm8960: expressatt: Add NFC
      ARM: dts: qcom: msm8960: expressatt: Add Magnetometer
      iio: accel: Prevent NULL pointer dereference in interrupt setup
      ARM: dts: qcom: msm8960: expressatt: Add Accelerometer

 .../dts/qcom/qcom-msm8960-samsung-expressatt.dts   | 109 +++++++++++++++++++++
 arch/arm/boot/dts/qcom/qcom-msm8960.dtsi           |  96 ++++++++++++++++++
 drivers/iio/accel/bmc150-accel-core.c              |   3 +
 3 files changed, 208 insertions(+)
---
base-commit: a771210bab42017434c91411e16694ac4fd7afc2
change-id: 20251119-expressatt_nfc_accel_magn_light-f78e02897186
prerequisite-message-id: <176210698639.937813.643585209118839199.b4-ty@kernel.org>
prerequisite-patch-id: befdfe1948c2fbfb867597a6de917c8067fd57be
prerequisite-patch-id: 70a2b0837b9846d8a775f464295da73ca8ff26b4
prerequisite-patch-id: 20e005aa4312c3525e1b90f33a398189b9e2b3b7
prerequisite-patch-id: 970e0eb8af1736e4565fc37830576a67bf7b3227
prerequisite-patch-id: babd3b55d9ff28f19dbc3f7978742c58ef436aee

Best regards,
-- 
Rudraksha Gupta <guptarud@gmail.com>

[PATCH v4 1/6] ARM: dts: qcom: msm8960: Add GSBI2 & GSBI7

[Rudraksha Gupta via B4 Relay]

From: Rudraksha Gupta <guptarud@gmail.com>

Add the GSBI2 & GSBI7 Node, which is similar to the
other GSBI nodes in this file.

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Rudraksha Gupta <guptarud@gmail.com>
---
 arch/arm/boot/dts/qcom/qcom-msm8960.dtsi | 96 ++++++++++++++++++++++++++++++++
 1 file changed, 96 insertions(+)

diff --git a/arch/arm/boot/dts/qcom/qcom-msm8960.dtsi b/arch/arm/boot/dts/qcom/qcom-msm8960.dtsi
index 38bd4fd8dda5..fd28401cebb5 100644
--- a/arch/arm/boot/dts/qcom/qcom-msm8960.dtsi
+++ b/arch/arm/boot/dts/qcom/qcom-msm8960.dtsi
@@ -149,6 +149,24 @@ i2c1-pins {
 				};
 			};
 
+			i2c2_default_state: i2c2-default-state {
+				i2c2-pins {
+					pins = "gpio12", "gpio13";
+					function = "gsbi2";
+					drive-strength = <8>;
+					bias-disable;
+				};
+			};
+
+			i2c2_sleep_state: i2c2-sleep-state {
+				i2c2-pins {
+					pins = "gpio12", "gpio13";
+					function = "gpio";
+					drive-strength = <2>;
+					bias-bus-hold;
+				};
+			};
+
 			i2c3_default_state: i2c3-default-state {
 				i2c3-pins {
 					pins = "gpio16", "gpio17";
@@ -167,6 +185,24 @@ i2c3-pins {
 				};
 			};
 
+			i2c7_default_state: i2c7-default-state {
+				i2c7-pins {
+					pins = "gpio32", "gpio33";
+					function = "gsbi7";
+					drive-strength = <8>;
+					bias-disable;
+				};
+			};
+
+			i2c7_sleep_state: i2c7-sleep-state {
+				i2c7-pins {
+					pins = "gpio32", "gpio33";
+					function = "gpio";
+					drive-strength = <2>;
+					bias-bus-hold;
+				};
+			};
+
 			i2c8_default_state: i2c8-default-state {
 				i2c8-pins {
 					pins = "gpio36", "gpio37";
@@ -543,6 +579,36 @@ gsbi1_spi: spi@16080000 {
 			};
 		};
 
+		gsbi2: gsbi@16100000 {
+			compatible = "qcom,gsbi-v1.0.0";
+			reg = <0x16100000 0x100>;
+			ranges;
+			cell-index = <2>;
+			clocks = <&gcc GSBI2_H_CLK>;
+			clock-names = "iface";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			status = "disabled";
+
+			gsbi2_i2c: i2c@16180000 {
+				compatible = "qcom,i2c-qup-v1.1.1";
+				reg = <0x16180000 0x1000>;
+				pinctrl-0 = <&i2c2_default_state>;
+				pinctrl-1 = <&i2c2_sleep_state>;
+				pinctrl-names = "default", "sleep";
+				interrupts = <GIC_SPI 149 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GSBI2_QUP_CLK>,
+					 <&gcc GSBI2_H_CLK>;
+				clock-names = "core",
+					      "iface";
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				status = "disabled";
+			};
+		};
+
 		gsbi3: gsbi@16200000 {
 			compatible = "qcom,gsbi-v1.0.0";
 			reg = <0x16200000 0x100>;
@@ -600,6 +666,36 @@ gsbi5_serial: serial@16440000 {
 			};
 		};
 
+		gsbi7: gsbi@16600000 {
+			compatible = "qcom,gsbi-v1.0.0";
+			reg = <0x16600000 0x100>;
+			ranges;
+			cell-index = <7>;
+			clocks = <&gcc GSBI7_H_CLK>;
+			clock-names = "iface";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			status = "disabled";
+
+			gsbi7_i2c: i2c@16680000 {
+				compatible = "qcom,i2c-qup-v1.1.1";
+				reg = <0x16680000 0x1000>;
+				pinctrl-0 = <&i2c7_default_state>;
+				pinctrl-1 = <&i2c7_sleep_state>;
+				pinctrl-names = "default", "sleep";
+				interrupts = <GIC_SPI 159 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GSBI7_QUP_CLK>,
+					 <&gcc GSBI7_H_CLK>;
+				clock-names = "core",
+					      "iface";
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				status = "disabled";
+			};
+		};
+
 		gsbi8: gsbi@1a000000 {
 			compatible = "qcom,gsbi-v1.0.0";
 			reg = <0x1a000000 0x100>;

-- 
2.52.0

[PATCH v4 2/6] ARM: dts: qcom: msm8960: expressatt: Add Light/Proximity Sensor

[Rudraksha Gupta via B4 Relay]

From: Rudraksha Gupta <guptarud@gmail.com>

Currently the Proximity Sensor doesn't work, but light sensor does.
Left the proximity sensor as a TODO for later.

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Rudraksha Gupta <guptarud@gmail.com>
---
 .../dts/qcom/qcom-msm8960-samsung-expressatt.dts   | 34 ++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts b/arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts
index 5ee919dce75b..8d75ebd7976c 100644
--- a/arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts
+++ b/arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts
@@ -54,6 +54,31 @@ key-volume-down {
 	};
 };
 
+&gsbi2 {
+	qcom,mode = <GSBI_PROT_I2C>;
+
+	status = "okay";
+};
+
+&gsbi2_i2c {
+	status = "okay";
+
+	light-sensor@39 {
+		compatible = "amstaos,tmd2772";
+		reg = <0x39>;
+		interrupts-extended = <&pm8921_gpio 6 IRQ_TYPE_EDGE_FALLING>;
+		vdd-supply = <&pm8921_l9>;
+		vddio-supply = <&pm8921_lvs4>;
+
+		/* TODO: Proximity doesn't work */
+		amstaos,proximity-diodes = <0>;
+		led-max-microamp = <100000>;
+
+		pinctrl-0 = <&prox_sensor_int>;
+		pinctrl-names = "default";
+	};
+};
+
 &gsbi5 {
 	qcom,mode = <GSBI_PROT_I2C_UART>;
 	status = "okay";
@@ -163,6 +188,15 @@ &pm8921 {
 	interrupts-extended = <&tlmm 104 IRQ_TYPE_LEVEL_LOW>;
 };
 
+&pm8921_gpio {
+	prox_sensor_int: prox-sensor-int-state {
+		pins = "gpio6";
+		function = "normal";
+		input-enable;
+		bias-disable;
+	};
+};
+
 &rpm {
 	regulators {
 		compatible = "qcom,rpm-pm8921-regulators";

-- 
2.52.0

[PATCH v4 3/6] ARM: dts: qcom: msm8960: expressatt: Add NFC

[Rudraksha Gupta via B4 Relay]

From: Rudraksha Gupta <guptarud@gmail.com>

Add pn544 NFC chip

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Rudraksha Gupta <guptarud@gmail.com>
---
 .../dts/qcom/qcom-msm8960-samsung-expressatt.dts   | 45 ++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts b/arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts
index 8d75ebd7976c..4f9b59db7bc3 100644
--- a/arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts
+++ b/arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts
@@ -182,6 +182,22 @@ touchscreen: touchscreen-int-state {
 		bias-disable;
 		drive-strength = <2>;
 	};
+
+	nfc_default: nfc-default-state {
+		irq-pins {
+			pins = "gpio106";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+
+		firmware-pins {
+			pins = "gpio92";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-disable;
+		};
+	};
 };
 
 &pm8921 {
@@ -195,6 +211,14 @@ prox_sensor_int: prox-sensor-int-state {
 		input-enable;
 		bias-disable;
 	};
+
+	nfc_enable: nfc-enable-state {
+		pins = "gpio21";
+		function = "normal";
+		bias-disable;
+		qcom,drive-strength = <PMIC_GPIO_STRENGTH_LOW>;
+		power-source = <PM8921_GPIO_S4>;
+	};
 };
 
 &rpm {
@@ -442,3 +466,24 @@ &usb1 {
 	dr_mode = "otg";
 	status = "okay";
 };
+
+&gsbi7 {
+	qcom,mode = <GSBI_PROT_I2C>;
+
+	status = "okay";
+};
+
+&gsbi7_i2c {
+	status = "okay";
+
+	nfc@2b {
+		compatible = "nxp,pn544-i2c";
+		reg = <0x2b>;
+		interrupts-extended = <&tlmm 106 IRQ_TYPE_EDGE_RISING>;
+		enable-gpios = <&pm8921_gpio 21 GPIO_ACTIVE_HIGH>;
+		firmware-gpios = <&tlmm 92 GPIO_ACTIVE_HIGH>;
+
+		pinctrl-0 = <&nfc_default &nfc_enable>;
+		pinctrl-names = "default";
+	};
+};

-- 
2.52.0

[PATCH v4 4/6] ARM: dts: qcom: msm8960: expressatt: Add Magnetometer

[Rudraksha Gupta via B4 Relay]

From: Rudraksha Gupta <guptarud@gmail.com>

Add the Yamaha magnetometer. Mount Matrix is left as a TODO.

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Rudraksha Gupta <guptarud@gmail.com>
---
 .../boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts b/arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts
index 4f9b59db7bc3..d32461fc58e9 100644
--- a/arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts
+++ b/arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts
@@ -487,3 +487,22 @@ nfc@2b {
 		pinctrl-names = "default";
 	};
 };
+
+&gsbi12 {
+	qcom,mode = <GSBI_PROT_I2C>;
+
+	status = "okay";
+};
+
+&gsbi12_i2c {
+	status = "okay";
+
+	magnetometer@2e {
+		compatible = "yamaha,yas532";
+		reg = <0x2e>;
+		vdd-supply = <&pm8921_l9>;
+		iovdd-supply = <&pm8921_lvs4>;
+
+		/* TODO: Figure out Mount Matrix */
+	};
+};

-- 
2.52.0

[PATCH v4 5/6] iio: accel: Prevent NULL pointer dereference in interrupt setup

[Rudraksha Gupta via B4 Relay]

From: Rudraksha Gupta <guptarud@gmail.com>

The bmc150_accel_set_interrupt() function assumes that the interrupt
info is provided. However, when no IRQ is provided, the info pointer
remains NULL, leading to a kernel oops:

	[   95.444148] 8<--- cut here ---
	[   95.444202] Unable to handle kernel NULL pointer dereference at virtual address 00000001 when read
	[   95.451504] [00000001] *pgd=00000000
	[   95.459997] Internal error: Oops: 5 [#1] SMP ARM
	[   95.460059] Modules linked in: nf_tables atmel_mxt_ts pn544_i2c crc_ccitt pn544 hci nfc rfkill tsl2772 qcom_rng zram zsmalloc fuse loop nfnetlink ext4 jbd2 dm_mod
	[   95.463738] CPU: 0 UID: 0 PID: 568 Comm: iio-sensor-prox Not tainted 6.18.0-rc6-00107-g56ee44ac80c9 #2 PREEMPT
	[   95.478046] Hardware name: Generic DT based system
	[   95.488019] PC is at bmc150_accel_set_interrupt+0x98/0x194
	[   95.492879] LR is at __pm_runtime_resume+0x5c/0x64
	[   95.498345] pc : [<c0bbadb4>]    lr : [<c0902474>]    psr: 60000013
	[   95.503124] sp : f09dddc0  ip : 00240024  fp : c1febb58
	[   95.509284] r10: c1e0b270  r9 : 00000100  r8 : c104f4f4
	[   95.514492] r7 : c35b6420  r6 : 00000000  r5 : 00000001  r4 : c1e0b380
	[   95.519704] r3 : 00250024  r2 : 00000025  r1 : 00000000  r0 : 00000000
	[   95.526298] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
	[   95.532812] Control: 10c5787d  Table: 8447006a  DAC: 00000051
	[   95.540011] Register r0 information: NULL pointer
	[   95.545743] Register r1 information: NULL pointer
	[   95.550427] Register r2 information: non-paged memory
	[   95.555115] Register r3 information: non-paged memory
	[   95.560152] Register r4 information: slab kmalloc-2k start c1e0b000 pointer offset 896 size 2048
	[   95.565195] Register r5 information: non-paged memory
	[   95.574038] Register r6 information: NULL pointer
	[   95.578989] Register r7 information: slab kmalloc-1k start c35b6400 pointer offset 32 size 1024
	[   95.583680] Register r8 information: non-slab/vmalloc memory
	[   95.592183] Register r9 information: non-paged memory
	[   95.598083] Register r10 information: slab kmalloc-2k start c1e0b000 pointer offset 624 size 2048
	[   95.603039] Register r11 information: slab kmalloc-192 start c1febb40 pointer offset 24 size 192
	[   95.611896] Register r12 information: non-paged memory
	[   95.620743] Process iio-sensor-prox (pid: 568, stack limit = 0x91dd47d2)
	[   95.625692] Stack: (0xf09dddc0 to 0xf09de000)
	[   95.632558] ddc0: 60000013 c104f4f4 00000100 c1e0b270 c1e0b3e4 c1e0b380 00000000 00000004
	[   95.636813] dde0: c1febb58 c0bbb32c c1e0b270 c1e0b000 c1febb40 00000004 c1febb58 c0bb5df0
	[   95.644978] de00: b6985148 00000001 c1e0b270 00000001 c104f4f4 c06a37a0 c1febba4 00000004
	[   95.653138] de20: c1e0b000 00000001 c1e0b234 c1febb40 c1e0b008 f09dde90 c2751f00 c4901048
	[   95.661294] de40: b6985148 c0bb7874 019dde90 99e880ae c48fe300 fffffff2 c48fe310 00000001
	[   95.669452] de60: b6985148 c04882c8 00000000 00000000 00000000 f09dde90 00004004 00000004
	[   95.677619] de80: 00000000 f09ddf78 b6985148 c03e1130 c4901000 00000000 00000000 00000000
	[   95.685773] dea0: 00000000 00000000 00000000 00004004 00000000 00000000 00000000 99e880ae
	[   95.693931] dec0: c4901000 c2bae880 00000002 00000002 f09ddf78 00000000 b6985148 c03e3208
	[   95.702093] dee0: 00000000 f09ddef0 000b6985 b6985000 00010001 00000000 f09ddf18 00000000
	[   95.710253] df00: 00000001 00000000 00000000 00000000 bed7e988 00000001 00000000 00000000
	[   95.718421] df20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
	[   95.726576] df40: 00000000 00000000 00000000 00000000 bed7e8d8 99e880ae c4901003 c4901000
	[   95.734731] df60: f09ddf78 bed7e8d8 00000002 c03e3010 00000000 c2bae880 00000000 00000000
	[   95.742894] df80: 00000092 99e880ae bed7e8d8 00000001 00000002 00000092 c01002c4 c2bae880
	[   95.751054] dfa0: 00000092 c01002b4 bed7e8d8 00000001 00000009 bed7e8d8 00000002 00000000
	[   95.759214] dfc0: bed7e8d8 00000001 00000002 00000092 b69850b0 00000001 00000001 b6985148
	[   95.767377] dfe0: ffffffff bed7e8d8 b6f5ac69 b6f58ee6 00000030 00000009 00000000 00000000
	[   95.775524] Call trace:
	[   95.775546]  bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108
	[   95.786288]  bmc150_accel_buffer_postenable from __iio_update_buffers+0xb78/0xdf4
	[   95.794018]  __iio_update_buffers from enable_store+0x88/0xc8
	[   95.801562]  enable_store from kernfs_fop_write_iter+0x154/0x1b4
	[   95.807295]  kernfs_fop_write_iter from do_iter_readv_writev+0x174/0x1dc
	[   95.813369]  do_iter_readv_writev from vfs_writev+0x18c/0x428
	[   95.820051]  vfs_writev from do_writev+0x74/0xe0
	[   95.825690]  do_writev from __sys_trace_return+0x0/0x10
	[   95.830376] Exception stack(0xf09ddfa8 to 0xf09ddff0)
	[   95.835331] dfa0:                   bed7e8d8 00000001 00000009 bed7e8d8 00000002 00000000
	[   95.840547] dfc0: bed7e8d8 00000001 00000002 00000092 b69850b0 00000001 00000001 b6985148
	[   95.848702] dfe0: ffffffff bed7e8d8 b6f5ac69 b6f58ee6
	[   95.856863] Code: e1a01005 ebffffa8 e3500000 4a000020 (e5d62001)
	[   95.862186] ---[ end trace 0000000000000000 ]---

Add a check to return -ENODEV if no interrupt is provided.

Signed-off-by: Rudraksha Gupta <guptarud@gmail.com>
---
 drivers/iio/accel/bmc150-accel-core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
index 3c5d1560b163..ec87901cf66a 100644
--- a/drivers/iio/accel/bmc150-accel-core.c
+++ b/drivers/iio/accel/bmc150-accel-core.c
@@ -523,6 +523,9 @@ static int bmc150_accel_set_interrupt(struct bmc150_accel_data *data, int i,
 	const struct bmc150_accel_interrupt_info *info = intr->info;
 	int ret;
 
+	if (!info)
+		return -ENODEV;
+
 	if (state) {
 		if (atomic_inc_return(&intr->users) > 1)
 			return 0;

-- 
2.52.0

[PATCH v4 6/6] ARM: dts: qcom: msm8960: expressatt: Add Accelerometer

[Rudraksha Gupta via B4 Relay]

From: Rudraksha Gupta <guptarud@gmail.com>

Add the Bosch Accelerometer.

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Rudraksha Gupta <guptarud@gmail.com>
---
 arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts b/arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts
index d32461fc58e9..5a39abd6f3ce 100644
--- a/arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts
+++ b/arch/arm/boot/dts/qcom/qcom-msm8960-samsung-expressatt.dts
@@ -497,6 +497,17 @@ &gsbi12 {
 &gsbi12_i2c {
 	status = "okay";
 
+	accelerometer@18 {
+		compatible = "bosch,bma254";
+		reg = <0x18>;
+		vdd-supply = <&pm8921_l9>;
+		vddio-supply = <&pm8921_lvs4>;
+
+		mount-matrix =  "-1", "0", "0",
+				"0",  "-1", "0",
+				"0",  "0", "1";
+	};
+
 	magnetometer@2e {
 		compatible = "yamaha,yas532";
 		reg = <0x2e>;

-- 
2.52.0

Re: [PATCH v4 5/6] iio: accel: Prevent NULL pointer dereference in interrupt setup

[Konrad Dybcio]

On 11/25/25 12:35 AM, Rudraksha Gupta via B4 Relay wrote:
> From: Rudraksha Gupta <guptarud@gmail.com>
> 
> The bmc150_accel_set_interrupt() function assumes that the interrupt
> info is provided. However, when no IRQ is provided, the info pointer
> remains NULL, leading to a kernel oops:

Hm, are you sure your device really doesn't have a pin connected to
the IC's interrupt line?

Konrad

Re: [PATCH v4 0/6] ARM: dts: qcom: msm8960: expressatt: Add more peripherals

[Konrad Dybcio]

On 11/25/25 12:35 AM, Rudraksha Gupta via B4 Relay wrote:
> Intro:

[...]

> Changes in v4:
> - corrected accelerometer's mount matrix
> - fix a nullptr issue in the accelerometer's driver code

The patches are now:

1 dt
2 dt
3 dt
4 dt
5 iio (different tree/maintainer)
6 dt

Which makes it non-obvious how to merge them, especially given 5 seems
like a pre-requisite for 6 if you don't like nullptrs

If that's the case (although I would like to think 5 isn't really
necessary because board designers generally don't randomly omit
connecting interrupt pins), it would be best if you first sent 1-4 and
then 5-6 as a follow-up in a new series.

For now, let's try to settle whether you really need 5

Konrad

Re: [PATCH v4 5/6] iio: accel: Prevent NULL pointer dereference in interrupt setup

[Andy Shevchenko]

On Tue, Nov 25, 2025 at 11:45:22AM +0100, Konrad Dybcio wrote:
> On 11/25/25 12:35 AM, Rudraksha Gupta via B4 Relay wrote:
> > 
> > The bmc150_accel_set_interrupt() function assumes that the interrupt
> > info is provided. However, when no IRQ is provided, the info pointer
> > remains NULL, leading to a kernel oops:
> 
> Hm, are you sure your device really doesn't have a pin connected to
> the IC's interrupt line?

I don't know the actual case here, but in general such a design occurred
in real life. So, shouldn't be a surprise to see another polling only mode
connection like this.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v4 5/6] iio: accel: Prevent NULL pointer dereference in interrupt setup

[Rudraksha Gupta]

On 11/25/25 03:14, Andy Shevchenko wrote:
> On Tue, Nov 25, 2025 at 11:45:22AM +0100, Konrad Dybcio wrote:
>> On 11/25/25 12:35 AM, Rudraksha Gupta via B4 Relay wrote:
>>> The bmc150_accel_set_interrupt() function assumes that the interrupt
>>> info is provided. However, when no IRQ is provided, the info pointer
>>> remains NULL, leading to a kernel oops:
>> Hm, are you sure your device really doesn't have a pin connected to
>> the IC's interrupt line?
> I don't know the actual case here, but in general such a design occurred
> in real life. So, shouldn't be a surprise to see another polling only mode
> connection like this.
>
I unfortunately don't have the schematics, so I can only reference the 
downstream kernel:

https://codeberg.org/LogicalErzor/Android_Kernel_Samsung_D2/commits/branch/downstream


The above is my kernel tree. This is based on:

https://github.com/LineageOS/android_kernel_samsung_d2/tree/cm-14.1


but with a few added commits on top to help me navigate the codebase. 
Notably, I've removed all .c files that wasn't needed by the downstream 
kernel, and verified that it works by flashing the kernel with 
Cyanogenmod running.


Based on the device's config:

https://codeberg.org/LogicalErzor/Android_Kernel_Samsung_D2/src/branch/downstream/arch/arm/configs/cyanogen_expressatt_defconfig


There is no .irq defined for the accelerator:

https://codeberg.org/LogicalErzor/Android_Kernel_Samsung_D2/src/branch/downstream/arch/arm/mach-msm/board-express.c#L2100


I also couldn't find a hardcoded irq in the driver code as well:

https://codeberg.org/LogicalErzor/Android_Kernel_Samsung_D2/src/branch/downstream/drivers/sensors/accelerometer/yas_acc_driver-bma25x.c

https://codeberg.org/LogicalErzor/Android_Kernel_Samsung_D2/src/branch/downstream/drivers/sensors/accelerometer/yas_acc_kernel_driver.c


This seems to be confirmed upstream too, where one has an irq:

https://github.com/torvalds/linux/blob/master/arch/arm/boot/dts/st/ste-ux500-samsung-skomer.dts#L420


and others don't:

https://github.com/torvalds/linux/blob/master/arch/arm/boot/dts/st/ste-ux500-samsung-kyle.dts#L439

https://github.com/torvalds/linux/blob/master/arch/arm/boot/dts/st/ste-ux500-samsung-codina-tmo.dts#L506


Happy to split this patch series into two, just let me know! :)

Re: [PATCH v4 5/6] iio: accel: Prevent NULL pointer dereference in interrupt setup

[Konrad Dybcio]

On 11/25/25 10:23 PM, Rudraksha Gupta wrote:
> 
> On 11/25/25 03:14, Andy Shevchenko wrote:
>> On Tue, Nov 25, 2025 at 11:45:22AM +0100, Konrad Dybcio wrote:
>>> On 11/25/25 12:35 AM, Rudraksha Gupta via B4 Relay wrote:
>>>> The bmc150_accel_set_interrupt() function assumes that the interrupt
>>>> info is provided. However, when no IRQ is provided, the info pointer
>>>> remains NULL, leading to a kernel oops:
>>> Hm, are you sure your device really doesn't have a pin connected to
>>> the IC's interrupt line?
>> I don't know the actual case here, but in general such a design occurred
>> in real life. So, shouldn't be a surprise to see another polling only mode
>> connection like this.

[...]

> This seems to be confirmed upstream too, where one has an irq:
> 
> https://github.com/torvalds/linux/blob/master/arch/arm/boot/dts/st/ste-ux500-samsung-skomer.dts#L420
> 
> 
> and others don't:
> 
> https://github.com/torvalds/linux/blob/master/arch/arm/boot/dts/st/ste-ux500-samsung-kyle.dts#L439
> 
> https://github.com/torvalds/linux/blob/master/arch/arm/boot/dts/st/ste-ux500-samsung-codina-tmo.dts#L506

Thanks for this investigation, it really seems like it's NC
> Happy to split this patch series into two, just let me know! :)

We won't be taking any non-urgent patches until rc1 drops (~3 weeks)
so if the IIO folks decide to pick it up in meantime, just send it as
one

Konrad

Re: [PATCH v4 5/6] iio: accel: Prevent NULL pointer dereference in interrupt setup

[Andy Shevchenko]

On Thu, Nov 27, 2025 at 07:38:45PM +0100, Konrad Dybcio wrote:
> On 11/25/25 10:23 PM, Rudraksha Gupta wrote:

[...]

> We won't be taking any non-urgent patches until rc1 drops (~3 weeks)
> so if the IIO folks decide to pick it up in meantime, just send it as
> one

AFAIK IIO is closed as well till v6.19-rc1.
The patch can be taken to a deferred queue though,
but in the result it will wait for a new cycle.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v4 5/6] iio: accel: Prevent NULL pointer dereference in interrupt setup

[Rudraksha Gupta]

Hello all,


Seems like Linus Walleij encountered this as well, and the fix seems to 
have landed upstream:

https://lore.kernel.org/all/20251103-fix-bmc150-v2-1-0811592259df@linaro.org/


This patch no longer applies.


Thanks,

Rudraksha