* [PATCH v9 7/9] arm64: dts: imx94: Add display pipeline nodes
From: Laurentiu Palcu @ 2026-06-12 11:58 UTC (permalink / raw)
To: Ying Liu, Luca Ceresoli, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Frank Li, Sascha Hauer, Pengutronix Kernel Team,
Fabio Estevam
Cc: Laurentiu Palcu, linux-clk, imx, devicetree, linux-arm-kernel,
linux-kernel, dri-devel
In-Reply-To: <20260612-dcif-upstreaming-v9-0-8d0ff89aa3c5@oss.nxp.com>
Add the nodes necessary for the display pipeline on i.MX94:
* LVDS/DISPLAY CSR;
* clock-ldb-pll-div7 needed by DCIF and LDB;
* Display controller interface (DCIF);
* LVDS display bridge (LDB);
Co-developed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
---
arch/arm64/boot/dts/freescale/imx94.dtsi | 82 ++++++++++++++++++++++++++++++++
1 file changed, 82 insertions(+)
diff --git a/arch/arm64/boot/dts/freescale/imx94.dtsi b/arch/arm64/boot/dts/freescale/imx94.dtsi
index a6cb5a6e848b3..95d862682703c 100644
--- a/arch/arm64/boot/dts/freescale/imx94.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx94.dtsi
@@ -3,6 +3,7 @@
* Copyright 2024-2025 NXP
*/
+#include <dt-bindings/clock/nxp,imx94-clock.h>
#include <dt-bindings/dma/fsl-edma.h>
#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>
@@ -39,6 +40,15 @@ clk_ext1: clock-ext1 {
clock-output-names = "clk_ext1";
};
+ clk_ldb_pll_div7: clock-ldb-pll-div7 {
+ compatible = "fixed-factor-clock";
+ #clock-cells = <0>;
+ clocks = <&scmi_clk IMX94_CLK_LDBPLL>;
+ clock-div = <7>;
+ clock-mult = <1>;
+ clock-output-names = "ldb_pll_div7";
+ };
+
sai1_mclk: clock-sai1-mclk1 {
compatible = "fixed-clock";
#clock-cells = <0>;
@@ -1305,6 +1315,78 @@ wdog4: watchdog@49230000 {
};
};
+ dispmix_csr: syscon@4b010000 {
+ compatible = "nxp,imx94-display-csr", "syscon";
+ reg = <0x0 0x4b010000 0x0 0x10000>;
+ clocks = <&scmi_clk IMX94_CLK_DISPAPB>;
+ #clock-cells = <1>;
+ power-domains = <&scmi_devpd IMX94_PD_DISPLAY>;
+ assigned-clocks = <&scmi_clk IMX94_CLK_DISPAXI>,
+ <&scmi_clk IMX94_CLK_DISPAPB>;
+ assigned-clock-parents = <&scmi_clk IMX94_CLK_SYSPLL1_PFD1>,
+ <&scmi_clk IMX94_CLK_SYSPLL1_PFD1_DIV2>;
+ assigned-clock-rates = <400000000>, <133333333>;
+ };
+
+ lvds_csr: syscon@4b0c0000 {
+ compatible = "nxp,imx94-lvds-csr", "syscon";
+ reg = <0x0 0x4b0c0000 0x0 0x10000>;
+ #address-cells = <1>;
+ #size-cells = <1>;
+ clocks = <&scmi_clk IMX94_CLK_DISPAPB>;
+ #clock-cells = <1>;
+ power-domains = <&scmi_devpd IMX94_PD_DISPLAY>;
+
+ ldb: ldb@4 {
+ compatible = "fsl,imx94-ldb";
+ reg = <0x4 0x4>, <0x8 0x4>;
+ reg-names = "ldb", "lvds";
+ clocks = <&lvds_csr IMX94_CLK_DISPMIX_LVDS_CLK_GATE>;
+ clock-names = "ldb";
+ status = "disabled";
+
+ ports {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ port@0 {
+ reg = <0>;
+
+ lvds_in: endpoint {
+ remote-endpoint = <&dcif_out>;
+ };
+ };
+
+ port@1 {
+ reg = <1>;
+ };
+ };
+ };
+ };
+
+ dcif: display-controller@4b120000 {
+ compatible = "nxp,imx94-dcif";
+ reg = <0x0 0x4b120000 0x0 0x300000>;
+ interrupts = <GIC_SPI 377 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 378 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 379 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "common", "bg_layer", "fg_layer";
+ clocks = <&scmi_clk IMX94_CLK_DISPAPB>,
+ <&scmi_clk IMX94_CLK_DISPAXI>,
+ <&dispmix_csr IMX94_CLK_DISPMIX_CLK_SEL>;
+ clock-names = "apb", "axi", "pix";
+ assigned-clocks = <&dispmix_csr IMX94_CLK_DISPMIX_CLK_SEL>;
+ assigned-clock-parents = <&clk_ldb_pll_div7>;
+ power-domains = <&scmi_devpd IMX94_PD_DISPLAY>;
+ status = "disabled";
+
+ port {
+ dcif_out: endpoint {
+ remote-endpoint = <&lvds_in>;
+ };
+ };
+ };
+
hsio_blk_ctl: syscon@4c0100c0 {
compatible = "nxp,imx95-hsio-blk-ctl", "syscon";
reg = <0x0 0x4c0100c0 0x0 0x1>;
--
2.51.0
^ permalink raw reply related
* [PATCH v9 5/9] drm/imx: Add support for i.MX94 DCIF
From: Laurentiu Palcu @ 2026-06-12 11:58 UTC (permalink / raw)
To: Ying Liu, Luca Ceresoli, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter, Frank Li,
Sascha Hauer, Pengutronix Kernel Team, Fabio Estevam
Cc: Laurentiu Palcu, linux-clk, imx, devicetree, linux-arm-kernel,
linux-kernel, dri-devel
In-Reply-To: <20260612-dcif-upstreaming-v9-0-8d0ff89aa3c5@oss.nxp.com>
From: Sandor Yu <sandor.yu@nxp.com>
The i.MX94 Display Control Interface features:
* Up to maximum 3 layers of alpha blending:
- 1 background layer(Layer 0);
- 1 foreground layer(Layer 1);
- A programmable constant color behind the background layer;
* Each layer supports:
- programmable plane size;
- programmable background color;
- embedded alpha and global alpha;
* Data output with CRC checksum for 4 programmable regions;
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # bridge refcounting
Signed-off-by: Sandor Yu <sandor.yu@nxp.com>
Co-developed-by: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
Signed-off-by: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
---
drivers/gpu/drm/imx/Kconfig | 1 +
drivers/gpu/drm/imx/Makefile | 1 +
drivers/gpu/drm/imx/dcif/Kconfig | 15 +
drivers/gpu/drm/imx/dcif/Makefile | 5 +
drivers/gpu/drm/imx/dcif/dcif-crc.c | 215 +++++++++++
drivers/gpu/drm/imx/dcif/dcif-crc.h | 43 +++
drivers/gpu/drm/imx/dcif/dcif-crtc.c | 705 ++++++++++++++++++++++++++++++++++
drivers/gpu/drm/imx/dcif/dcif-drv.c | 233 +++++++++++
drivers/gpu/drm/imx/dcif/dcif-drv.h | 89 +++++
drivers/gpu/drm/imx/dcif/dcif-kms.c | 96 +++++
drivers/gpu/drm/imx/dcif/dcif-plane.c | 308 +++++++++++++++
drivers/gpu/drm/imx/dcif/dcif-reg.h | 267 +++++++++++++
12 files changed, 1978 insertions(+)
diff --git a/drivers/gpu/drm/imx/Kconfig b/drivers/gpu/drm/imx/Kconfig
index 3e8c6edbc17c2..1b6ced5c60b51 100644
--- a/drivers/gpu/drm/imx/Kconfig
+++ b/drivers/gpu/drm/imx/Kconfig
@@ -1,6 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
source "drivers/gpu/drm/imx/dc/Kconfig"
+source "drivers/gpu/drm/imx/dcif/Kconfig"
source "drivers/gpu/drm/imx/dcss/Kconfig"
source "drivers/gpu/drm/imx/ipuv3/Kconfig"
source "drivers/gpu/drm/imx/lcdc/Kconfig"
diff --git a/drivers/gpu/drm/imx/Makefile b/drivers/gpu/drm/imx/Makefile
index c7b317640d71d..2b9fd85eefaa3 100644
--- a/drivers/gpu/drm/imx/Makefile
+++ b/drivers/gpu/drm/imx/Makefile
@@ -1,6 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
obj-$(CONFIG_DRM_IMX8_DC) += dc/
+obj-$(CONFIG_DRM_IMX_DCIF) += dcif/
obj-$(CONFIG_DRM_IMX_DCSS) += dcss/
obj-$(CONFIG_DRM_IMX) += ipuv3/
obj-$(CONFIG_DRM_IMX_LCDC) += lcdc/
diff --git a/drivers/gpu/drm/imx/dcif/Kconfig b/drivers/gpu/drm/imx/dcif/Kconfig
new file mode 100644
index 0000000000000..c33c662721d36
--- /dev/null
+++ b/drivers/gpu/drm/imx/dcif/Kconfig
@@ -0,0 +1,15 @@
+config DRM_IMX_DCIF
+ tristate "DRM support for NXP i.MX94 DCIF"
+ select DRM_KMS_HELPER
+ select VIDEOMODE_HELPERS
+ select DRM_GEM_DMA_HELPER
+ select DRM_DISPLAY_HELPER
+ select DRM_BRIDGE_CONNECTOR
+ select DRM_CLIENT_SELECTION
+ depends on DRM && OF && ARCH_MXC
+ depends on COMMON_CLK
+ help
+ Enable NXP i.MX94 Display Control Interface(DCIF) support. The DCIF is
+ a system master that fetches graphics stored in memory and displays
+ them on a TFT LCD panel or connects to a display interface depending
+ on the chip configuration.
diff --git a/drivers/gpu/drm/imx/dcif/Makefile b/drivers/gpu/drm/imx/dcif/Makefile
new file mode 100644
index 0000000000000..b429572040f0e
--- /dev/null
+++ b/drivers/gpu/drm/imx/dcif/Makefile
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0
+
+imx-dcif-drm-objs := dcif-crc.o dcif-crtc.o dcif-drv.o dcif-kms.o dcif-plane.o
+
+obj-$(CONFIG_DRM_IMX_DCIF) += imx-dcif-drm.o
diff --git a/drivers/gpu/drm/imx/dcif/dcif-crc.c b/drivers/gpu/drm/imx/dcif/dcif-crc.c
new file mode 100644
index 0000000000000..dee36e5ca6793
--- /dev/null
+++ b/drivers/gpu/drm/imx/dcif/dcif-crc.c
@@ -0,0 +1,215 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright 2025 NXP
+ */
+
+#include <linux/regmap.h>
+
+#include <drm/drm_atomic.h>
+#include <drm/drm_rect.h>
+
+#include "dcif-crc.h"
+#include "dcif-reg.h"
+
+#define MAX_DCIF_CRC_NUM 4
+
+static int dcif_crc_config(struct dcif_dev *dcif, struct drm_rect *roi, int ncrc)
+{
+ int pos, size;
+
+ if (ncrc >= MAX_DCIF_CRC_NUM)
+ return -EINVAL;
+
+ pos = DCIF_CRC_POS_CRC_HOR_POS(roi->x1) |
+ DCIF_CRC_POS_CRC_VER_POS(roi->y1);
+ size = DCIF_CRC_SIZE_CRC_HOR_SIZE(roi->x2 - roi->x1) |
+ DCIF_CRC_SIZE_CRC_VER_SIZE(roi->y2 - roi->y1);
+
+ regmap_write(dcif->regmap, DCIF_CRC_POS_R(ncrc), pos);
+ regmap_write(dcif->regmap, DCIF_CRC_SIZE_R(ncrc), size);
+
+ regmap_set_bits(dcif->regmap, DCIF_CRC_CTRL,
+ DCIF_CRC_CTRL_CRC_EN(ncrc) | DCIF_CRC_CTRL_CRC_ERR_CNT_RST);
+
+ return 0;
+}
+
+void dcif_crc_source_enable(struct dcif_dev *dcif, enum dcif_crc_source source,
+ struct drm_rect *roi, int ncrc)
+{
+ if (ncrc >= MAX_DCIF_CRC_NUM)
+ return;
+
+ if (source == DCIF_CRC_SRC_NONE)
+ return;
+
+ if (dcif->crc_is_enabled)
+ return;
+
+ dcif_crc_config(dcif, roi, ncrc);
+
+ regmap_set_bits(dcif->regmap, DCIF_CRC_CTRL,
+ DCIF_CRC_CTRL_CRC_MODE | DCIF_CRC_CTRL_CRC_SHADOW_LOAD_EN |
+ DCIF_CRC_CTRL_CRC_TRIG);
+
+ dcif->crc_is_enabled = true;
+}
+
+void dcif_crc_source_disable(struct dcif_dev *dcif, int ncrc)
+{
+ if (!dcif->crc_is_enabled)
+ return;
+
+ if (ncrc >= MAX_DCIF_CRC_NUM)
+ return;
+
+ regmap_clear_bits(dcif->regmap, DCIF_CRC_CTRL, DCIF_CRC_CTRL_CRC_EN(ncrc));
+
+ dcif->crc_is_enabled = false;
+}
+
+/*
+ * Supported modes and source names:
+ * 1) auto mode:
+ * "auto" should be selected as the source name.
+ * The evaluation window is the same to the display region as
+ * indicated by drm_crtc_state->adjusted_mode.
+ *
+ * 2) region of interest(ROI) mode:
+ * "roi:x1,y1,x2,y2" should be selected as the source name.
+ * The region of interest is defined by the inclusive upper left
+ * position at (x1, y1) and the exclusive lower right position
+ * at (x2, y2), see struct drm_rect for the same idea.
+ * The evaluation window is the region of interest.
+ */
+static int dcif_crc_source_parse(struct drm_crtc *crtc, const char *source_name,
+ enum dcif_crc_source *s, struct drm_rect *roi)
+{
+ static const char roi_prefix[] = "roi:";
+
+ if (!source_name) {
+ *s = DCIF_CRC_SRC_NONE;
+ } else if (!strcmp(source_name, "auto")) {
+ struct drm_display_mode *mode = &crtc->state->adjusted_mode;
+
+ roi->x1 = 0;
+ roi->y1 = 0;
+ roi->x2 = mode->hdisplay;
+ roi->y2 = mode->vdisplay;
+
+ *s = DCIF_CRC_SRC_FRAME;
+ } else if (strstarts(source_name, roi_prefix)) {
+ int len = strlen(roi_prefix);
+ unsigned int params[4];
+ char *options, *opt;
+ int i = 0, ret;
+
+ char *buf __free(kfree) = kstrdup(source_name + len, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+ options = buf;
+
+ while ((opt = strsep(&options, ",")) != NULL) {
+ if (i > 3)
+ return -EINVAL;
+
+ ret = kstrtouint(opt, 10, ¶ms[i]);
+ if (ret < 0)
+ return ret;
+
+ i++;
+ }
+
+ if (i != 4)
+ return -EINVAL;
+
+ roi->x1 = params[0];
+ roi->y1 = params[1];
+ roi->x2 = params[2];
+ roi->y2 = params[3];
+
+ if (!drm_rect_visible(roi))
+ return -EINVAL;
+
+ *s = DCIF_CRC_SRC_FRAME_ROI;
+ } else {
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
+int dcif_crc_source_verify(struct drm_crtc *crtc, const char *source_name,
+ size_t *values_cnt)
+{
+ struct dcif_dev *dcif = crtc_to_dcif_dev(crtc);
+ enum dcif_crc_source source;
+ struct drm_rect roi;
+
+ if (dcif_crc_source_parse(crtc, source_name, &source, &roi) < 0) {
+ dev_dbg(dcif->drm.dev, "unknown source %s\n", source_name);
+ return -EINVAL;
+ }
+
+ *values_cnt = 1;
+
+ return 0;
+}
+
+int dcif_crc_source_set(struct drm_crtc *crtc, const char *source_name)
+{
+ struct dcif_dev *dcif = crtc_to_dcif_dev(crtc);
+ struct drm_modeset_acquire_ctx ctx;
+ struct drm_crtc_state *crtc_state;
+ struct drm_atomic_commit *state;
+ struct drm_rect roi = {0, 0, 0, 0};
+ enum dcif_crc_source source;
+ int ret;
+
+ if (dcif_crc_source_parse(crtc, source_name, &source, &roi) < 0) {
+ dev_dbg(dcif->drm.dev, "unknown source %s\n", source_name);
+ return -EINVAL;
+ }
+
+ /* Perform an atomic commit to set the CRC source. */
+ drm_modeset_acquire_init(&ctx, 0);
+
+ state = drm_atomic_commit_alloc(crtc->dev);
+ if (!state) {
+ ret = -ENOMEM;
+ goto unlock;
+ }
+
+ state->acquire_ctx = &ctx;
+
+retry:
+ crtc_state = drm_atomic_get_crtc_state(state, crtc);
+ if (!IS_ERR(crtc_state)) {
+ struct dcif_crtc_state *dcif_crtc_state;
+
+ dcif_crtc_state = to_dcif_crtc_state(crtc_state);
+
+ dcif_crtc_state->crc.source = source;
+ dcif_copy_roi(&roi, &dcif_crtc_state->crc.roi);
+
+ ret = drm_atomic_commit(state);
+ } else {
+ ret = PTR_ERR(crtc_state);
+ }
+
+ if (ret == -EDEADLK) {
+ drm_atomic_commit_clear(state);
+ drm_modeset_backoff(&ctx);
+ goto retry;
+ }
+
+ drm_atomic_commit_put(state);
+
+unlock:
+ drm_modeset_drop_locks(&ctx);
+ drm_modeset_acquire_fini(&ctx);
+
+ return ret;
+}
diff --git a/drivers/gpu/drm/imx/dcif/dcif-crc.h b/drivers/gpu/drm/imx/dcif/dcif-crc.h
new file mode 100644
index 0000000000000..6ccb1b7186732
--- /dev/null
+++ b/drivers/gpu/drm/imx/dcif/dcif-crc.h
@@ -0,0 +1,43 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+/*
+ * Copyright 2025 NXP
+ */
+
+#ifndef __DCIF_CRC_H__
+#define __DCIF_CRC_H__
+
+#include <linux/types.h>
+
+#include "dcif-drv.h"
+
+static inline bool enable_dcif_crc_needed(struct dcif_crtc_state *new_dcstate,
+ struct dcif_crtc_state *old_dcstate)
+{
+ return old_dcstate->crc.source == DCIF_CRC_SRC_NONE &&
+ new_dcstate->crc.source != DCIF_CRC_SRC_NONE;
+}
+
+static inline bool disable_dcif_crc_needed(struct dcif_crtc_state *new_dcstate,
+ struct dcif_crtc_state *old_dcstate)
+{
+ return old_dcstate->crc.source != DCIF_CRC_SRC_NONE &&
+ new_dcstate->crc.source == DCIF_CRC_SRC_NONE;
+}
+
+static inline void dcif_copy_roi(struct drm_rect *from, struct drm_rect *to)
+{
+ to->x1 = from->x1;
+ to->y1 = from->y1;
+ to->x2 = from->x2;
+ to->y2 = from->y2;
+}
+
+int dcif_crc_source_verify(struct drm_crtc *crtc, const char *source_name,
+ size_t *values_cnt);
+int dcif_crc_source_set(struct drm_crtc *crtc, const char *source_name);
+void dcif_crc_source_enable(struct dcif_dev *dcif, enum dcif_crc_source source,
+ struct drm_rect *roi, int ncrc);
+void dcif_crc_source_disable(struct dcif_dev *dcif, int ncrc);
+
+#endif /* __DCIF_CRC_H__ */
diff --git a/drivers/gpu/drm/imx/dcif/dcif-crtc.c b/drivers/gpu/drm/imx/dcif/dcif-crtc.c
new file mode 100644
index 0000000000000..1fa2dfb2e0b98
--- /dev/null
+++ b/drivers/gpu/drm/imx/dcif/dcif-crtc.c
@@ -0,0 +1,705 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright 2025 NXP
+ */
+
+#include <linux/irqreturn.h>
+#include <linux/media-bus-format.h>
+#include <linux/pm_runtime.h>
+#include <linux/regmap.h>
+
+#include <drm/drm_atomic.h>
+#include <drm/drm_atomic_helper.h>
+#include <drm/drm_atomic_state_helper.h>
+#include <drm/drm_bridge.h>
+#include <drm/drm_fb_dma_helper.h>
+#include <drm/drm_fourcc.h>
+#include <drm/drm_framebuffer.h>
+#include <drm/drm_plane.h>
+#include <drm/drm_print.h>
+#include <drm/drm_vblank.h>
+
+#include "dcif-crc.h"
+#include "dcif-drv.h"
+#include "dcif-reg.h"
+
+#define DCIF_MAX_PIXEL_CLOCK 148500000
+
+/* -----------------------------------------------------------------------------
+ * CRTC
+ */
+
+/*
+ * For conversion from YCbCr to RGB, the CSC operates as follows:
+ *
+ * |R| |A1 A2 A3| |Y + D1|
+ * |G| = |B1 B2 B3| * |Cb + D2|
+ * |B| |C1 C2 C3| |Cr + D3|
+ *
+ * The A, B and C coefficients are expressed as signed Q3.8 fixed point values and
+ * the D coefficients as signed Q9.0.
+ */
+static const u32 dcif_yuv2rgb_coeffs[3][2][6] = {
+ [DRM_COLOR_YCBCR_BT601] = {
+ [DRM_COLOR_YCBCR_LIMITED_RANGE] = {
+ /*
+ * BT.601 limited range:
+ *
+ * |R| |1.1644 0.0000 1.5960| |Y - 16 |
+ * |G| = |1.1644 -0.3917 -0.8129| * |Cb - 128|
+ * |B| |1.1644 2.0172 0.0000| |Cr - 128|
+ */
+ DCIF_CSC_COEF0_L0_A1(0x12a) | DCIF_CSC_COEF0_L0_A2(0x000),
+ DCIF_CSC_COEF1_L0_A3(0x199) | DCIF_CSC_COEF1_L0_B1(0x12a),
+ DCIF_CSC_COEF2_L0_B2(0x79c) | DCIF_CSC_COEF2_L0_B3(0x730),
+ DCIF_CSC_COEF3_L0_C1(0x12a) | DCIF_CSC_COEF3_L0_C2(0x204),
+ DCIF_CSC_COEF4_L0_C3(0x000) | DCIF_CSC_COEF4_L0_D1(0x1f0),
+ DCIF_CSC_COEF5_L0_D2(0x180) | DCIF_CSC_COEF5_L0_D3(0x180),
+ },
+ [DRM_COLOR_YCBCR_FULL_RANGE] = {
+ /*
+ * BT.601 full range:
+ *
+ * |R| |1.0000 0.0000 1.4020| |Y - 0 |
+ * |G| = |1.0000 -0.3441 -0.7141| * |Cb - 128|
+ * |B| |1.0000 1.7720 0.0000| |Cr - 128|
+ */
+ DCIF_CSC_COEF0_L0_A1(0x100) | DCIF_CSC_COEF0_L0_A2(0x000),
+ DCIF_CSC_COEF1_L0_A3(0x167) | DCIF_CSC_COEF1_L0_B1(0x100),
+ DCIF_CSC_COEF2_L0_B2(0x7a8) | DCIF_CSC_COEF2_L0_B3(0x749),
+ DCIF_CSC_COEF3_L0_C1(0x100) | DCIF_CSC_COEF3_L0_C2(0x1c6),
+ DCIF_CSC_COEF4_L0_C3(0x000) | DCIF_CSC_COEF4_L0_D1(0x000),
+ DCIF_CSC_COEF5_L0_D2(0x180) | DCIF_CSC_COEF5_L0_D3(0x180),
+ },
+ },
+ [DRM_COLOR_YCBCR_BT709] = {
+ [DRM_COLOR_YCBCR_LIMITED_RANGE] = {
+ /*
+ * Rec.709 limited range:
+ *
+ * |R| |1.1644 0.0000 1.7927| |Y - 16 |
+ * |G| = |1.1644 -0.2132 -0.5329| * |Cb - 128|
+ * |B| |1.1644 2.1124 0.0000| |Cr - 128|
+ */
+ DCIF_CSC_COEF0_L0_A1(0x12a) | DCIF_CSC_COEF0_L0_A2(0x000),
+ DCIF_CSC_COEF1_L0_A3(0x1cb) | DCIF_CSC_COEF1_L0_B1(0x12a),
+ DCIF_CSC_COEF2_L0_B2(0x7c9) | DCIF_CSC_COEF2_L0_B3(0x778),
+ DCIF_CSC_COEF3_L0_C1(0x12a) | DCIF_CSC_COEF3_L0_C2(0x21d),
+ DCIF_CSC_COEF4_L0_C3(0x000) | DCIF_CSC_COEF4_L0_D1(0x1f0),
+ DCIF_CSC_COEF5_L0_D2(0x180) | DCIF_CSC_COEF5_L0_D3(0x180),
+ },
+ [DRM_COLOR_YCBCR_FULL_RANGE] = {
+ /*
+ * Rec.709 full range:
+ *
+ * |R| |1.0000 0.0000 1.5748| |Y - 0 |
+ * |G| = |1.0000 -0.1873 -0.4681| * |Cb - 128|
+ * |B| |1.0000 1.8556 0.0000| |Cr - 128|
+ */
+ DCIF_CSC_COEF0_L0_A1(0x100) | DCIF_CSC_COEF0_L0_A2(0x000),
+ DCIF_CSC_COEF1_L0_A3(0x193) | DCIF_CSC_COEF1_L0_B1(0x100),
+ DCIF_CSC_COEF2_L0_B2(0x7d0) | DCIF_CSC_COEF2_L0_B3(0x788),
+ DCIF_CSC_COEF3_L0_C1(0x100) | DCIF_CSC_COEF3_L0_C2(0x1db),
+ DCIF_CSC_COEF4_L0_C3(0x000) | DCIF_CSC_COEF4_L0_D1(0x000),
+ DCIF_CSC_COEF5_L0_D2(0x180) | DCIF_CSC_COEF5_L0_D3(0x180),
+ },
+ },
+ [DRM_COLOR_YCBCR_BT2020] = {
+ [DRM_COLOR_YCBCR_LIMITED_RANGE] = {
+ /*
+ * BT.2020 limited range:
+ *
+ * |R| |1.1644 0.0000 1.6787| |Y - 16 |
+ * |G| = |1.1644 -0.1874 -0.6505| * |Cb - 128|
+ * |B| |1.1644 2.1418 0.0000| |Cr - 128|
+ */
+ DCIF_CSC_COEF0_L0_A1(0x12a) | DCIF_CSC_COEF0_L0_A2(0x000),
+ DCIF_CSC_COEF1_L0_A3(0x1ae) | DCIF_CSC_COEF1_L0_B1(0x12a),
+ DCIF_CSC_COEF2_L0_B2(0x7d0) | DCIF_CSC_COEF2_L0_B3(0x759),
+ DCIF_CSC_COEF3_L0_C1(0x12a) | DCIF_CSC_COEF3_L0_C2(0x224),
+ DCIF_CSC_COEF4_L0_C3(0x000) | DCIF_CSC_COEF4_L0_D1(0x1f0),
+ DCIF_CSC_COEF5_L0_D2(0x180) | DCIF_CSC_COEF5_L0_D3(0x180),
+ },
+ [DRM_COLOR_YCBCR_FULL_RANGE] = {
+ /*
+ * BT.2020 full range:
+ *
+ * |R| |1.0000 0.0000 1.4746| |Y - 0 |
+ * |G| = |1.0000 -0.1646 -0.5714| * |Cb - 128|
+ * |B| |1.0000 1.8814 0.0000| |Cr - 128|
+ */
+ DCIF_CSC_COEF0_L0_A1(0x100) | DCIF_CSC_COEF0_L0_A2(0x000),
+ DCIF_CSC_COEF1_L0_A3(0x179) | DCIF_CSC_COEF1_L0_B1(0x100),
+ DCIF_CSC_COEF2_L0_B2(0x7d6) | DCIF_CSC_COEF2_L0_B3(0x76e),
+ DCIF_CSC_COEF3_L0_C1(0x100) | DCIF_CSC_COEF3_L0_C2(0x1e2),
+ DCIF_CSC_COEF4_L0_C3(0x000) | DCIF_CSC_COEF4_L0_D1(0x000),
+ DCIF_CSC_COEF5_L0_D2(0x180) | DCIF_CSC_COEF5_L0_D3(0x180),
+ },
+ },
+};
+
+static enum drm_mode_status dcif_crtc_mode_valid(struct drm_crtc *crtc,
+ const struct drm_display_mode *mode)
+{
+ if (mode->crtc_clock > DCIF_MAX_PIXEL_CLOCK)
+ return MODE_CLOCK_HIGH;
+
+ return MODE_OK;
+}
+
+static void dcif_set_formats(struct dcif_dev *dcif, struct drm_plane_state *plane_state,
+ const u32 bus_format)
+{
+ const u32 format = plane_state->fb->format->format;
+ struct drm_device *drm = &dcif->drm;
+ bool in_yuv = false;
+ u32 reg = 0;
+
+ switch (bus_format) {
+ case MEDIA_BUS_FMT_RGB565_1X16:
+ reg |= DCIF_DPI_CTRL_DATA_PATTERN(PATTERN_RGB565);
+ break;
+ case MEDIA_BUS_FMT_RGB888_1X24:
+ reg |= DCIF_DPI_CTRL_DATA_PATTERN(PATTERN_RGB888);
+ break;
+ case MEDIA_BUS_FMT_RBG888_1X24:
+ reg |= DCIF_DPI_CTRL_DATA_PATTERN(PATTERN_RBG888);
+ break;
+ case MEDIA_BUS_FMT_BGR888_1X24:
+ reg |= DCIF_DPI_CTRL_DATA_PATTERN(PATTERN_BGR888);
+ break;
+ case MEDIA_BUS_FMT_GBR888_1X24:
+ reg |= DCIF_DPI_CTRL_DATA_PATTERN(PATTERN_GBR888);
+ break;
+ default:
+ dev_err(drm->dev, "Unknown media bus format 0x%x\n", bus_format);
+ break;
+ }
+
+ regmap_update_bits(dcif->regmap, DCIF_DPI_CTRL, DCIF_DPI_CTRL_DATA_PATTERN_MASK, reg);
+
+ reg = 0;
+ switch (format) {
+ /* RGB Formats */
+ case DRM_FORMAT_RGB565:
+ reg |= DCIF_CTRLDESC0_FORMAT(CTRLDESCL0_FORMAT_RGB565);
+ break;
+ case DRM_FORMAT_RGB888:
+ reg |= DCIF_CTRLDESC0_FORMAT(CTRLDESCL0_FORMAT_RGB888);
+ break;
+ case DRM_FORMAT_XRGB1555:
+ case DRM_FORMAT_ARGB1555:
+ reg |= DCIF_CTRLDESC0_FORMAT(CTRLDESCL0_FORMAT_ARGB1555);
+ break;
+ case DRM_FORMAT_XRGB4444:
+ case DRM_FORMAT_ARGB4444:
+ reg |= DCIF_CTRLDESC0_FORMAT(CTRLDESCL0_FORMAT_ARGB4444);
+ break;
+ case DRM_FORMAT_XBGR8888:
+ case DRM_FORMAT_ABGR8888:
+ reg |= DCIF_CTRLDESC0_FORMAT(CTRLDESCL0_FORMAT_ABGR8888);
+ break;
+ case DRM_FORMAT_XRGB8888:
+ case DRM_FORMAT_ARGB8888:
+ reg |= DCIF_CTRLDESC0_FORMAT(CTRLDESCL0_FORMAT_ARGB8888);
+ break;
+
+ /* YUV Formats */
+ case DRM_FORMAT_YUYV:
+ reg |= DCIF_CTRLDESC0_FORMAT(CTRLDESCL0_FORMAT_YCBCR422) |
+ DCIF_CTRLDESC0_YUV_FORMAT(CTRLDESCL0_YUV_FORMAT_VY2UY1);
+ in_yuv = true;
+ break;
+ case DRM_FORMAT_YVYU:
+ reg |= DCIF_CTRLDESC0_FORMAT(CTRLDESCL0_FORMAT_YCBCR422) |
+ DCIF_CTRLDESC0_YUV_FORMAT(CTRLDESCL0_YUV_FORMAT_UY2VY1);
+ in_yuv = true;
+ break;
+ case DRM_FORMAT_UYVY:
+ reg |= DCIF_CTRLDESC0_FORMAT(CTRLDESCL0_FORMAT_YCBCR422) |
+ DCIF_CTRLDESC0_YUV_FORMAT(CTRLDESCL0_YUV_FORMAT_Y2VY1U);
+ in_yuv = true;
+ break;
+ case DRM_FORMAT_VYUY:
+ reg |= DCIF_CTRLDESC0_FORMAT(CTRLDESCL0_FORMAT_YCBCR422) |
+ DCIF_CTRLDESC0_YUV_FORMAT(CTRLDESCL0_YUV_FORMAT_Y2UY1V);
+ in_yuv = true;
+ break;
+
+ default:
+ dev_err(drm->dev, "Unknown pixel format 0x%x\n", format);
+ break;
+ }
+
+ regmap_update_bits(dcif->regmap, DCIF_CTRLDESC0(0),
+ DCIF_CTRLDESC0_FORMAT_MASK | DCIF_CTRLDESC0_YUV_FORMAT_MASK,
+ reg);
+
+ if (in_yuv) {
+ /* Enable CSC YCbCr -> RGB */
+ const u32 *coeffs =
+ dcif_yuv2rgb_coeffs[plane_state->color_encoding][plane_state->color_range];
+
+ regmap_bulk_write(dcif->regmap, DCIF_CSC_COEF0_L0, coeffs, 6);
+
+ regmap_write(dcif->regmap, DCIF_CSC_CTRL_L0,
+ DCIF_CSC_CTRL_L0_CSC_EN |
+ DCIF_CSC_CTRL_L0_CSC_MODE_YCBCR2RGB);
+ } else {
+ regmap_write(dcif->regmap, DCIF_CSC_CTRL_L0, 0);
+ }
+}
+
+static void dcif_set_mode(struct dcif_dev *dcif, u32 bus_flags)
+{
+ struct drm_display_mode *m = &dcif->crtc.state->adjusted_mode;
+ u32 reg = 0;
+
+ if (m->flags & DRM_MODE_FLAG_NHSYNC)
+ reg |= DCIF_DPI_CTRL_HSYNC_POL_LOW;
+ if (m->flags & DRM_MODE_FLAG_NVSYNC)
+ reg |= DCIF_DPI_CTRL_VSYNC_POL_LOW;
+ if (bus_flags & DRM_BUS_FLAG_DE_LOW)
+ reg |= DCIF_DPI_CTRL_DE_POL_LOW;
+ if (bus_flags & DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE)
+ reg |= DCIF_DPI_CTRL_PCLK_EDGE_FALLING;
+
+ regmap_update_bits(dcif->regmap, DCIF_DPI_CTRL, DCIF_DPI_CTRL_POL_MASK, reg);
+
+ /* config display timings */
+ reg = DCIF_DISP_SIZE_DISP_WIDTH(m->hdisplay) |
+ DCIF_DISP_SIZE_DISP_HEIGHT(m->vdisplay);
+ regmap_write(dcif->regmap, DCIF_DISP_SIZE, reg);
+
+ reg = DCIF_DPI_HSYN_PAR_BP_H(m->htotal - m->hsync_end) |
+ DCIF_DPI_HSYN_PAR_FP_H(m->hsync_start - m->hdisplay);
+ regmap_write(dcif->regmap, DCIF_DPI_HSYN_PAR, reg);
+
+ reg = DCIF_DPI_VSYN_PAR_BP_V(m->vtotal - m->vsync_end) |
+ DCIF_DPI_VSYN_PAR_FP_V(m->vsync_start - m->vdisplay);
+ regmap_write(dcif->regmap, DCIF_DPI_VSYN_PAR, reg);
+
+ reg = DCIF_DPI_VSYN_HSYN_WIDTH_PW_V(m->vsync_end - m->vsync_start) |
+ DCIF_DPI_VSYN_HSYN_WIDTH_PW_H(m->hsync_end - m->hsync_start);
+ regmap_write(dcif->regmap, DCIF_DPI_VSYN_HSYN_WIDTH, reg);
+
+ /* Layer 0 frame size */
+ reg = DCIF_CTRLDESC2_HEIGHT(m->vdisplay) |
+ DCIF_CTRLDESC2_WIDTH(m->hdisplay);
+ regmap_write(dcif->regmap, DCIF_CTRLDESC2(0), reg);
+
+ /*
+ * Configure P_SIZE, T_SIZE and pitch
+ * 1. P_SIZE and T_SIZE should never be less than AXI bus width.
+ * 2. P_SIZE should never be less than T_SIZE.
+ */
+ reg = DCIF_CTRLDESC3_P_SIZE(2) | DCIF_CTRLDESC3_T_SIZE(2) |
+ DCIF_CTRLDESC3_PITCH(dcif->crtc.primary->state->fb->pitches[0]);
+ regmap_write(dcif->regmap, DCIF_CTRLDESC3(0), reg);
+}
+
+static void dcif_enable_plane_panic(struct dcif_dev *dcif)
+{
+ u32 reg;
+
+ /* Set FIFO Panic watermarks, low 1/3, high 2/3. */
+ reg = DCIF_PANIC_THRES_LOW(1 * PANIC0_THRES_MAX / 3) |
+ DCIF_PANIC_THRES_HIGH(2 * PANIC0_THRES_MAX / 3) |
+ DCIF_PANIC_THRES_REQ_EN;
+ regmap_write(dcif->regmap, DCIF_PANIC_THRES(0), reg);
+ regmap_write(dcif->regmap, DCIF_PANIC_THRES(1), reg);
+
+ regmap_set_bits(dcif->regmap, DCIF_IE1(dcif->cpu_domain),
+ DCIF_INT1_FIFO_PANIC0 | DCIF_INT1_FIFO_PANIC1);
+}
+
+static void dcif_disable_plane_panic(struct dcif_dev *dcif)
+{
+ regmap_clear_bits(dcif->regmap, DCIF_IE1(dcif->cpu_domain),
+ DCIF_INT1_FIFO_PANIC0 | DCIF_INT1_FIFO_PANIC1);
+ regmap_clear_bits(dcif->regmap, DCIF_PANIC_THRES(0), DCIF_PANIC_THRES_REQ_EN);
+ regmap_clear_bits(dcif->regmap, DCIF_PANIC_THRES(1), DCIF_PANIC_THRES_REQ_EN);
+}
+
+static void dcif_enable_controller(struct dcif_dev *dcif)
+{
+ /* Enable Display */
+ regmap_set_bits(dcif->regmap, DCIF_DISP_CTRL, DCIF_DISP_CTRL_DISP_ON);
+
+ /* Enable layer 0 */
+ regmap_set_bits(dcif->regmap, DCIF_CTRLDESC0(0), DCIF_CTRLDESC0_EN);
+}
+
+static void dcif_disable_controller(struct dcif_dev *dcif)
+{
+ u32 reg;
+ int ret;
+
+ /* Disable layer 0 */
+ regmap_clear_bits(dcif->regmap, DCIF_CTRLDESC0(0), DCIF_CTRLDESC0_EN);
+
+ ret = regmap_read_poll_timeout(dcif->regmap, DCIF_CTRLDESC0(0), reg,
+ !(reg & DCIF_CTRLDESC0_EN), 0,
+ 36000); /* Wait ~2 frame times max */
+ if (ret)
+ drm_err(&dcif->drm, "Failed to disable controller!\n");
+
+ /* Disable Display */
+ regmap_clear_bits(dcif->regmap, DCIF_DISP_CTRL, DCIF_DISP_CTRL_DISP_ON);
+}
+
+static void dcif_shadow_load_enable(struct dcif_dev *dcif)
+{
+ regmap_write_bits(dcif->regmap, DCIF_CTRLDESC0(0), DCIF_CTRLDESC0_SHADOW_LOAD_EN,
+ DCIF_CTRLDESC0_SHADOW_LOAD_EN);
+}
+
+static void dcif_reset_block(struct dcif_dev *dcif)
+{
+ regmap_set_bits(dcif->regmap, DCIF_DISP_CTRL, DCIF_DISP_CTRL_SW_RST);
+
+ regmap_clear_bits(dcif->regmap, DCIF_DISP_CTRL, DCIF_DISP_CTRL_SW_RST);
+}
+
+static void dcif_crtc_atomic_destroy_state(struct drm_crtc *crtc,
+ struct drm_crtc_state *state)
+{
+ __drm_atomic_helper_crtc_destroy_state(state);
+ kfree(to_dcif_crtc_state(state));
+}
+
+static void dcif_crtc_reset(struct drm_crtc *crtc)
+{
+ struct dcif_crtc_state *state;
+
+ if (crtc->state)
+ dcif_crtc_atomic_destroy_state(crtc, crtc->state);
+
+ crtc->state = NULL;
+
+ state = kzalloc_obj(*state, GFP_KERNEL);
+ if (state)
+ __drm_atomic_helper_crtc_reset(crtc, &state->base);
+}
+
+static struct drm_crtc_state *dcif_crtc_atomic_duplicate_state(struct drm_crtc *crtc)
+{
+ struct dcif_crtc_state *old = to_dcif_crtc_state(crtc->state);
+ struct dcif_crtc_state *new;
+
+ if (WARN_ON(!crtc->state))
+ return NULL;
+
+ new = kzalloc_obj(*new, GFP_KERNEL);
+ if (!new)
+ return NULL;
+
+ __drm_atomic_helper_crtc_duplicate_state(crtc, &new->base);
+
+ new->bus_format = old->bus_format;
+ new->bus_flags = old->bus_flags;
+ new->crc.source = old->crc.source;
+ dcif_copy_roi(&old->crc.roi, &new->crc.roi);
+
+ return &new->base;
+}
+
+static void dcif_crtc_mode_set_nofb(struct drm_crtc_state *crtc_state,
+ struct drm_plane_state *plane_state)
+{
+ struct dcif_crtc_state *dcif_crtc_state = to_dcif_crtc_state(crtc_state);
+ struct drm_device *drm = crtc_state->crtc->dev;
+ struct dcif_dev *dcif = crtc_to_dcif_dev(crtc_state->crtc);
+ struct drm_display_mode *m = &crtc_state->adjusted_mode;
+
+ dev_dbg(drm->dev, "Pixel clock: %dkHz\n", m->crtc_clock);
+ dev_dbg(drm->dev, "Bridge bus_flags: 0x%08X\n", dcif_crtc_state->bus_flags);
+ dev_dbg(drm->dev, "Mode flags: 0x%08X\n", m->flags);
+
+ dcif_reset_block(dcif);
+
+ dcif_set_formats(dcif, plane_state, dcif_crtc_state->bus_format);
+
+ dcif_set_mode(dcif, dcif_crtc_state->bus_flags);
+}
+
+static void dcif_crtc_queue_state_event(struct drm_crtc *crtc)
+{
+ struct dcif_dev *dcif = crtc_to_dcif_dev(crtc);
+
+ scoped_guard(spinlock_irq, &crtc->dev->event_lock) {
+ if (crtc->state->event) {
+ WARN_ON(drm_crtc_vblank_get(crtc));
+ WARN_ON(dcif->event);
+ dcif->event = crtc->state->event;
+ crtc->state->event = NULL;
+ }
+ }
+}
+
+static struct drm_bridge *dcif_crtc_get_bridge(struct drm_crtc *crtc,
+ struct drm_crtc_state *crtc_state)
+{
+ struct drm_connector_state *conn_state;
+ struct drm_encoder *encoder;
+ struct drm_connector *conn;
+ struct drm_bridge *bridge;
+ int i;
+
+ for_each_new_connector_in_state(crtc_state->state, conn, conn_state, i) {
+ if (crtc != conn_state->crtc)
+ continue;
+
+ encoder = conn_state->best_encoder;
+
+ bridge = drm_bridge_chain_get_first_bridge(encoder);
+ if (bridge)
+ return bridge;
+ }
+
+ return NULL;
+}
+
+static void dcif_crtc_query_output_bus_format(struct drm_crtc *crtc,
+ struct drm_crtc_state *crtc_state)
+{
+ struct dcif_crtc_state *dcif_state = to_dcif_crtc_state(crtc_state);
+ struct drm_bridge *bridge __free(drm_bridge_put) = NULL;
+ struct drm_bridge_state *bridge_state;
+
+ dcif_state->bus_format = MEDIA_BUS_FMT_RGB888_1X24;
+ dcif_state->bus_flags = 0;
+
+ bridge = dcif_crtc_get_bridge(crtc, crtc_state);
+ if (!bridge)
+ return;
+
+ bridge_state = drm_atomic_get_new_bridge_state(crtc_state->state, bridge);
+ if (!bridge_state)
+ return;
+
+ dcif_state->bus_format = bridge_state->input_bus_cfg.format;
+ dcif_state->bus_flags = bridge_state->input_bus_cfg.flags;
+}
+
+static int dcif_crtc_atomic_check(struct drm_crtc *crtc, struct drm_atomic_commit *state)
+{
+ struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
+ bool enable_primary = crtc_state->plane_mask & drm_plane_mask(crtc->primary);
+ int ret;
+
+ if (crtc_state->active && !enable_primary)
+ return -EINVAL;
+
+ dcif_crtc_query_output_bus_format(crtc, crtc_state);
+
+ if (crtc_state->active_changed && crtc_state->active) {
+ if (!crtc_state->mode_changed) {
+ crtc_state->mode_changed = true;
+ ret = drm_atomic_helper_check_modeset(crtc->dev, state);
+ if (ret)
+ return ret;
+ }
+ }
+
+ return 0;
+}
+
+static void dcif_crtc_atomic_flush(struct drm_crtc *crtc,
+ struct drm_atomic_commit *state)
+{
+ struct drm_crtc_state *old_crtc_state = drm_atomic_get_old_crtc_state(state, crtc);
+ struct dcif_crtc_state *old_dcif_crtc_state = to_dcif_crtc_state(old_crtc_state);
+ struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
+ struct dcif_crtc_state *dcif_crtc_state = to_dcif_crtc_state(crtc_state);
+ struct dcif_dev *dcif = crtc_to_dcif_dev(crtc);
+
+ dcif_shadow_load_enable(dcif);
+
+ if (drm_atomic_crtc_needs_modeset(crtc->state))
+ return;
+
+ if (dcif->has_crc && disable_dcif_crc_needed(dcif_crtc_state,
+ old_dcif_crtc_state))
+ dcif_crc_source_disable(dcif, 0);
+
+ dcif_crtc_queue_state_event(crtc);
+
+ if (dcif->has_crc && enable_dcif_crc_needed(dcif_crtc_state,
+ old_dcif_crtc_state))
+ dcif_crc_source_enable(dcif, dcif_crtc_state->crc.source,
+ &dcif_crtc_state->crc.roi, 0);
+}
+
+static void dcif_crtc_atomic_enable(struct drm_crtc *crtc,
+ struct drm_atomic_commit *state)
+{
+ struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
+ struct drm_plane_state *plane_state = drm_atomic_get_new_plane_state(state, crtc->primary);
+ struct dcif_crtc_state *dcif_crtc_state = to_dcif_crtc_state(crtc_state);
+ struct drm_display_mode *adj = &crtc_state->adjusted_mode;
+ struct dcif_dev *dcif = crtc_to_dcif_dev(crtc);
+ struct drm_device *drm = crtc->dev;
+ dma_addr_t baseaddr;
+ int ret;
+
+ dev_dbg(drm->dev, "mode " DRM_MODE_FMT "\n", DRM_MODE_ARG(adj));
+
+ /* enable power when we start to set mode for CRTC */
+ ret = pm_runtime_resume_and_get(drm->dev);
+ if (ret < 0) {
+ drm_err(drm, "failed to resume DCIF, ret = %d\n", ret);
+ return;
+ }
+ dcif->crtc_pm_enabled = true;
+
+ drm_crtc_vblank_on(crtc);
+
+ dcif_crtc_mode_set_nofb(crtc_state, plane_state);
+
+ baseaddr = drm_fb_dma_get_gem_addr(plane_state->fb, plane_state, 0);
+ if (baseaddr)
+ regmap_write(dcif->regmap, DCIF_CTRLDESC4(0), baseaddr);
+
+ dcif_enable_plane_panic(dcif);
+ dcif_enable_controller(dcif);
+
+ dcif_crtc_queue_state_event(crtc);
+
+ if (dcif->has_crc && dcif_crtc_state->crc.source != DCIF_CRC_SRC_NONE)
+ dcif_crc_source_enable(dcif, dcif_crtc_state->crc.source,
+ &dcif_crtc_state->crc.roi, 0);
+}
+
+static void dcif_crtc_atomic_disable(struct drm_crtc *crtc,
+ struct drm_atomic_commit *state)
+{
+ struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
+ struct dcif_crtc_state *dcif_crtc_state = to_dcif_crtc_state(crtc_state);
+ struct dcif_dev *dcif = crtc_to_dcif_dev(crtc);
+ struct drm_device *drm = crtc->dev;
+
+ if (dcif->has_crc && dcif_crtc_state->crc.source != DCIF_CRC_SRC_NONE)
+ dcif_crc_source_disable(dcif, 0);
+
+ dcif_disable_controller(dcif);
+ dcif_disable_plane_panic(dcif);
+
+ drm_crtc_vblank_off(crtc);
+
+ if (dcif->crtc_pm_enabled) {
+ dcif->crtc_pm_enabled = false;
+ pm_runtime_put_sync(drm->dev);
+ }
+
+ scoped_guard(spinlock_irq, &crtc->dev->event_lock) {
+ if (crtc->state->event && !crtc->state->active) {
+ drm_crtc_send_vblank_event(crtc, crtc->state->event);
+ crtc->state->event = NULL;
+ }
+ }
+}
+
+static const struct drm_crtc_helper_funcs dcif_crtc_helper_funcs = {
+ .mode_valid = dcif_crtc_mode_valid,
+ .atomic_check = dcif_crtc_atomic_check,
+ .atomic_flush = dcif_crtc_atomic_flush,
+ .atomic_enable = dcif_crtc_atomic_enable,
+ .atomic_disable = dcif_crtc_atomic_disable,
+};
+
+static int dcif_crtc_enable_vblank(struct drm_crtc *crtc)
+{
+ struct dcif_dev *dcif = crtc_to_dcif_dev(crtc);
+ int domain = dcif->cpu_domain;
+
+ /* Clear and enable VS_BLANK IRQ */
+ regmap_set_bits(dcif->regmap, DCIF_IS0(domain), DCIF_INT0_VS_BLANK);
+ regmap_set_bits(dcif->regmap, DCIF_IE0(domain), DCIF_INT0_VS_BLANK);
+
+ return 0;
+}
+
+static void dcif_crtc_disable_vblank(struct drm_crtc *crtc)
+{
+ struct dcif_dev *dcif = crtc_to_dcif_dev(crtc);
+ int domain = dcif->cpu_domain;
+
+ /* Disable and clear VS_BLANK IRQ */
+ regmap_clear_bits(dcif->regmap, DCIF_IE0(domain), DCIF_INT0_VS_BLANK);
+ regmap_clear_bits(dcif->regmap, DCIF_IS0(domain), DCIF_INT0_VS_BLANK);
+}
+
+static const struct drm_crtc_funcs dcif_crtc_funcs = {
+ .reset = dcif_crtc_reset,
+ .destroy = drm_crtc_cleanup,
+ .set_config = drm_atomic_helper_set_config,
+ .page_flip = drm_atomic_helper_page_flip,
+ .atomic_duplicate_state = dcif_crtc_atomic_duplicate_state,
+ .atomic_destroy_state = dcif_crtc_atomic_destroy_state,
+ .enable_vblank = dcif_crtc_enable_vblank,
+ .disable_vblank = dcif_crtc_disable_vblank,
+ .set_crc_source = dcif_crc_source_set,
+ .verify_crc_source = dcif_crc_source_verify,
+};
+
+irqreturn_t dcif_irq_handler(int irq, void *data)
+{
+ struct drm_device *drm = data;
+ struct dcif_dev *dcif = to_dcif_dev(drm);
+ int domain = dcif->cpu_domain;
+ u32 stat0, stat1, crc;
+
+ regmap_read(dcif->regmap, DCIF_IS0(domain), &stat0);
+ regmap_read(dcif->regmap, DCIF_IS1(domain), &stat1);
+ regmap_write(dcif->regmap, DCIF_IS0(domain), stat0);
+ regmap_write(dcif->regmap, DCIF_IS1(domain), stat1);
+
+ if (stat0 & DCIF_INT0_VS_BLANK) {
+ drm_crtc_handle_vblank(&dcif->crtc);
+
+ scoped_guard(spinlock_irqsave, &drm->event_lock) {
+ if (dcif->event) {
+ drm_crtc_send_vblank_event(&dcif->crtc, dcif->event);
+ dcif->event = NULL;
+ drm_crtc_vblank_put(&dcif->crtc);
+ }
+ if (dcif->crc_is_enabled) {
+ regmap_read(dcif->regmap, DCIF_CRC_VAL_R(0), &crc);
+ drm_crtc_add_crc_entry(&dcif->crtc, false, 0, &crc);
+ dev_dbg(drm->dev, "crc=0x%x\n", crc);
+ }
+ }
+ }
+
+ if (stat1 & (DCIF_INT1_FIFO_PANIC0 | DCIF_INT1_FIFO_PANIC1)) {
+ u32 panic = stat1 & (DCIF_INT1_FIFO_PANIC0 | DCIF_INT1_FIFO_PANIC1);
+
+ dev_dbg_ratelimited(drm->dev, "FIFO panic on %s\n",
+ panic == (DCIF_INT1_FIFO_PANIC0 | DCIF_INT1_FIFO_PANIC1) ?
+ "layers 0 & 1" : panic == DCIF_INT1_FIFO_PANIC0 ? "layer 0" :
+ "layer 1");
+ }
+
+ return IRQ_HANDLED;
+}
+
+int dcif_crtc_init(struct dcif_dev *dcif)
+{
+ int ret;
+
+ ret = dcif_plane_init(dcif);
+ if (ret)
+ return ret;
+
+ drm_crtc_helper_add(&dcif->crtc, &dcif_crtc_helper_funcs);
+ ret = drm_crtc_init_with_planes(&dcif->drm, &dcif->crtc, &dcif->planes.primary, NULL,
+ &dcif_crtc_funcs, NULL);
+ if (ret) {
+ drm_err(&dcif->drm, "failed to initialize CRTC: %d\n", ret);
+ return ret;
+ }
+
+ return 0;
+}
diff --git a/drivers/gpu/drm/imx/dcif/dcif-drv.c b/drivers/gpu/drm/imx/dcif/dcif-drv.c
new file mode 100644
index 0000000000000..50ca6461ffb30
--- /dev/null
+++ b/drivers/gpu/drm/imx/dcif/dcif-drv.c
@@ -0,0 +1,233 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright 2025 NXP
+ */
+
+#include <linux/dma-mapping.h>
+#include <linux/interrupt.h>
+#include <linux/mfd/syscon.h>
+#include <linux/mod_devicetable.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/regmap.h>
+
+#include <drm/clients/drm_client_setup.h>
+#include <drm/drm_atomic_helper.h>
+#include <drm/drm_drv.h>
+#include <drm/drm_fbdev_dma.h>
+#include <drm/drm_gem_dma_helper.h>
+#include <drm/drm_modeset_helper.h>
+#include <drm/drm_print.h>
+
+#include "dcif-drv.h"
+#include "dcif-reg.h"
+
+#define DCIF_CPU_DOMAIN 0
+
+DEFINE_DRM_GEM_DMA_FOPS(dcif_driver_fops);
+
+static struct drm_driver dcif_driver = {
+ .driver_features = DRIVER_MODESET | DRIVER_GEM | DRIVER_ATOMIC,
+ DRM_GEM_DMA_DRIVER_OPS,
+ DRM_FBDEV_DMA_DRIVER_OPS,
+ .fops = &dcif_driver_fops,
+ .name = "imx-dcif",
+ .desc = "i.MX DCIF DRM graphics",
+ .major = 1,
+ .minor = 0,
+ .patchlevel = 0,
+};
+
+static void dcif_read_chip_info(struct dcif_dev *dcif)
+{
+ struct drm_device *drm = &dcif->drm;
+ u32 val, vmin, vmaj;
+ int ret;
+
+ ret = pm_runtime_resume_and_get(drm->dev);
+ if (ret < 0) {
+ drm_err(drm, "failed to resume DCIF: %d\n", ret);
+ return;
+ }
+
+ regmap_read(dcif->regmap, DCIF_VER, &val);
+
+ dcif->has_crc = val & DCIF_FEATURE_CRC;
+
+ vmin = DCIF_VER_GET_MINOR(val);
+ vmaj = DCIF_VER_GET_MAJOR(val);
+ DRM_DEV_DEBUG(drm->dev, "DCIF version is %d.%d\n", vmaj, vmin);
+
+ pm_runtime_put_sync(drm->dev);
+}
+
+static const struct regmap_config dcif_regmap_config = {
+ .reg_bits = 32,
+ .val_bits = 32,
+ .reg_stride = 4,
+ .fast_io = true,
+ .max_register = 0x20250,
+ .cache_type = REGCACHE_NONE,
+ .disable_locking = true,
+};
+
+static int dcif_probe(struct platform_device *pdev)
+{
+ struct dcif_dev *dcif;
+ struct drm_device *drm;
+ int ret;
+ int i;
+
+ dcif = devm_drm_dev_alloc(&pdev->dev, &dcif_driver, struct dcif_dev, drm);
+ if (IS_ERR(dcif))
+ return PTR_ERR(dcif);
+
+ /* CPU 0 domain for interrupt control */
+ dcif->cpu_domain = DCIF_CPU_DOMAIN;
+
+ drm = &dcif->drm;
+ dev_set_drvdata(&pdev->dev, dcif);
+
+ dcif->reg_base = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(dcif->reg_base))
+ return dev_err_probe(drm->dev, PTR_ERR(dcif->reg_base),
+ "failed to get reg base\n");
+
+ for (i = 0; i < 3; i++) {
+ dcif->irq[i] = platform_get_irq(pdev, i);
+ if (dcif->irq[i] < 0)
+ return dev_err_probe(drm->dev, dcif->irq[i],
+ "failed to get domain%d irq\n", i);
+ }
+
+ dcif->regmap = devm_regmap_init_mmio(drm->dev, dcif->reg_base, &dcif_regmap_config);
+ if (IS_ERR(dcif->regmap))
+ return dev_err_probe(drm->dev, PTR_ERR(dcif->regmap),
+ "failed to init DCIF regmap\n");
+
+ dcif->num_clks = devm_clk_bulk_get_all(drm->dev, &dcif->clks);
+ if (dcif->num_clks < 0)
+ return dev_err_probe(drm->dev, dcif->num_clks,
+ "cannot get required clocks\n");
+
+ dma_set_mask_and_coherent(drm->dev, DMA_BIT_MASK(32));
+
+ devm_pm_runtime_enable(drm->dev);
+
+ ret = devm_request_irq(drm->dev, dcif->irq[dcif->cpu_domain],
+ dcif_irq_handler, 0, drm->driver->name, drm);
+ if (ret < 0)
+ return dev_err_probe(drm->dev, ret, "failed to install IRQ handler\n");
+
+ dcif_read_chip_info(dcif);
+
+ ret = dcif_kms_prepare(dcif);
+ if (ret)
+ return ret;
+
+ ret = drm_dev_register(drm, 0);
+ if (ret)
+ return dev_err_probe(drm->dev, ret, "failed to register drm device\n");
+
+ drm_client_setup(drm, NULL);
+
+ return 0;
+}
+
+static void dcif_remove(struct platform_device *pdev)
+{
+ struct dcif_dev *dcif = dev_get_drvdata(&pdev->dev);
+ struct drm_device *drm = &dcif->drm;
+
+ drm_dev_unregister(drm);
+
+ drm_atomic_helper_shutdown(drm);
+}
+
+static void dcif_shutdown(struct platform_device *pdev)
+{
+ struct dcif_dev *dcif = dev_get_drvdata(&pdev->dev);
+ struct drm_device *drm = &dcif->drm;
+
+ drm_atomic_helper_shutdown(drm);
+}
+
+static int dcif_runtime_suspend(struct device *dev)
+{
+ struct dcif_dev *dcif = dev_get_drvdata(dev);
+
+ clk_bulk_disable_unprepare(dcif->num_clks, dcif->clks);
+
+ return 0;
+}
+
+static int dcif_runtime_resume(struct device *dev)
+{
+ struct dcif_dev *dcif = dev_get_drvdata(dev);
+ int ret;
+
+ ret = clk_bulk_prepare_enable(dcif->num_clks, dcif->clks);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks: %d\n", ret);
+ return ret;
+ }
+
+ return 0;
+}
+
+static int dcif_suspend(struct device *dev)
+{
+ struct dcif_dev *dcif = dev_get_drvdata(dev);
+ int ret;
+
+ ret = drm_mode_config_helper_suspend(&dcif->drm);
+ if (ret < 0)
+ return ret;
+
+ if (pm_runtime_suspended(dev))
+ return 0;
+
+ return dcif_runtime_suspend(dev);
+}
+
+static int dcif_resume(struct device *dev)
+{
+ struct dcif_dev *dcif = dev_get_drvdata(dev);
+ int ret;
+
+ if (!pm_runtime_suspended(dev)) {
+ ret = dcif_runtime_resume(dev);
+ if (ret < 0)
+ return ret;
+ }
+
+ return drm_mode_config_helper_resume(&dcif->drm);
+}
+
+static const struct dev_pm_ops dcif_pm_ops = {
+ SET_SYSTEM_SLEEP_PM_OPS(dcif_suspend, dcif_resume)
+ SET_RUNTIME_PM_OPS(dcif_runtime_suspend, dcif_runtime_resume, NULL)
+};
+
+static const struct of_device_id dcif_dt_ids[] = {
+ { .compatible = "nxp,imx94-dcif", },
+ { /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, dcif_dt_ids);
+
+static struct platform_driver dcif_platform_driver = {
+ .probe = dcif_probe,
+ .remove = dcif_remove,
+ .shutdown = dcif_shutdown,
+ .driver = {
+ .name = "imx-dcif-drm",
+ .of_match_table = dcif_dt_ids,
+ .pm = pm_ptr(&dcif_pm_ops),
+ },
+};
+module_platform_driver(dcif_platform_driver);
+
+MODULE_AUTHOR("NXP Semiconductor");
+MODULE_DESCRIPTION("i.MX94 DCIF DRM driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/gpu/drm/imx/dcif/dcif-drv.h b/drivers/gpu/drm/imx/dcif/dcif-drv.h
new file mode 100644
index 0000000000000..895b2efc51a26
--- /dev/null
+++ b/drivers/gpu/drm/imx/dcif/dcif-drv.h
@@ -0,0 +1,89 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+/*
+ * Copyright 2025 NXP
+ */
+
+#ifndef __DCIF_DRV_H__
+#define __DCIF_DRV_H__
+
+#include <linux/clk.h>
+#include <linux/irqreturn.h>
+
+#include <drm/drm_crtc.h>
+#include <drm/drm_device.h>
+#include <drm/drm_encoder.h>
+#include <drm/drm_plane.h>
+#include <drm/drm_vblank.h>
+
+#define DCIF_CPU_DOMAINS 3
+
+struct dcif_dev {
+ struct drm_device drm;
+ void __iomem *reg_base;
+
+ struct regmap *regmap;
+ int irq[DCIF_CPU_DOMAINS];
+
+ int num_clks;
+ struct clk_bulk_data *clks;
+
+ struct drm_crtc crtc;
+ struct {
+ struct drm_plane primary;
+ struct drm_plane overlay;
+ } planes;
+ struct drm_encoder encoder;
+
+ struct drm_pending_vblank_event *event;
+
+ /* Implement crc */
+ bool has_crc;
+ bool crc_is_enabled;
+
+ /* Tracks whether atomic_enable obtained a PM runtime reference */
+ bool crtc_pm_enabled;
+
+ /* CPU domain for interrupt control */
+ int cpu_domain;
+};
+
+enum dcif_crc_source {
+ DCIF_CRC_SRC_NONE,
+ DCIF_CRC_SRC_FRAME,
+ DCIF_CRC_SRC_FRAME_ROI,
+};
+
+struct dcif_crc {
+ enum dcif_crc_source source;
+ struct drm_rect roi;
+};
+
+struct dcif_crtc_state {
+ struct drm_crtc_state base;
+ struct dcif_crc crc;
+ u32 bus_format;
+ u32 bus_flags;
+};
+
+static inline struct dcif_dev *to_dcif_dev(struct drm_device *drm_dev)
+{
+ return container_of(drm_dev, struct dcif_dev, drm);
+}
+
+static inline struct dcif_dev *crtc_to_dcif_dev(struct drm_crtc *crtc)
+{
+ return to_dcif_dev(crtc->dev);
+}
+
+static inline struct dcif_crtc_state *to_dcif_crtc_state(struct drm_crtc_state *s)
+{
+ return container_of(s, struct dcif_crtc_state, base);
+}
+
+irqreturn_t dcif_irq_handler(int irq, void *data);
+int dcif_crtc_init(struct dcif_dev *dcif);
+int dcif_plane_init(struct dcif_dev *dcif);
+int dcif_kms_prepare(struct dcif_dev *dcif);
+
+#endif
diff --git a/drivers/gpu/drm/imx/dcif/dcif-kms.c b/drivers/gpu/drm/imx/dcif/dcif-kms.c
new file mode 100644
index 0000000000000..8981434b0a803
--- /dev/null
+++ b/drivers/gpu/drm/imx/dcif/dcif-kms.c
@@ -0,0 +1,96 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright 2025 NXP
+ */
+
+#include <drm/drm_atomic_helper.h>
+#include <drm/drm_bridge.h>
+#include <drm/drm_bridge_connector.h>
+#include <drm/drm_gem_framebuffer_helper.h>
+#include <drm/drm_print.h>
+#include <drm/drm_probe_helper.h>
+#include <drm/drm_simple_kms_helper.h>
+
+#include "dcif-drv.h"
+
+static int dcif_kms_init(struct dcif_dev *dcif)
+{
+ struct drm_device *drm = &dcif->drm;
+ struct device_node *np = drm->dev->of_node;
+ struct drm_connector *connector;
+ struct drm_bridge *bridge;
+ int ret;
+
+ ret = dcif_crtc_init(dcif);
+ if (ret)
+ return ret;
+
+ bridge = devm_drm_of_get_bridge(drm->dev, np, 0, 0);
+ if (IS_ERR(bridge))
+ return dev_err_probe(drm->dev, PTR_ERR(bridge), "Failed to find bridge\n");
+
+ dcif->encoder.possible_crtcs = drm_crtc_mask(&dcif->crtc);
+ ret = drm_simple_encoder_init(drm, &dcif->encoder, DRM_MODE_ENCODER_NONE);
+ if (ret) {
+ drm_err(drm, "failed to initialize encoder: %d\n", ret);
+ return ret;
+ }
+
+ ret = drm_bridge_attach(&dcif->encoder, bridge, NULL, DRM_BRIDGE_ATTACH_NO_CONNECTOR);
+ if (ret) {
+ drm_err(drm, "failed to attach bridge to encoder: %d\n", ret);
+ return ret;
+ }
+
+ connector = drm_bridge_connector_init(drm, &dcif->encoder);
+ if (IS_ERR(connector)) {
+ drm_err(drm, "failed to initialize bridge connector: %ld\n", PTR_ERR(connector));
+ return PTR_ERR(connector);
+ }
+
+ return 0;
+}
+
+static const struct drm_mode_config_funcs dcif_mode_config_funcs = {
+ .fb_create = drm_gem_fb_create,
+ .atomic_check = drm_atomic_helper_check,
+ .atomic_commit = drm_atomic_helper_commit,
+};
+
+static const struct drm_mode_config_helper_funcs dcif_mode_config_helpers = {
+ .atomic_commit_tail = drm_atomic_helper_commit_tail_rpm,
+};
+
+int dcif_kms_prepare(struct dcif_dev *dcif)
+{
+ struct drm_device *drm = &dcif->drm;
+ int ret;
+
+ ret = drmm_mode_config_init(drm);
+ if (ret)
+ return ret;
+
+ ret = dcif_kms_init(dcif);
+ if (ret)
+ return ret;
+
+ drm->mode_config.min_width = 1;
+ drm->mode_config.min_height = 1;
+ drm->mode_config.max_width = 1920;
+ drm->mode_config.max_height = 1920;
+ drm->mode_config.funcs = &dcif_mode_config_funcs;
+ drm->mode_config.helper_private = &dcif_mode_config_helpers;
+
+ ret = drm_vblank_init(drm, 1);
+ if (ret < 0) {
+ drm_err(drm, "failed to initialize vblank: %d\n", ret);
+ return ret;
+ }
+
+ drm_mode_config_reset(drm);
+
+ drmm_kms_helper_poll_init(drm);
+
+ return 0;
+}
diff --git a/drivers/gpu/drm/imx/dcif/dcif-plane.c b/drivers/gpu/drm/imx/dcif/dcif-plane.c
new file mode 100644
index 0000000000000..7b5a68dab6587
--- /dev/null
+++ b/drivers/gpu/drm/imx/dcif/dcif-plane.c
@@ -0,0 +1,308 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright 2025 NXP
+ */
+
+#include <linux/regmap.h>
+
+#include <drm/drm_atomic.h>
+#include <drm/drm_atomic_helper.h>
+#include <drm/drm_blend.h>
+#include <drm/drm_fb_dma_helper.h>
+#include <drm/drm_fourcc.h>
+#include <drm/drm_framebuffer.h>
+#include <drm/drm_gem_atomic_helper.h>
+#include <drm/drm_gem_dma_helper.h>
+#include <drm/drm_print.h>
+#include <drm/drm_rect.h>
+
+#include "dcif-drv.h"
+#include "dcif-reg.h"
+
+static const u32 dcif_primary_plane_formats[] = {
+ /* RGB */
+ DRM_FORMAT_RGB565,
+ DRM_FORMAT_RGB888,
+ DRM_FORMAT_XBGR8888,
+ DRM_FORMAT_ABGR8888,
+ DRM_FORMAT_XRGB1555,
+ DRM_FORMAT_ARGB1555,
+ DRM_FORMAT_XRGB4444,
+ DRM_FORMAT_ARGB4444,
+ DRM_FORMAT_XRGB8888,
+ DRM_FORMAT_ARGB8888,
+
+ /* Packed YCbCr */
+ DRM_FORMAT_YUYV,
+ DRM_FORMAT_YVYU,
+ DRM_FORMAT_UYVY,
+ DRM_FORMAT_VYUY,
+};
+
+static const u32 dcif_overlay_plane_formats[] = {
+ /* RGB */
+ DRM_FORMAT_RGB565,
+ DRM_FORMAT_RGB888,
+ DRM_FORMAT_XBGR8888,
+ DRM_FORMAT_ABGR8888,
+ DRM_FORMAT_XRGB1555,
+ DRM_FORMAT_ARGB1555,
+ DRM_FORMAT_XRGB4444,
+ DRM_FORMAT_ARGB4444,
+ DRM_FORMAT_XRGB8888,
+ DRM_FORMAT_ARGB8888,
+};
+
+static inline struct dcif_dev *plane_to_dcif_dev(struct drm_plane *plane)
+{
+ return to_dcif_dev(plane->dev);
+}
+
+static inline dma_addr_t drm_plane_state_to_baseaddr(struct drm_plane_state *state)
+{
+ struct drm_framebuffer *fb = state->fb;
+ struct drm_gem_dma_object *dma_obj;
+ unsigned int x = state->src.x1 >> 16;
+ unsigned int y = state->src.y1 >> 16;
+
+ dma_obj = drm_fb_dma_get_gem_obj(fb, 0);
+ if (!dma_obj)
+ return 0;
+
+ return dma_obj->dma_addr + fb->offsets[0] + fb->pitches[0] * y + fb->format->cpp[0] * x;
+}
+
+static int dcif_plane_get_layer_id(struct drm_plane *plane)
+{
+ return (plane->type == DRM_PLANE_TYPE_PRIMARY) ? 0 : 1;
+}
+
+static int dcif_plane_atomic_check(struct drm_plane *plane, struct drm_atomic_commit *state)
+{
+ struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state, plane);
+ struct drm_plane_state *old_plane_state = drm_atomic_get_old_plane_state(state, plane);
+ struct dcif_dev *dcif = plane_to_dcif_dev(plane);
+ struct drm_framebuffer *fb = new_plane_state->fb;
+ struct drm_framebuffer *old_fb = old_plane_state->fb;
+ struct drm_crtc_state *crtc_state;
+ int ret;
+
+ if (!fb)
+ return 0;
+
+ crtc_state = drm_atomic_get_new_crtc_state(state, &dcif->crtc);
+ if (WARN_ON(!crtc_state))
+ return -EINVAL;
+
+ /*
+ * Force CRTC mode change if framebuffer stride or pixel format have changed.
+ */
+ if (plane->type == DRM_PLANE_TYPE_PRIMARY && old_fb &&
+ (fb->pitches[0] != old_fb->pitches[0] || fb->format->format != old_fb->format->format))
+ crtc_state->mode_changed = true;
+
+ ret = drm_atomic_helper_check_plane_state(new_plane_state, crtc_state,
+ DRM_PLANE_NO_SCALING,
+ DRM_PLANE_NO_SCALING,
+ true,
+ true);
+ if (ret)
+ return ret;
+
+ if (new_plane_state->fb->format->has_alpha &&
+ new_plane_state->pixel_blend_mode != DRM_MODE_BLEND_PIXEL_NONE &&
+ new_plane_state->alpha != DRM_BLEND_ALPHA_OPAQUE)
+ return -EINVAL;
+
+ return 0;
+}
+
+static void dcif_plane_atomic_update(struct drm_plane *plane, struct drm_atomic_commit *state)
+{
+ struct drm_plane_state *new_state = drm_atomic_get_new_plane_state(state, plane);
+ struct dcif_dev *dcif = plane_to_dcif_dev(plane);
+ int layer_id = dcif_plane_get_layer_id(plane);
+ struct drm_framebuffer *fb = new_state->fb;
+ u32 crtc_x, crtc_y, crtc_h, crtc_w;
+ u32 layer_fmt = 0, yuv_fmt = 0;
+ dma_addr_t baseaddr;
+ u32 reg;
+
+ if (!fb)
+ return;
+
+ crtc_x = new_state->dst.x1;
+ crtc_y = new_state->dst.y1;
+ crtc_w = drm_rect_width(&new_state->dst);
+ crtc_h = drm_rect_height(&new_state->dst);
+
+ /* visible portion of plane on crtc */
+ regmap_write(dcif->regmap, DCIF_CTRLDESC1(layer_id),
+ DCIF_CTRLDESC1_POSX(crtc_x) | DCIF_CTRLDESC1_POSY(crtc_y));
+ regmap_write(dcif->regmap, DCIF_CTRLDESC2(layer_id),
+ DCIF_CTRLDESC2_WIDTH(crtc_w) | DCIF_CTRLDESC2_HEIGHT(crtc_h));
+
+ /* pitch size */
+ reg = DCIF_CTRLDESC3_P_SIZE(2) | DCIF_CTRLDESC3_T_SIZE(2) |
+ DCIF_CTRLDESC3_PITCH(fb->pitches[0]);
+ regmap_write(dcif->regmap, DCIF_CTRLDESC3(layer_id), reg);
+
+ /* address */
+ baseaddr = drm_plane_state_to_baseaddr(new_state);
+
+ drm_dbg_kms(plane->dev, "[PLANE:%d:%s] fb address %pad, pitch 0x%08x\n",
+ plane->base.id, plane->name, &baseaddr, fb->pitches[0]);
+
+ regmap_write(dcif->regmap, DCIF_CTRLDESC4(layer_id), baseaddr);
+
+ /* Format */
+ switch (fb->format->format) {
+ /* RGB Formats */
+ case DRM_FORMAT_RGB565:
+ layer_fmt = CTRLDESCL0_FORMAT_RGB565;
+ break;
+ case DRM_FORMAT_RGB888:
+ layer_fmt = CTRLDESCL0_FORMAT_RGB888;
+ break;
+ case DRM_FORMAT_XRGB1555:
+ case DRM_FORMAT_ARGB1555:
+ layer_fmt = CTRLDESCL0_FORMAT_ARGB1555;
+ break;
+ case DRM_FORMAT_XRGB4444:
+ case DRM_FORMAT_ARGB4444:
+ layer_fmt = CTRLDESCL0_FORMAT_ARGB4444;
+ break;
+ case DRM_FORMAT_XBGR8888:
+ case DRM_FORMAT_ABGR8888:
+ layer_fmt = CTRLDESCL0_FORMAT_ABGR8888;
+ break;
+ case DRM_FORMAT_XRGB8888:
+ case DRM_FORMAT_ARGB8888:
+ layer_fmt = CTRLDESCL0_FORMAT_ARGB8888;
+ break;
+
+ /* YUV Formats */
+ case DRM_FORMAT_YUYV:
+ layer_fmt = CTRLDESCL0_FORMAT_YCBCR422;
+ yuv_fmt = CTRLDESCL0_YUV_FORMAT_VY2UY1;
+ break;
+ case DRM_FORMAT_YVYU:
+ layer_fmt = CTRLDESCL0_FORMAT_YCBCR422;
+ yuv_fmt = CTRLDESCL0_YUV_FORMAT_UY2VY1;
+ break;
+ case DRM_FORMAT_UYVY:
+ layer_fmt = CTRLDESCL0_FORMAT_YCBCR422;
+ yuv_fmt = CTRLDESCL0_YUV_FORMAT_Y2VY1U;
+ break;
+ case DRM_FORMAT_VYUY:
+ layer_fmt = CTRLDESCL0_FORMAT_YCBCR422;
+ yuv_fmt = CTRLDESCL0_YUV_FORMAT_Y2UY1V;
+ break;
+
+ default:
+ dev_err(dcif->drm.dev, "Unknown pixel format 0x%x\n", fb->format->format);
+ break;
+ }
+
+ reg = DCIF_CTRLDESC0_EN | DCIF_CTRLDESC0_SHADOW_LOAD_EN |
+ DCIF_CTRLDESC0_FORMAT(layer_fmt) | DCIF_CTRLDESC0_YUV_FORMAT(yuv_fmt);
+
+ /* Alpha */
+ if (new_state->pixel_blend_mode == DRM_MODE_BLEND_PIXEL_NONE ||
+ !new_state->fb->format->has_alpha)
+ reg |= DCIF_CTRLDESC0_GLOBAL_ALPHA(new_state->alpha >> 8) | ALPHA_GLOBAL;
+ else if (new_state->pixel_blend_mode == DRM_MODE_BLEND_COVERAGE)
+ reg |= ALPHA_EMBEDDED;
+ else
+ /*
+ * DCIF does not support premultiplied per-pixel blending but,
+ * since PREMULTI's property presence is mandatory to not break
+ * userspace, we just disable alpha blending for this one.
+ */
+ reg |= DCIF_CTRLDESC0_GLOBAL_ALPHA(255) | ALPHA_GLOBAL;
+
+ regmap_write(dcif->regmap, DCIF_CTRLDESC0(layer_id), reg);
+}
+
+static void dcif_overlay_plane_atomic_disable(struct drm_plane *plane,
+ struct drm_atomic_commit *state)
+{
+ struct dcif_dev *dcif = plane_to_dcif_dev(plane);
+
+ regmap_update_bits(dcif->regmap, DCIF_CTRLDESC0(1),
+ DCIF_CTRLDESC0_EN | DCIF_CTRLDESC0_SHADOW_LOAD_EN,
+ DCIF_CTRLDESC0_SHADOW_LOAD_EN);
+}
+
+static const struct drm_plane_helper_funcs dcif_primary_plane_helper_funcs = {
+ .prepare_fb = drm_gem_plane_helper_prepare_fb,
+ .atomic_check = dcif_plane_atomic_check,
+ .atomic_update = dcif_plane_atomic_update,
+};
+
+static const struct drm_plane_helper_funcs dcif_overlay_plane_helper_funcs = {
+ .atomic_check = dcif_plane_atomic_check,
+ .atomic_update = dcif_plane_atomic_update,
+ .atomic_disable = dcif_overlay_plane_atomic_disable,
+};
+
+static const struct drm_plane_funcs dcif_plane_funcs = {
+ .update_plane = drm_atomic_helper_update_plane,
+ .disable_plane = drm_atomic_helper_disable_plane,
+ .destroy = drm_plane_cleanup,
+ .reset = drm_atomic_helper_plane_reset,
+ .atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state,
+ .atomic_destroy_state = drm_atomic_helper_plane_destroy_state,
+};
+
+int dcif_plane_init(struct dcif_dev *dcif)
+{
+ const u32 supported_encodings = BIT(DRM_COLOR_YCBCR_BT601) |
+ BIT(DRM_COLOR_YCBCR_BT709) |
+ BIT(DRM_COLOR_YCBCR_BT2020);
+ const u32 supported_ranges = BIT(DRM_COLOR_YCBCR_LIMITED_RANGE) |
+ BIT(DRM_COLOR_YCBCR_FULL_RANGE);
+ int ret;
+
+ /* primary plane */
+ drm_plane_helper_add(&dcif->planes.primary, &dcif_primary_plane_helper_funcs);
+ ret = drm_universal_plane_init(&dcif->drm, &dcif->planes.primary, 1, &dcif_plane_funcs,
+ dcif_primary_plane_formats,
+ ARRAY_SIZE(dcif_primary_plane_formats), NULL,
+ DRM_PLANE_TYPE_PRIMARY, NULL);
+ if (ret) {
+ drm_err(&dcif->drm, "failed to initialize primary plane: %d\n", ret);
+ return ret;
+ }
+
+ ret = drm_plane_create_color_properties(&dcif->planes.primary, supported_encodings,
+ supported_ranges, DRM_COLOR_YCBCR_BT601,
+ DRM_COLOR_YCBCR_LIMITED_RANGE);
+ if (ret)
+ return ret;
+
+ ret = drm_plane_create_alpha_property(&dcif->planes.primary);
+ if (ret)
+ return ret;
+
+ /* overlay plane */
+ drm_plane_helper_add(&dcif->planes.overlay, &dcif_overlay_plane_helper_funcs);
+ ret = drm_universal_plane_init(&dcif->drm, &dcif->planes.overlay, 1, &dcif_plane_funcs,
+ dcif_overlay_plane_formats,
+ ARRAY_SIZE(dcif_overlay_plane_formats), NULL,
+ DRM_PLANE_TYPE_OVERLAY, NULL);
+ if (ret) {
+ drm_err(&dcif->drm, "failed to initialize overlay plane: %d\n", ret);
+ return ret;
+ }
+
+ ret = drm_plane_create_alpha_property(&dcif->planes.overlay);
+ if (ret)
+ return ret;
+
+ return drm_plane_create_blend_mode_property(&dcif->planes.overlay,
+ BIT(DRM_MODE_BLEND_PIXEL_NONE) |
+ BIT(DRM_MODE_BLEND_PREMULTI) |
+ BIT(DRM_MODE_BLEND_COVERAGE));
+}
diff --git a/drivers/gpu/drm/imx/dcif/dcif-reg.h b/drivers/gpu/drm/imx/dcif/dcif-reg.h
new file mode 100644
index 0000000000000..acf9e3071aa52
--- /dev/null
+++ b/drivers/gpu/drm/imx/dcif/dcif-reg.h
@@ -0,0 +1,267 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+/*
+ * Copyright 2025 NXP
+ */
+#ifndef __DCIF_REG_H__
+#define __DCIF_REG_H__
+
+#include <linux/bits.h>
+
+/* Version ID Register */
+#define DCIF_VER 0x0
+#define DCIF_VER_GET_FEATURE(x) FIELD_GET(GENMASK(15, 0), x)
+#define DCIF_VER_GET_MINOR(x) FIELD_GET(GENMASK(23, 16), x)
+#define DCIF_VER_GET_MAJOR(x) FIELD_GET(GENMASK(31, 24), x)
+#define DCIF_FEATURE_CRC BIT(1)
+
+/* Parameter Registers */
+#define DCIF_PAR_0 0x4
+#define DCIF_PAR_0_LAYER_NUM(x) FIELD_PREP(GENMASK(3, 0), x)
+#define DCIF_PAR_0_DOMAIN_NUM(x) FIELD_PREP(GENMASK(5, 4), x)
+#define DCIF_PAR_0_AXI_DATA_WIDTH(x) FIELD_PREP(GENMASK(7, 6), x)
+#define DCIF_PAR_0_CLUT_RAM_NUM(x) FIELD_PREP(GENMASK(11, 8), x)
+#define DCIF_PAR_0_CSC_NUM(x) FIELD_PREP(GENMASK(13, 12), x)
+#define DCIF_PAR_0_CRC_REGION_NUM(x) FIELD_PREP(GENMASK(18, 16), x)
+#define DCIF_PAR_0_BACKUP(x) FIELD_PREP(GENMASK(31, 28), x)
+
+#define DCIF_PAR_1 0x8
+#define DCIF_PAR_1_LAYER0_FIFO_SIZE(x) FIELD_PREP(GENMASK(3, 0), x)
+#define DCIF_PAR_1_LAYER1_FIFO_SIZE(x) FIELD_PREP(GENMASK(7, 4), x)
+
+/* Display Control and Parameter Registers */
+#define DCIF_DISP_CTRL 0x10
+#define DCIF_DISP_CTRL_DISP_ON BIT(0)
+#define DCIF_DISP_CTRL_AXI_RD_HOLD BIT(30)
+#define DCIF_DISP_CTRL_SW_RST BIT(31)
+#define DCIF_DISP_PAR 0x14
+#define DCIF_DISP_PAR_BGND_B(x) FIELD_PREP(GENMASK(7, 0), x)
+#define DCIF_DISP_PAR_BGND_G(x) FIELD_PREP(GENMASK(15, 8), x)
+#define DCIF_DISP_PAR_BGND_R(x) FIELD_PREP(GENMASK(23, 16), x)
+#define DCIF_DISP_SIZE 0x18
+#define DCIF_DISP_SIZE_DISP_WIDTH(x) FIELD_PREP(GENMASK(11, 0), x)
+#define DCIF_DISP_SIZE_DISP_HEIGHT(x) FIELD_PREP(GENMASK(27, 16), x)
+
+/* Display Status Registers */
+#define DCIF_DISP_SR0 0x1C
+#define DCIF_DISP_SR0_AXI_RD_PEND(x) FIELD_PREP(GENMASK(4, 0), x)
+#define DCIF_DISP_SR0_DPI_BUSY(x) FIELD_PREP(GENMASK(14, 14), x)
+#define DCIF_DISP_SR0_AXI_RD_BUSY(x) FIELD_PREP(GENMASK(15, 15), x)
+#define DCIF_DISP_SR0_TXFIFO_CNT(x) FIELD_PREP(GENMASK(23, 16), x)
+
+#define DCIF_DISP_SR1 0x20
+#define DCIF_DISP_SR1_H_CNT(x) FIELD_PREP(GENMASK(11, 0), x)
+#define DCIF_DISP_SR1_V_CNT(x) FIELD_PREP(GENMASK(27, 16), x)
+
+/* Interrupt Enable and Status Registers, n=0-2*/
+#define DCIF_IE0(n) (0x24 + (n) * 0x10000)
+#define DCIF_IS0(n) (0x28 + (n) * 0x10000)
+#define DCIF_INT0_VSYNC BIT(0)
+#define DCIF_INT0_UNDERRUN BIT(1)
+#define DCIF_INT0_VS_BLANK BIT(2)
+#define DCIF_INT0_HIST_DONE BIT(5)
+#define DCIF_INT0_CRC_ERR BIT(6)
+#define DCIF_INT0_CRC_ERR_SAT BIT(7)
+
+#define DCIF_IE1(n) (0x2C + (n) * 0x10000)
+#define DCIF_IS1(n) (0x30 + (n) * 0x10000)
+#define DCIF_INT1_FIFO_PANIC0 BIT(0)
+#define DCIF_INT1_FIFO_PANIC1 BIT(1)
+#define DCIF_INT1_DMA_ERR0 BIT(8)
+#define DCIF_INT1_DMA_ERR1 BIT(9)
+#define DCIF_INT1_DMA_DONE0 BIT(16)
+#define DCIF_INT1_DMA_DONE1 BIT(17)
+#define DCIF_INT1_FIFO_EMPTY0 BIT(24)
+#define DCIF_INT1_FIFO_EMPTY1 BIT(25)
+
+/* DPI Control and Sync Parameter Registers */
+#define DCIF_DPI_CTRL 0x40
+#define DCIF_DPI_CTRL_HSYNC_POL_LOW BIT(0)
+#define DCIF_DPI_CTRL_VSYNC_POL_LOW BIT(1)
+#define DCIF_DPI_CTRL_DE_POL_LOW BIT(2)
+#define DCIF_DPI_CTRL_PCLK_EDGE_FALLING BIT(3)
+#define DCIF_DPI_CTRL_POL_MASK GENMASK(3, 0)
+#define DCIF_DPI_CTRL_DATA_INV(x) FIELD_PREP(GENMASK(4, 4), x)
+#define DCIF_DPI_CTRL_DEF_BGND_EN(x) FIELD_PREP(GENMASK(5, 5), x)
+#define DCIF_DPI_CTRL_FETCH_OPT(x) FIELD_PREP(GENMASK(9, 8), x)
+#define DCIF_DPI_CTRL_DISP_MODE(x) FIELD_PREP(GENMASK(13, 12), x)
+#define DCIF_DPI_CTRL_DATA_PATTERN_MASK GENMASK(18, 16)
+#define DCIF_DPI_CTRL_DATA_PATTERN(x) FIELD_PREP(GENMASK(18, 16), x)
+#define PATTERN_RGB888 0
+#define PATTERN_RBG888 1
+#define PATTERN_GBR888 2
+#define PATTERN_GRB888 3
+#define PATTERN_BRG888 4
+#define PATTERN_BGR888 5
+#define PATTERN_RGB555 6
+#define PATTERN_RGB565 7
+
+#define DCIF_DPI_HSYN_PAR 0x44
+#define DCIF_DPI_HSYN_PAR_FP_H(x) FIELD_PREP(GENMASK(11, 0), x)
+#define DCIF_DPI_HSYN_PAR_BP_H(x) FIELD_PREP(GENMASK(27, 16), x)
+
+#define DCIF_DPI_VSYN_PAR 0x48
+#define DCIF_DPI_VSYN_PAR_FP_V(x) FIELD_PREP(GENMASK(11, 0), x)
+#define DCIF_DPI_VSYN_PAR_BP_V(x) FIELD_PREP(GENMASK(27, 16), x)
+
+#define DCIF_DPI_VSYN_HSYN_WIDTH 0x4C
+#define DCIF_DPI_VSYN_HSYN_WIDTH_PW_H(x) FIELD_PREP(GENMASK(11, 0), x)
+#define DCIF_DPI_VSYN_HSYN_WIDTH_PW_V(x) FIELD_PREP(GENMASK(27, 16), x)
+
+/* Control Descriptor Registers, n=0-1*/
+#define DCIF_CTRLDESC0(n) (0x10000 + (n) * 0x10000)
+#define DCIF_CTRLDESC0_AB_MODE(x) FIELD_PREP(GENMASK(1, 0), x)
+#define ALPHA_EMBEDDED 0
+#define ALPHA_GLOBAL 1
+#define DCIF_CTRLDESC0_YUV_FORMAT_MASK GENMASK(15, 14)
+#define DCIF_CTRLDESC0_YUV_FORMAT(x) FIELD_PREP(GENMASK(15, 14), x)
+#define CTRLDESCL0_YUV_FORMAT_Y2VY1U 0x0
+#define CTRLDESCL0_YUV_FORMAT_Y2UY1V 0x1
+#define CTRLDESCL0_YUV_FORMAT_VY2UY1 0x2
+#define CTRLDESCL0_YUV_FORMAT_UY2VY1 0x3
+#define DCIF_CTRLDESC0_GLOBAL_ALPHA(x) FIELD_PREP(GENMASK(23, 16), x)
+#define DCIF_CTRLDESC0_FORMAT_MASK GENMASK(27, 24)
+#define DCIF_CTRLDESC0_FORMAT(x) FIELD_PREP(GENMASK(27, 24), x)
+#define CTRLDESCL0_FORMAT_RGB565 0x4
+#define CTRLDESCL0_FORMAT_ARGB1555 0x5
+#define CTRLDESCL0_FORMAT_ARGB4444 0x6
+#define CTRLDESCL0_FORMAT_YCBCR422 0x7
+#define CTRLDESCL0_FORMAT_RGB888 0x8
+#define CTRLDESCL0_FORMAT_ARGB8888 0x9
+#define CTRLDESCL0_FORMAT_ABGR8888 0xa
+#define DCIF_CTRLDESC0_SHADOW_LOAD_EN BIT(30)
+#define DCIF_CTRLDESC0_EN BIT(31)
+
+#define DCIF_CTRLDESC1(n) (0x10004 + (n) * 0x10000)
+#define DCIF_CTRLDESC1_POSX(x) FIELD_PREP(GENMASK(11, 0), x)
+#define DCIF_CTRLDESC1_POSY(x) FIELD_PREP(GENMASK(27, 16), x)
+
+#define DCIF_CTRLDESC2(n) (0x10008 + (n) * 0x10000)
+#define DCIF_CTRLDESC2_WIDTH(x) FIELD_PREP(GENMASK(11, 0), x)
+#define DCIF_CTRLDESC2_HEIGHT(x) FIELD_PREP(GENMASK(27, 16), x)
+
+#define DCIF_CTRLDESC3(n) (0x1000C + (n) * 0x10000)
+#define DCIF_CTRLDESC3_PITCH(x) FIELD_PREP(GENMASK(15, 0), x)
+#define DCIF_CTRLDESC3_T_SIZE(x) FIELD_PREP(GENMASK(17, 16), x)
+#define DCIF_CTRLDESC3_P_SIZE(x) FIELD_PREP(GENMASK(22, 20), x)
+
+#define DCIF_CTRLDESC4(n) (0x10010 + (n) * 0x10000)
+#define DCIF_CTRLDESC4_ADDR(x) FIELD_PREP(GENMASK(31, 0), x)
+
+#define DCIF_CTRLDESC5(n) (0x10014 + (n) * 0x10000)
+#define DCIF_CTRLDESC6(n) (0x10018 + (n) * 0x10000)
+#define DCIF_CTRLDESC6_BCLR_B(x) FIELD_PREP(GENMASK(7, 0), x)
+#define DCIF_CTRLDESC6_BCLR_G(x) FIELD_PREP(GENMASK(15, 8), x)
+#define DCIF_CTRLDESC6_BCLR_R(x) FIELD_PREP(GENMASK(23, 16), x)
+#define DCIF_CTRLDESC6_BCLR_A(x) FIELD_PREP(GENMASK(31, 24), x)
+
+/* CLUT control Register */
+#define DCIF_CLUT_CTRL 0x1003C
+#define DCIF_CLUT_CTRL_CLUT0_SEL(x) FIELD_PREP(GENMASK(0, 0), x)
+#define DCIF_CLUT_CTRL_CLUT1_SEL(x) FIELD_PREP(GENMASK(3, 3), x)
+#define DCIF_CLUT_CTRL_CLUT_MUX(x) FIELD_PREP(GENMASK(29, 28), x)
+#define DCIF_CLUT_CTRL_CLUT_SHADOW_LOAD_EN(x) FIELD_PREP(GENMASK(31, 31), x)
+
+/* FIFO Panic Threshold Register, n=0-1 */
+#define DCIF_PANIC_THRES(n) (0x10040 + (n) * 0x10000)
+#define DCIF_PANIC_THRES_LOW_MASK GENMASK(11, 0)
+#define DCIF_PANIC_THRES_LOW(x) FIELD_PREP(GENMASK(11, 00), x)
+#define DCIF_PANIC_THRES_HIGH_MASK GENMASK(27, 16)
+#define DCIF_PANIC_THRES_HIGH(x) FIELD_PREP(GENMASK(27, 16), x)
+#define DCIF_PANIC_THRES_REQ_EN BIT(31)
+#define PANIC0_THRES_MAX 511
+
+/* Layer Status Register 0, n=0-1 */
+#define DCIF_LAYER_SR0(n) (0x10044 + (n) * 0x10000)
+#define DCIF_LAYER_SR0_L0_FIFO_CNT_MASK GENMASK(9, 0)
+#define DCIF_LAYER_SR0_L0_FIFO_CNT(x) FIELD_PREP(GENMASK(9, 0), x)
+
+/* Color Space Conversion Control and Coefficient Registers for Layer 0 */
+#define DCIF_CSC_CTRL_L0 0x10050
+#define DCIF_CSC_CTRL_L0_CSC_EN BIT(0)
+#define DCIF_CSC_CTRL_L0_CSC_MODE_YCBCR2RGB BIT(1)
+
+#define DCIF_CSC_COEF0_L0 0x10054
+#define DCIF_CSC_COEF0_L0_A1(x) FIELD_PREP_CONST(GENMASK(10, 0), x)
+#define DCIF_CSC_COEF0_L0_A2(x) FIELD_PREP_CONST(GENMASK(26, 16), x)
+
+#define DCIF_CSC_COEF1_L0 0x10058
+#define DCIF_CSC_COEF1_L0_A3(x) FIELD_PREP_CONST(GENMASK(10, 0), x)
+#define DCIF_CSC_COEF1_L0_B1(x) FIELD_PREP_CONST(GENMASK(26, 16), x)
+
+#define DCIF_CSC_COEF2_L0 0x1005C
+#define DCIF_CSC_COEF2_L0_B2(x) FIELD_PREP_CONST(GENMASK(10, 0), x)
+#define DCIF_CSC_COEF2_L0_B3(x) FIELD_PREP_CONST(GENMASK(26, 16), x)
+
+#define DCIF_CSC_COEF3_L0 0x10060
+#define DCIF_CSC_COEF3_L0_C1(x) FIELD_PREP_CONST(GENMASK(10, 0), x)
+#define DCIF_CSC_COEF3_L0_C2(x) FIELD_PREP_CONST(GENMASK(26, 16), x)
+
+#define DCIF_CSC_COEF4_L0 0x10064
+#define DCIF_CSC_COEF4_L0_C3(x) FIELD_PREP_CONST(GENMASK(10, 0), x)
+#define DCIF_CSC_COEF4_L0_D1(x) FIELD_PREP_CONST(GENMASK(24, 16), x)
+
+#define DCIF_CSC_COEF5_L0 0x10068
+#define DCIF_CSC_COEF5_L0_D2(x) FIELD_PREP_CONST(GENMASK(8, 0), x)
+#define DCIF_CSC_COEF5_L0_D3(x) FIELD_PREP_CONST(GENMASK(24, 16), x)
+
+/* CRC Control, Threshold, and Histogram Coefficient Registers */
+#define DCIF_CRC_CTRL 0x20100
+#define DCIF_CRC_CTRL_CRC_EN(x) (1 << (x))
+#define DCIF_CRC_CTRL_HIST_REGION_SEL(x) FIELD_PREP(GENMASK(17, 16), x)
+#define DCIF_CRC_CTRL_HIST_MODE BIT(21)
+#define DCIF_CRC_CTRL_HIST_TRIG BIT(22)
+#define DCIF_CRC_CTRL_HIST_EN BIT(23)
+#define DCIF_CRC_CTRL_CRC_MODE BIT(28)
+#define DCIF_CRC_CTRL_CRC_TRIG BIT(29)
+#define DCIF_CRC_CTRL_CRC_ERR_CNT_RST BIT(30)
+#define DCIF_CRC_CTRL_CRC_SHADOW_LOAD_EN BIT(31)
+
+#define DCIF_CRC_THRES 0x20104
+#define DCIF_CRC_THRES_CRC_THRESHOLD_MASK GENMASK(31, 0)
+#define DCIF_CRC_THRES_CRC_THRESHOLD(x) FIELD_PREP(GENMASK(31, 0), x)
+
+#define DCIF_CRC_HIST_COEF 0x20108
+#define DCIF_CRC_HIST_COEF_HIST_WB_MASK GENMASK(7, 0)
+#define DCIF_CRC_HIST_COEF_HIST_WB(x) FIELD_PREP(GENMASK(7, 0), x)
+#define DCIF_CRC_HIST_COEF_HIST_WG_MASK GENMASK(15, 8)
+#define DCIF_CRC_HIST_COEF_HIST_WG(x) FIELD_PREP(GENMASK(15, 8), x)
+#define DCIF_CRC_HIST_COEF_HIST_WR_MASK GENMASK(23, 16)
+#define DCIF_CRC_HIST_COEF_HIST_WR(x) FIELD_PREP(GENMASK(23, 16), x)
+
+#define DCIF_CRC_ERR_CNT 0x2010C
+#define DCIF_CRC_ERR_CNT_CRC_ERR_CNT_MASK GENMASK(31, 0)
+#define DCIF_CRC_ERR_CNT_CRC_ERR_CNT(x) FIELD_PREP(GENMASK(31, 0), x)
+
+#define DCIF_CRC_SR 0x20110
+#define DCIF_CRC_SR_HIST_CNT_SAT_MASK BIT(13)
+#define DCIF_CRC_SR_HIST_CNT_SAT(x) FIELD_PREP(GENMASK(13, 13), x)
+#define DCIF_CRC_SR_HIST_SAT_MASK BIT(14)
+#define DCIF_CRC_SR_HIST_SAT(x) FIELD_PREP(GENMASK(14, 14), x)
+#define DCIF_CRC_SR_HIST_BUSY_MASK BIT(15)
+#define DCIF_CRC_SR_HIST_BUSY(x) FIELD_PREP(GENMASK(15, 15), x)
+#define DCIF_CRC_SR_CRC_STATUS_MASK BIT(31)
+#define DCIF_CRC_SR_CRC_STATUS(x) FIELD_PREP(GENMASK(31, 31), x)
+
+#define DCIF_CRC_HIST_CNT_B(n) (0x20114 + (n) * 4)
+#define DCIF_B_BIN_CNT_MASK GENMASK(20, 0)
+#define DCIF_B_BIN_CNT(x) FIELD_PREP(GENMASK(20, 0), x)
+
+/* CRC Region Position, Size, Value, and Expected Value Registers, n=0-3 */
+#define DCIF_CRC_POS_R(n) (0x20214 + (n) * 0x10)
+#define DCIF_CRC_POS_CRC_HOR_POS(x) FIELD_PREP(GENMASK(11, 0), x)
+#define DCIF_CRC_POS_CRC_VER_POS(x) FIELD_PREP(GENMASK(27, 16), x)
+
+#define DCIF_CRC_SIZE_R(n) (0x20218 + (n) * 0x10)
+#define DCIF_CRC_SIZE_CRC_HOR_SIZE(x) FIELD_PREP(GENMASK(11, 0), x)
+#define DCIF_CRC_SIZE_CRC_VER_SIZE(x) FIELD_PREP(GENMASK(27, 16), x)
+
+#define DCIF_CRC_VAL_R(n) (0x2021C + (n) * 0x10)
+#define DCIF_CRC_VAL_CRC_VAL_MASK GENMASK(31, 0)
+#define DCIF_CRC_VAL_CRC_VAL(x) FIELD_PREP(GENMASK(31, 0), x)
+
+#define DCIF_CRC_EXP_VAL_R(n) (0x20220 + (n) * 0x10)
+#define DCIF_CRC_EXP_VAL_CRC_EXP_VAL_MASK GENMASK(31, 0)
+#define DCIF_CRC_EXP_VAL_CRC_EXP_VAL(x) FIELD_PREP(GENMASK(31, 0), x)
+
+#endif /* __DCIF_REG_H__ */
--
2.51.0
^ permalink raw reply related
* [PATCH v9 6/9] dt-bindings: clock: nxp,imx95-blk-ctl: Add ldb child node
From: Laurentiu Palcu @ 2026-06-12 11:58 UTC (permalink / raw)
To: Ying Liu, Luca Ceresoli, Abel Vesa, Peng Fan, Michael Turquette,
Stephen Boyd, Brian Masney, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Frank Li, Sascha Hauer, Pengutronix Kernel Team,
Fabio Estevam
Cc: Laurentiu Palcu, linux-clk, imx, devicetree, linux-arm-kernel,
linux-kernel, dri-devel
In-Reply-To: <20260612-dcif-upstreaming-v9-0-8d0ff89aa3c5@oss.nxp.com>
Since the BLK CTL registers, like the LVDS CSR, can be used to control the
LVDS Display Bridge controllers, add 'ldb' child node to handle
these use cases.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
---
.../bindings/clock/nxp,imx95-blk-ctl.yaml | 26 ++++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/Documentation/devicetree/bindings/clock/nxp,imx95-blk-ctl.yaml b/Documentation/devicetree/bindings/clock/nxp,imx95-blk-ctl.yaml
index 27403b4c52d62..2b3c762aba1e0 100644
--- a/Documentation/devicetree/bindings/clock/nxp,imx95-blk-ctl.yaml
+++ b/Documentation/devicetree/bindings/clock/nxp,imx95-blk-ctl.yaml
@@ -26,6 +26,12 @@ properties:
reg:
maxItems: 1
+ '#address-cells':
+ const: 1
+
+ '#size-cells':
+ const: 1
+
power-domains:
maxItems: 1
@@ -39,6 +45,11 @@ properties:
ID in its "clocks" phandle cell. See
include/dt-bindings/clock/nxp,imx95-clock.h
+patternProperties:
+ '^ldb@[0-9a-f]+$':
+ type: object
+ $ref: /schemas/display/bridge/fsl,ldb.yaml#
+
required:
- compatible
- reg
@@ -46,6 +57,21 @@ required:
- power-domains
- clocks
+allOf:
+ - if:
+ not:
+ properties:
+ compatible:
+ contains:
+ const: nxp,imx94-lvds-csr
+ then:
+ patternProperties:
+ "^ldb@[0-9a-f]+$": false
+ else:
+ required:
+ - '#address-cells'
+ - '#size-cells'
+
additionalProperties: false
examples:
--
2.51.0
^ permalink raw reply related
* [PATCH v9 3/9] drm/bridge: fsl-ldb: Add support for i.MX94
From: Laurentiu Palcu @ 2026-06-12 11:58 UTC (permalink / raw)
To: Ying Liu, Luca Ceresoli, Andrzej Hajda, Neil Armstrong,
Robert Foss, Laurent Pinchart, Jonas Karlman, Jernej Skrabec,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Simona Vetter
Cc: Laurentiu Palcu, linux-clk, imx, devicetree, linux-arm-kernel,
linux-kernel, dri-devel
In-Reply-To: <20260612-dcif-upstreaming-v9-0-8d0ff89aa3c5@oss.nxp.com>
i.MX94 series LDB controller shares the same LDB and LVDS control
registers as i.MX8MP and i.MX93 but supports a higher maximum clock
frequency.
Add a 'max_clk_khz' member to the fsl_ldb_devdata structure in order to
be able to set different max frequencies for other platforms.
Signed-off-by: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
---
drivers/gpu/drm/bridge/fsl-ldb.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/fsl-ldb.c b/drivers/gpu/drm/bridge/fsl-ldb.c
index bd03c36ee696c..b4959f654f2ac 100644
--- a/drivers/gpu/drm/bridge/fsl-ldb.c
+++ b/drivers/gpu/drm/bridge/fsl-ldb.c
@@ -57,6 +57,7 @@ enum fsl_ldb_devtype {
IMX6SX_LDB,
IMX8MP_LDB,
IMX93_LDB,
+ IMX94_LDB,
};
struct fsl_ldb_devdata {
@@ -64,21 +65,31 @@ struct fsl_ldb_devdata {
u32 lvds_ctrl;
bool lvds_en_bit;
bool single_ctrl_reg;
+ u32 max_clk_khz;
};
static const struct fsl_ldb_devdata fsl_ldb_devdata[] = {
[IMX6SX_LDB] = {
.ldb_ctrl = 0x18,
.single_ctrl_reg = true,
+ .max_clk_khz = 80000,
},
[IMX8MP_LDB] = {
.ldb_ctrl = 0x5c,
.lvds_ctrl = 0x128,
+ .max_clk_khz = 80000,
},
[IMX93_LDB] = {
.ldb_ctrl = 0x20,
.lvds_ctrl = 0x24,
.lvds_en_bit = true,
+ .max_clk_khz = 80000,
+ },
+ [IMX94_LDB] = {
+ .ldb_ctrl = 0x04,
+ .lvds_ctrl = 0x08,
+ .lvds_en_bit = true,
+ .max_clk_khz = 148500,
},
};
@@ -274,7 +285,7 @@ fsl_ldb_mode_valid(struct drm_bridge *bridge,
{
struct fsl_ldb *fsl_ldb = to_fsl_ldb(bridge);
- if (mode->clock > (fsl_ldb_is_dual(fsl_ldb) ? 160000 : 80000))
+ if (mode->clock > (fsl_ldb_is_dual(fsl_ldb) ? 2 : 1) * fsl_ldb->devdata->max_clk_khz)
return MODE_CLOCK_HIGH;
return MODE_OK;
@@ -386,6 +397,8 @@ static const struct of_device_id fsl_ldb_match[] = {
.data = &fsl_ldb_devdata[IMX8MP_LDB], },
{ .compatible = "fsl,imx93-ldb",
.data = &fsl_ldb_devdata[IMX93_LDB], },
+ { .compatible = "fsl,imx94-ldb",
+ .data = &fsl_ldb_devdata[IMX94_LDB], },
{ /* sentinel */ },
};
MODULE_DEVICE_TABLE(of, fsl_ldb_match);
--
2.51.0
^ permalink raw reply related
* [PATCH v9 4/9] dt-bindings: display: imx: Add i.MX94 DCIF
From: Laurentiu Palcu @ 2026-06-12 11:58 UTC (permalink / raw)
To: Ying Liu, Luca Ceresoli, Philipp Zabel, Maarten Lankhorst,
Maxime Ripard, Thomas Zimmermann, David Airlie, Simona Vetter,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Frank Li,
Sascha Hauer, Pengutronix Kernel Team, Fabio Estevam
Cc: Laurentiu Palcu, linux-clk, imx, devicetree, linux-arm-kernel,
linux-kernel, dri-devel
In-Reply-To: <20260612-dcif-upstreaming-v9-0-8d0ff89aa3c5@oss.nxp.com>
DCIF is the i.MX94 Display Controller Interface which is used to
drive a TFT LCD panel or connects to a display interface depending
on the chip configuration.
Signed-off-by: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
---
.../bindings/display/imx/nxp,imx94-dcif.yaml | 90 ++++++++++++++++++++++
1 file changed, 90 insertions(+)
diff --git a/Documentation/devicetree/bindings/display/imx/nxp,imx94-dcif.yaml b/Documentation/devicetree/bindings/display/imx/nxp,imx94-dcif.yaml
new file mode 100644
index 0000000000000..8894e87666972
--- /dev/null
+++ b/Documentation/devicetree/bindings/display/imx/nxp,imx94-dcif.yaml
@@ -0,0 +1,90 @@
+# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
+# Copyright 2025 NXP
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/display/imx/nxp,imx94-dcif.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: i.MX94 Display Control Interface (DCIF)
+
+maintainers:
+ - Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
+
+description:
+ The Display Control Interface(DCIF) is a system master that fetches graphics
+ stored in memory and displays them on a TFT LCD panel or connects to a
+ display interface depending on the chip configuration.
+
+properties:
+ compatible:
+ const: nxp,imx94-dcif
+
+ reg:
+ maxItems: 1
+
+ interrupts:
+ items:
+ - description: CPU domain 0 (controlled by common registers group).
+ - description: CPU domain 1 (controlled by background layer registers group).
+ - description: CPU domain 2 (controlled by foreground layer registers group).
+
+ interrupt-names:
+ items:
+ - const: common
+ - const: bg_layer
+ - const: fg_layer
+
+ clocks:
+ maxItems: 3
+
+ clock-names:
+ items:
+ - const: apb
+ - const: axi
+ - const: pix
+
+ power-domains:
+ maxItems: 1
+
+ port:
+ $ref: /schemas/graph.yaml#/$defs/port-base
+ unevaluatedProperties: false
+ description: Display Pixel Interface(DPI) output port
+
+ properties:
+ endpoint:
+ $ref: /schemas/media/video-interfaces.yaml#
+ unevaluatedProperties: false
+
+required:
+ - compatible
+ - reg
+ - interrupts
+ - clocks
+ - power-domains
+ - port
+
+additionalProperties: false
+
+examples:
+ - |
+ #include <dt-bindings/interrupt-controller/arm-gic.h>
+
+ display-controller@4b120000 {
+ compatible = "nxp,imx94-dcif";
+ reg = <0x4b120000 0x300000>;
+ interrupts = <GIC_SPI 377 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 378 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 379 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "common", "bg_layer", "fg_layer";
+ clocks = <&scmi_clk 69>, <&scmi_clk 70>, <&dispmix_csr 0>;
+ clock-names = "apb", "axi", "pix";
+ assigned-clocks = <&dispmix_csr 0>;
+ assigned-clock-parents = <&ldb_pll_pixel>;
+ power-domains = <&scmi_devpd 11>;
+ port {
+ dcif_out: endpoint {
+ remote-endpoint = <&ldb_in>;
+ };
+ };
+ };
--
2.51.0
^ permalink raw reply related
* [PATCH v9 2/9] drm/bridge: fsl-ldb: Get the next non-panel bridge
From: Laurentiu Palcu @ 2026-06-12 11:58 UTC (permalink / raw)
To: Ying Liu, Luca Ceresoli, Andrzej Hajda, Neil Armstrong,
Robert Foss, Laurent Pinchart, Jonas Karlman, Jernej Skrabec,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Simona Vetter
Cc: Laurentiu Palcu, linux-clk, imx, devicetree, linux-arm-kernel,
linux-kernel, dri-devel
In-Reply-To: <20260612-dcif-upstreaming-v9-0-8d0ff89aa3c5@oss.nxp.com>
From: Liu Ying <victor.liu@nxp.com>
The next bridge in bridge chain could be a panel bridge or a non-panel
bridge. Use devm_drm_of_get_bridge() to replace the combination
function calls of of_drm_find_panel() and devm_drm_panel_bridge_add()
to get either a panel bridge or a non-panel bridge, instead of getting
a panel bridge only.
Signed-off-by: Liu Ying <victor.liu@nxp.com>
Signed-off-by: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
---
drivers/gpu/drm/bridge/fsl-ldb.c | 31 ++++++++++++-------------------
1 file changed, 12 insertions(+), 19 deletions(-)
diff --git a/drivers/gpu/drm/bridge/fsl-ldb.c b/drivers/gpu/drm/bridge/fsl-ldb.c
index 9bfaa3f933709..bd03c36ee696c 100644
--- a/drivers/gpu/drm/bridge/fsl-ldb.c
+++ b/drivers/gpu/drm/bridge/fsl-ldb.c
@@ -15,7 +15,6 @@
#include <drm/drm_atomic_helper.h>
#include <drm/drm_bridge.h>
#include <drm/drm_of.h>
-#include <drm/drm_panel.h>
#define LDB_CTRL_CH0_ENABLE BIT(0)
#define LDB_CTRL_CH0_DI_SELECT BIT(1)
@@ -86,7 +85,6 @@ static const struct fsl_ldb_devdata fsl_ldb_devdata[] = {
struct fsl_ldb {
struct device *dev;
struct drm_bridge bridge;
- struct drm_bridge *panel_bridge;
struct clk *clk;
struct regmap *regmap;
const struct fsl_ldb_devdata *devdata;
@@ -119,7 +117,7 @@ static int fsl_ldb_attach(struct drm_bridge *bridge,
{
struct fsl_ldb *fsl_ldb = to_fsl_ldb(bridge);
- return drm_bridge_attach(encoder, fsl_ldb->panel_bridge,
+ return drm_bridge_attach(encoder, fsl_ldb->bridge.next_bridge,
bridge, flags);
}
@@ -296,9 +294,8 @@ static const struct drm_bridge_funcs funcs = {
static int fsl_ldb_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
- struct device_node *panel_node;
struct device_node *remote1, *remote2;
- struct drm_panel *panel;
+ struct drm_bridge *next_bridge;
struct fsl_ldb *fsl_ldb;
int dual_link;
@@ -321,36 +318,32 @@ static int fsl_ldb_probe(struct platform_device *pdev)
if (IS_ERR(fsl_ldb->regmap))
return PTR_ERR(fsl_ldb->regmap);
- /* Locate the remote ports and the panel node */
+ /* Locate the remote ports. */
remote1 = of_graph_get_remote_node(dev->of_node, 1, 0);
remote2 = of_graph_get_remote_node(dev->of_node, 2, 0);
fsl_ldb->ch0_enabled = (remote1 != NULL);
fsl_ldb->ch1_enabled = (remote2 != NULL);
- panel_node = of_node_get(remote1 ? remote1 : remote2);
of_node_put(remote1);
of_node_put(remote2);
- if (!fsl_ldb->ch0_enabled && !fsl_ldb->ch1_enabled) {
- of_node_put(panel_node);
- return dev_err_probe(dev, -ENXIO, "No panel node found");
- }
+ if (!fsl_ldb->ch0_enabled && !fsl_ldb->ch1_enabled)
+ return dev_err_probe(dev, -ENXIO, "No next bridge node found");
dev_dbg(dev, "Using %s\n",
fsl_ldb_is_dual(fsl_ldb) ? "dual-link mode" :
fsl_ldb->ch0_enabled ? "channel 0" : "channel 1");
- panel = of_drm_find_panel(panel_node);
- of_node_put(panel_node);
- if (IS_ERR(panel))
- return PTR_ERR(panel);
-
if (of_property_present(dev->of_node, "nxp,enable-termination-resistor"))
fsl_ldb->use_termination_resistor = true;
- fsl_ldb->panel_bridge = devm_drm_panel_bridge_add(dev, panel);
- if (IS_ERR(fsl_ldb->panel_bridge))
- return PTR_ERR(fsl_ldb->panel_bridge);
+ next_bridge = devm_drm_of_get_bridge(dev, dev->of_node,
+ fsl_ldb->ch0_enabled ? 1 : 2,
+ 0);
+ if (IS_ERR(next_bridge))
+ return dev_err_probe(dev, PTR_ERR(next_bridge),
+ "failed to get next bridge\n");
+ fsl_ldb->bridge.next_bridge = drm_bridge_get(next_bridge);
if (fsl_ldb_is_dual(fsl_ldb)) {
struct device_node *port1, *port2;
--
2.51.0
^ permalink raw reply related
* [PATCH v9 1/9] dt-bindings: display: fsl,ldb: Add i.MX94 LDB
From: Laurentiu Palcu @ 2026-06-12 11:58 UTC (permalink / raw)
To: Ying Liu, Luca Ceresoli, Andrzej Hajda, Neil Armstrong,
Robert Foss, Laurent Pinchart, Jonas Karlman, Jernej Skrabec,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Simona Vetter, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Marek Vasut
Cc: Laurentiu Palcu, linux-clk, imx, devicetree, linux-arm-kernel,
linux-kernel, dri-devel
In-Reply-To: <20260612-dcif-upstreaming-v9-0-8d0ff89aa3c5@oss.nxp.com>
i.MX94 has a single LVDS port and share similar LDB and LVDS control
registers as i.MX8MP and i.MX93.
Signed-off-by: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
---
Documentation/devicetree/bindings/display/bridge/fsl,ldb.yaml | 2 ++
1 file changed, 2 insertions(+)
diff --git a/Documentation/devicetree/bindings/display/bridge/fsl,ldb.yaml b/Documentation/devicetree/bindings/display/bridge/fsl,ldb.yaml
index 7f380879fffdf..fb70409161fc0 100644
--- a/Documentation/devicetree/bindings/display/bridge/fsl,ldb.yaml
+++ b/Documentation/devicetree/bindings/display/bridge/fsl,ldb.yaml
@@ -20,6 +20,7 @@ properties:
- fsl,imx6sx-ldb
- fsl,imx8mp-ldb
- fsl,imx93-ldb
+ - fsl,imx94-ldb
clocks:
maxItems: 1
@@ -78,6 +79,7 @@ allOf:
enum:
- fsl,imx6sx-ldb
- fsl,imx93-ldb
+ - fsl,imx94-ldb
then:
properties:
ports:
--
2.51.0
^ permalink raw reply related
* [PATCH v9 0/9] Add support for i.MX94 DCIF
From: Laurentiu Palcu @ 2026-06-12 11:58 UTC (permalink / raw)
To: Ying Liu, Luca Ceresoli, Abel Vesa, Peng Fan, Michael Turquette,
Stephen Boyd, Brian Masney, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Frank Li, Sascha Hauer, Pengutronix Kernel Team,
Fabio Estevam, Andrzej Hajda, Neil Armstrong, Robert Foss,
Laurent Pinchart, Jonas Karlman, Jernej Skrabec, David Airlie,
Simona Vetter, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, Philipp Zabel, Marek Vasut
Cc: Laurentiu Palcu, linux-clk, imx, devicetree, linux-arm-kernel,
linux-kernel, dri-devel
Hi,
This patch-set adds support for the i.MX94 Display Control Interface.
Also, included in the patch-set is patch that the DCIF driver depends on
for functioning properly:
* 1/9 - 3/9 : add support for i.MX94 to fsl-ldb driver. It also
contains a patch (2/9) from Liu Ying that was already reviewed
and was part of another patch-set ([1]), but was never merged;
Thanks,
Laurentiu
[1] https://lkml.org/lkml/2024/11/14/262
---
Changes in v9:
- Rebased to latest linux-next (next-20260611);
- 2/9: Reworked to store the next bridge in fsl_ldb->bridge.next_bridge
(taking a reference with drm_bridge_get()) instead of adding a new
dedicated field. Removed the r-b tags for this patch since it needs a
fresh review;
- 3/9: Fixed the i.MX94 LDB max_clk_khz limit (165 MHz -> 148.5 MHz) to
match the actual hardware limit. Removed the r-b tags for this patch
since it needs a fresh review;
- 4/9: Added a 'required:' properties list to the binding. Removed
Krzysztof's r-b tag for this patch since it needs a fresh review;
- 5/9: Renamed the CRC source helpers (dcif_crc_source_*) and made them
unconditionally available, dropping the CONFIG_DEBUG_FS stubs;
improved CRC source parsing (auto ROI for the full-frame source,
unsigned params, safer string handling); rebased onto the
drm_atomic_state -> drm_atomic_commit rename in linux-next; reworked
CRC/modeset gating with new has_crc and crtc_pm_enabled flags and
proper PM error handling; switched event_lock to spinlock_irq; removed
a redundant connector-attach call and fixed an error format string;
added new pixel formats and full alpha/blend-mode support;
- 6/9: YAML quoting style fix only, no functional change;
- 7/9: Combined the former "arm64: dts: imx943: Add LVDS/DISPLAY CSR
nodes" prerequisite and the "arm64: dts: imx943: Add display pipeline
nodes" patch into a single new patch targeting the shared imx94.dtsi
instead of imx943.dtsi, removing the dependency on Peng Fan's
not-yet-merged patch;
- 8/9: Renamed the IT6263 bridge node to 'hdmi@4c' and fixed its
reset-gpios polarity to GPIO_ACTIVE_LOW;
- Link to v8: https://lore.kernel.org/r/20260304-dcif-upstreaming-v8-0-bec5c047edd4@oss.nxp.com
Changes in v8:
- Rebased to latest linux-next (next-20260303). Patch 2/9 had a minor
conflict bacause of a patch introduced recently;
- 8/9: Fixed CHECK_DTBS errors reported by Rob's bot due to missing
regulators. Removed the r-b tag for this patch because it needs a
fresh review;
- Link to v7: https://lore.kernel.org/r/20260122-dcif-upstreaming-v7-0-19ea17eb046f@oss.nxp.com
Changes in v7:
- Rebased to latest linux-next;
- Addressed some new checkpatch warnings: kzalloc -> kzalloc_obj;
- Fixed a couple of static check warnings in probe();
- Added Luca's r-b tag for bridge refcounting;
- Link to v6: https://lore.kernel.org/r/20251103-dcif-upstreaming-v6-0-76fcecfda919@oss.nxp.com
Changes in v6:
- 2/9: Collected r-b tag from Francesco;
- 3/9: Removed ch_max_clk_khz variable as suggested by Luca and added
his r-b tag;
- 4/9: Collected r-b tag;
- 5/9: Call drm_bridge_put() automatically in
dcif_crtc_query_output_bus_format() by using a cleanup action (Luca);
- 6/9: Moved allOf: block after required: block (Krzysztof). Collected
r-b tag;
- Link to v5: https://lore.kernel.org/r/20250911-dcif-upstreaming-v5-0-a1e8dab8ae40@oss.nxp.com
Changes in v5:
- 4/9: Removed "bindings for" from the title, changed the port
definition and simplified the example;
- 6/9: Fixed the way 'ldb' child node is declared: declare the
'ldb' child node out of if:then: block and set the property
to false for compatibles other than nxp,imx94-lvds-csr;
- Link to v4: https://lore.kernel.org/r/20250903123332.2569241-1-laurentiu.palcu@oss.nxp.com
Changes in v4:
- Addressed remaining DCIF driver comments from Frank;
- Limit the 'ldb' child node only to CSRs compatible with 'nxp,imx94-lvds-csr'
in the binding file. Since LVDS CSRs are a minority, I chose to
use the if:then: construct instead of if:not:then:;
- Remove the '#address-cells' and '#size-cells' from the ldb node, in
imx94.dtsi, as they're not needed;
- Link to v3: https://lore.kernel.org/r/20250806150521.2174797-1-laurentiu.palcu@oss.nxp.com
Changes in v3:
- Removed the BLK CTL patches and created a separate patch set [2] for them;
- Collected r-b tags for 1/9, 2/9, 3/9 and 9/9;
- Removed the DCIF QoS functionality until I find a better way to
implement it through syscon. QoS functionality will be added in
subsequent patches. Also, used devm_clk_bulk_get_all() and used
dev_err_probe() as suggested;
- Addressed Frank's and Krzysztof's comments on the DCIF bindings;
- Addressed Frank's comments on dtsi and dts files;
- Added a new binding patch, 6/9, for adding 'ldb' optional property to
nxp,imx95-blk-ctl.yaml;
- Link to v2: https://lore.kernel.org/r/20250716081519.3400158-1-laurentiu.palcu@oss.nxp.com
Changes in v2:
- reworked the BLK_CTL patch and split in 2 to make it easier for
review;
- split the dts and dtsi patch in 2 separate ones;
- addressed Frank's comments in DCIF driver;
- addressed Rob's comments for the bindings files;
- addressed a couple of checkpatch issues;
- Link to v1: https://lore.kernel.org/r/20250709122332.2874632-1-laurentiu.palcu@oss.nxp.com
---
Laurentiu Palcu (7):
dt-bindings: display: fsl,ldb: Add i.MX94 LDB
drm/bridge: fsl-ldb: Add support for i.MX94
dt-bindings: display: imx: Add i.MX94 DCIF
dt-bindings: clock: nxp,imx95-blk-ctl: Add ldb child node
arm64: dts: imx94: Add display pipeline nodes
arm64: dts: imx943-evk: Add display support using IT6263
MAINTAINERS: Add entry for i.MX94 DCIF driver
Liu Ying (1):
drm/bridge: fsl-ldb: Get the next non-panel bridge
Sandor Yu (1):
drm/imx: Add support for i.MX94 DCIF
.../bindings/clock/nxp,imx95-blk-ctl.yaml | 26 +
.../bindings/display/bridge/fsl,ldb.yaml | 2 +
.../bindings/display/imx/nxp,imx94-dcif.yaml | 90 +++
MAINTAINERS | 9 +
arch/arm64/boot/dts/freescale/imx94.dtsi | 82 +++
arch/arm64/boot/dts/freescale/imx943-evk.dts | 86 +++
drivers/gpu/drm/bridge/fsl-ldb.c | 46 +-
drivers/gpu/drm/imx/Kconfig | 1 +
drivers/gpu/drm/imx/Makefile | 1 +
drivers/gpu/drm/imx/dcif/Kconfig | 15 +
drivers/gpu/drm/imx/dcif/Makefile | 5 +
drivers/gpu/drm/imx/dcif/dcif-crc.c | 215 +++++++
drivers/gpu/drm/imx/dcif/dcif-crc.h | 43 ++
drivers/gpu/drm/imx/dcif/dcif-crtc.c | 705 +++++++++++++++++++++
drivers/gpu/drm/imx/dcif/dcif-drv.c | 233 +++++++
drivers/gpu/drm/imx/dcif/dcif-drv.h | 89 +++
drivers/gpu/drm/imx/dcif/dcif-kms.c | 96 +++
drivers/gpu/drm/imx/dcif/dcif-plane.c | 308 +++++++++
drivers/gpu/drm/imx/dcif/dcif-reg.h | 267 ++++++++
19 files changed, 2299 insertions(+), 20 deletions(-)
---
base-commit: e7b907ffb2cd66314df92360e41f7bd5fdaa8182
change-id: 20260602-dcif-upstreaming-fb177f3c9351
Best regards,
--
Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
^ permalink raw reply
* Re: [PATCH v3 4/7] drm/rcar-du: dsi: Support DSC in the pipeline
From: Tomi Valkeinen @ 2026-06-12 11:56 UTC (permalink / raw)
To: Laurent Pinchart
Cc: Geert Uytterhoeven, Michael Turquette, Stephen Boyd,
Andrzej Hajda, Neil Armstrong, Robert Foss, Jonas Karlman,
Jernej Skrabec, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Magnus Damm, Marek Vasut,
Kieran Bingham, Philipp Zabel, linux-renesas-soc, linux-clk,
linux-kernel, dri-devel, devicetree
In-Reply-To: <20260611000324.GH1632628@killaraus.ideasonboard.com>
Hi,
On 11/06/2026 03:03, Laurent Pinchart wrote:
> Hi Tomi,
>
> Thank you for the patch.
>
> On Fri, May 15, 2026 at 12:09:29PM +0300, Tomi Valkeinen wrote:
>> Enabling DSI clocks on rcar-du needs some tricks as the DU dot clock is
>> provided by the DSI. Thus, we call rcar_mipi_dsi_pclk_enable() from the
>> crtc, when enabling the crtc.
>>
>> With DSC (added in upcoming patch) in the pipeline, between the DU and
>> the DSI, the above call path is broken as the crtc tries to call
>> rcar_mipi_dsi_pclk_enable() on the DSC.
>>
>> Adjust the rcar_mipi_dsi_pclk_enable() so that it detects the DSC, and
>> in that case gets the next bridge from the DSC, which is the DSI.
>>
>> Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
>> ---
>> drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c | 36 +++++++++++++++++++++++--
>> 1 file changed, 34 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c
>> index 4ef2e3c129ed..085e229bcb0b 100644
>> --- a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c
>> +++ b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c
>> @@ -88,6 +88,8 @@ struct dsi_setup_info {
>> const struct dsi_clk_config *clkset;
>> };
>>
>> +static const struct drm_bridge_funcs rcar_mipi_dsi_bridge_ops;
>> +
>> static inline struct rcar_mipi_dsi *
>> bridge_to_rcar_mipi_dsi(struct drm_bridge *bridge)
>> {
>> @@ -844,15 +846,39 @@ static void rcar_mipi_dsi_atomic_disable(struct drm_bridge *bridge,
>> rcar_mipi_dsi_stop_video(dsi);
>> }
>>
>> +/*
>> + * We need to skip the DSC bridge when we have DSC in between the DU and
>> + * the DSI. We detect the DSI bridge via bridge->funcs, and assume the
>> + * next_bridge is the DSI bridge. If this is not the case, the DT data
>> + * is wrong (so it shouldn't really happen).
>> + */
>> +static struct drm_bridge *
>> +rcar_mipi_dsi_resolve_bridge(struct drm_bridge *bridge)
>> +{
>> + if (bridge->funcs != &rcar_mipi_dsi_bridge_ops)
>> + bridge = bridge->next_bridge;
>> +
>> + if (!bridge || bridge->funcs != &rcar_mipi_dsi_bridge_ops)
>> + return NULL;
>> +
>> + return bridge;
>> +}
>
> Hmmmm... It's quite a bit of a hack. It would be nicer to do this in
> rcar_du_crtc.c instead, where we cache the dsi bridge pointer. The
It's actually cached in rcar_du_encoder.c, but used in rcar_du_crtc.c.
If I understand right, you'd like to do the DSC detection in
rcar_du_crtc, and skip the DSC, if needed, before calling
rcar_mipi_dsi_pclk_enable()?
> question is how to then identify the right bridge, as we won't have
> access to rcar_mipi_dsi_bridge_ops. Should this driver set the bridge
> type field to DRM_MODE_CONNECTOR_DSI ?
I'm not sure how that would help. Or, I can, as the dsi driver does not
set the bridge type, so only DSC would set it. But isn't that even more
hacky?
Or did you rather mean that the DSI driver would set the bridge type,
and DSC would not? We can then do:
if (bridge->type != DRM_MODE_CONNECTOR_DSI)
bridge = bridge->next_bridge;
in the crtc driver. This works. It's still a bit hacky, but I think the
chances of the code getting it wrong are quite low. If the output port
is RCAR_DU_OUTPUT_DSIx, then the next bridge must be rcar-dsi or
rcar-dsc, so it's all under our control. Also, it's less code than this
patch, so I'll go with that.
Tomi
^ permalink raw reply
* Re: [PATCH v11 3/9] i3c: master: Add APIs for I3C hub support
From: sashiko-bot @ 2026-06-12 11:48 UTC (permalink / raw)
To: Lakshay Piplani; +Cc: linux-i3c, devicetree, conor+dt, Frank.Li, robh
In-Reply-To: <20260612111816.3688240-4-lakshay.piplani@nxp.com>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] i3c_master_direct_detach_i3c_dev_locked lacks the unaddressable device check present in its attach counterpart, leading to a NULL pointer dereference in controller drivers.
--
commit a7f74140d15672b8f2824666071ce06e3051e0d8
Author: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
i3c: master: Add APIs for I3C hub support
Add helpers for attaching and detaching I3C devices and CCC helpers
to check CCC support and send CCC commands to prepare for I3C hub support.
> diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
> index ec3547f75469e..59e0f82de6ebd 100644
> --- a/drivers/i3c/master.c
> +++ b/drivers/i3c/master.c
[ ... ]
> +int i3c_master_direct_attach_i3c_dev_locked(struct i3c_master_controller *master,
> + struct i3c_dev_desc *dev)
> +{
> + int ret = 0;
> +
> + /*
> + * We don't attach devices to the controller until they are
> + * addressable on the bus.
> + */
> +
> + if (!dev->info.static_addr && !dev->info.dyn_addr)
> + return 0;
> +
> + /* Do not attach the master device itself. */
> + if (master->this != dev && master->ops->attach_i3c_dev)
> + ret = master->ops->attach_i3c_dev(dev);
> +
> + return ret;
> +}
> +EXPORT_SYMBOL_GPL(i3c_master_direct_attach_i3c_dev_locked);
[ ... ]
> +void i3c_master_direct_detach_i3c_dev_locked(struct i3c_dev_desc *dev)
> +{
> + struct i3c_master_controller *master = i3c_dev_get_master(dev);
> +
> + /* Do not detach the master device itself. */
> + if (master->this != dev && master->ops->detach_i3c_dev)
> + master->ops->detach_i3c_dev(dev);
[Severity: High]
Does this missing address check in the detach helper lead to a NULL pointer
dereference in controller drivers?
The attach helper i3c_master_direct_attach_i3c_dev_locked() gracefully skips
attaching devices without a static or dynamic address and returns 0 (success).
Because it returns success, callers might naturally invoke this companion
detach API during teardown for these same devices.
However, since this helper lacks the corresponding address check, it
unconditionally invokes the controller's detach callback. Controller drivers
often retrieve the device's private data and immediately dereference it. Since
the attach phase was skipped, this private data would be NULL.
Should this function also check if the device has an address before calling
the detach callback?
> +}
> +EXPORT_SYMBOL_GPL(i3c_master_direct_detach_i3c_dev_locked);
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260612111816.3688240-1-lakshay.piplani@nxp.com?part=3
^ permalink raw reply
* Re: [PATCH v6 02/11] ARM: dts: renesas: r8a7740: Add clocks for FSI
From: Geert Uytterhoeven @ 2026-06-12 11:45 UTC (permalink / raw)
To: Bui Duc Phuc
Cc: Kuninori Morimoto, Mark Brown, Liam Girdwood, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Magnus Damm, Jaroslav Kysela,
Takashi Iwai, linux-sound, linux-renesas-soc, devicetree,
linux-kernel
In-Reply-To: <CAABR9nHFHWFeEaaYE6X9fqt_Zb-3pF=jJbHQpsiBTgkS5LyTLQ@mail.gmail.com>
Hi Phuc,
On Fri, 12 Jun 2026 at 13:08, Bui Duc Phuc <phucduc.bui@gmail.com> wrote:
> > I have one more general question.
> > arch/arm/boot/dts/renesas/r8a7740-armadillo800eva.dts configures
> > audio for FSI (fsia_pins), but does not fill in a clock-frequency
> > in fsiack_clk. Instead, it fills in 12.288 MHz in fsibck_clk, while
> > the schematics call it FSIACK.
> > Apparently the FSIACK pin is shared with FSIBCK on R-Mobile A1, so
> > which function is used depends on pin control. However, the DTS does
> > not perform any pin configuration for this pin?
>
> I checked the schematic in more detail.
> On sheet 12 (FSIA section), the FSIACK signal is connected to the
> WM8978 MCLK pin (pin 11).
> It is also connected to the X8 oscillator output (pin 3) through R121.
> By default, the board populates R120 (0 ohm), which routes the signal
> to R8A7740 pin K5 (FSIAOMC).
> If R120 is removed and R250 is populated instead, the signal is routed
> to pin G3 (FSIACK).
According to my schematics (RevA), R120 is not populated, but R250 is.
So the 12.288 MHz clock is fed to both the FSIACK-pin of R-Mobile A1,
and the MCLK-pin of the WM8978 codec.
Which revision of the schematics and board do you have?
> From my understanding, the default resistor configuration places FSIA
> in slave mode.
> In this configuration, FSIA receives BCLK and LRCLK from the WM8978,
> while the codec receives the 12.288 MHz MCLK from oscillator X8.
>
> This matches the current DTS configuration:
>
> simple-audio-card,codec {
> sound-dai = <&wm8978>;
> bitclock-master;
> frame-master;
> system-clock-frequency = <12288000>;
> };
>
> Therefore, I do not think it is necessary to provide a 12.288 MHz
> frequency for fsiack_clk (xcka) in the current configuration.
> If the hardware were reconfigured to operate FSIA in master mode, that
> might need to be revisited.
>
> I have considered testing the alternative resistor configuration
> (removing R120 and populating R250)
> to switch FSIA into master mode, but I have not done so due to the
> risk of damaging the board.
I haven't located R120 and R250 yet, so I don't know which
configuration my board has.
> As for the relationship between FSIACK and FSIBCK, I am not sure.
> The schematic I have does not appear to describe FSIB at all.
> The HDMI section only documents video signals and does not mention audio,
> so I do not have enough information to determine whether FSIACK and
> FSIBCK share the same pin on this board.
That information is found in the R-Mobile A1 docs (PORT11):
Table 1.3 Pin Assignment (505-Pin BGA Package)
Ball No. / Pin Name / Multiplexed Pin Functions / GPIO
G3 / FSIACK / FSIACK/FSIBCK / PORT11
Table 54.1 List of Multiplexed Pins
Pin Name / Function 0 / Function 1 / Function 2
FSIACK / PORT11 / FSIACK / FSIBCK
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
^ permalink raw reply
* Re: [PATCH v11 2/9] i3c: master: Expose the APIs to support I3C hub
From: sashiko-bot @ 2026-06-12 11:44 UTC (permalink / raw)
To: Lakshay Piplani; +Cc: devicetree, Frank.Li, linux-i3c, conor+dt, robh
In-Reply-To: <20260612111816.3688240-3-lakshay.piplani@nxp.com>
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
New issues:
- [Medium] API documentation mismatch: i3c_master_reattach_i3c_dev_locked() claims to return -EBUSY on collision, but unconditionally overwrites slot status.
- [Low] Invalid lock context expressions and typos in newly added IBI kernel-doc.
Pre-existing issues:
- [Critical] Multiple Use-After-Free vulnerabilities in i3c_dev_free_ibi_locked() due to improper synchronization and teardown order.
- [High] Unbalanced release of address slots in i3c_master_reattach_i3c_dev_locked() failure path leads to bus corruption.
--
commit 13a1ff5c64b48ceff03545ae3bebd5e60a136c1e
Author: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
i3c: master: Expose the APIs to support I3C hub
This patch exposes several internal I3C master functions to allow new I3C
hub drivers to use them. It adds kernel-doc comments and exports symbols
like i3c_master_reattach_i3c_dev_locked and various IBI handling functions.
> diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
> index c45b450af319d..ec3547f75469e 100644
> --- a/drivers/i3c/master.c
> +++ b/drivers/i3c/master.c
> @@ -1652,8 +1652,23 @@ static int i3c_master_attach_i3c_dev(struct i3c_master_controller *master,
> return 0;
> }
>
> -static int i3c_master_reattach_i3c_dev_locked(struct i3c_dev_desc *dev,
> - u8 old_dyn_addr)
> +/**
> + * i3c_master_reattach_i3c_dev_locked() - reattach an I3C device with a new address
> + * @dev: I3C device descriptor to reattach
> + * @old_dyn_addr: previous dynamic address of the device
> + *
> + * This function reattaches an existing I3C device to the bus when its dynamic
> + * address has changed. It updates the bus address slot status accordingly:
> + * - Marks the new dynamic address as occupied by an I3C device.
> + * - Frees the old dynamic address slot if applicable.
> + *
> + * This function must be called with the bus lock held in write mode.
> + *
> + * Return: 0 on success, or a negative error code if reattachment fails
> + * (e.g. -EBUSY if the new address slot is not free).
> + */
> +int i3c_master_reattach_i3c_dev_locked(struct i3c_dev_desc *dev,
> + u8 old_dyn_addr)
> {
[Severity: Medium]
The kernel-doc states this returns -EBUSY if the new address slot is not free,
but does the implementation actually check this?
Looking at the rest of i3c_master_reattach_i3c_dev_locked(), it appears
i3c_bus_set_addr_slot_status() is called unconditionally to set
I3C_ADDR_SLOT_I3C_DEV without first checking if the slot is available.
Could this silently overwrite an existing occupied slot if an external driver
relies on the documented failure behavior?
[Severity: High]
This is a pre-existing issue, but does the error path safely handle a failure
from master->ops->reattach_i3c_dev()?
When the reattach operation fails, i3c_master_put_i3c_addrs(dev) is called,
which marks the address slots as free. However, it doesn't appear to revert
the hardware device's assigned address.
Since callers like i3c_master_add_i3c_dev_locked() completely ignore the
return value of this function, could this leave the bus manager out of sync
with the hardware state and cause severe address collisions if the slot is
subsequently reassigned?
[ ... ]
> @@ -3195,6 +3211,16 @@ int i3c_dev_do_xfers_locked(struct i3c_dev_desc *dev, struct i3c_xfer *xfers,
> return master->ops->i3c_xfers(dev, xfers, nxfers, mode);
> }
>
> +/**
> + * i3c_dev_disable_ibi_locked() - Disable IBIs coming from a specific device
> + * @dev: device on which IBIs should be disabled
> + *
> + * This function disable IBIs coming from a specific device and wait for
> + * all pending IBIs to be processed.
> + *
> + * Context: Must be called with mutex_lock(&dev->desc->ibi_lock) held.
> + * Return: 0 in case of success, a negative error core otherwise.
> + */
[Severity: Low]
Is the lock context expression correct here?
The parameter is of type struct i3c_dev_desc, which does not have a desc
member, so &dev->desc->ibi_lock appears to be structurally invalid.
Should this be &dev->ibi_lock instead?
Also, there is a minor typo: "error core" should likely be "error code".
[ ... ]
> +/**
> + * i3c_dev_free_ibi_locked() - Free all resources needed for IBI handling
> + * @dev: device on which you want to release IBI resources
> + *
> + * This function is responsible for de-allocating resources previously
> + * allocated by i3c_device_request_ibi(). It should be called after disabling
> + * IBIs with i3c_device_disable_ibi().
> + *
> + * Context: Must be called with mutex_lock(&dev->desc->ibi_lock) held.
> + */
> void i3c_dev_free_ibi_locked(struct i3c_dev_desc *dev)
[Severity: Critical]
This is a pre-existing issue, but does this teardown order introduce a
use-after-free regression when exposed to external drivers?
Looking at the body of i3c_dev_free_ibi_locked(), the function calls
master->ops->free_ibi(dev) before destroy_workqueue(dev->ibi->wq).
If free_ibi() frees the underlying IBI pool memory, and destroy_workqueue()
subsequently flushes pending async work items, could those work items
execute and dereference the already freed pool?
Additionally, if i3c_dev_disable_ibi_locked() had failed to disable the
hardware interrupt, could a firing interrupt access dev->ibi after it is
unconditionally freed by kfree(dev->ibi) at the end of this function?
> {
> struct i3c_master_controller *master = i3c_dev_get_master(dev);
> @@ -3301,6 +3366,7 @@ void i3c_dev_free_ibi_locked(struct i3c_dev_desc *dev)
> kfree(dev->ibi);
> dev->ibi = NULL;
> }
> +EXPORT_SYMBOL_GPL(i3c_dev_free_ibi_locked);
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260612111816.3688240-1-lakshay.piplani@nxp.com?part=2
^ permalink raw reply
* Re: [PATCH v11 9/9] i3c: hub: p3h2x4x: Add SMBus slave mode support
From: sashiko-bot @ 2026-06-12 11:41 UTC (permalink / raw)
To: Lakshay Piplani; +Cc: robh, devicetree, linux-i3c, conor+dt, Frank.Li
In-Reply-To: <20260612111816.3688240-10-lakshay.piplani@nxp.com>
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:
New issues:
- [High] Unconditional dereference of `tp_smbus_client` prior to its NULL check in `p3h2x4x_read_smbus_agent_rx_buf`.
- [High] Failure to clear `tp_smbus_client` on hardware error in `p3h2x4x_tp_i2c_unreg_slave` leads to Use-After-Free.
- [High] IBI requests are not cleaned up on the `probe` error path, leaving active interrupts pointing to freed device memory.
- [High] Early return on `regmap_read` failure in `p3h2x4x_ibi_handler` aborts processing for other ports, risking an interrupt storm.
Pre-existing issues:
- [High] I2C adapters registered in `p3h2x4x_tp_smbus_algo` are leaked on subsequent probe errors, leading to Use-After-Free.
--
commit c3438427374cdabfa4f0a09443f69b5b076d009a
Author: Lakshay Piplani <lakshay.piplani@nxp.com>
i3c: hub: p3h2x4x: Add SMBus slave mode support
Add SMBus slave mode support for the P3H2x4x hub SMBus target ports,
allowing the hub to receive downstream payloads into target buffers and
report receive events through IBI to registered I2C slave clients.
> diff --git a/drivers/i3c/hub/p3h2840_i3c_hub_i3c.c b/drivers/i3c/hub/p3h2840_i3c_hub_i3c.c
> --- a/drivers/i3c/hub/p3h2840_i3c_hub_i3c.c
> +++ b/drivers/i3c/hub/p3h2840_i3c_hub_i3c.c
[ ... ]
> @@ -120,5 +128,24 @@ int p3h2x4x_tp_i3c_algo(struct p3h2x4x_i3c_hub_dev *p3h2x4x_hub)
> p3h2x4x_hub->tp_bus[tp].is_registered = true;
> p3h2x4x_hub->hub_config.tp_config[tp].always_enable = true;
> }
> - return regmap_write(p3h2x4x_hub->regmap, P3H2X4X_TP_NET_CON_CONF, ntwk_mask);
> +#if IS_ENABLED(CONFIG_I2C_SLAVE)
> + ret = i3c_device_request_ibi(p3h2x4x_hub->i3cdev, &p3h2x4x_ibireq);
> + if (ret)
> + return ret;
> +
> + ret = i3c_device_enable_ibi(p3h2x4x_hub->i3cdev);
[Severity: High]
Because these IBI functions are not devres-managed, do we need to manually
clean them up on a probe failure?
If a subsequent step in p3h2x4x_i3c_hub_probe() fails after this completes,
probe will abort and devres will free the p3h2x4x_i3c_hub structure. Since
the I3C core isn't informed to free the IBI, the hardware remains
configured. If an IBI fires later, could p3h2x4x_ibi_handler() try to
dereference the freed driver data?
[ ... ]
> diff --git a/drivers/i3c/hub/p3h2840_i3c_hub_smbus.c b/drivers/i3c/hub/p3h2840_i3c_hub_smbus.c
> --- a/drivers/i3c/hub/p3h2840_i3c_hub_smbus.c
> +++ b/drivers/i3c/hub/p3h2840_i3c_hub_smbus.c
[ ... ]
> @@ -15,6 +15,146 @@ enum p3h2x4x_smbus_desc_idx {
> P3H2X4X_DESC_READ_LEN,
> };
>
> +#if IS_ENABLED(CONFIG_I2C_SLAVE)
> +static void p3h2x4x_read_smbus_agent_rx_buf(struct i3c_device *i3cdev, enum p3h2x4x_rcv_buf rfbuf,
> + enum p3h2x4x_tp tp, bool is_of)
> +{
[ ... ]
> + /* notify slave driver about received data */
> + if ((p3h2x4x_i3c_hub->tp_bus[tp].tp_smbus_client->addr & 0x7f) == (slave_address >> 1)) {
> + client = p3h2x4x_i3c_hub->tp_bus[tp].tp_smbus_client;
> + if (!client)
> + goto ibi_err;
[Severity: High]
Can this code cause a panic if an In-Band Interrupt occurs for a port
without a bound SMBus slave client?
We dereference tp_smbus_client->addr unconditionally here, right before
the NULL check happens.
[ ... ]
> +void p3h2x4x_ibi_handler(struct i3c_device *i3cdev,
> + const struct i3c_ibi_payload *payload)
> +{
[ ... ]
> + for (i = 0; i < P3H2X4X_TP_MAX_COUNT; ++i) {
> + if (p3h2x4x_i3c_hub->tp_bus[i].is_registered && (payload_byte_two >> i) & 0x01) {
> + ret = regmap_read(p3h2x4x_i3c_hub->regmap, P3H2X4X_TP0_SMBUS_AGNT_STS + i,
> + &target_port_status);
> + if (ret) {
> + dev_err(&i3cdev->dev, "target port read status failed %d\n", ret);
> + return;
> + }
[Severity: High]
If regmap_read() fails for one port, this return statement prematurely
exits the handler.
Does this skip clearing the hardware status of the current port and prevent
servicing other ports with pending events? If the underlying hardware
interrupt conditions are not cleared, could the device immediately re-assert
the IBI line and cause an interrupt storm?
[ ... ]
> +static int p3h2x4x_tp_i2c_unreg_slave(struct i2c_client *slave)
> +{
[ ... ]
> + ret = regmap_clear_bits(hub->regmap,
> + P3H2X4X_TP_SMBUS_AGNT_IBI_CONFIG,
> + bus->tp_mask);
> + if (ret)
> + return ret;
> +
> + bus->tp_smbus_client = NULL;
[Severity: High]
If regmap_clear_bits() fails, we return the error without clearing
bus->tp_smbus_client.
Since the client driver might still free its i2c_client structure during
removal despite the unregistration failure, could this leave a dangling
pointer that gets dereferenced if an IBI fires later?
[ ... ]
> @@ -205,11 +345,63 @@ static u32 p3h2x4x_tp_smbus_funcs(struct i2c_adapter *adapter)
> return I2C_FUNC_I2C | I2C_FUNC_SMBUS_BLOCK_DATA;
> }
>
[ ... ]
> /*
> * I2C algorithm Structure
> */
> static struct i2c_algorithm p3h2x4x_tp_i2c_algorithm = {
> .master_xfer = p3h2x4x_tp_i2c_xfer,
> +#if IS_ENABLED(CONFIG_I2C_SLAVE)
> + .reg_slave = p3h2x4x_tp_i2c_reg_slave,
> + .unreg_slave = p3h2x4x_tp_i2c_unreg_slave,
> +#endif
> .functionality = p3h2x4x_tp_smbus_funcs,
> };
[Severity: High]
This is a pre-existing issue, but I2C adapters registered in
p3h2x4x_tp_smbus_algo() lack a devres action for automatic cleanup.
If p3h2x4x_i3c_hub_probe() encounters an error after adapters are added
with i2c_add_adapter(), devres will free the memory backing the adapters,
but they remain registered with the I2C subsystem.
Could this lead to a use-after-free if the I2C core accesses these ghost
adapters?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260612111816.3688240-1-lakshay.piplani@nxp.com?part=9
^ permalink raw reply
* Re: [PATCH v11 1/9] i3c: master: rename i3c_master_reattach_i3c_dev() to *_locked
From: sashiko-bot @ 2026-06-12 11:41 UTC (permalink / raw)
To: Lakshay Piplani; +Cc: Frank.Li, conor+dt, devicetree, linux-i3c, robh
In-Reply-To: <20260612111816.3688240-2-lakshay.piplani@nxp.com>
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
Pre-existing issues:
- [High] The return value of `i3c_master_reattach_i3c_dev_locked()` is ignored in `i3c_master_add_i3c_dev_locked()`, leading to bus state corruption if reattachment fails.
- [High] Aggressive cleanup in `i3c_master_reattach_i3c_dev_locked()` sabotages the caller's hardware rollback path (`RSTDAA`) in `i3c_master_early_i3c_dev_add()`.
- [High] `i3c_device_uevent()` accesses `i3cdev->desc` without acquiring `bus->lock`, leading to a Use-After-Free if a hot-join device replacement occurs concurrently.
--
commit 8a7af37c292c3791d232cdb1c2f37ae5aba2ca10
Author: Lakshay Piplani <lakshay.piplani@nxp.com>
i3c: master: rename i3c_master_reattach_i3c_dev() to *_locked
Rename i3c_master_reattach_i3c_dev() to *_locked() to make the locking
requirement explicit and consistent with other I3C core helpers that
require the bus lock to be held by the caller.
> diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
> index 6b8df8089a357..c45b450af319d 100644
> --- a/drivers/i3c/master.c
> +++ b/drivers/i3c/master.c
[ ... ]
> @@ -1742,7 +1742,7 @@ static int i3c_master_early_i3c_dev_add(struct i3c_master_controller *master,
> goto err_detach_dev;
>
> i3cdev->info.dyn_addr = i3cdev->boardinfo->init_dyn_addr;
> - ret = i3c_master_reattach_i3c_dev(i3cdev, 0);
> + ret = i3c_master_reattach_i3c_dev_locked(i3cdev, 0);
[Severity: High]
This isn't a bug introduced by this patch, but doesn't the error path
here break if the reattach fails?
If master->ops->reattach_i3c_dev() fails,
i3c_master_reattach_i3c_dev_locked() immediately marks the
dev->info.dyn_addr slot as I3C_ADDR_SLOT_FREE via i3c_master_put_i3c_addrs().
This seems to sabotage the fallback path at err_rstdaa:
drivers/i3c/master.c:i3c_master_early_i3c_dev_add() {
...
err_rstdaa:
i3c_master_rstdaa_locked(master, i3cdev->boardinfo->init_dyn_addr);
...
}
Since the address slot is now marked free, i3c_master_rstdaa_locked()
will instantly abort with -EINVAL because the slot status is no longer
I3C_ADDR_SLOT_I3C_DEV. Will this leave the physical device retaining
the dynamic address while the master controller incorrectly considers it free?
> if (ret)
> goto err_rstdaa;
>
[ ... ]
> @@ -2358,7 +2358,7 @@ int i3c_master_add_i3c_dev_locked(struct i3c_master_controller *master,
> if (!ret) {
> old_dyn_addr = newdev->info.dyn_addr;
> newdev->info.dyn_addr = expected_dyn_addr;
> - i3c_master_reattach_i3c_dev(newdev, old_dyn_addr);
> + i3c_master_reattach_i3c_dev_locked(newdev, old_dyn_addr);
[Severity: High]
This is a pre-existing issue, but is it safe to ignore the return
value of i3c_master_reattach_i3c_dev_locked() here?
If the underlying master->ops->reattach_i3c_dev() fails, the reattach
function calls i3c_master_put_i3c_addrs(), marking the device's assigned
dynamic address slot as I3C_ADDR_SLOT_FREE in the bus bitmask.
Since this failure is completely ignored and the caller returns success,
the hardware remains configured to listen on the new dynamic address, but
the software allocator considers the slot free. Could a subsequent
hot-join or device addition be assigned this exact same dynamic address,
leading to unrecoverable bus collisions?
[Severity: High]
Additionally, this isn't a bug introduced by this patch, but does
i3c_master_add_i3c_dev_locked() race with userspace uevents during a
hot-join device replacement?
Later in this function, it identifies duplicate devices, migrates
the generic struct device from the old descriptor to the new one, and
eventually frees the old descriptor via i3c_master_free_i3c_dev(olddev).
This process is protected by the bus maintenance lock.
However, i3c_device_uevent() is triggered by sysfs and directly
dereferences i3cdev->desc without acquiring the bus lock or employing RCU:
drivers/i3c/master.c:i3c_device_uevent() {
...
if (i3cdev->desc)
devinfo = i3cdev->desc->info;
manuf = I3C_PID_MANUF_ID(devinfo.pid);
...
}
If a thread executing i3c_device_uevent() evaluates i3cdev->desc, gets
preempted while i3c_master_add_i3c_dev_locked() frees olddev, and then
resumes, will this trigger a use-after-free during the structure copy?
> } else {
> dev_err(&master->dev,
> "Failed to assign reserved/old address to device %d%llx",
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260612111816.3688240-1-lakshay.piplani@nxp.com?part=1
^ permalink raw reply
* Re: [PATCH v3 3/3] media: i2c: os02g10: implement crop handling with set_selection
From: Tarang Raval @ 2026-06-12 11:41 UTC (permalink / raw)
To: Vladimir Zapolskiy
Cc: Elgin Perumbilly, laurent.pinchart@ideasonboard.com,
sakari.ailus@linux.intel.com, Mauro Carvalho Chehab, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Hans Verkuil, Hans de Goede,
Mehdi Djait, Sylvain Petinot, Benjamin Mugnier,
Bryan O'Donoghue, Heimir Thor Sverrisson, Hardevsinh Palaniya,
linux-media@vger.kernel.org, devicetree@vger.kernel.org,
linux-kernel@vger.kernel.org
In-Reply-To: <0f4bfe08-0504-48ff-83ce-c84600e6f38d@linaro.org>
Hi Vladimir,
Thank you for the review.
Since I authored this patch, I will try to address the comments below.
> On 4/24/26 12:25, Elgin Perumbilly wrote:
> > From: Tarang Raval <tarang.raval@siliconsignals.io>
> >
> > Add crop support to os02g10 by implementing .set_selection() and
> > storing the crop rectangle in subdev state.
> >
> > Initialize the default crop to the active area, make set_fmt() use the
> > current crop, and update the output format when the crop size changes.
> > Also program the sensor window from the active crop/format state instead
> > of using the fixed supported_modes entry.
> >
> > This allows userspace to configure the sensor crop window explicitly.
> >
> > Signed-off-by: Tarang Raval <tarang.raval@siliconsignals.io>
> > Signed-off-by: Elgin Perumbilly <elgin.perumbilly@siliconsignals.io>
> > ---
> > drivers/media/i2c/os02g10.c | 166 ++++++++++++++++++++++--------------
> > 1 file changed, 103 insertions(+), 63 deletions(-)
> >
> > diff --git a/drivers/media/i2c/os02g10.c b/drivers/media/i2c/os02g10.c
> > index fad2dd0ad7aa..9bf8f5d1caea 100644
> > --- a/drivers/media/i2c/os02g10.c
> > +++ b/drivers/media/i2c/os02g10.c
> > @@ -112,6 +112,11 @@
> > #define OS02G10_ORIENTATION_BAYER_FIX 0x32
> >
> > #define OS02G10_LINK_FREQ_720MHZ (720 * HZ_PER_MHZ)
> > +#define OS02G10_WINDOW_WIDTH_MIN 2
> > +#define OS02G10_WINDOW_HEIGHT_MIN 2
>
> Add a blank line before the new group of macro.
>
> > +#define OS02G10_VBLANK_DEF 166
>
> This one is computable, and it can be dropped.
Can you explain how this value can be computed ?
> > +#define OS02G10_VBLANK_MIN 25
>
> This macro shall be added to the group of OS02G10_REG_FRAME_LENGTH
> register, and it should be included into the previous change.
>
> > +#define OS02G10_EXPOSURE_DEF 1100
>
> This macro shall be added to the group of OS02G10_REG_LONG_EXPOSURE
> register, and it should be included into the previous change.
I would prefer to introduce these macros here only, as they are related to
this patch. There is no use of these macros in the previous patch, so moving
them there would not provide any benefit.
I will group them in the appropriate place within this patch as per your
suggestion.
> >
> > /* OS02G10 native and active pixel array size */
> > static const struct v4l2_rect os02g10_native_area = {
> > @@ -152,15 +157,6 @@ struct os02g10 {
> > struct v4l2_ctrl *hflip;
> > };
> >
> > -struct os02g10_mode {
> > - u32 width;
> > - u32 height;
> > - u32 vts_def;
> > - u32 exp_def;
> > - u32 x_start;
> > - u32 y_start;
> > -};
> > -
> > static const struct cci_reg_sequence os02g10_common_regs[] = {
> > { OS02G10_REG_PLL_DIV_CTRL, 0x0a},
> > { OS02G10_REG_PLL_DCTL_BIAS_CTRL, 0x04},
...
> > static const struct v4l2_subdev_video_ops os02g10_video_ops = {
> > @@ -645,6 +684,7 @@ static const struct v4l2_subdev_pad_ops os02g10_pad_ops = {
> > .get_fmt = v4l2_subdev_get_fmt,
> > .set_fmt = os02g10_set_pad_format,
> > .get_selection = os02g10_get_selection,
> > + .set_selection = os02g10_set_selection,
> > .enum_frame_size = os02g10_enum_frame_size,
> > .enable_streams = os02g10_enable_streams,
> > .disable_streams = os02g10_disable_streams,
>
> I understand that this change is written by another person, and likely
> it is not squashed with the previous one to preserve authorship, however
> it significantly rewrites the change already found in the series.
I don't think this patch significantly rewrites the previous changes. Its
main purpose is to introduce a crop rectangle and implement set_selection(),
allowing userspace to stream arbitrary resolutions within the sensor limits
instead of being restricted to 1920x1080.
> I don't see information about the maximum supported frame height/width
> or default VTS setting etc. anymore, for me it's hard to say, if
> this kind of information can be dropped with no consequences in runtime.
The maximum supported width and height are still defined and enforced in
os02g10_set_selection(). The default VTS handling is implemented in
os02g10_set_pad_format(), where VBLANK is adjusted to maintain 30 fps for
the selected resolution. So I don't believe any information has been dropped.
> Probably this 3/3 change will break a quick inclusion of the sensor
> driver, you may consider to exlcude it from the series now, and publish
> it afterwards.
Regarding whether patch 3/3 should be included in the current series, I am
happy to leave that decision to Sakari. If needed, this patch can be merged
separately once the new raw sensor model is finalized.
This patch was created based on Laurent's suggestion.
Link: https://lore.kernel.org/linux-media/20260414084952.217215-1-elgin.perumbilly@siliconsignals.io/T/#t
Best Regards,
Tarang
^ permalink raw reply
* Re: [PATCH v11 7/9] i3c: hub: Add support for the I3C interface in the I3C hub
From: sashiko-bot @ 2026-06-12 11:41 UTC (permalink / raw)
To: Lakshay Piplani; +Cc: devicetree, robh, conor+dt, linux-i3c, Frank.Li
In-Reply-To: <20260612111816.3688240-8-lakshay.piplani@nxp.com>
Thank you for your contribution! Sashiko AI review found 11 potential issue(s) to consider:
- [Critical] Concurrent private transfers through the hub race on `hub_dev->info.dyn_addr`, causing data corruption.
- [Critical] Delegating DAA to the parent controller incorrectly attaches downstream devices to the parent bus.
- [Critical] Unsynchronized hub port enablement breaks virtual bus isolation, causing bus collisions.
- [Critical] `i3c_hub_master_priv_xfers` corrupts the parent bus address slots by freeing slots that belong to unrelated physical devices.
- [High] Double free and memory leak of the IBI workqueue in `i3c_hub_request_ibi` error path.
- [High] Deterministic NULL pointer dereference in `i3c_dev_free_ibi_locked` after hub recursive call.
- [High] Unlocked write to `hub_dev->info.dyn_addr` introduces a data race on the error path.
- [High] Failure in `priv_xfers` address reattachment permanently orphans the hub device.
- [High] IBI support for downstream hub devices is broken because devices are never added to the physical parent's bus list.
- [High] Lockdep splat due to nested acquisition of `bus.lock` without subclass annotations.
- [Medium] I2C transfers silently succeed without performing any communication, masking failures.
--
commit f3f90aaf2c0040d96007fed285ccd49e4c6e8e7a
Author: Lakshay Piplani <lakshay.piplani@nxp.com>
i3c: hub: Add support for the I3C interface in the I3C hub
Add virtual I3C bus support for the hub and provide interface to enable
or disable downstream ports.
> diff --git a/drivers/i3c/hub.c b/drivers/i3c/hub.c
> new file mode 100644
> index 0000000000000..c37b01fddcb4c
> --- /dev/null
> +++ b/drivers/i3c/hub.c
[ ... ]
> +static int i3c_hub_do_daa(struct i3c_hub *hub,
> + struct i3c_master_controller *controller)
> +{
> + struct i3c_master_controller *parent;
> + int ret;
> +
> + if (!hub || !hub->hub_dev)
> + return -ENODEV;
> +
> + parent = i3c_dev_get_master(hub->hub_dev->desc);
> + if (!parent)
> + return -ENODEV;
> +
> + i3c_hub_enable_port(controller);
[Severity: Critical]
Does enabling the port outside of the parent controller's bus lock break
virtual bus isolation? If multiple virtual ports execute global broadcasts
concurrently, they might both enable their respective hardware ports before
blocking on parent->bus.lock. This could cause the parent to execute the
broadcast across all enabled ports simultaneously, potentially resulting in
severe bus collisions.
> + ret = i3c_master_do_daa(parent);
[Severity: Critical]
Could delegating the Dynamic Address Assignment procedure to the physical
parent controller incorrectly attach downstream devices to the parent bus?
Since i3c_master_do_daa() natively creates and attaches devices to the
physical parent bus, any transfers targeting these devices would bypass the
hub's virtual controller callbacks. As a result, i3c_hub_enable_port()
would never be invoked prior to communication, potentially causing I3C
transfers to the downstream devices to fail.
> + i3c_hub_disable_port(controller);
> +
> + return ret;
> +}
[ ... ]
> +static int i3c_hub_send_ccc_cmd(struct i3c_hub *hub,
> + struct i3c_master_controller *controller,
> + struct i3c_ccc_cmd *cmd)
> +{
> + struct i3c_master_controller *parent;
> + int ret;
> +
> + if (!hub || !hub->hub_dev)
> + return -ENODEV;
> +
> + parent = i3c_dev_get_master(hub->hub_dev->desc);
> + if (!parent)
> + return -ENODEV;
> +
> + i3c_hub_enable_port(controller);
[Severity: Critical]
Is it possible for concurrent CCC broadcasts to cause bus collisions here?
Similar to i3c_hub_do_daa(), enabling the port outside of parent->bus.lock
could allow multiple ports to be enabled simultaneously if they execute
broadcasts concurrently.
> + ret = i3c_master_send_ccc_cmd(parent, cmd);
> + i3c_hub_disable_port(controller);
> +
> + return ret;
> +}
[ ... ]
> +static int i3c_hub_master_priv_xfers(struct i3c_dev_desc *dev,
> + struct i3c_xfer *xfers,
> + int nxfers,
> + enum i3c_xfer_mode mode)
> +{
> + struct i3c_master_controller *controller = i3c_dev_get_master(dev);
> + struct i3c_hub_controller *hub_controller;
> + struct i3c_dev_desc *hub_dev;
> + struct i3c_master_controller *parent;
> + u8 hub_addr, target_addr;
> + struct i3c_hub *hub;
> + int ret, xfer_ret;
[ ... ]
> + if (hub_addr != target_addr) {
> + down_write(&parent->bus.lock);
[Severity: High]
Does acquiring this lock cause a lockdep splat?
This function is invoked from contexts where the core framework has already
locked the virtual downstream controller's bus.lock (e.g., via
i3c_bus_normaluse_lock() which takes a down_read). Acquiring a second lock
of the same class without using down_write_nested() might violate lock
nesting rules.
> + hub_dev->info.dyn_addr = target_addr;
> +
> + ret = i3c_master_reattach_i3c_dev_locked(hub_dev, hub_addr);
> + up_write(&parent->bus.lock);
> + if (ret) {
> + hub_dev->info.dyn_addr = hub_addr;
[Severity: High]
Is it safe to modify hub_dev->info.dyn_addr outside of the bus write lock?
Modifying this shared bus state variable after up_write(&parent->bus.lock)
appears to introduce a data race with concurrent bus operations.
[Severity: High]
If i3c_master_reattach_i3c_dev_locked() fails, are we permanently orphaning
the hub device?
When it fails, the core code automatically marks both the new and old address
slots as I3C_ADDR_SLOT_FREE via i3c_master_put_i3c_addrs(). Because this
error path restores dyn_addr but fails to reinstate the address allocation
on the parent bus, the parent controller might re-assign the hub's legitimate
address to new hot-joined devices.
> + goto disable;
> + }
> + }
> +
> + ret = i3c_device_do_xfers(hub->hub_dev, xfers, nxfers, mode);
[Severity: Critical]
Could concurrent private transfers through the hub race on
hub_dev->info.dyn_addr?
This function drops the write lock before calling i3c_device_do_xfers(),
which only acquires the lock in read mode. If multiple threads concurrently
initiate transfers to different downstream ports, they might take the read
lock simultaneously and race to overwrite hub_dev->info.dyn_addr, potentially
causing transfers to be misrouted.
> +
> + if (hub_addr != target_addr) {
> + down_write(&parent->bus.lock);
> + hub_dev->info.dyn_addr = hub_addr;
> +
> + xfer_ret = i3c_master_reattach_i3c_dev_locked(hub_dev,
> + target_addr);
[Severity: Critical]
Does passing target_addr as the old dynamic address corrupt the parent bus
address slots?
When the core function interprets target_addr as the old dynamic address of
the device on the parent bus:
drivers/i3c/master.c:i3c_master_reattach_i3c_dev_locked() {
...
if (old_dyn_addr)
i3c_bus_set_addr_slot_status(&master->bus, old_dyn_addr,
I3C_ADDR_SLOT_FREE);
...
}
Because target_addr is a downstream address independently assigned by the
virtual controller, this might blindly free an in-use address slot on the
parent bus that belongs to an unrelated physical device.
> +
> + up_write(&parent->bus.lock);
> + if (!ret)
> + ret = xfer_ret;
> + }
> +disable:
> + i3c_hub_disable_port(controller);
> + return ret;
> +}
[ ... ]
> +static int i3c_hub_i2c_xfers(struct i2c_dev_desc *dev,
> + struct i2c_msg *xfers, int nxfers)
> +{
> + return 0;
> +}
[Severity: Medium]
Should this callback attempt to forward the I2C transfers through the hub to
the parent bus, or return an error like -EOPNOTSUPP? Unconditionally
returning 0 might lead the kernel and userspace applications to falsely
assume that I2C transactions to downstream devices were successful when no
actual hardware communication occurred.
[ ... ]
> +static int i3c_hub_request_ibi(struct i3c_dev_desc *desc,
> + const struct i3c_ibi_setup *req)
> +{
> + struct i3c_master_controller *controller = i3c_dev_get_master(desc);
> + struct i3c_hub_controller *hub_controller;
> + struct i3c_master_controller *orig_parent;
> + struct i3c_master_controller *parent;
> + struct i3c_hub *hub;
> + int ret;
[ ... ]
> + parent = i3c_dev_get_master(hub->hub_dev->desc);
> +
> + down_write(&parent->bus.lock);
[Severity: High]
Does acquiring parent->bus.lock here cause a lockdep splat? As with
i3c_hub_master_priv_xfers(), this might acquire a second lock of the
same class without using down_write_nested().
> +
> + orig_parent = i3c_hub_update_desc_parent(&desc->common, parent);
> +
> + ret = i3c_master_direct_attach_i3c_dev_locked(parent, desc);
[Severity: High]
Are downstream devices missing from the physical parent's bus list?
i3c_master_direct_attach_i3c_dev_locked() explicitly skips adding the device
to the parent's bus.devs.i3c list. When the hardware subsequently receives an
IBI, the core framework (i3c_master_handle_ibi) might look up the source
device by matching the IBI address against its bus.devs.i3c list. Since the
downstream device is missing from the list, the lookup would predictably
fail, causing IBIs to be ignored.
> + if (ret) {
> + i3c_hub_update_desc_parent(&desc->common, orig_parent);
> + up_write(&parent->bus.lock);
> + return ret;
> + }
> +
> + kfree(desc->ibi);
> + desc->ibi = NULL;
[Severity: High]
Are we leaking the IBI workqueue here?
When i3c_dev_request_ibi_locked() handles an IBI request, it allocates a
new ibi structure and a workqueue (ibi->wq). Freeing desc->ibi without
destroying ibi->wq seems to leak the workqueue.
Furthermore, if the nested i3c_dev_request_ibi_locked() call fails, this
hub callback will return an error to the outer caller. The outer caller's
error handling path might then unconditionally execute kfree(ibi) using its
original local pointer:
drivers/i3c/master.c:i3c_dev_request_ibi_locked() {
...
ret = master->ops->request_ibi(dev, req);
if (ret) {
kfree(ibi);
dev->ibi = NULL;
}
...
}
Since the hub callback already freed it, wouldn't this result in a
double-free?
> + ret = i3c_dev_request_ibi_locked(desc, req);
> + if (ret)
> + i3c_master_direct_detach_i3c_dev_locked(desc);
> +
> + i3c_hub_update_desc_parent(&desc->common, orig_parent);
> +
> + up_write(&parent->bus.lock);
> +
> + return ret;
> +}
> +
> +static void i3c_hub_free_ibi(struct i3c_dev_desc *desc)
> +{
> + struct i3c_master_controller *controller = i3c_dev_get_master(desc);
> + struct i3c_hub_controller *hub_controller;
> + struct i3c_master_controller *orig_parent;
> + struct i3c_master_controller *parent;
> + struct i3c_hub *hub;
[ ... ]
> + down_write(&parent->bus.lock);
> + orig_parent = i3c_hub_update_desc_parent(&desc->common, parent);
> + i3c_master_direct_detach_i3c_dev_locked(desc);
> + i3c_dev_free_ibi_locked(desc);
[Severity: High]
Does this nested call to i3c_dev_free_ibi_locked() cause a NULL pointer
dereference upon returning to the outer caller?
The inner call tears down the IBI state and sets desc->ibi = NULL.
When control returns to the outer i3c_dev_free_ibi_locked():
drivers/i3c/master.c:i3c_dev_free_ibi_locked() {
...
master->ops->free_ibi(dev);
if (dev->ibi->wq) {
...
}
It seems to unconditionally evaluate dev->ibi->wq immediately after the
callback returns, which would blindly dereference the newly nullified
pointer.
> + i3c_hub_update_desc_parent(&desc->common, orig_parent);
> + up_write(&parent->bus.lock);
> +
> + i3c_hub_disable_port(controller);
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260612111816.3688240-1-lakshay.piplani@nxp.com?part=7
^ permalink raw reply
* Re: [PATCH v11 5/9] mfd: p3h2x4x: Add driver for NXP P3H2x4x i3c hub and on-die regulator
From: sashiko-bot @ 2026-06-12 11:41 UTC (permalink / raw)
To: Lakshay Piplani; +Cc: robh, devicetree, linux-i3c, Frank.Li, conor+dt
In-Reply-To: <20260612111816.3688240-6-lakshay.piplani@nxp.com>
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] The driver incorrectly binds to any generic I3C hub device on the bus.
- [Low] The driver bypasses the I3C subsystem abstraction by including <linux/i3c/master.h> instead of <linux/i3c/device.h>.
--
commit 3682ca3c66e35b06e88823e8081c57b3ea1d4084
Author: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
mfd: p3h2x4x: Add driver for NXP P3H2x4x i3c hub and on-die regulator
Add core MFD support for the NXP P3H2x4x (P3H2440/P3H2441/P3H2840/P3H2841)
family of multiport I3C hub devices. These devices connect to a host via
I3C/I2C/SMBus and expose multiple downstream target ports.
> diff --git a/drivers/mfd/p3h2840.c b/drivers/mfd/p3h2840.c
> new file mode 100644
> index 0000000000000..0a80992d6250a
> --- /dev/null
> +++ b/drivers/mfd/p3h2840.c
> @@ -0,0 +1,119 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * Copyright 2025-2026 NXP
> + * P3H2X4X i3c hub and regulator device.
> + */
> +
> +#include <linux/i2c.h>
> +#include <linux/i3c/master.h>
[Severity: Low]
Does this include bypass the I3C subsystem abstraction? By including the
master header, the driver has access to the internal definition of
struct i3c_device. Should this include <linux/i3c/device.h> instead?
[ ... ]
> +static int p3h2x4x_device_probe_i3c(struct i3c_device *i3cdev)
> +{
> + struct p3h2x4x_dev *ddata;
> + int ret;
> +
> + ddata = devm_kzalloc(&i3cdev->dev, sizeof(*ddata), GFP_KERNEL);
[Severity: Low]
This directly accesses the internal dev field of struct i3c_device. Should
this use i3cdev_to_dev(i3cdev) to obtain the underlying struct device pointer
to maintain API boundaries?
[ ... ]
> +static const struct i3c_device_id p3h2x4x_i3c_ids[] = {
> + I3C_CLASS(I3C_DCR_HUB, NULL),
> + { /* sentinel */ },
> +};
[Severity: High]
Will this driver inappropriately bind to any generic I3C hub device on the
bus?
Using I3C_CLASS(I3C_DCR_HUB, NULL) instructs the subsystem to match any
device that advertises the generic Hub DCR (194), without filtering by
vendor or part ID.
Because the probe function doesn't verify the Manufacturer ID, it seems this
could eagerly bind to third-party hubs and attempt NXP-specific register
operations on them.
Should this use I3C_DEVICE(I3C_VENDOR_NXP, ...) to exclusively match the
supported NXP devices instead of the generic hub class?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260612111816.3688240-1-lakshay.piplani@nxp.com?part=5
^ permalink raw reply
* Re: [PATCH v11 8/9] i3c: hub: p3h2x4x: Add support for NXP P3H2x4x I3C hub functionality
From: sashiko-bot @ 2026-06-12 11:39 UTC (permalink / raw)
To: Lakshay Piplani; +Cc: Frank.Li, linux-i3c, devicetree, conor+dt, robh
In-Reply-To: <20260612111816.3688240-9-lakshay.piplani@nxp.com>
Thank you for your contribution! Sashiko AI review found 10 potential issue(s) to consider:
- [High] Regulator devres cleanup actions are erroneously attached to the parent device instead of the child device being probed.
- [High] SMBus I2C adapters are not unregistered on probe error paths, causing a Use-After-Free.
- [High] In-Band Interrupt (IBI) remains requested and enabled on probe failure, causing a Use-After-Free.
- [High] Unsafe reliance on non-deterministic delays without polling the SMBus finish flag causes premature data reads.
- [High] The driver dynamically overwrites the shared platform device's `of_node` pointer, corrupting the core device tree state.
- [High] `regmap_update_bits` uses the configuration value as the bitmask, failing to clear stale bits.
- [High] DAA is performed on the upstream bus before the downstream target ports are physically enabled.
- [Medium] Target port device tree node references acquired during probe are leaked on error paths.
- [Medium] Default configuration structures are populated with enum values instead of Ohms, causing misconfiguration.
- [Low] Dead code due to incorrect `IS_ERR` check on `devm_kzalloc` return value.
--
commit 8d18a29a52d0297c45635edaf397ce828e709ef9
Author: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
i3c: hub: p3h2x4x: Add support for NXP P3H2x4x I3C hub functionality
Add I3C hub functionality for the NXP P3H2x4x family of multiport hubs.
These devices support downstream target ports that can be configured
as I3C, I2C, or SMBus.
> diff --git a/drivers/i3c/hub/p3h2840_i3c_hub_common.c b/drivers/i3c/hub/p3h2840_i3c_hub_common.c
> new file mode 100644
> index 0000000000000..fedcb978f07ee
> --- /dev/null
> +++ b/drivers/i3c/hub/p3h2840_i3c_hub_common.c
[ ... ]
> +static int p3h2x4x_configure_ldo(struct device *dev)
> +{
> + static const char * const supplies[] = {
> + "vcc1",
> + "vcc2",
> + "vcc3",
> + "vcc4"
> + };
> + int ret, i;
> +
> + for (i = 0; i < ARRAY_SIZE(supplies); i++) {
> + ret = devm_regulator_get_enable_optional(dev->parent, supplies[i]);
[Severity: High]
Could this leak devres memory on the parent device? By passing dev->parent
(the MFD parent device) instead of dev (the child hub device), the regulator
cleanup actions are attached to the parent. If the hub driver fails probe
or is repeatedly bound/unbound, it looks like these regulators won't be
disabled and the references will be leaked.
[ ... ]
> +static int p3h2x4x_configure_tp(struct device *dev)
> +{
> + struct p3h2x4x_i3c_hub_dev *hub = dev_get_drvdata(dev);
> + u8 mode = 0, smbus = 0, pullup = 0, target_port = 0;
> + int tp, ret;
> +
> + for (tp = 0; tp < P3H2X4X_TP_MAX_COUNT; tp++) {
> + pullup |= hub->hub_config.tp_config[tp].pullup_en ? P3H2X4X_SET_BIT(tp) : 0;
[ ... ]
> + ret = regmap_update_bits(hub->regmap, P3H2X4X_TP_PULLUP_EN, pullup, pullup);
[Severity: High]
Does this fail to clear stale bits? The third argument to regmap_update_bits()
is the mask. By using 'pullup' as the mask, it seems this only applies
operations to bits that are 1. Any bit that is 0 in 'pullup' is ignored,
which might leave stale hardware state (like pullups enabled by the
bootloader) unmodified. Should this use a proper mask covering all relevant
bits?
[ ... ]
> +static void p3h2x4x_get_target_port_dt_conf(struct device *dev,
> + const struct device_node *node)
> +{
> + struct p3h2x4x_i3c_hub_dev *p3h2x4x_i3c_hub = dev_get_drvdata(dev);
> + u64 tp_port;
> +
> + for_each_available_child_of_node_scoped(node, dev_node) {
> + if (of_property_read_reg(dev_node, 0, &tp_port, NULL))
> + continue;
> +
> + if (tp_port < P3H2X4X_TP_MAX_COUNT) {
> + p3h2x4x_i3c_hub->tp_bus[tp_port].of_node = of_node_get(dev_node);
[Severity: Medium]
Is there a resource leak here on probe error paths? This manually increments
the reference count of the child nodes using of_node_get(). While
p3h2x4x_i3c_hub_remove() correctly drops these references, if
p3h2x4x_i3c_hub_probe() fails and returns an error, the remove callback
isn't executed. Without a devm cleanup action, could these OF nodes leak
memory?
[ ... ]
> +static void p3h2x4x_default_configuration(struct device *dev)
> +{
> + struct p3h2x4x_i3c_hub_dev *p3h2x4x_i3c_hub = dev_get_drvdata(dev);
> + int tp_count;
> +
> + p3h2x4x_i3c_hub->hub_config.tp0145_pullup = P3H2X4X_TP_PULLUP_500R;
[Severity: Medium]
Are these default configuration values being set correctly? These fields
appear to be designed to store physical Ohm measurements, but they are
initialized to macros like P3H2X4X_TP_PULLUP_500R which evaluate to enum
indices (e.g., 1). When the default value 1 is later processed by
p3h2x4x_pullup_dt_to_reg() using find_closest(), it would resolve to the
closest table entry 250 instead of the intended 500. Should these initialize
with real-world units?
[ ... ]
> +static int p3h2x4x_i3c_hub_probe(struct platform_device *pdev)
> +{
[ ... ]
> + /* Register virtual I2C adapters for SMBus target ports */
> + ret = p3h2x4x_tp_smbus_algo(p3h2x4x_i3c_hub);
> + if (ret)
> + return dev_err_probe(dev, ret, "Failed to add i2c adapter\n");
> +
> + /* Lock access to protected registers */
> + ret = regmap_write(p3h2x4x_i3c_hub->regmap, P3H2X4X_DEV_REG_PROTECTION_CODE,
> + P3H2X4X_REGISTERS_LOCK_CODE);
> + if (ret)
> + return dev_err_probe(dev, ret, "Failed to lock HUB's protected registers\n");
[Severity: High]
Are the SMBus I2C adapters cleaned up if this final regmap_write() fails?
p3h2x4x_tp_smbus_algo() registers adapters using i2c_add_adapter(), which
requires an explicit i2c_del_adapter(). If the probe fails here, the adapters
are never unregistered, which leaves the I2C core with active references to
devm-freed memory. Could this cause a use-after-free?
> +
> + return 0;
> +}
> diff --git a/drivers/i3c/hub/p3h2840_i3c_hub_i3c.c b/drivers/i3c/hub/p3h2840_i3c_hub_i3c.c
> new file mode 100644
> index 0000000000000..38505dda0e81b
> --- /dev/null
> +++ b/drivers/i3c/hub/p3h2840_i3c_hub_i3c.c
[ ... ]
> +int p3h2x4x_tp_i3c_algo(struct p3h2x4x_i3c_hub_dev *p3h2x4x_hub)
> +{
[ ... ]
> + p3h2x4x_hub->hub = devm_kzalloc(p3h2x4x_hub->dev,
> + sizeof(*p3h2x4x_hub->hub),
> + GFP_KERNEL);
> +
> + if (!p3h2x4x_hub->hub)
> + return -ENOMEM;
> +
> + i3c_hub_init(p3h2x4x_hub->hub,
> + &p3h2x4x_hub_ops,
> + p3h2x4x_hub->i3cdev);
> +
> + if (IS_ERR(p3h2x4x_hub->hub))
> + return PTR_ERR(p3h2x4x_hub->hub);
[Severity: Low]
Is this IS_ERR() check necessary? devm_kzalloc() returns either a valid
pointer or NULL on failure, never an error pointer. It seems this block of
code might be dead.
[ ... ]
> + for (tp = 0; tp < P3H2X4X_TP_MAX_COUNT; tp++) {
> + if (!p3h2x4x_hub->tp_bus[tp].of_node ||
> + p3h2x4x_hub->hub_config.tp_config[tp].mode != P3H2X4X_TP_MODE_I3C)
> + continue;
> +
> + /* Assign DT node for this TP */
> + p3h2x4x_hub->dev->of_node = p3h2x4x_hub->tp_bus[tp].of_node;
[Severity: High]
Can dynamically overwriting the platform device's of_node pointer corrupt the
core device tree state? By changing p3h2x4x_hub->dev->of_node in a loop
without saving and restoring the original, it looks like this permanently
changes the node the device points to. Could this break device tree links,
sysfs topologies, or devres lookups that rely on the original parent hub
of_node?
[ ... ]
> + /* Perform DAA */
> + ret = i3c_master_do_daa(parent);
> + if (ret)
> + return ret;
> +
> + ntwk_mask |= p3h2x4x_hub->tp_bus[tp].tp_mask;
> + p3h2x4x_hub->tp_bus[tp].is_registered = true;
> + p3h2x4x_hub->hub_config.tp_config[tp].always_enable = true;
> + }
[ ... ]
> +#if IS_ENABLED(CONFIG_I2C_SLAVE)
> + ret = i3c_device_request_ibi(p3h2x4x_hub->i3cdev, &p3h2x4x_ibireq);
> + if (ret)
> + return ret;
> +
> + ret = i3c_device_enable_ibi(p3h2x4x_hub->i3cdev);
[Severity: High]
If a subsequent step in p3h2x4x_i3c_hub_probe() fails, are the IBIs safely
cleaned up? The devm framework would free the p3h2x4x_i3c_hub structure,
but the IBI might remain active on the master. If an interrupt fires later
and accesses the freed structure via i3cdev_get_drvdata(i3cdev), could this
trigger a use-after-free?
> + if (ret) {
> + i3c_device_free_ibi(p3h2x4x_hub->i3cdev);
> + return ret;
> + }
> +#endif
> + ret = regmap_write(p3h2x4x_hub->regmap, P3H2X4X_TP_NET_CON_CONF, ntwk_mask);
[Severity: High]
Does performing DAA here actually reach the downstream targets? The DAA is
executed earlier on the upstream bus inside the target port loop, but the
downstream target ports don't appear to be logically connected to the upstream
bus until ntwk_mask is written to P3H2X4X_TP_NET_CON_CONF at the end of the
function. Will downstream targets receive the ENTDAA command if DAA is done
before the physical ports are enabled?
> diff --git a/drivers/i3c/hub/p3h2840_i3c_hub_smbus.c b/drivers/i3c/hub/p3h2840_i3c_hub_smbus.c
> new file mode 100644
> index 0000000000000..edb75f790e92e
> --- /dev/null
> +++ b/drivers/i3c/hub/p3h2840_i3c_hub_smbus.c
[ ... ]
> +static int p3h2x4x_read_smbus_transaction_status(struct p3h2x4x_i3c_hub_dev *hub,
> + u8 target_port_status,
> + u8 data_length)
> +{
> + u32 status_read;
> + u8 status;
> + int ret;
> +
> + fsleep(P3H2X4X_SMBUS_400kHz_TRANSFER_TIMEOUT(data_length));
> +
> + ret = regmap_read(hub->regmap, target_port_status, &status_read);
[Severity: High]
Could relying on a fixed timeout instead of polling the hardware finish flag
cause the driver to read stale data? Because the top 4 bits of the status
register are initialized to 0 before the transaction begins, they remain 0
while the hardware is busy. If the transaction exceeds the timeout (e.g., due
to clock stretching), status evaluates to 0
(P3H2X4X_SMBUS_CNTRL_STATUS_TXN_OK). Should this code poll the
P3H2X4X_SMBUS_TRANSACTION_FINISH_FLAG instead to ensure completion?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260612111816.3688240-1-lakshay.piplani@nxp.com?part=8
^ permalink raw reply
* Re: [PATCH v11 6/9] regulator: p3h2x4x: Add driver for on-die regulators in NXP P3H2x4x i3c hub
From: sashiko-bot @ 2026-06-12 11:37 UTC (permalink / raw)
To: Lakshay Piplani; +Cc: conor+dt, linux-i3c, Frank.Li, robh, devicetree
In-Reply-To: <20260612111816.3688240-7-lakshay.piplani@nxp.com>
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Concurrent hardware operations on different regulators share the same protection lock register without a cross-device shared lock, leading to a race condition where regulator writes fail silently.
- [High] I/O errors during hardware unlock are silently ignored, leading to false success returns for regulator operations.
--
commit 8fb846835511c487dd04df576ca53fdbc089839a
Author: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
Subject: regulator: p3h2x4x: Add driver for on-die regulators in NXP P3H2x4x i3c hub
The NXP P3H2x4x family integrates on-die regulators alongside I3C hub
functionality. This driver registers the regulators using the MFD
framework and exposes them via the regulator subsystem.
> diff --git a/drivers/regulator/p3h2840_i3c_hub_regulator.c b/drivers/regulator/p3h2840_i3c_hub_regulator.c
> new file mode 100644
> index 0000000000000..4f2514d4d928e
> --- /dev/null
> +++ b/drivers/regulator/p3h2840_i3c_hub_regulator.c
[ ... ]
> +static void p3h2x4x_reg_guard_enter(struct regulator_dev *rdev,
> + struct p3h2x4x_reg_state *state)
> +{
> + state->restore = false;
> +
> + if (regmap_read(rdev->regmap,
> + P3H2X4X_DEV_REG_PROTECTION_CODE,
> + &state->orig))
> + return;
[Severity: High]
If this regmap_read() fails, the function returns silently since it
has a void return type. Will this cause subsequent regulator operations
like regulator_enable_regmap() to execute blindly on locked hardware,
ignoring the configuration write but returning a false success to the caller?
> +
> + if (state->orig != P3H2X4X_REGISTERS_UNLOCK_CODE) {
> + regmap_write(rdev->regmap,
> + P3H2X4X_DEV_REG_PROTECTION_CODE,
> + P3H2X4X_REGISTERS_UNLOCK_CODE);
> + state->restore = true;
> + }
> +}
> +
> +static void p3h2x4x_reg_guard_exit(struct regulator_dev *rdev,
> + struct p3h2x4x_reg_state *state)
> +{
> + if (state->restore)
> + regmap_write(rdev->regmap,
> + P3H2X4X_DEV_REG_PROTECTION_CODE,
> + state->orig);
> +}
> +
> +DEFINE_LOCK_GUARD_1(p3h2x4x_reg, struct regulator_dev,
> + p3h2x4x_reg_guard_enter(_T->lock, &_T->state),
> + p3h2x4x_reg_guard_exit(_T->lock, &_T->state),
> + struct p3h2x4x_reg_state state);
> +
> +static int p3h2x4x_regulator_enable(struct regulator_dev *rdev)
> +{
> + guard(p3h2x4x_reg)(rdev);
[Severity: High]
Could there be a race condition here between different regulator instances?
The P3H2X4X_DEV_REG_PROTECTION_CODE register appears to be a shared
device-wide resource, but guard(p3h2x4x_reg) relies on rdev->mutex, which
only serializes operations for a single regulator instance.
If two threads access different regulators (e.g., ldo-cp0 and ldo-cp1)
concurrently, could they interleave like this:
Thread A reads state->orig, sees locked, writes unlock, sets restore=true
Thread B reads state->orig, sees unlocked, sets restore=false
Thread A completes its update, runs guard_exit, and relocks the device
Thread B attempts its regulator update, but the hardware is now locked
Would it be safer to use a shared device-level lock in the parent MFD
device to protect the hardware protection register?
> + return regulator_enable_regmap(rdev);
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260612111816.3688240-1-lakshay.piplani@nxp.com?part=6
^ permalink raw reply
* Re: [PATCH v11 4/9] dt-bindings: i3c: Add NXP P3H2x4x i3c-hub support
From: sashiko-bot @ 2026-06-12 11:33 UTC (permalink / raw)
To: Lakshay Piplani; +Cc: Frank.Li, conor+dt, devicetree, robh, linux-i3c
In-Reply-To: <20260612111816.3688240-5-lakshay.piplani@nxp.com>
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] Missing GPIO provider properties and constraints in the DT binding schema, violating subsystem guidelines.
- [Medium] Missing compatible strings and port constraints for the documented 4-port hardware variants (P3H2440/P3H2441).
--
commit cfd8cd31027f9ddcdd30fe595d5d947dc8bae49b
Author: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
dt-bindings: i3c: Add NXP P3H2x4x i3c-hub support
Adds bindings for the NXP P3H2x4x multiport I3C hub family. These devices
connect to a host via I3C/I2C/SMBus and allow communication with multiple
downstream peripherals.
> diff --git a/Documentation/devicetree/bindings/i3c/nxp,p3h2840.yaml b/Documentation/devicetree/bindings/i3c/nxp,p3h2840.yaml
> new file mode 100644
> index 0000000000000..c080eeb0eeaa8
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/i3c/nxp,p3h2840.yaml
> @@ -0,0 +1,291 @@
> +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
> +# Copyright 2025 NXP
> +%YAML 1.2
> +---
> +$id: http://devicetree.org/schemas/i3c/nxp,p3h2840.yaml#
> +$schema: http://devicetree.org/meta-schemas/core.yaml#
> +
> +title: NXP P3H2X4X I3C HUB
[ ... ]
> +description: |
> + P3H2x4x (P3H2440/P3H2441/P3H2840/P3H2841) is a family of multiport I3C
> + hub devices that connect to:-
> + 1. A host CPU via I3C/I2C/SMBus bus on upstream side and connect to multiple
> + peripheral devices on the downstream side.
> + 2. Have two Controller Ports which can support either
> + I2C/SMBus or I3C buses and connect to a CPU, BMC or SOC.
> + 3. P3H2840/ P3H2841 are 8 port I3C hub with eight I3C/I2C Target Port.
> + 4. P3H2440/ P3H2441 are 4 port I3C hub with four I3C/I2C Target Port.
> + Target ports can be configured as I2C/SMBus, I3C or GPIO and connect to
> + peripherals.
[Severity: Medium]
If the target ports can be configured as GPIO, should the schema include the
corresponding provider properties (such as gpio-controller and #gpio-cells)?
Without these properties defined, device trees attempting to use the
documented GPIO capabilities will be strictly rejected due to
unevaluatedProperties: false at the top level.
> +
> +properties:
> + compatible:
> + const: nxp,p3h2840
[Severity: Medium]
The description mentions support for the P3H2440 and P3H2441 4-port hardware
variants, but the compatible property is restricted strictly to nxp,p3h2840.
Should the compatible strings for the 4-port variants also be included here?
[ ... ]
> +patternProperties:
> + "^i3c@[0-7]$":
> + type: object
> + $ref: /schemas/i3c/i3c.yaml#
> + unevaluatedProperties: false
> +
> + properties:
> + reg:
> + description:
> + The I3C HUB Target Port number.
> + maximum: 7
[Severity: Medium]
The maximum port number is currently hardcoded to 7 for all variants. If the
4-port variants (P3H2440/P3H2441) are supported, wouldn't we need conditional
if-then constraints to restrict the reg maximum to 3 for the 4-port hubs?
Otherwise, invalid device trees defining non-existent ports on 4-port hubs
might pass validation.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260612111816.3688240-1-lakshay.piplani@nxp.com?part=4
^ permalink raw reply
* [PATCH v11 7/9] i3c: hub: Add support for the I3C interface in the I3C hub
From: Lakshay Piplani @ 2026-06-12 11:18 UTC (permalink / raw)
To: linux-kernel, linux-i3c, alexandre.belloni, krzk+dt, robh,
conor+dt, devicetree, broonie, lee, Frank.Li, lgirdwood
Cc: vikash.bansal, priyanka.jain, aman.kumarpandey, Lakshay Piplani
In-Reply-To: <20260612111816.3688240-1-lakshay.piplani@nxp.com>
Add virtual I3C bus support for the hub and provide interface to enable
or disable downstream ports.
Signed-off-by: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
Signed-off-by: Vikash Bansal <vikash.bansal@nxp.com>
Signed-off-by: Lakshay Piplani <lakshay.piplani@nxp.com>
---
Changes in v11:
- Fix virtual hub address reattach handling
- Fix parent bus locking during address reattach operations
- Improve transfer and IBI request error handling
Changes in v10:
- Remove unnecessary ibi_lock handling in request/enable/disable/free
IBI APIs
- Remove redundant parent pointer from struct i3c_hub and derive upstream
master from hub_dev
Changes in v9:
- No change
Changes in v8:
- No change
Changes in v7:
- Convert Kconfig option to tristate
- Fix signedness issue in return value
- Fix kernel-doc warnings
Changes in v6:
- Add support for the generic I3C interface in the I3C Hub
---
---
MAINTAINERS | 2 +
drivers/i3c/Kconfig | 15 ++
drivers/i3c/Makefile | 1 +
drivers/i3c/hub.c | 484 ++++++++++++++++++++++++++++++++++++++++
include/linux/i3c/hub.h | 99 ++++++++
5 files changed, 601 insertions(+)
create mode 100644 drivers/i3c/hub.c
create mode 100644 include/linux/i3c/hub.h
diff --git a/MAINTAINERS b/MAINTAINERS
index fcb3917aa096..a0b7fd85f8e3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -19311,8 +19311,10 @@ L: linux-kernel@vger.kernel.org
L: linux-i3c@lists.infradead.org
S: Maintained
F: Documentation/devicetree/bindings/i3c/nxp,p3h2840.yaml
+F: drivers/i3c/hub.c
F: drivers/mfd/p3h2840.c
F: drivers/regulator/p3h2840_i3c_hub_regulator.c
+F: include/linux/i3c/hub.h
F: include/linux/mfd/p3h2840.h
NXP PF5300/PF5301/PF5302 PMIC REGULATOR DEVICE DRIVER
diff --git a/drivers/i3c/Kconfig b/drivers/i3c/Kconfig
index 626c54b386d5..65304b416bb4 100644
--- a/drivers/i3c/Kconfig
+++ b/drivers/i3c/Kconfig
@@ -21,6 +21,21 @@ menuconfig I3C
if I3C
source "drivers/i3c/master/Kconfig"
+
+config I3C_HUB
+ tristate "I3C Hub Support"
+ depends on I3C
+ help
+ Enable support for the I3C interface in hub devices.
+
+ This option adds virtual I3C bus support for hubs by creating
+ virtual master controllers for downstream ports and forwarding
+ bus operations through the hub device. It also provides an
+ interface used by hub drivers to enable or disable downstream
+ ports during bus transactions.
+
+ Say Y here if your platform includes an I3C hub device
+
endif # I3C
config I3C_OR_I2C
diff --git a/drivers/i3c/Makefile b/drivers/i3c/Makefile
index 11982efbc6d9..9ddee56a6338 100644
--- a/drivers/i3c/Makefile
+++ b/drivers/i3c/Makefile
@@ -2,3 +2,4 @@
i3c-y := device.o master.o
obj-$(CONFIG_I3C) += i3c.o
obj-$(CONFIG_I3C) += master/
+obj-$(CONFIG_I3C_HUB) += hub.o
diff --git a/drivers/i3c/hub.c b/drivers/i3c/hub.c
new file mode 100644
index 000000000000..c37b01fddcb4
--- /dev/null
+++ b/drivers/i3c/hub.c
@@ -0,0 +1,484 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2026 NXP
+ * Generic I3C Hub core implementing virtual controller operations.
+ */
+#include <linux/i3c/device.h>
+#include <linux/i3c/hub.h>
+
+#include "internals.h"
+
+/**
+ * i3c_hub_master_bus_init() - Bind controller to hub device
+ * @controller: Virtual controller for a hub port
+ *
+ * Associates the virtual controller with the hub device descriptor so that
+ * transfers are executed through the hub on the parent bus.
+ */
+static int i3c_hub_master_bus_init(struct i3c_master_controller *controller)
+{
+ struct i3c_hub_controller *hub_controller;
+ struct i3c_hub *hub;
+
+ hub_controller = dev_get_drvdata(&controller->dev);
+ if (!hub_controller || !hub_controller->hub)
+ return -ENODEV;
+
+ hub = hub_controller->hub;
+
+ if (!hub->hub_dev)
+ return -ENODEV;
+
+ controller->this = hub->hub_dev->desc;
+ return 0;
+}
+
+static void i3c_hub_master_bus_cleanup(struct i3c_master_controller *controller)
+{
+ controller->this = NULL;
+}
+
+static int i3c_hub_attach_i3c_dev(struct i3c_dev_desc *dev)
+{
+ return 0;
+}
+
+static int i3c_hub_reattach_i3c_dev(struct i3c_dev_desc *dev, u8 old_dyn_addr)
+{
+ return 0;
+}
+
+static void i3c_hub_detach_i3c_dev(struct i3c_dev_desc *dev)
+{
+}
+
+/**
+ * i3c_hub_do_daa() - Perform DAA via hub port
+ * @hub: Hub instance
+ * @controller: Virtual controller for a hub port
+ *
+ * Enables the port connection, performs DAA on the parent controller,
+ * then disables the connection.
+ */
+static int i3c_hub_do_daa(struct i3c_hub *hub,
+ struct i3c_master_controller *controller)
+{
+ struct i3c_master_controller *parent;
+ int ret;
+
+ if (!hub || !hub->hub_dev)
+ return -ENODEV;
+
+ parent = i3c_dev_get_master(hub->hub_dev->desc);
+ if (!parent)
+ return -ENODEV;
+
+ i3c_hub_enable_port(controller);
+ ret = i3c_master_do_daa(parent);
+ i3c_hub_disable_port(controller);
+
+ return ret;
+}
+
+static bool i3c_hub_supports_ccc_cmd(struct i3c_hub *hub,
+ const struct i3c_ccc_cmd *cmd)
+{
+ struct i3c_master_controller *parent;
+
+ if (!hub || !hub->hub_dev)
+ return false;
+
+ parent = i3c_dev_get_master(hub->hub_dev->desc);
+ if (!parent)
+ return false;
+
+ return i3c_master_supports_ccc_cmd(parent, cmd);
+}
+
+/**
+ * i3c_hub_send_ccc_cmd() - Send CCC through hub port
+ * @hub: Hub instance
+ * @controller: Virtual controller
+ * @cmd: CCC command
+ *
+ * Enables the port connection while issuing CCC on the parent controller.
+ */
+static int i3c_hub_send_ccc_cmd(struct i3c_hub *hub,
+ struct i3c_master_controller *controller,
+ struct i3c_ccc_cmd *cmd)
+{
+ struct i3c_master_controller *parent;
+ int ret;
+
+ if (!hub || !hub->hub_dev)
+ return -ENODEV;
+
+ parent = i3c_dev_get_master(hub->hub_dev->desc);
+ if (!parent)
+ return -ENODEV;
+
+ i3c_hub_enable_port(controller);
+ ret = i3c_master_send_ccc_cmd(parent, cmd);
+ i3c_hub_disable_port(controller);
+
+ return ret;
+}
+
+/**
+ * i3c_hub_master_priv_xfers() - Execute private transfers via hub
+ * @dev: Target device descriptor
+ * @xfers: Transfer array
+ * @nxfers: Number of transfers
+ * @mode: transfer mode (SDR, HDR, etc.)
+ *
+ * Handles address adjustment and forwards private transfers through the hub
+ * device.
+ */
+static int i3c_hub_master_priv_xfers(struct i3c_dev_desc *dev,
+ struct i3c_xfer *xfers,
+ int nxfers,
+ enum i3c_xfer_mode mode)
+{
+ struct i3c_master_controller *controller = i3c_dev_get_master(dev);
+ struct i3c_hub_controller *hub_controller;
+ struct i3c_dev_desc *hub_dev;
+ struct i3c_master_controller *parent;
+ u8 hub_addr, target_addr;
+ struct i3c_hub *hub;
+ int ret, xfer_ret;
+
+ hub_controller = dev_get_drvdata(&controller->dev);
+ if (!hub_controller || !hub_controller->hub)
+ return -ENODEV;
+
+ hub = hub_controller->hub;
+
+ if (!hub->hub_dev)
+ return -ENODEV;
+
+ hub_dev = hub->hub_dev->desc;
+
+ parent = i3c_dev_get_master(hub_dev);
+ if (!parent)
+ return -ENODEV;
+
+ i3c_hub_enable_port(controller);
+
+ hub_addr = hub_dev->info.dyn_addr ?
+ hub_dev->info.dyn_addr : hub_dev->info.static_addr;
+
+ target_addr = dev->info.dyn_addr ?
+ dev->info.dyn_addr : dev->info.static_addr;
+
+ if (hub_addr != target_addr) {
+ down_write(&parent->bus.lock);
+ hub_dev->info.dyn_addr = target_addr;
+
+ ret = i3c_master_reattach_i3c_dev_locked(hub_dev, hub_addr);
+ up_write(&parent->bus.lock);
+ if (ret) {
+ hub_dev->info.dyn_addr = hub_addr;
+ goto disable;
+ }
+ }
+
+ ret = i3c_device_do_xfers(hub->hub_dev, xfers, nxfers, mode);
+
+ if (hub_addr != target_addr) {
+ down_write(&parent->bus.lock);
+ hub_dev->info.dyn_addr = hub_addr;
+
+ xfer_ret = i3c_master_reattach_i3c_dev_locked(hub_dev,
+ target_addr);
+
+ up_write(&parent->bus.lock);
+ if (!ret)
+ ret = xfer_ret;
+ }
+disable:
+ i3c_hub_disable_port(controller);
+ return ret;
+}
+
+static int i3c_hub_attach_i2c_dev(struct i2c_dev_desc *dev)
+{
+ return 0;
+}
+
+static void i3c_hub_detach_i2c_dev(struct i2c_dev_desc *dev)
+{
+}
+
+static int i3c_hub_i2c_xfers(struct i2c_dev_desc *dev,
+ struct i2c_msg *xfers, int nxfers)
+{
+ return 0;
+}
+
+static int i3c_hub_master_do_daa(struct i3c_master_controller *controller)
+{
+ struct i3c_hub_controller *hub_controller;
+ struct i3c_hub *hub;
+
+ hub_controller = dev_get_drvdata(&controller->dev);
+ if (!hub_controller || !hub_controller->hub)
+ return -ENODEV;
+
+ hub = hub_controller->hub;
+
+ return i3c_hub_do_daa(hub, controller);
+}
+
+static int i3c_hub_master_send_ccc_cmd(struct i3c_master_controller *controller,
+ struct i3c_ccc_cmd *cmd)
+{
+ struct i3c_hub_controller *hub_controller;
+ struct i3c_hub *hub;
+
+ hub_controller = dev_get_drvdata(&controller->dev);
+ if (!hub_controller || !hub_controller->hub)
+ return -ENODEV;
+
+ hub = hub_controller->hub;
+
+ if (!hub->hub_dev)
+ return -ENODEV;
+
+ if (cmd->id == I3C_CCC_RSTDAA(true))
+ return 0;
+
+ return i3c_hub_send_ccc_cmd(hub, controller, cmd);
+}
+
+static bool i3c_hub_master_supports_ccc_cmd(struct i3c_master_controller *controller,
+ const struct i3c_ccc_cmd *cmd)
+{
+ struct i3c_hub_controller *hub_controller;
+ struct i3c_hub *hub;
+
+ hub_controller = dev_get_drvdata(&controller->dev);
+ if (!hub_controller || !hub_controller->hub)
+ return false;
+
+ hub = hub_controller->hub;
+
+ return i3c_hub_supports_ccc_cmd(hub, cmd);
+}
+
+/**
+ * i3c_hub_request_ibi() - Request IBI through parent controller
+ * @desc: Target device descriptor
+ * @req: IBI setup
+ *
+ * Temporarily updates parent controller context to request IBI for a device
+ * connected through the hub.
+ */
+static int i3c_hub_request_ibi(struct i3c_dev_desc *desc,
+ const struct i3c_ibi_setup *req)
+{
+ struct i3c_master_controller *controller = i3c_dev_get_master(desc);
+ struct i3c_hub_controller *hub_controller;
+ struct i3c_master_controller *orig_parent;
+ struct i3c_master_controller *parent;
+ struct i3c_hub *hub;
+ int ret;
+
+ hub_controller = dev_get_drvdata(&controller->dev);
+ if (!hub_controller || !hub_controller->hub)
+ return -ENODEV;
+
+ hub = hub_controller->hub;
+
+ if (!hub->hub_dev)
+ return -ENODEV;
+
+ parent = i3c_dev_get_master(hub->hub_dev->desc);
+
+ down_write(&parent->bus.lock);
+
+ orig_parent = i3c_hub_update_desc_parent(&desc->common, parent);
+
+ ret = i3c_master_direct_attach_i3c_dev_locked(parent, desc);
+ if (ret) {
+ i3c_hub_update_desc_parent(&desc->common, orig_parent);
+ up_write(&parent->bus.lock);
+ return ret;
+ }
+
+ kfree(desc->ibi);
+ desc->ibi = NULL;
+ ret = i3c_dev_request_ibi_locked(desc, req);
+ if (ret)
+ i3c_master_direct_detach_i3c_dev_locked(desc);
+
+ i3c_hub_update_desc_parent(&desc->common, orig_parent);
+
+ up_write(&parent->bus.lock);
+
+ return ret;
+}
+
+static void i3c_hub_free_ibi(struct i3c_dev_desc *desc)
+{
+ struct i3c_master_controller *controller = i3c_dev_get_master(desc);
+ struct i3c_hub_controller *hub_controller;
+ struct i3c_master_controller *orig_parent;
+ struct i3c_master_controller *parent;
+ struct i3c_hub *hub;
+
+ hub_controller = dev_get_drvdata(&controller->dev);
+ if (!hub_controller || !hub_controller->hub)
+ return;
+
+ hub = hub_controller->hub;
+
+ parent = i3c_dev_get_master(hub->hub_dev->desc);
+
+ i3c_hub_enable_port(controller);
+
+ down_write(&parent->bus.lock);
+ orig_parent = i3c_hub_update_desc_parent(&desc->common, parent);
+ i3c_master_direct_detach_i3c_dev_locked(desc);
+ i3c_dev_free_ibi_locked(desc);
+ i3c_hub_update_desc_parent(&desc->common, orig_parent);
+ up_write(&parent->bus.lock);
+
+ i3c_hub_disable_port(controller);
+}
+
+/**
+ * i3c_hub_enable_ibi() - Enable IBI via hub port
+ * @desc: Target device descriptor
+ *
+ * Enables port connection and forwards the IBI enable request to the parent
+ * controller.
+ */
+static int i3c_hub_enable_ibi(struct i3c_dev_desc *desc)
+{
+ struct i3c_master_controller *controller = i3c_dev_get_master(desc);
+ struct i3c_hub_controller *hub_controller;
+ struct i3c_master_controller *orig_parent;
+ struct i3c_master_controller *parent;
+ struct i3c_hub *hub;
+ int ret;
+
+ hub_controller = dev_get_drvdata(&controller->dev);
+ if (!hub_controller || !hub_controller->hub)
+ return -ENODEV;
+
+ hub = hub_controller->hub;
+
+ if (!hub->hub_dev)
+ return -ENODEV;
+
+ parent = i3c_dev_get_master(hub->hub_dev->desc);
+
+ i3c_hub_enable_port(controller);
+
+ orig_parent = i3c_hub_update_desc_parent(&desc->common, parent);
+
+ down_write(&parent->bus.lock);
+ ret = i3c_dev_enable_ibi_locked(desc);
+ up_write(&parent->bus.lock);
+
+ i3c_hub_update_desc_parent(&desc->common, orig_parent);
+
+ i3c_hub_disable_port(controller);
+
+ return ret;
+}
+
+/**
+ * i3c_hub_disable_ibi() - Disable IBI via hub port
+ * @desc: Target device descriptor
+ *
+ * Enables port connection and forwards the IBI disable request to the parent
+ * controller.
+ */
+static int i3c_hub_disable_ibi(struct i3c_dev_desc *desc)
+{
+ struct i3c_master_controller *controller = i3c_dev_get_master(desc);
+ struct i3c_hub_controller *hub_controller;
+ struct i3c_master_controller *orig_parent;
+ struct i3c_master_controller *parent;
+ struct i3c_hub *hub;
+ int ret;
+
+ hub_controller = dev_get_drvdata(&controller->dev);
+ if (!hub_controller || !hub_controller->hub)
+ return -ENODEV;
+
+ hub = hub_controller->hub;
+
+ if (!hub->hub_dev)
+ return -ENODEV;
+
+ parent = i3c_dev_get_master(hub->hub_dev->desc);
+
+ i3c_hub_enable_port(controller);
+
+ orig_parent = i3c_hub_update_desc_parent(&desc->common, parent);
+
+ down_write(&parent->bus.lock);
+ ret = i3c_dev_disable_ibi_locked(desc);
+ up_write(&parent->bus.lock);
+
+ i3c_hub_update_desc_parent(&desc->common, orig_parent);
+
+ i3c_hub_disable_port(controller);
+
+ return ret;
+}
+
+static void i3c_hub_recycle_ibi_slot(struct i3c_dev_desc *desc,
+ struct i3c_ibi_slot *slot)
+{
+}
+
+static const struct i3c_master_controller_ops i3c_hub_master_ops_data = {
+ .bus_init = i3c_hub_master_bus_init,
+ .bus_cleanup = i3c_hub_master_bus_cleanup,
+ .attach_i3c_dev = i3c_hub_attach_i3c_dev,
+ .reattach_i3c_dev = i3c_hub_reattach_i3c_dev,
+ .detach_i3c_dev = i3c_hub_detach_i3c_dev,
+ .do_daa = i3c_hub_master_do_daa,
+ .supports_ccc_cmd = i3c_hub_master_supports_ccc_cmd,
+ .send_ccc_cmd = i3c_hub_master_send_ccc_cmd,
+ .i3c_xfers = i3c_hub_master_priv_xfers,
+ .attach_i2c_dev = i3c_hub_attach_i2c_dev,
+ .detach_i2c_dev = i3c_hub_detach_i2c_dev,
+ .i2c_xfers = i3c_hub_i2c_xfers,
+ .request_ibi = i3c_hub_request_ibi,
+ .free_ibi = i3c_hub_free_ibi,
+ .enable_ibi = i3c_hub_enable_ibi,
+ .disable_ibi = i3c_hub_disable_ibi,
+ .recycle_ibi_slot = i3c_hub_recycle_ibi_slot,
+};
+
+/**
+ * i3c_hub_init() - Initialize hub context
+ * @hub: Hub instance
+ * @parent: Parent I3C master controller
+ * @ops: Vendor callbacks
+ * @hub_dev: I3C hub device
+ */
+void i3c_hub_init(struct i3c_hub *hub,
+ const struct i3c_hub_ops *ops,
+ struct i3c_device *hub_dev)
+{
+ hub->ops = ops;
+ hub->hub_dev = hub_dev;
+}
+EXPORT_SYMBOL_GPL(i3c_hub_init);
+
+const struct i3c_master_controller_ops *i3c_hub_master_ops(void)
+{
+ return &i3c_hub_master_ops_data;
+}
+EXPORT_SYMBOL_GPL(i3c_hub_master_ops);
+
+MODULE_AUTHOR("Aman Kumar Pandey <aman.kumarpandey@nxp.com>");
+MODULE_AUTHOR("Vikash Bansal <vikash.bansal@nxp.com>");
+MODULE_AUTHOR("Lakshay Piplani <lakshay.piplani@nxp.com>");
+MODULE_DESCRIPTION("Generic I3C hub support");
+MODULE_LICENSE("GPL");
diff --git a/include/linux/i3c/hub.h b/include/linux/i3c/hub.h
new file mode 100644
index 000000000000..8b5c162067c3
--- /dev/null
+++ b/include/linux/i3c/hub.h
@@ -0,0 +1,99 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright 2026 NXP
+ * Generic hub definitions and helper interfaces.
+ */
+#ifndef _LINUX_I3C_HUB_H
+#define _LINUX_I3C_HUB_H
+
+#include <linux/i3c/master.h>
+
+static inline struct i3c_master_controller *
+i3c_hub_update_desc_parent(struct i3c_i2c_dev_desc *desc,
+ struct i3c_master_controller *parent)
+{
+ struct i3c_master_controller *orig_parent = desc->master;
+
+ desc->master = parent;
+ return orig_parent;
+}
+
+/**
+ * struct i3c_hub - Generic I3C hub context
+ * @parent: Parent I3C master controller
+ * @ops: Vendor callbacks for port connection control
+ * @hub_dev: I3C device representing the hub on the parent bus
+ */
+struct i3c_hub {
+ const struct i3c_hub_ops *ops;
+ struct i3c_device *hub_dev;
+};
+
+struct i3c_hub_controller {
+ struct i3c_master_controller *parent;
+ struct i3c_master_controller controller;
+ struct i3c_hub *hub;
+};
+
+struct i3c_hub_ops {
+ void (*enable_port)(struct i3c_master_controller *controller);
+ void (*disable_port)(struct i3c_master_controller *controller);
+};
+
+/**
+ * i3c_hub_enable_port() - Enable hub connection for a controller
+ * @controller: Virtual controller representing a hub port
+ *
+ * Retrieves hub context from controller drvdata and invokes the vendor
+ * callback to enable the associated port connection.
+ */
+static inline void i3c_hub_enable_port(struct i3c_master_controller *controller)
+{
+ struct i3c_hub_controller *hub_controller;
+ struct i3c_hub *hub;
+
+ hub_controller = dev_get_drvdata(&controller->dev);
+ if (!hub_controller || !hub_controller->hub)
+ return;
+
+ hub = hub_controller->hub;
+
+ if (hub && hub->ops && hub->ops->enable_port)
+ hub->ops->enable_port(controller);
+}
+
+/**
+ * i3c_hub_disable_port() - Disable hub connection for a controller
+ * @controller: Virtual controller representing a hub port
+ *
+ * Retrieves hub context from controller drvdata and invokes the vendor
+ * callback to disable the associated port connection.
+ */
+static inline void i3c_hub_disable_port(struct i3c_master_controller *controller)
+{
+ struct i3c_hub_controller *hub_controller;
+ struct i3c_hub *hub;
+
+ hub_controller = dev_get_drvdata(&controller->dev);
+ if (!hub_controller || !hub_controller->hub)
+ return;
+
+ hub = hub_controller->hub;
+
+ if (hub && hub->ops && hub->ops->disable_port)
+ hub->ops->disable_port(controller);
+}
+
+/**
+ * i3c_hub_master_ops() - Return virtual controller ops for hub ports
+ *
+ * Provides i3c_master_controller_ops used by controllers created for hub
+ * ports.
+ */
+const struct i3c_master_controller_ops *i3c_hub_master_ops(void);
+
+void i3c_hub_init(struct i3c_hub *hub,
+ const struct i3c_hub_ops *ops,
+ struct i3c_device *hub_dev);
+
+#endif
--
2.25.1
^ permalink raw reply related
* [PATCH v11 4/9] dt-bindings: i3c: Add NXP P3H2x4x i3c-hub support
From: Lakshay Piplani @ 2026-06-12 11:18 UTC (permalink / raw)
To: linux-kernel, linux-i3c, alexandre.belloni, krzk+dt, robh,
conor+dt, devicetree, broonie, lee, Frank.Li, lgirdwood
Cc: vikash.bansal, priyanka.jain, aman.kumarpandey, Lakshay Piplani
In-Reply-To: <20260612111816.3688240-1-lakshay.piplani@nxp.com>
From: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
Add bindings for the NXP P3H2x4x (P3H2440/P3H2441/P3H2840/P3H2841)
multiport I3C hub family. These devices connect to a host via
I3C/I2C/SMBus and allow communication with multiple downstream
peripherals.
Signed-off-by: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
Signed-off-by: Vikash Bansal <vikash.bansal@nxp.com>
Signed-off-by: Lakshay Piplani <lakshay.piplani@nxp.com>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
---
Changes in v11:
- No change
Changes in v10:
- No change, added Reviewed-By tag
Changes in v9:
- Referenced i3c.yaml and i2c-controller.yaml for child nodes
- Dropped unnecessary #address-cells and #size-cells from child nodes
Changes in v8:
- Add compatible in i3c example
Changes in v7:
- Fix schema validation issues
- Adjust required properties
- Add I2C example
Changes in v6:
- Use a vendor prefix for the attributes
Changes in v5:
- Removed SW properties: cp0-ldo-microvolt,cp1-ldo-microvolt,
tp0145-ldo-microvolt, tp2367-ldo-microvolt
- Changed supply entries and its descriptions
Changes in v4:
- Fixed DT binding check warning
- Removed SW properties: ibi-enable, local-dev, and always-enable
Changes in v3:
- Added MFD (Multi-Function Device) support for I3C hub and on-die regulator
- Added Regulator supply node
Changes in v2:
- Fixed DT binding check warning
- Revised logic for parsing DTS nodes
---
---
.../devicetree/bindings/i3c/nxp,p3h2840.yaml | 291 ++++++++++++++++++
MAINTAINERS | 9 +
2 files changed, 300 insertions(+)
create mode 100644 Documentation/devicetree/bindings/i3c/nxp,p3h2840.yaml
diff --git a/Documentation/devicetree/bindings/i3c/nxp,p3h2840.yaml b/Documentation/devicetree/bindings/i3c/nxp,p3h2840.yaml
new file mode 100644
index 000000000000..c080eeb0eeaa
--- /dev/null
+++ b/Documentation/devicetree/bindings/i3c/nxp,p3h2840.yaml
@@ -0,0 +1,291 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+# Copyright 2025 NXP
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/i3c/nxp,p3h2840.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: NXP P3H2X4X I3C HUB
+
+maintainers:
+ - Aman Kumar Pandey <aman.kumarpandey@nxp.com>
+ - Vikash Bansal <vikash.bansal@nxp.com>
+ - Lakshay Piplani <lakshay.piplani@nxp.com>
+
+description: |
+ P3H2x4x (P3H2440/P3H2441/P3H2840/P3H2841) is a family of multiport I3C
+ hub devices that connect to:-
+ 1. A host CPU via I3C/I2C/SMBus bus on upstream side and connect to multiple
+ peripheral devices on the downstream side.
+ 2. Have two Controller Ports which can support either
+ I2C/SMBus or I3C buses and connect to a CPU, BMC or SOC.
+ 3. P3H2840/ P3H2841 are 8 port I3C hub with eight I3C/I2C Target Port.
+ 4. P3H2440/ P3H2441 are 4 port I3C hub with four I3C/I2C Target Port.
+ Target ports can be configured as I2C/SMBus, I3C or GPIO and connect to
+ peripherals.
+
+properties:
+ compatible:
+ const: nxp,p3h2840
+
+ reg:
+ maxItems: 1
+
+ '#address-cells':
+ const: 1
+
+ '#size-cells':
+ const: 0
+
+ assigned-address:
+ maximum: 0x7f
+
+ nxp,tp0145-pullup-ohms:
+ description:
+ Selects the pull up resistance for target Port 0/1/4/5, in ohms.
+ enum: [250, 500, 1000, 2000]
+ default: 500
+
+ nxp,tp2367-pullup-ohms:
+ description:
+ Selects the pull up resistance for target Port 2/3/6/7, in ohms.
+ enum: [250, 500, 1000, 2000]
+ default: 500
+
+ nxp,cp0-io-strength-ohms:
+ description:
+ Selects the IO drive strength for controller Port 0, in ohms.
+ enum: [20, 30, 40, 50]
+ default: 20
+
+ nxp,cp1-io-strength-ohms:
+ description:
+ Selects the IO drive strength for controller Port 1, in ohms.
+ enum: [20, 30, 40, 50]
+ default: 20
+
+ nxp,tp0145-io-strength-ohms:
+ description:
+ Selects the IO drive strength for target port 0/1/4/5, in ohms.
+ enum: [20, 30, 40, 50]
+ default: 20
+
+ nxp,tp2367-io-strength-ohms:
+ description:
+ Selects the IO drive strength for target port 2/3/6/7, in ohms.
+ enum: [20, 30, 40, 50]
+ default: 20
+
+ vcc1-supply:
+ description: Controller port 0 power supply.
+
+ vcc2-supply:
+ description: Controller port 1 power supply.
+
+ vcc3-supply:
+ description: Target port 0/1/4/5 power supply.
+
+ vcc4-supply:
+ description: Target port 2/3/6/7 power supply.
+
+ regulators:
+ type: object
+ additionalProperties: false
+
+ properties:
+ ldo-cp0:
+ type: object
+ $ref: /schemas/regulator/regulator.yaml#
+ unevaluatedProperties: false
+
+ ldo-cp1:
+ type: object
+ $ref: /schemas/regulator/regulator.yaml#
+ unevaluatedProperties: false
+
+ ldo-tpg0:
+ type: object
+ $ref: /schemas/regulator/regulator.yaml#
+ unevaluatedProperties: false
+
+ ldo-tpg1:
+ type: object
+ $ref: /schemas/regulator/regulator.yaml#
+ unevaluatedProperties: false
+
+required:
+ - reg
+
+patternProperties:
+ "^i3c@[0-7]$":
+ type: object
+ $ref: /schemas/i3c/i3c.yaml#
+ unevaluatedProperties: false
+
+ properties:
+ reg:
+ description:
+ The I3C HUB Target Port number.
+ maximum: 7
+
+ nxp,pullup-enable:
+ type: boolean
+ description:
+ Enables the on-die pull-up for Target Port.
+
+ required:
+ - reg
+
+ "^(i2c|smbus)@[0-7]$":
+ type: object
+ $ref: /schemas/i2c/i2c-controller.yaml#
+ unevaluatedProperties: false
+
+ properties:
+ reg:
+ description:
+ The I3C HUB Target Port number.
+ maximum: 7
+
+ nxp,pullup-enable:
+ type: boolean
+ description:
+ Enables the on-die pull-up for Target Port.
+
+ required:
+ - reg
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ i3c {
+ #address-cells = <3>;
+ #size-cells = <0>;
+
+ hub@70,236153000c2 {
+ reg = <0x70 0x236 0x3000c2>;
+ compatible = "nxp,p3h2840";
+ #address-cells = <1>;
+ #size-cells = <0>;
+ assigned-address = <0x50>;
+
+ nxp,tp0145-pullup-ohms = <1000>;
+ nxp,tp2367-pullup-ohms = <1000>;
+ nxp,cp0-io-strength-ohms = <50>;
+ nxp,cp1-io-strength-ohms = <50>;
+ nxp,tp0145-io-strength-ohms = <50>;
+ nxp,tp2367-io-strength-ohms = <50>;
+ vcc3-supply = <®_tpg0>;
+ vcc4-supply = <®_tpg1>;
+
+ regulators {
+ reg_cp0: ldo-cp0 {
+ regulator-name = "ldo-cp0";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ };
+
+ reg_cp1: ldo-cp1 {
+ regulator-name = "ldo-cp1";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ };
+
+ reg_tpg0: ldo-tpg0 {
+ regulator-name = "ldo-tpg0";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ };
+
+ reg_tpg1: ldo-tpg1 {
+ regulator-name = "ldo-tpg1";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ };
+ };
+
+ smbus@0 {
+ reg = <0x0>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+ nxp,pullup-enable;
+ };
+
+ i2c@1 {
+ reg = <0x1>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+ nxp,pullup-enable;
+ };
+
+ i3c@2 {
+ reg = <0x2>;
+ #address-cells = <3>;
+ #size-cells = <0>;
+ nxp,pullup-enable;
+ };
+ };
+ };
+
+ - |
+ i2c {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ hub@70 {
+ reg = <0x70>;
+ compatible = "nxp,p3h2840";
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ nxp,tp0145-pullup-ohms = <1000>;
+ nxp,tp2367-pullup-ohms = <1000>;
+ nxp,cp0-io-strength-ohms = <50>;
+ nxp,cp1-io-strength-ohms = <50>;
+ nxp,tp0145-io-strength-ohms = <50>;
+ nxp,tp2367-io-strength-ohms = <50>;
+ vcc3-supply = <®_tpg0_i2c>;
+ vcc4-supply = <®_tpg1_i2c>;
+
+ regulators {
+ reg_cp0_i2c: ldo-cp0 {
+ regulator-name = "ldo-cp0";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ };
+
+ reg_cp1_i2c: ldo-cp1 {
+ regulator-name = "ldo-cp1";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ };
+
+ reg_tpg0_i2c: ldo-tpg0 {
+ regulator-name = "ldo-tpg0";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ };
+
+ reg_tpg1_i2c: ldo-tpg1 {
+ regulator-name = "ldo-tpg1";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ };
+ };
+
+ smbus@0 {
+ reg = <0x0>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+ nxp,pullup-enable;
+ };
+
+ i2c@1 {
+ reg = <0x1>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+ nxp,pullup-enable;
+ };
+ };
+ };
diff --git a/MAINTAINERS b/MAINTAINERS
index c2c6d79275c6..ba65ae5a008b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -19303,6 +19303,15 @@ S: Maintained
F: Documentation/devicetree/bindings/ptp/nxp,ptp-netc.yaml
F: drivers/ptp/ptp_netc.c
+NXP P3H2X4X I3C-HUB DRIVER
+M: Vikash Bansal <vikash.bansal@nxp.com>
+M: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
+M: Lakshay Piplani <lakshay.piplani@nxp.com>
+L: linux-kernel@vger.kernel.org
+L: linux-i3c@lists.infradead.org
+S: Maintained
+F: Documentation/devicetree/bindings/i3c/nxp,p3h2840.yaml
+
NXP PF5300/PF5301/PF5302 PMIC REGULATOR DEVICE DRIVER
M: Woodrow Douglass <wdouglass@carnegierobotics.com>
S: Maintained
--
2.25.1
^ permalink raw reply related
* [PATCH v11 2/9] i3c: master: Expose the APIs to support I3C hub
From: Lakshay Piplani @ 2026-06-12 11:18 UTC (permalink / raw)
To: linux-kernel, linux-i3c, alexandre.belloni, krzk+dt, robh,
conor+dt, devicetree, broonie, lee, Frank.Li, lgirdwood
Cc: vikash.bansal, priyanka.jain, aman.kumarpandey, Lakshay Piplani
In-Reply-To: <20260612111816.3688240-1-lakshay.piplani@nxp.com>
From: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
Change the below internal static functions to APIs to allow new I3C hub
driver to use them
1) i3c_dev_enable_ibi_locked()
2) i3c_dev_disable_ibi_locked()
3) i3c_dev_request_ibi_locked()
4) i3c_dev_free_ibi_locked()
5) i3c_master_reattach_i3c_dev_locked()
Signed-off-by: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
Signed-off-by: Lakshay Piplani <lakshay.piplani@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
---
Changes in v11:
- No change, added Reviewed-By tag
Changes in v10:
- Expose the renamed reattach API.
Changes in v9:
- No change
Changes in v8:
- No change
Changes in v7:
- Fix kernel-doc warnings for *_locked() APIs
- Clarify API exposure in commit message
Changes in v6:
- Split the patch into two parts:
1) expose the existing API
2) add new APIs.
Changes in v5:
- No change
Changes in v4:
- Updated I3C master to handle hub support
---
---
drivers/i3c/master.c | 70 ++++++++++++++++++++++++++++++++++++--
include/linux/i3c/master.h | 2 ++
2 files changed, 70 insertions(+), 2 deletions(-)
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index e89d73508b9a..0636e3e21758 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -1652,8 +1652,23 @@ static int i3c_master_attach_i3c_dev(struct i3c_master_controller *master,
return 0;
}
-static int i3c_master_reattach_i3c_dev_locked(struct i3c_dev_desc *dev,
- u8 old_dyn_addr)
+/**
+ * i3c_master_reattach_i3c_dev_locked() - reattach an I3C device with a new address
+ * @dev: I3C device descriptor to reattach
+ * @old_dyn_addr: previous dynamic address of the device
+ *
+ * This function reattaches an existing I3C device to the bus when its dynamic
+ * address has changed. It updates the bus address slot status accordingly:
+ * - Marks the new dynamic address as occupied by an I3C device.
+ * - Frees the old dynamic address slot if applicable.
+ *
+ * This function must be called with the bus lock held in write mode.
+ *
+ * Return: 0 on success, or a negative error code if reattachment fails
+ * (e.g. -EBUSY if the new address slot is not free).
+ */
+int i3c_master_reattach_i3c_dev_locked(struct i3c_dev_desc *dev,
+ u8 old_dyn_addr)
{
struct i3c_master_controller *master = i3c_dev_get_master(dev);
int ret;
@@ -1677,6 +1692,7 @@ static int i3c_master_reattach_i3c_dev_locked(struct i3c_dev_desc *dev,
return 0;
}
+EXPORT_SYMBOL_GPL(i3c_master_reattach_i3c_dev_locked);
static void i3c_master_detach_i3c_dev(struct i3c_dev_desc *dev)
{
@@ -3195,6 +3211,16 @@ int i3c_dev_do_xfers_locked(struct i3c_dev_desc *dev, struct i3c_xfer *xfers,
return master->ops->i3c_xfers(dev, xfers, nxfers, mode);
}
+/**
+ * i3c_dev_disable_ibi_locked() - Disable IBIs coming from a specific device
+ * @dev: device on which IBIs should be disabled
+ *
+ * This function disable IBIs coming from a specific device and wait for
+ * all pending IBIs to be processed.
+ *
+ * Context: Must be called with mutex_lock(&dev->desc->ibi_lock) held.
+ * Return: 0 in case of success, a negative error core otherwise.
+ */
int i3c_dev_disable_ibi_locked(struct i3c_dev_desc *dev)
{
struct i3c_master_controller *master;
@@ -3216,7 +3242,22 @@ int i3c_dev_disable_ibi_locked(struct i3c_dev_desc *dev)
return 0;
}
+EXPORT_SYMBOL_GPL(i3c_dev_disable_ibi_locked);
+/**
+ * i3c_dev_enable_ibi_locked() - Enable IBIs from a specific device (lock held)
+ * @dev: device on which IBIs should be enabled
+ *
+ * This function enable IBIs coming from a specific device and wait for
+ * all pending IBIs to be processed. This should be called on a device
+ * where i3c_device_request_ibi() has succeeded.
+ *
+ * Note that IBIs from this device might be received before this function
+ * returns to its caller.
+ *
+ * Context: Must be called with mutex_lock(&dev->desc->ibi_lock) held.
+ * Return: 0 on success, or a negative error code on failure.
+ */
int i3c_dev_enable_ibi_locked(struct i3c_dev_desc *dev)
{
struct i3c_master_controller *master = i3c_dev_get_master(dev);
@@ -3231,7 +3272,20 @@ int i3c_dev_enable_ibi_locked(struct i3c_dev_desc *dev)
return ret;
}
+EXPORT_SYMBOL_GPL(i3c_dev_enable_ibi_locked);
+/**
+ * i3c_dev_request_ibi_locked() - Request an IBI
+ * @dev: device for which we should enable IBIs
+ * @req: setup requested for this IBI
+ *
+ * This function is responsible for pre-allocating all resources needed to
+ * process IBIs coming from @dev. When this function returns, the IBI is not
+ * enabled until i3c_device_enable_ibi() is called.
+ *
+ * Context: Must be called with mutex_lock(&dev->desc->ibi_lock) held.
+ * Return: 0 in case of success, a negative error core otherwise.
+ */
int i3c_dev_request_ibi_locked(struct i3c_dev_desc *dev,
const struct i3c_ibi_setup *req)
{
@@ -3270,7 +3324,18 @@ int i3c_dev_request_ibi_locked(struct i3c_dev_desc *dev,
return ret;
}
+EXPORT_SYMBOL_GPL(i3c_dev_request_ibi_locked);
+/**
+ * i3c_dev_free_ibi_locked() - Free all resources needed for IBI handling
+ * @dev: device on which you want to release IBI resources
+ *
+ * This function is responsible for de-allocating resources previously
+ * allocated by i3c_device_request_ibi(). It should be called after disabling
+ * IBIs with i3c_device_disable_ibi().
+ *
+ * Context: Must be called with mutex_lock(&dev->desc->ibi_lock) held.
+ */
void i3c_dev_free_ibi_locked(struct i3c_dev_desc *dev)
{
struct i3c_master_controller *master = i3c_dev_get_master(dev);
@@ -3301,6 +3366,7 @@ void i3c_dev_free_ibi_locked(struct i3c_dev_desc *dev)
kfree(dev->ibi);
dev->ibi = NULL;
}
+EXPORT_SYMBOL_GPL(i3c_dev_free_ibi_locked);
static int __init i3c_init(void)
{
diff --git a/include/linux/i3c/master.h b/include/linux/i3c/master.h
index 592b646f6134..355e9b3d9ae3 100644
--- a/include/linux/i3c/master.h
+++ b/include/linux/i3c/master.h
@@ -613,6 +613,8 @@ void i3c_master_dma_unmap_single(struct i3c_dma *dma_xfer);
DEFINE_FREE(i3c_master_dma_unmap_single, void *,
if (_T) i3c_master_dma_unmap_single(_T))
+int i3c_master_reattach_i3c_dev_locked(struct i3c_dev_desc *dev,
+ u8 old_dyn_addr);
int i3c_master_set_info(struct i3c_master_controller *master,
const struct i3c_device_info *info);
--
2.25.1
^ permalink raw reply related
* [PATCH v11 6/9] regulator: p3h2x4x: Add driver for on-die regulators in NXP P3H2x4x i3c hub
From: Lakshay Piplani @ 2026-06-12 11:18 UTC (permalink / raw)
To: linux-kernel, linux-i3c, alexandre.belloni, krzk+dt, robh,
conor+dt, devicetree, broonie, lee, Frank.Li, lgirdwood
Cc: vikash.bansal, priyanka.jain, aman.kumarpandey, Lakshay Piplani,
Frank Li
In-Reply-To: <20260612111816.3688240-1-lakshay.piplani@nxp.com>
From: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
The NXP P3H2x4x family integrates on-die regulators alongside I3C hub
functionality. This driver registers the regulators using the MFD
framework and exposes them via the regulator subsystem.
Signed-off-by: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
Signed-off-by: Vikash Bansal <vikash.bansal@nxp.com>
Signed-off-by: Lakshay Piplani <lakshay.piplani@nxp.com>
Reviewed-by: Frank Li <frank.li@nxp.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
---
Changes in v11:
- No change, added Reviewed-By tag
Changes in v10:
- No change
Changes in v9:
- No change
Changes in v8:
- No change
Changes in v7:
- No change, added Reviewed-By tag
Changes in v6:
- Use DEFINE_LOCK_GUARD_1 for reg lock/unlock
Changes in v5:
- Updated dev_err_probe() for regmap_init failure.
- Updated module description
Changes in v4:
- Split the driver into three separate patches (mfd, regulator and I3C hub)
- Introduced driver for on-die regulators in NXP P3H2x4x I3C hub
---
---
MAINTAINERS | 1 +
drivers/regulator/Kconfig | 10 +
drivers/regulator/Makefile | 1 +
drivers/regulator/p3h2840_i3c_hub_regulator.c | 218 ++++++++++++++++++
4 files changed, 230 insertions(+)
create mode 100644 drivers/regulator/p3h2840_i3c_hub_regulator.c
diff --git a/MAINTAINERS b/MAINTAINERS
index 3420701a75c5..fcb3917aa096 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -19312,6 +19312,7 @@ L: linux-i3c@lists.infradead.org
S: Maintained
F: Documentation/devicetree/bindings/i3c/nxp,p3h2840.yaml
F: drivers/mfd/p3h2840.c
+F: drivers/regulator/p3h2840_i3c_hub_regulator.c
F: include/linux/mfd/p3h2840.h
NXP PF5300/PF5301/PF5302 PMIC REGULATOR DEVICE DRIVER
diff --git a/drivers/regulator/Kconfig b/drivers/regulator/Kconfig
index d71dac9436e3..88809f493fd4 100644
--- a/drivers/regulator/Kconfig
+++ b/drivers/regulator/Kconfig
@@ -1019,6 +1019,16 @@ config REGULATOR_MTK_DVFSRC
of Mediatek. It allows for voting on regulator state
between multiple users.
+config REGULATOR_P3H2X4X
+ tristate "NXP P3H2X4X regulator support"
+ depends on MFD_P3H2X4X
+ help
+ This driver provides support for the voltage regulators of the
+ P3H244x/P3H284x multi-function I3C Hub device.
+
+ Say M here if you want to include support for this regulator as
+ a module. The module will be named "p3h2840_i3c_hub_regulator".
+
config REGULATOR_PALMAS
tristate "TI Palmas PMIC Regulators"
depends on MFD_PALMAS
diff --git a/drivers/regulator/Makefile b/drivers/regulator/Makefile
index 35639f3115fd..46f586ccde63 100644
--- a/drivers/regulator/Makefile
+++ b/drivers/regulator/Makefile
@@ -128,6 +128,7 @@ obj-$(CONFIG_REGULATOR_QCOM_RPMH) += qcom-rpmh-regulator.o
obj-$(CONFIG_REGULATOR_QCOM_SMD_RPM) += qcom_smd-regulator.o
obj-$(CONFIG_REGULATOR_QCOM_SPMI) += qcom_spmi-regulator.o
obj-$(CONFIG_REGULATOR_QCOM_USB_VBUS) += qcom_usb_vbus-regulator.o
+obj-$(CONFIG_REGULATOR_P3H2X4X) += p3h2840_i3c_hub_regulator.o
obj-$(CONFIG_REGULATOR_PALMAS) += palmas-regulator.o
obj-$(CONFIG_REGULATOR_PCA9450) += pca9450-regulator.o
obj-$(CONFIG_REGULATOR_PF0900) += pf0900-regulator.o
diff --git a/drivers/regulator/p3h2840_i3c_hub_regulator.c b/drivers/regulator/p3h2840_i3c_hub_regulator.c
new file mode 100644
index 000000000000..4f2514d4d928
--- /dev/null
+++ b/drivers/regulator/p3h2840_i3c_hub_regulator.c
@@ -0,0 +1,218 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2025-2026 NXP
+ * This P3H2X4X driver file contain functions for enable/disable regulator and voltage set/get.
+ */
+#include <linux/bitfield.h>
+#include <linux/cleanup.h>
+#include <linux/mfd/p3h2840.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+#include <linux/regulator/driver.h>
+
+#define P3H2X4X_LDO_AND_PULLUP_CONF 0x19
+#define P3H2X4X_LDO_ENABLE_DISABLE_MASK GENMASK(3, 0)
+#define P3H2X4X_CP0_EN_LDO BIT(0)
+#define P3H2X4X_CP1_EN_LDO BIT(1)
+#define P3H2X4X_TP0145_EN_LDO BIT(2)
+#define P3H2X4X_TP2367_EN_LDO BIT(3)
+
+#define P3H2X4X_NET_OPER_MODE_CONF 0x15
+#define P3H2X4X_VCCIO_LDO_CONF 0x16
+#define P3H2X4X_CP0_VCCIO_LDO_VOLTAGE_MASK GENMASK(1, 0)
+#define P3H2X4X_CP0_VCCIO_LDO_VOLTAGE(x) \
+ FIELD_PREP(P3H2X4X_CP0_VCCIO_LDO_VOLTAGE_MASK, x)
+#define P3H2X4X_CP1_VCCIO_LDO_VOLTAGE_MASK GENMASK(3, 2)
+#define P3H2X4X_CP1_VCCIO_LDO_VOLTAGE(x) \
+ FIELD_PREP(P3H2X4X_CP1_VCCIO_LDO_VOLTAGE_MASK, x)
+#define P3H2X4X_TP0145_VCCIO_LDO_VOLTAGE_MASK GENMASK(5, 4)
+#define P3H2X4X_TP0145_VCCIO_LDO_VOLTAGE(x) \
+ FIELD_PREP(P3H2X4X_TP0145_VCCIO_LDO_VOLTAGE_MASK, x)
+#define P3H2X4X_TP2367_VCCIO_LDO_VOLTAGE_MASK GENMASK(7, 6)
+#define P3H2X4X_TP2367_VCCIO_LDO_VOLTAGE(x) \
+ FIELD_PREP(P3H2X4X_TP2367_VCCIO_LDO_VOLTAGE_MASK, x)
+#define P3H2X4X_LDO_COUNT 4
+
+struct p3h2x4x_regulator_dev {
+ struct regulator_dev *rp3h2x4x_dev[P3H2X4X_LDO_COUNT];
+ struct regmap *regmap;
+};
+
+struct p3h2x4x_reg_state {
+ unsigned int orig;
+ bool restore;
+};
+
+static void p3h2x4x_reg_guard_enter(struct regulator_dev *rdev,
+ struct p3h2x4x_reg_state *state)
+{
+ state->restore = false;
+
+ if (regmap_read(rdev->regmap,
+ P3H2X4X_DEV_REG_PROTECTION_CODE,
+ &state->orig))
+ return;
+
+ if (state->orig != P3H2X4X_REGISTERS_UNLOCK_CODE) {
+ regmap_write(rdev->regmap,
+ P3H2X4X_DEV_REG_PROTECTION_CODE,
+ P3H2X4X_REGISTERS_UNLOCK_CODE);
+ state->restore = true;
+ }
+}
+
+static void p3h2x4x_reg_guard_exit(struct regulator_dev *rdev,
+ struct p3h2x4x_reg_state *state)
+{
+ if (state->restore)
+ regmap_write(rdev->regmap,
+ P3H2X4X_DEV_REG_PROTECTION_CODE,
+ state->orig);
+}
+
+DEFINE_LOCK_GUARD_1(p3h2x4x_reg, struct regulator_dev,
+ p3h2x4x_reg_guard_enter(_T->lock, &_T->state),
+ p3h2x4x_reg_guard_exit(_T->lock, &_T->state),
+ struct p3h2x4x_reg_state state);
+
+static int p3h2x4x_regulator_enable(struct regulator_dev *rdev)
+{
+ guard(p3h2x4x_reg)(rdev);
+ return regulator_enable_regmap(rdev);
+}
+
+static int p3h2x4x_regulator_disable(struct regulator_dev *rdev)
+{
+ guard(p3h2x4x_reg)(rdev);
+ return regulator_disable_regmap(rdev);
+}
+
+static int p3h2x4x_regulator_set_voltage_sel(struct regulator_dev *rdev,
+ unsigned int sel)
+{
+ guard(p3h2x4x_reg)(rdev);
+ return regulator_set_voltage_sel_regmap(rdev, sel);
+}
+
+static const struct regulator_ops p3h2x4x_ldo_ops = {
+ .list_voltage = regulator_list_voltage_table,
+ .map_voltage = regulator_map_voltage_iterate,
+ .set_voltage_sel = p3h2x4x_regulator_set_voltage_sel,
+ .get_voltage_sel = regulator_get_voltage_sel_regmap,
+ .enable = p3h2x4x_regulator_enable,
+ .disable = p3h2x4x_regulator_disable,
+ .is_enabled = regulator_is_enabled_regmap,
+};
+
+static const unsigned int p3h2x4x_voltage_table[] = {
+ 1000000,
+ 1100000,
+ 1200000,
+ 1800000,
+};
+
+static struct regulator_desc p3h2x4x_regulators[] = {
+ {
+ .name = "ldo-cp0",
+ .of_match = of_match_ptr("ldo-cp0"),
+ .regulators_node = of_match_ptr("regulators"),
+ .volt_table = p3h2x4x_voltage_table,
+ .n_voltages = ARRAY_SIZE(p3h2x4x_voltage_table),
+ .ops = &p3h2x4x_ldo_ops,
+ .type = REGULATOR_VOLTAGE,
+ .owner = THIS_MODULE,
+ .enable_reg = P3H2X4X_LDO_AND_PULLUP_CONF,
+ .enable_mask = P3H2X4X_CP0_EN_LDO,
+ .vsel_reg = P3H2X4X_VCCIO_LDO_CONF,
+ .vsel_mask = P3H2X4X_CP0_VCCIO_LDO_VOLTAGE_MASK,
+ },
+ {
+ .name = "ldo-cp1",
+ .of_match = of_match_ptr("ldo-cp1"),
+ .regulators_node = of_match_ptr("regulators"),
+ .volt_table = p3h2x4x_voltage_table,
+ .n_voltages = ARRAY_SIZE(p3h2x4x_voltage_table),
+ .ops = &p3h2x4x_ldo_ops,
+ .type = REGULATOR_VOLTAGE,
+ .owner = THIS_MODULE,
+ .enable_reg = P3H2X4X_LDO_AND_PULLUP_CONF,
+ .enable_mask = P3H2X4X_CP1_EN_LDO,
+ .vsel_reg = P3H2X4X_VCCIO_LDO_CONF,
+ .vsel_mask = P3H2X4X_CP1_VCCIO_LDO_VOLTAGE_MASK,
+ },
+ {
+ .name = "ldo-tpg0",
+ .of_match = of_match_ptr("ldo-tpg0"),
+ .regulators_node = of_match_ptr("regulators"),
+ .volt_table = p3h2x4x_voltage_table,
+ .n_voltages = ARRAY_SIZE(p3h2x4x_voltage_table),
+ .ops = &p3h2x4x_ldo_ops,
+ .type = REGULATOR_VOLTAGE,
+ .owner = THIS_MODULE,
+ .enable_reg = P3H2X4X_LDO_AND_PULLUP_CONF,
+ .enable_mask = P3H2X4X_TP0145_EN_LDO,
+ .vsel_reg = P3H2X4X_VCCIO_LDO_CONF,
+ .vsel_mask = P3H2X4X_TP0145_VCCIO_LDO_VOLTAGE_MASK,
+ },
+ {
+ .name = "ldo-tpg1",
+ .of_match = of_match_ptr("ldo-tpg1"),
+ .regulators_node = of_match_ptr("regulators"),
+ .volt_table = p3h2x4x_voltage_table,
+ .n_voltages = ARRAY_SIZE(p3h2x4x_voltage_table),
+ .ops = &p3h2x4x_ldo_ops,
+ .type = REGULATOR_VOLTAGE,
+ .owner = THIS_MODULE,
+ .enable_reg = P3H2X4X_LDO_AND_PULLUP_CONF,
+ .enable_mask = P3H2X4X_TP2367_EN_LDO,
+ .vsel_reg = P3H2X4X_VCCIO_LDO_CONF,
+ .vsel_mask = P3H2X4X_TP2367_VCCIO_LDO_VOLTAGE_MASK,
+ },
+};
+
+static int p3h2x4x_regulator_probe(struct platform_device *pdev)
+{
+ struct p3h2x4x_dev *p3h2x4x = dev_get_drvdata(pdev->dev.parent);
+ struct p3h2x4x_regulator_dev *p3h2x4x_regulator;
+ struct regulator_config rcfg = { };
+ struct device *dev = &pdev->dev;
+ struct regulator_dev *rdev;
+ int i;
+
+ p3h2x4x_regulator = devm_kzalloc(dev, sizeof(*p3h2x4x_regulator), GFP_KERNEL);
+ if (!p3h2x4x_regulator)
+ return -ENOMEM;
+
+ platform_set_drvdata(pdev, p3h2x4x_regulator);
+
+ p3h2x4x_regulator->regmap = p3h2x4x->regmap;
+
+ rcfg.dev = dev->parent;
+ rcfg.regmap = p3h2x4x_regulator->regmap;
+ rcfg.driver_data = p3h2x4x_regulator;
+
+ for (i = 0; i < ARRAY_SIZE(p3h2x4x_regulators); i++) {
+ rdev = devm_regulator_register(&pdev->dev, &p3h2x4x_regulators[i], &rcfg);
+ if (IS_ERR(rdev))
+ return dev_err_probe(dev, PTR_ERR(rdev), "Failed to register %s\n",
+ p3h2x4x_regulators[i].name);
+ p3h2x4x_regulator->rp3h2x4x_dev[i] = rdev;
+ }
+ return 0;
+}
+
+static struct platform_driver p3h2x4x_regulator_driver = {
+ .driver = {
+ .name = "p3h2x4x-regulator",
+ .probe_type = PROBE_PREFER_ASYNCHRONOUS,
+ },
+ .probe = p3h2x4x_regulator_probe,
+};
+module_platform_driver(p3h2x4x_regulator_driver);
+
+MODULE_AUTHOR("Aman Kumar Pandey <aman.kumarpandey@nxp.com>");
+MODULE_AUTHOR("Vikash Bansal <vikash.bansal@nxp.com>");
+MODULE_AUTHOR("Lakshay Piplani <lakshay.piplani@nxp.com>");
+MODULE_DESCRIPTION("NXP P3H2X4X I3C HUB Regulator driver");
+MODULE_LICENSE("GPL");
--
2.25.1
^ permalink raw reply related
* [PATCH v11 3/9] i3c: master: Add APIs for I3C hub support
From: Lakshay Piplani @ 2026-06-12 11:18 UTC (permalink / raw)
To: linux-kernel, linux-i3c, alexandre.belloni, krzk+dt, robh,
conor+dt, devicetree, broonie, lee, Frank.Li, lgirdwood
Cc: vikash.bansal, priyanka.jain, aman.kumarpandey, Lakshay Piplani
In-Reply-To: <20260612111816.3688240-1-lakshay.piplani@nxp.com>
From: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
Add helpers for attaching and detaching I3C devices and CCC helpers
to check CCC support and send CCC commands. These additions prepare
for I3C hub support.
The attach and detach helpers must be called with the bus lock held in
write mode.
1) i3c_master_direct_attach_i3c_dev_locked()
2) i3c_master_direct_detach_i3c_dev_locked()
3) i3c_master_send_ccc_cmd()
4) i3c_master_supports_ccc_cmd()
Signed-off-by: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
Signed-off-by: Lakshay Piplani <lakshay.piplani@nxp.com>
---
Changes in v11:
- Convert i3c_master_supports_ccc_cmd() to return bool and align
semantics with CCC support checks used by the I3C core
Changes in v10:
- Rename i3c_master_direct_attach_i3c_dev and i3c_master_direct_detach_i3c_dev
APIs to *_locked, as these APIs must be called with the bus lock held in
write mode
Changes in v9:
- No change
Changes in v8:
- No change
Changes in v7:
- Update commit message to clarify purpose (prepare for I3C hub support)
Changes in v6:
- Split the patch into two parts:
1) expose the existing API
2) add new APIs.
---
---
drivers/i3c/master.c | 101 +++++++++++++++++++++++++++++++++++++
include/linux/i3c/master.h | 7 +++
2 files changed, 108 insertions(+)
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index 0636e3e21758..9cd2e9e3bd67 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -1652,6 +1652,63 @@ static int i3c_master_attach_i3c_dev(struct i3c_master_controller *master,
return 0;
}
+/**
+ * i3c_master_direct_attach_i3c_dev_locked() - attach an I3C device to a master
+ * @master: I3C master controller to attach the device to
+ * @dev: I3C device descriptor representing the device
+ *
+ * This function attaches an I3C device to its master controller once the
+ * device has a valid address on the bus. Devices without an assigned address
+ * are ignored. The master device itself is never attached through this bus.
+ *
+ * Context: Caller must hold master->bus.lock in write mode.
+ *
+ * Return: 0 on success, or a negative error code if the attach operation
+ * fails in the master controller driver.
+ */
+int i3c_master_direct_attach_i3c_dev_locked(struct i3c_master_controller *master,
+ struct i3c_dev_desc *dev)
+{
+ int ret = 0;
+
+ /*
+ * We don't attach devices to the controller until they are
+ * addressable on the bus.
+ */
+
+ if (!dev->info.static_addr && !dev->info.dyn_addr)
+ return 0;
+
+ /* Do not attach the master device itself. */
+ if (master->this != dev && master->ops->attach_i3c_dev)
+ ret = master->ops->attach_i3c_dev(dev);
+
+ return ret;
+}
+EXPORT_SYMBOL_GPL(i3c_master_direct_attach_i3c_dev_locked);
+
+/**
+ * i3c_master_direct_detach_i3c_dev_locked() - Detach an I3C device from its
+ * master controller.
+ * @dev: I3C device descriptor to be detached
+ *
+ * This function detaches an I3C device from its master controller.
+ * It ensures that the master itself is not detached. If the device is not
+ * the master and the master controller provides a detach operation,
+ * the detach callback is invoked to perform the actual removal.
+ *
+ * Context: Caller must hold master->bus.lock in write mode.
+ */
+void i3c_master_direct_detach_i3c_dev_locked(struct i3c_dev_desc *dev)
+{
+ struct i3c_master_controller *master = i3c_dev_get_master(dev);
+
+ /* Do not detach the master device itself. */
+ if (master->this != dev && master->ops->detach_i3c_dev)
+ master->ops->detach_i3c_dev(dev);
+}
+EXPORT_SYMBOL_GPL(i3c_master_direct_detach_i3c_dev_locked);
+
/**
* i3c_master_reattach_i3c_dev_locked() - reattach an I3C device with a new address
* @dev: I3C device descriptor to reattach
@@ -1816,6 +1873,50 @@ i3c_master_register_new_i3c_devs(struct i3c_master_controller *master)
}
}
+/**
+ * i3c_master_supports_ccc_cmd() - check CCC command support
+ * @master: I3C master controller
+ * @cmd: CCC command to verify
+ *
+ * Return: true if @cmd is supported, false otherwise.
+ */
+bool i3c_master_supports_ccc_cmd(struct i3c_master_controller *master,
+ const struct i3c_ccc_cmd *cmd)
+{
+ if (!master || !cmd)
+ return false;
+
+ if (!master->ops->supports_ccc_cmd)
+ return true;
+
+ return master->ops->supports_ccc_cmd(master, cmd);
+}
+EXPORT_SYMBOL_GPL(i3c_master_supports_ccc_cmd);
+
+/**
+ * i3c_master_send_ccc_cmd() - send a CCC command
+ * @master: I3C master controller issuing the command
+ * @cmd: CCC command to be sent
+ *
+ * This function sends a Common Command Code (CCC) command to devices on the
+ * I3C bus. It acquires the bus maintenance lock, executes the command, and
+ * then releases the lock to ensure safe access to the bus.
+ *
+ * Return: 0 on success, or a negative error code on failure.
+ */
+int i3c_master_send_ccc_cmd(struct i3c_master_controller *master,
+ struct i3c_ccc_cmd *cmd)
+{
+ int ret;
+
+ i3c_bus_maintenance_lock(&master->bus);
+ ret = i3c_master_send_ccc_cmd_locked(master, cmd);
+ i3c_bus_maintenance_unlock(&master->bus);
+
+ return ret;
+}
+EXPORT_SYMBOL_GPL(i3c_master_send_ccc_cmd);
+
/**
* i3c_master_do_daa_ext() - Dynamic Address Assignment (extended version)
* @master: controller
diff --git a/include/linux/i3c/master.h b/include/linux/i3c/master.h
index 355e9b3d9ae3..7e358b6774c5 100644
--- a/include/linux/i3c/master.h
+++ b/include/linux/i3c/master.h
@@ -615,6 +615,13 @@ DEFINE_FREE(i3c_master_dma_unmap_single, void *,
int i3c_master_reattach_i3c_dev_locked(struct i3c_dev_desc *dev,
u8 old_dyn_addr);
+int i3c_master_direct_attach_i3c_dev_locked(struct i3c_master_controller *master,
+ struct i3c_dev_desc *dev);
+void i3c_master_direct_detach_i3c_dev_locked(struct i3c_dev_desc *dev);
+int i3c_master_send_ccc_cmd(struct i3c_master_controller *master,
+ struct i3c_ccc_cmd *cmd);
+bool i3c_master_supports_ccc_cmd(struct i3c_master_controller *master,
+ const struct i3c_ccc_cmd *cmd);
int i3c_master_set_info(struct i3c_master_controller *master,
const struct i3c_device_info *info);
--
2.25.1
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox