22 Oct, 2025
1 commit
05 Oct, 2025
1 commit
20 Nov, 2024
1 commit
-
When using a cmdline such as "bportals=s0 qportals=s0", Linux is given a
single QMan and a single BMan portal which is shared among all CPUs, and
accessed with locking.This is only supported for the staging SDK QBMan driver and not for the
upstream variant.In a strange twist of events, qman_create_affine_slave() also sets
affine_portals[] for CPUs which use the portal affine to a different CPU
(aka "slaves" here), and just have portal->sharing_redirect set to that
other portal.But that panics the kernel hard, because these dummy portals, not
having been created by qman_create_portal(), have uninitialized struct
qm_portal :: addr, eqcr, dqrr, etc, but also portal->config. So any time
these are dereferenced, the kernel panics.There are actually 2 code paths which are in this situation:
qman_enable_irqs()
-> qm_isr_status_clear()
-> __qm_isr_write()
-> __qm_out(&portal->addr, ...) // portal->addr uninitializedqm_shutdown_fq()
-> qm_get_portal_for_channel()
-> qman_p_get_portal_config()
-> &p->config->public_cfg // p->config uninitializedBoth functions were actually copied over from the upstream QBMan driver
(for the purpose of kexec support), which does not support portal
sharing and thus the problem does not exist there.Actually, we need to take into consideration in these code paths only
those affine portals created by qman_create_affine_portal(), and not the
fake ones with sharing_redirect. The qman_create_affine_portal() sets
the CPU in the &affine_mask retrievable through qman_affine_cpus().This is also the way in which dpaa_eth_add_channel() from
drivers/net/ethernet/freescale/sdk_dpaa/dpaa_eth_common.c avoids the
fake channels, when dereferencing the affine_cpus[] array through the
qman_get_affine_portal() API method.Fixes: a218c908c8ea ("staging: fsl_qbman: account for pre-initialized BARs in case of kexec")
Fixes: 78ff3aa0713b ("staging: fsl_qbman: use correct portal for static dequeues in qm_shutdown_fq()")
Signed-off-by: Vladimir Oltean
19 Nov, 2024
2 commits
-
neutron requires more memory to support large size firmware, merge
dtcm and dtcm-ring buffer for larger contiguous memory.Signed-off-by: Jiwei.Fu
Reviewed-by: Forrest Shi
Reviewed-by: Peng Fan
Acked-by: Jason Liu -
To improve performance, we have implemented zero-copy optimization for
neutron NPU, and third-party inference engines such as tflite can use
neutron memory directly, thus avoiding to perform memcpy between neutron
ddr memory and application context as follows:
- Avoid copying input data from application to neutron memory.
- Avoid copying output data from neutron memory back to the application.This patch enables the memory cache and let the driver maintain the
memory and cache coherency.The main changes are:
- Flush the input buffer cache for device before starting inference.
- Invalidate the output buffer cache for cpu after inference is complete.
- Flush other constant data for device via IOCTL in preparation.Signed-off-by: Jiwei.Fu
Reviewed-by: Forrest Shi
Acked-by: Jason Liu
18 Nov, 2024
2 commits
-
Currently, if streamon/streamoff calls are imbalanced we can either end up
with a negative ISI m2m usage_count (if streamoff() is called more times
than streamon()) in which case we'll not be able to restart the ISI pipe
next time, or the usage_count never gets to 0 and the pipe is never
switched off.To avoid that, add a 'streaming' flag to mxc_isi_m2m_ctx_queue_data and use it
in the streamon/streamoff to avoid incrementing/decrementing the usage_count
uselessly, if called multiple times from the same context.Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
Suggested-by: Laurent Pinchart
Signed-off-by: Laurentiu Palcu
Tested-by: Guoniu Zhou
Reviewed-by: Robert Chiras
Acked-by: Jason Liu -
Running the v4l2-compliance (1.27.0-5208, SHA: af114250d48d) on the m2m
device fails on the MMAP streaming tests, with the following messages:fail: v4l2-test-buffers.cpp(240): g_field() == V4L2_FIELD_ANY
fail: v4l2-test-buffers.cpp(1508): buf.qbuf(node)Apparently, the driver does not properly set the field member of
vb2_v4l2_buffer struct, returning the default V4L2_FIELD_ANY value which
is against the guidelines.Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
Signed-off-by: Laurentiu Palcu
Reviewed-by: Laurent Pinchart
Tested-by: Guoniu Zhou
Reviewed-by: Robert Chiras
Acked-by: Jason Liu
13 Nov, 2024
2 commits
-
Currently, interrogating the controls, before they're set for the first
time, will return all-zero values. To fix this, use the init() callback
in the v4l2_ctrl_type_ops structure to populate the initial control
values.Also, when running the sensor initialization sequence, make sure we
don't cache the settings for the embedded data because they do not
contain register values. They contain ranges. Otherwise we'll end up
with wrong register values in the regmap cache.Signed-off-by: Laurentiu Palcu
Reviewed-by: Robert Chiras
Reviewed-by: Mirela Rabulea
Tested-by: Celine Laurencin
Reviewed-by: Celine Laurencin
Acked-by: Jason Liu -
Currently, the registers returned in the embedded data contain RW
registers for gains and exposure. That affects the way the registers are
updated which does not follow the specifications. Using the RO registers
fixes the problem. Also, move the embedded data initialization sequence
to the end and add a comment to be easier to find it out in the future.Signed-off-by: Laurentiu Palcu
Reviewed-by: Mirela Rabulea
Tested-by: Celine Laurencin
Reviewed-by: Celine Laurencin
Acked-by: Jason Liu
11 Nov, 2024
2 commits
-
Initialized the err variable to fix the coverity issue,
"Uninitialized scalar variable"Signed-off-by: Rahul Kumar Yadav
Reviewed-by: Pankaj Gupta
Acked-by: Jason Liu -
The ipu_task_thread thread ran by kthread_run() could be excuted
before kthread_run() returns especially when 'nosmp' or 'maxcpus=1'
kernel bootup parameters are used. So, in this case, the thread[0]
or thread[1] entries in struct ipu_soc are not yet set before
ipu_task_thread() references them to set thread affinity, hence a
NULL pointer de-referencing issue happens. Fix this by referencing
*current* task in ipu_task_thread() instead of the uninitialized
thread[0] or thread[1] entries.This fixes an old bug introduced by the below commit in linux-imx:
commit 0d36f8226d22 ("ENGR00175724-2 IPU: change ipu_device thread
process mode to interrupt mode.")Signed-off-by: Liu Ying
Reviewed-by: Sandor Yu
Acked-by: Jason Liu
06 Nov, 2024
1 commit
-
When i.MX91 platform use MT9M114 sonsor, the capture image bottom edge
will meet green line for 100%. It caused by the vsync signals of parallel
csi and sensor, they are opposite, so the vsync output to pixel link
need to be inverted.Signed-off-by: Alice Yuan
Reviewed-by: Robby Cai
Acked-by: Jason Liu
05 Nov, 2024
3 commits
-
The IMX91_CLK_SPDIF_GATE also controls the gate of IPG clock
and root clock, need to define them separately.
Otherwise disabling IMX91_CLK_SPDIF_GATE in driver will cause
IPG clock is disabled, then register accessing fail.Signed-off-by: Shengjiu Wang
Reviewed-by: Jacky Bai
Reviewed-by: Chancel Liu
Acked-by: Jason Liu -
The IMX93_CLK_SPDIF_GATE also controls the gate of IPG clock
and root clock, need to define them separately.
Otherwise driver disable IMX93_CLK_SPDIF_GATE will cause
IPG clock is also disabled, then register accessing fail.Signed-off-by: Shengjiu Wang
Reviewed-by: Jacky Bai
Reviewed-by: Chancel Liu
Acked-by: Jason Liu -
While preparing the firmware, we should not stop neutron as there may
be other tasks running. Otherwise the tasks may fail due to neutron core
has stopped.Signed-off-by: Jiwei.Fu
Reviewed-by: Iuliana Prodan
Acked-by: Jason Liu
31 Oct, 2024
1 commit
-
The edma CHn_MUX isn't reset after warm reboot on imx95. If the dma
client request channel is different the last channel, the src id is
unique and can't be written the new edma CHn_MUX on imx95 so that
the transfer fail.This patch writes the CHn_MUX to reserved value 0.
Fixes: 9e34c0115e39 ("LF-10579-02: dmaengine: fsl-edma-v3: add imx95 edma support")
Signed-off-by: Joy Zou
Reviewed-by: Ye Li
Acked-by: Jason Liu
30 Oct, 2024
1 commit
-
The for loop check condition should be "i < bc->onecell_data.num_domains".
Using "bc->onecell_data.num_domains" as condition is wrong, it will lead
to kernel panic.Reviewed-by: Jacky Bai
Signed-off-by: Peng Fan
Acked-by: Jason Liu
24 Oct, 2024
3 commits
-
As mentioned in reference manual, ISI actual output line
value will be rounded up to an integer. For example, if
the input line value equal to 800 and the output line
value equal to 720, you must set [Y_SCALE] to a value
such that the theoretical output line value (800/[Y_SCALE])
is equal to or less than 720, which means:1. If [Y_SCALE] is set to 1C8h, the theoretical output line
value equal to 719.859375 which will be rounded up to 720.
2. If [Y_SCALE] is set to 1C7h, the theoretical output line
value equal to 720.017578 which will be rounded up to 721.There will be one excessive line in the actual output, So
adjust scale factor to make them equal.Signed-off-by: Guoniu Zhou
Reviewed-by: Robby Cai -
Keep subdev name as v4l2 core set since libcamera camera module
model identification heuristic does not work properly, it will
identify camera modules by parsing the default name.Signed-off-by: Guoniu Zhou
Reviewed-by: Robby Cai -
Add more RGB formats which supported by ISI.
Signed-off-by: Guoniu Zhou
Reviewed-by: Robby Cai
23 Oct, 2024
8 commits
-
HDR need clean its infoframe when it is disabled.
Add info frame clean function, transfer all "0" to infoframe slot
to stop the info frame.Signed-off-by: Sandor Yu
Reviewed-by: Robby Cai -
Fix Coverity issue #5483966: Dereference null return value.
Signed-off-by: Sandor Yu
Reviewed-by: Robby Cai -
Fix Coverity issue #250401: Dereference null return value
Signed-off-by: Sandor Yu
Reviewed-by: Robby Cai -
Fix Coverity issue 20812416: Dereferencing iores, which is known to be NULL.
Signed-off-by: Sandor Yu
Reviewed-by: Robby Cai -
Fix Coverity issue 22841530:
variable "audio_rates" was declared but never referencedSigned-off-by: Sandor Yu
Reviewed-by: Robby Cai -
The driver no longer uses the autosuspend function, so remove it.
Signed-off-by: Joy Zou
Reviewed-by: Shengjiu Wang
Reviewed-by: Ye Li -
The fsl_edma3_issue_pending call schedule_work to start edma, but it is
asynchronous. Meet an issue that the dma clients have send request, but
the dma isn't ready. According to the RM Description: "The DMA hardware
request input signal and the enable request bit (ERQ) must be asserted
before a channel's hardware service request is accepted.", so we can't
use schedule_work way.In addition, the execution process of some dma clients like the audio need
to make sure atomic. So the fsl_edma3_issue_pending can't call
pm_runtime_get_sync or pm_runtime_forbid due to might sleep.This patch simplifies the pm_runtime handler that open channel power in
request chan and close power in free chan. Have tested the impact on power
is very small.Signed-off-by: Joy Zou
Reviewed-by: Shengjiu Wang
Reviewed-by: Ye Li -
Runtime PM is disabled when the system call __device_suspend_late()->
__pm_runtime_disable() in suspend process.So remove the unnecessary pm_runtime_get_sync() and
pm_runtime_put_sync_suspend().Signed-off-by: Joy Zou
Reviewed-by: Shengjiu Wang
Reviewed-by: Ye Li
22 Oct, 2024
9 commits
-
A CMA leak is observed when interrupting the process abnormally. Before
the process stopped, if another interrupt signal is sent, the process
will be forcefully terminated without cleaning properly. This is
preventing any_buf to be released properly and context to be reset
to default as VIDIOC_STREAMOFF could not be sent.This patch aims to perform cleaning before terminating the process
by using stop_streaming callback to release any_buf and reset context.
This callback is waiting for all buffers to be given back before
terminating, allowing to perform cleaning without being interrupted.
The streamon and streamoff callback will be managed by default video
buffer 2 core framework, while neoisp implementation will be performed
in start_streaming and stop_streaming callback.Signed-off-by: Alexi Birlinger
Reviewed-by: Aymen Sghaier -
Adds dump methods to get isp memory status for Lookup tables.
The Vignetting, Global and Local DRC tonemap tables could be now dumped
using debugfs.Signed-off-by: Alexi Birlinger
Reviewed-by: Aymen Sghaier -
Secure-enclave FW drivers enhanced to publish the FW abort
indication with an error print.Signed-off-by: Pankaj Gupta
-
Fix issue: CID 5486100: Dereference null return value (NULL_RETURNS)
Signed-off-by: Robby Cai
Reviewed-by: Guoniu Zhou -
Fix "Dereference null return value" Coverity issues of following CID:
21634744, 21634846, 21634870, 21634979, 21635089Signed-off-by: Robby Cai
Reviewed-by: Guoniu Zhou -
Fix Coverity issue: CID 21634622: Unchecked return value (CHECKED_RETURN)
Calling pxp_buffer_handle_delete without checking return value,
this patch added the check before use.Signed-off-by: Robby Cai
Reviewed-by: Guoniu Zhou -
Fix Coverity issue: CID 20813467 Enum compared against 0 (NO_EFFECT)
Removed it to fix.Signed-off-by: Robby Cai
Reviewed-by: Guoniu Zhou -
Fix Coverity issue: CID 5484434 of "dereference null return value".
The function pxp_get_format could return NULL, so add the check before use.Signed-off-by: Robby Cai
Reviewed-by: Guoniu Zhou -
The pmic pf9453 A2 has changed the LDO_SNVS voltage range, so update it.
Signed-off-by: Joy Zou
Reviewed-by: Ye Li
21 Oct, 2024
3 commits
-
error log:
error: variable 'data_ddr' is uninitialized when used here [-Werror,-Wuninitialized]
ret = neutron_rproc_elf_load(rproc, buf->firmware_p, data_ddr, 0x1);
^~~~~~~~Change-Id: If3852cf0214f594b7fc6bcc147226558ecb75ec0
Signed-off-by: Zhipeng Wang -
This reverts commit d95ba73844cb8125b2104f265836836b5b24810e.
This workaround may fail some android case, the proper solution is that
parse drop the first Non-I frame in the beginning.Signed-off-by: Ming Qian
-
There is a new neutron fine-tuning workflow. Different model files have
different firmware, which requires the neutron linux driver to support
loading different firmware for different models. This patch adds new
interfaces to support loading firmware during runtime.This is a temporary workflow, but will be around for a whiles.
Signed-off-by: Jiwei.Fu
Reviewed-by: Peng Fan
