Add Invensense ICM42607
Subsystems (4)
v7 cover Add Invensense ICM42607
From: Chris Morgan <[email protected]>
Add support for the ICM42607 IMU. This sensor shares the same functionality but a different register layout with the existing ICM42600.
This driver should work with the ICM42607 and ICM42607P over both I2C and SPI, however only the ICM42607P over I2C could be tested.
Changes Since V1:
- Instead of creating a new driver, merged with the existing inv_icm42600 driver. This necessitated adding some code to the existing driver to permit using a different register layout for the same functionality.
- Split changes up a bit more to decrease the size of the individual patches. Note that patch 0004 is still pretty hefty; if I need to split further I may need to create some temporary stub functions.
- Used guard() and PM_RUNTIME_ACQUIRE_AUTOSUSPEND() on the new functions per Jonathan's recommendations.
Changes Since V2:
- Went back to using a new driver on advice from Invensense engineer.
- Further split changes up into smaller chunks of functionality. Note still that the largest patch is approximately 900 lines, and that while the driver compiles cleanly at each commit it is not able to drive the hardware until the commit that adds the Interrupt (as it also adds the Makefile).
- Change the error to a warning when the devicetree binding does not match the hardware ID.
- Dropped the ack on the devicetree bindings, as I am creating a new file (for a new driver) instead of modifying the existing one.
Changes Since V3:
- Numerous small fixes (too many to list here). Thank you to everyone who provided feedback.
- Split power management additions into an additional commit to break things up further.
- Consolidated devicetree documentation in existing invensense,icm42600.yaml file.
- Removed most of the FIELD_PREP from header file to c files to make code easier to read.
- Changed scale values to 2D arrays for Gyro and Accelerometer.
- Removed IIO_CHAN_INFO_CALIBBIAS attribute.
Changes Since V4:
- Additional numerous small fixes, thank you again for all the feedback.
- Dropped power control API and instead run device in low noise mode.
- Split devicetree bindings into two distinct changes.
- Reordered adding of enums and structs to main header file so that they are only brought in when needed.
- Stopped using enum for driver data and instead am using pointer to device specific driver data.
Changes Since V5:
- Corrected use of "dev_warn_probe" to just "dev_warn".
- Fixed some return scenarios which would unconditionally return 0 when an error was present.
- Corrected use of max() to min() for bounds checking. max() was incorrect.
- Fixed using "st->conf.accel.odr" in the gyroscope function. It should have been "st->conf.gyro.odr" which it now is.
- Additional small fixes suggested by "sashiko.dev".
- Added a regmap cache. I used the datasheet to try and determine which registers might change without explicit writes.
Changes Since V6:
- Corrected additional errors identified by sashiko.dev, mostly fixing potential deadlocks, missing calls for pm runtime, and potential overflow issues.
Chris Morgan (11):
dt-bindings: iio: imu: icm42600: Add mount-matrix to icm42600
dt-bindings: iio: imu: icm42600: Add icm42607 binding
iio: imu: inv_icm42607: Add inv_icm42607 Core Driver
iio: imu: inv_icm42607: Add I2C and SPI For icm42607
iio: imu: inv_icm42607: Add PM support for icm42607
iio: imu: inv_icm42607: Add Buffer support for icm42607
iio: imu: inv_icm42607: Add Temp Support in icm42607
iio: imu: inv_icm42607: Add Accelerometer for icm42607
iio: imu: inv_icm42607: Add Wake on Movement to icm42607
iio: imu: inv_icm42607: Add Gyroscope to icm42607
arm64: dts: rockchip: Add icm42607p IMU for RG-DS
.../bindings/iio/imu/invensense,icm42600.yaml | 4 + .../dts/rockchip/rk3568-anbernic-rg-ds.dts | 20 +- drivers/iio/imu/Kconfig | 1 + drivers/iio/imu/Makefile | 1 + drivers/iio/imu/inv_icm42607/Kconfig | 30 + drivers/iio/imu/inv_icm42607/Makefile | 14 + drivers/iio/imu/inv_icm42607/inv_icm42607.h | 457 +++++++++ .../iio/imu/inv_icm42607/inv_icm42607_accel.c | 890 ++++++++++++++++++ .../imu/inv_icm42607/inv_icm42607_buffer.c | 565 +++++++++++ .../imu/inv_icm42607/inv_icm42607_buffer.h | 95 ++ .../iio/imu/inv_icm42607/inv_icm42607_core.c | 863 +++++++++++++++++ .../iio/imu/inv_icm42607/inv_icm42607_gyro.c | 545 +++++++++++ .../iio/imu/inv_icm42607/inv_icm42607_i2c.c | 90 ++ .../iio/imu/inv_icm42607/inv_icm42607_spi.c | 103 ++ .../iio/imu/inv_icm42607/inv_icm42607_temp.c | 80 ++ .../iio/imu/inv_icm42607/inv_icm42607_temp.h | 33 + 16 files changed, 3790 insertions(+), 1 deletion(-) create mode 100644 drivers/iio/imu/inv_icm42607/Kconfig create mode 100644 drivers/iio/imu/inv_icm42607/Makefile create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607.h create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.h create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_core.c create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_i2c.c create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_spi.c create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_temp.c create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_temp.h
Signature · 1 line
2.43.0
PATCH v7 1/11 dt-bindings: iio: imu: icm42600: Add mount-matrix to icm42600
From: Chris Morgan <[email protected]>
Add mount-matrix attribute to schema. This attribute has been supported since the first revision of this driver, but was not documented.
--- .../devicetree/bindings/iio/imu/invensense,icm42600.yaml | 2 ++ 1 file changed, 2 insertions(+)
Documentation/devicetree/bindings/iio/imu/invensense,icm42600.yaml +2 -0
@@ -53,6 +53,8 @@ properties: drive-open-drain: type: boolean + mount-matrix: true + vdd-supply: description: Regulator that provides power to the sensor
Signature · 1 line
2.43.0
PATCH v7 2/11 dt-bindings: iio: imu: icm42600: Add icm42607 binding
In reply to Chris MorganFrom: Chris Morgan <[email protected]>
Add devicetree binding for the Invensense ICM42607 and Invensense ICM42607P inertial measurement unit. This unit is a combined accelerometer, gyroscope, and thermometer available via I2C or SPI.
This device is functionally very similar to the icm42600 series with a very different register layout.
--- .../devicetree/bindings/iio/imu/invensense,icm42600.yaml | 2 ++ 1 file changed, 2 insertions(+)
Documentation/devicetree/bindings/iio/imu/invensense,icm42600.yaml +2 -0
@@ -30,6 +30,8 @@ properties: - invensense,icm42600 - invensense,icm42602 - invensense,icm42605 + - invensense,icm42607 + - invensense,icm42607p - invensense,icm42622 - invensense,icm42631 - invensense,icm42686
Signature · 1 line
2.43.0
PATCH v7 3/11 iio: imu: inv_icm42607: Add inv_icm42607 Core Driver
In reply to Chris MorganFrom: Chris Morgan <[email protected]>
Add the core component of a new inv_icm42607 driver. This includes a few setup functions and the full register definition in the header file.
--- drivers/iio/imu/inv_icm42607/inv_icm42607.h | 334 ++++++++++++++++++ .../iio/imu/inv_icm42607/inv_icm42607_core.c | 207 +++++++++++ 2 files changed, 541 insertions(+) create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607.h create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_core.c
drivers/iio/imu/inv_icm42607/inv_icm42607.h new file +334 -0
@@ -0,0 +1,334 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* +* Copyright (C) 2026 InvenSense, Inc. +*/ + +#ifndef INV_ICM42607_H_ +#define INV_ICM42607_H_ + +#include <linux/bitfield.h> +#include <linux/bitops.h> +#include <linux/iio/iio.h> +#include <linux/mutex.h> +#include <linux/regmap.h> +#include <linux/regulator/consumer.h> + +enum inv_icm42607_sensor_mode { +INV_ICM42607_SENSOR_MODE_OFF , +INV_ICM42607_SENSOR_MODE_STANDBY , +INV_ICM42607_SENSOR_MODE_LOW_POWER , +INV_ICM42607_SENSOR_MODE_LOW_NOISE , +INV_ICM42607_SENSOR_MODE_NB +}; + +/* gyroscope fullscale values */ +enum inv_icm42607_gyro_fs { +INV_ICM42607_GYRO_FS_2000DPS , +INV_ICM42607_GYRO_FS_1000DPS , +INV_ICM42607_GYRO_FS_500DPS , +INV_ICM42607_GYRO_FS_250DPS , +INV_ICM42607_GYRO_FS_NB +}; + +/* accelerometer fullscale values */ +enum inv_icm42607_accel_fs { +INV_ICM42607_ACCEL_FS_16G , +INV_ICM42607_ACCEL_FS_8G , +INV_ICM42607_ACCEL_FS_4G , +INV_ICM42607_ACCEL_FS_2G , +INV_ICM42607_ACCEL_FS_NB +}; + +/* ODR values */ +enum inv_icm42607_odr { +INV_ICM42607_ODR_1600HZ =5 , +INV_ICM42607_ODR_800HZ , +INV_ICM42607_ODR_400HZ , +INV_ICM42607_ODR_200HZ , +INV_ICM42607_ODR_100HZ , +INV_ICM42607_ODR_50HZ , +INV_ICM42607_ODR_25HZ , +INV_ICM42607_ODR_12_5HZ , +INV_ICM42607_ODR_6_25HZ_LP , +INV_ICM42607_ODR_3_125HZ_LP , +INV_ICM42607_ODR_1_5625HZ_LP , +INV_ICM42607_ODR_NB +}; + +enum inv_icm42607_filter_bw { +/* Low-Noise mode sensor data filter (bandwidth) */ +INV_ICM42607_FILTER_BYPASS , +INV_ICM42607_FILTER_BW_180HZ , +INV_ICM42607_FILTER_BW_121HZ , +INV_ICM42607_FILTER_BW_73HZ , +INV_ICM42607_FILTER_BW_53HZ , +INV_ICM42607_FILTER_BW_34HZ , +INV_ICM42607_FILTER_BW_25HZ , +INV_ICM42607_FILTER_BW_16HZ +}; + +struct inv_icm42607_sensor_conf { +int mode; +int fs; +int odr; +int filter; +}; + +struct inv_icm42607_conf { +struct inv_icm42607_sensor_conf gyro; +struct inv_icm42607_sensor_conf accel; +bool temp_en; +}; + +struct inv_icm42607_hw { +uint8_t whoami; +const char *name; +const struct inv_icm42607_conf *conf; +}; + +/** +* struct inv_icm42607_state - driver state variables +* @lock: lock for serializing multiple registers access. +* @hw: Hardware specific data. +* @map: regmap pointer. +* @vddio_supply: I/O voltage regulator for the chip. +* @irq: chip irq, required to enable/disable and set wakeup +* @orientation: sensor chip orientation relative to main hardware. +* @conf: chip sensors configurations. +*/ +struct inv_icm42607_state { +struct mutex lock; +const struct inv_icm42607_hw *hw; +struct regmap *map; +struct regulator *vddio_supply; +int irq; +struct iio_mount_matrix orientation; +struct inv_icm42607_conf conf; +}; + +/* Virtual register addresses: @bank on MSB (4 upper bits), @address on LSB */ + +/* Register Map for User Bank 0 */ +#define INV_ICM42607_REG_MCLK_RDY 0x00 + +#define INV_ICM42607_REG_DEVICE_CONFIG 0x01 +#define INV_ICM42607_DEVICE_CONFIG_SPI_AP_4WIRE BIT(2) +#define INV_ICM42607_DEVICE_CONFIG_SPI_MODE BIT(0) + +#define INV_ICM42607_REG_SIGNAL_PATH_RESET 0x02 +#define INV_ICM42607_SIGNAL_PATH_RESET_SOFT_RESET BIT(4) +#define INV_ICM42607_SIGNAL_PATH_RESET_FIFO_FLUSH BIT(2) + +#define INV_ICM42607_REG_DRIVE_CONFIG1 0x03 +#define INV_ICM42607_DRIVE_CONFIG1_I3C_DDR_MASK GENMASK(5, 3) +#define INV_ICM42607_DRIVE_CONFIG1_I3C_SDR_MASK GENMASK(2, 0) + +#define INV_ICM42607_REG_DRIVE_CONFIG2 0x04 +#define INV_ICM42607_DRIVE_CONFIG2_I2C_MASK GENMASK(5, 3) +#define INV_ICM42607_DRIVE_CONFIG2_ALL_MASK GENMASK(2, 0) + +#define INV_ICM42607_REG_DRIVE_CONFIG3 0x05 +#define INV_ICM42607_DRIVE_CONFIG3_SPI_MASK GENMASK(2, 0) + +#define INV_ICM42607_REG_INT_CONFIG 0x06 +#define INV_ICM42607_INT_CONFIG_INT2_LATCHED BIT(5) +#define INV_ICM42607_INT_CONFIG_INT2_PUSH_PULL BIT(4) +#define INV_ICM42607_INT_CONFIG_INT2_ACTIVE_HIGH BIT(3) +#define INV_ICM42607_INT_CONFIG_INT2_ACTIVE_LOW 0x00 +#define INV_ICM42607_INT_CONFIG_INT1_LATCHED BIT(2) +#define INV_ICM42607_INT_CONFIG_INT1_PUSH_PULL BIT(1) +#define INV_ICM42607_INT_CONFIG_INT1_ACTIVE_HIGH BIT(0) +#define INV_ICM42607_INT_CONFIG_INT1_ACTIVE_LOW 0x00 + +/* all sensor data are 16 bits (2 registers wide) in big-endian */ +#define INV_ICM42607_REG_TEMP_DATA1 0x09 +#define INV_ICM42607_REG_TEMP_DATA0 0x0A +#define INV_ICM42607_REG_ACCEL_DATA_X1 0x0B +#define INV_ICM42607_REG_ACCEL_DATA_X0 0x0C +#define INV_ICM42607_REG_ACCEL_DATA_Y1 0x0D +#define INV_ICM42607_REG_ACCEL_DATA_Y0 0x0E +#define INV_ICM42607_REG_ACCEL_DATA_Z1 0x0F +#define INV_ICM42607_REG_ACCEL_DATA_Z0 0x10 +#define INV_ICM42607_REG_GYRO_DATA_X1 0x11 +#define INV_ICM42607_REG_GYRO_DATA_X0 0x12 +#define INV_ICM42607_REG_GYRO_DATA_Y1 0x13 +#define INV_ICM42607_REG_GYRO_DATA_Y0 0x14 +#define INV_ICM42607_REG_GYRO_DATA_Z1 0x15 +#define INV_ICM42607_REG_GYRO_DATA_Z0 0x16 +#define INV_ICM42607_DATA_INVALID -32768 + +#define INV_ICM42607_REG_TMST_FSYNCH 0x17 +#define INV_ICM42607_REG_TMST_FSYNCL 0x18 + +/* APEX Data Registers */ +#define INV_ICM42607_REG_APEX_DATA0 0x31 +#define INV_ICM42607_REG_APEX_DATA1 0x32 +#define INV_ICM42607_REG_APEX_DATA2 0x33 +#define INV_ICM42607_REG_APEX_DATA3 0x34 +#define INV_ICM42607_REG_APEX_DATA4 0x1D +#define INV_ICM42607_REG_APEX_DATA5 0x1E + +#define INV_ICM42607_REG_PWR_MGMT0 0x1F +#define INV_ICM42607_PWR_MGMT0_ACCEL_LP_CLK_SEL BIT(7) +#define INV_ICM42607_PWR_MGMT0_IDLE BIT(4) +#define INV_ICM42607_PWR_MGMT0_GYRO_MODE_MASK GENMASK(3, 2) +#define INV_ICM42607_PWR_MGMT0_ACCEL_MODE_MASK GENMASK(1, 0) + +#define INV_ICM42607_REG_GYRO_CONFIG0 0x20 +#define INV_ICM42607_GYRO_CONFIG0_FS_SEL_MASK GENMASK(6, 5) +#define INV_ICM42607_GYRO_CONFIG0_ODR_MASK GENMASK(3, 0) + +#define INV_ICM42607_REG_ACCEL_CONFIG0 0x21 +#define INV_ICM42607_ACCEL_CONFIG0_FS_SEL_MASK GENMASK(6, 5) +#define INV_ICM42607_ACCEL_CONFIG0_ODR_MASK GENMASK(3, 0) + +#define INV_ICM42607_REG_TEMP_CONFIG0 0x22 +#define INV_ICM42607_TEMP_CONFIG0_FILTER_MASK GENMASK(6, 4) + +#define INV_ICM42607_REG_GYRO_CONFIG1 0x23 +#define INV_ICM42607_GYRO_CONFIG1_FILTER_MASK GENMASK(2, 0) + +#define INV_ICM42607_REG_ACCEL_CONFIG1 0x24 +#define INV_ICM42607_ACCEL_CONFIG1_AVG_MASK GENMASK(6, 4) +#define INV_ICM42607_ACCEL_CONFIG1_FILTER_MASK GENMASK(2, 0) + +#define INV_ICM42607_REG_APEX_CONFIG0 0x25 +#define INV_ICM42607_APEX_CONFIG0_DMP_POWER_SAVE_EN BIT(3) +#define INV_ICM42607_APEX_CONFIG0_DMP_INIT_EN BIT(2) +#define INV_ICM42607_APEX_CONFIG0_DMP_MEM_RESET_EN BIT(0) + +#define INV_ICM42607_REG_APEX_CONFIG1 0x26 +#define INV_ICM42607_APEX_CONFIG1_SMD_ENABLE BIT(6) +#define INV_ICM42607_APEX_CONFIG1_FF_ENABLE BIT(5) +#define INV_ICM42607_APEX_CONFIG1_TILT_ENABLE BIT(4) +#define INV_ICM42607_APEX_CONFIG1_PED_ENABLE BIT(3) +#define INV_ICM42607_APEX_CONFIG1_DMP_ODR_MASK GENMASK(1, 0) + +#define INV_ICM42607_REG_WOM_CONFIG 0x27 +#define INV_ICM42607_WOM_CONFIG_INT_DUR_MASK GENMASK(4, 3) +#define INV_ICM42607_WOM_CONFIG_INT_MODE BIT(2) +#define INV_ICM42607_WOM_CONFIG_MODE BIT(1) +#define INV_ICM42607_WOM_CONFIG_EN BIT(0) + +#define INV_ICM42607_REG_FIFO_CONFIG1 0x28 +#define INV_ICM42607_FIFO_CONFIG1_MODE BIT(1) +#define INV_ICM42607_FIFO_CONFIG1_BYPASS BIT(0) + +#define INV_ICM42607_REG_FIFO_CONFIG2 0x29 +#define INV_ICM42607_REG_FIFO_CONFIG3 0x2A +#define INV_ICM42607_FIFO_WATERMARK_VAL (_wm) \ + cpu_to_le16((_wm) & GENMASK(11, 0)) +/* FIFO is 2048 bytes, let 12 samples for reading latency */ +#define INV_ICM42607_FIFO_WATERMARK_MAX (2048 - 12 * 16) +#define INV_ICM42607_FIFO_1SENSOR_PACKET_SIZE 8 +#define INV_ICM42607_FIFO_2SENSORS_PACKET_SIZE 16 + +#define INV_ICM42607_REG_INT_SOURCE0 0x2B +#define INV_ICM42607_INT_SOURCE0_ST_INT1_EN BIT(7) +#define INV_ICM42607_INT_SOURCE0_FSYNC_INT1_EN BIT(6) +#define INV_ICM42607_INT_SOURCE0_PLL_RDY_INT1_EN BIT(5) +#define INV_ICM42607_INT_SOURCE0_RESET_DONE_INT1_EN BIT(4) +#define INV_ICM42607_INT_SOURCE0_DRDY_INT1_EN BIT(3) +#define INV_ICM42607_INT_SOURCE0_FIFO_THS_INT1_EN BIT(2) +#define INV_ICM42607_INT_SOURCE0_FIFO_FULL_INT1_EN BIT(1) +#define INV_ICM42607_INT_SOURCE0_AGC_RDY_INT1_EN BIT(0) + +#define INV_ICM42607_REG_INT_SOURCE1 0x2C +#define INV_ICM42607_INT_SOURCE1_I3C_ERROR_INT1_EN BIT(6) +#define INV_ICM42607_INT_SOURCE1_SMD_INT1_EN BIT(3) +#define INV_ICM42607_INT_SOURCE1_WOM_INT1_EN GENMASK(2, 0) + +#define INV_ICM42607_REG_INT_SOURCE3 0x2D +#define INV_ICM42607_INT_SOURCE3_ST_INT2_EN BIT(7) +#define INV_ICM42607_INT_SOURCE3_FSYNC_INT2_EN BIT(6) +#define INV_ICM42607_INT_SOURCE3_PLL_RDY_INT2_EN BIT(5) +#define INV_ICM42607_INT_SOURCE3_RESET_DONE_INT2_EN BIT(4) +#define INV_ICM42607_INT_SOURCE3_DRDY_INT2_EN BIT(3) +#define INV_ICM42607_INT_SOURCE3_FIFO_THS_INT2_EN BIT(2) +#define INV_ICM42607_INT_SOURCE3_FIFO_FULL_INT2_EN BIT(1) +#define INV_ICM42607_INT_SOURCE3_AGC_RDY_INT2_EN BIT(0) + +#define INV_ICM42607_REG_INT_SOURCE4 0x2E +#define INV_ICM42607_INT_SOURCE4_I3C_ERROR_INT2_EN BIT(6) +#define INV_ICM42607_INT_SOURCE4_SMD_INT2_EN BIT(3) +#define INV_ICM42607_INT_SOURCE4_WOM_Z_INT2_EN BIT(2) +#define INV_ICM42607_INT_SOURCE4_WOM_Y_INT2_EN BIT(1) +#define INV_ICM42607_INT_SOURCE4_WOM_X_INT2_EN BIT(0) + +#define INV_ICM42607_REG_FIFO_LOST_PKT0 0x2F +#define INV_ICM42607_REG_FIFO_LOST_PKT1 0x30 + +#define INV_ICM42607_REG_INTF_CONFIG0 0x35 +#define INV_ICM42607_INTF_CONFIG0_FIFO_COUNT_FORMAT BIT(6) +#define INV_ICM42607_INTF_CONFIG0_FIFO_COUNT_ENDIAN BIT(5) +#define INV_ICM42607_INTF_CONFIG0_SENSOR_DATA_ENDIAN BIT(4) +#define INV_ICM42607_INTF_CONFIG0_UI_SIFS_CFG_MASK GENMASK(1, 0) +#define INV_ICM42607_INTF_CONFIG0_UI_SIFS_CFG_SPI_DIS \ + FIELD_PREP(INV_ICM42607_INTF_CONFIG0_UI_SIFS_CFG_MASK, 2) +#define INV_ICM42607_INTF_CONFIG0_UI_SIFS_CFG_I2C_DIS \ + FIELD_PREP(INV_ICM42607_INTF_CONFIG0_UI_SIFS_CFG_MASK, 3) + +#define INV_ICM42607_REG_INTF_CONFIG1 0x36 +#define INV_ICM42607_INTF_CONFIG1_I3C_SDR_EN BIT(3) +#define INV_ICM42607_INTF_CONFIG1_I3C_DDR_EN BIT(2) +#define INV_ICM42607_INTF_CONFIG1_CLKSEL_MASK GENMASK(1, 0) +#define INV_ICM42607_INTF_CONFIG1_CLKSEL_INT 0 +#define INV_ICM42607_INTF_CONFIG1_CLKSEL_PLL 1 +#define INV_ICM42607_INTF_CONFIG1_CLKSEL_OFF 2 + +#define INV_ICM42607_REG_INT_STATUS_DRDY 0x39 +#define INV_ICM42607_INT_STATUS_DRDY_DATA_RDY BIT(0) + +#define INV_ICM42607_REG_INT_STATUS 0x3A +#define INV_ICM42607_INT_STATUS_ST BIT(7) +#define INV_ICM42607_INT_STATUS_FSYNC BIT(6) +#define INV_ICM42607_INT_STATUS_PLL_RDY BIT(5) +#define INV_ICM42607_INT_STATUS_RESET_DONE BIT(4) +#define INV_ICM42607_INT_STATUS_FIFO_THS BIT(2) +#define INV_ICM42607_INT_STATUS_FIFO_FULL BIT(1) +#define INV_ICM42607_INT_STATUS_AGC_RDY BIT(0) + +#define INV_ICM42607_REG_INT_STATUS2 0x3B +#define INV_ICM42607_INT_STATUS2_SMD BIT(3) +#define INV_ICM42607_INT_STATUS2_WOM_INT GENMASK(2, 0) + +#define INV_ICM42607_REG_INT_STATUS3 0x3C +#define INV_ICM42607_INT_STATUS3_STEP_DET BIT(5) +#define INV_ICM42607_INT_STATUS3_STEP_CNT_OVF BIT(4) +#define INV_ICM42607_INT_STATUS3_TILT_DET BIT(3) +#define INV_ICM42607_INT_STATUS3_FF_DET BIT(2) + +/* +* FIFO access registers +* FIFO count is 16 bits (2 registers) big-endian +* FIFO data is a continuous read register to read FIFO content +*/ +#define INV_ICM42607_REG_FIFO_COUNTH 0x3D +#define INV_ICM42607_REG_FIFO_COUNTL 0x3E +#define INV_ICM42607_REG_FIFO_DATA 0x3F + +#define INV_ICM42607_REG_ACCEL_WOM_X_THR 0x4b +#define INV_ICM42607_REG_ACCEL_WOM_Y_THR 0x4c +#define INV_ICM42607_REG_ACCEL_WOM_Z_THR 0x4d + +#define INV_ICM42607_REG_WHOAMI 0x75 +#define INV_ICM42607P_WHOAMI 0x60 +#define INV_ICM42607_WHOAMI 0x67 + +/* Sleep times required by the driver */ +#define INV_ICM42607_POWER_UP_TIME_US 100000 +#define INV_ICM42607_RESET_TIME_MS 1 +#define INV_ICM42607_ACCEL_STARTUP_TIME_MS 20 +#define INV_ICM42607_GYRO_STARTUP_TIME_MS 60 +#define INV_ICM42607_GYRO_STOP_TIME_MS 150 +#define INV_ICM42607_TEMP_STARTUP_TIME_MS 14 +#define INV_ICM42607_SUSPEND_DELAY_MS 2000 + +typedef int (*inv_icm42607_bus_setup )(struct inv_icm42607_state *); + +extern const struct regmap_config inv_icm42607_regmap_config; + +int inv_icm42607_core_probe (struct regmap *regmap,const struct inv_icm42607_hw *hw, +inv_icm42607_bus_setup bus_setup); + +#endif
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +207 -0
207 lines not on this page · raw message
Signature · 1 line
2.43.0
[email protected]
AI reviewRe: [PATCH V7 03/11] iio: imu: inv_icm42607: Add inv_icm42607 Core Driver
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider: - [High] Overriding `fwnode_irq_get_byname` return value breaks probe deferral. - [Medium] Permissive…
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Overriding fwnode_irq_get_byname return value breaks probe deferral.
- [Medium] Permissive WHOAMI check allows successful probe of non-existent devices on floating SPI busses. --
commit 4cf92e828a7378ea0e258610a5cbe3601aaf01a0
Author: Chris Morgan <[email protected]>
iio: imu: inv_icm42607: Add inv_icm42607 Core Driver
This commit adds the core component of the new inv_icm42607 driver. It includes setup functions and the full register definition in the header file.
Quoted 5 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +0
-0
[ ... ]
Quoted 4 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +4
-0+static int inv_icm42607_setup (struct inv_icm42607_state *st, +inv_icm42607_bus_setup bus_setup) +{ +const struct device *dev =regmap_get_device (st->map);
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 90
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +10
-0+unsigned int val; +int ret; + + ret =regmap_read (st->map,INV_ICM42607_REG_WHOAMI , &val); +if (ret) +return ret; + +if (val != st->hw->whoami) +dev_warn (dev,"invalid whoami %#02x expected %#02x (%s)\n" , + val, st->hw->whoami, st->hw->name);
Should the WHOAMI check fail the probe if the device returns completely invalid values like 0xff or 0x00?
If the device is not present and the SPI MISO line is floating high, regmap_read() will return 0xff for the WHOAMI register. Because this check only issues a warning, the driver continues the probe sequence.
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 102
Quoted 12 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +12
-0+ + ret =regmap_write (st->map,INV_ICM42607_REG_SIGNAL_PATH_RESET , +INV_ICM42607_SIGNAL_PATH_RESET_SOFT_RESET ); +if (ret) +return ret; + +fsleep (1000 ); + + ret =regmap_read_poll_timeout (st->map,INV_ICM42607_REG_INT_STATUS , + val, val &INV_ICM42607_INT_STATUS_RESET_DONE , +INV_ICM42607_RESET_TIME_MS *100 , +INV_ICM42607_RESET_TIME_MS *1000 );
Later, when polling for the reset completion here, the condition (val & INV_ICM42607_INT_STATUS_RESET_DONE) checks for BIT(4). A floating bus returning 0xff will immediately evaluate to true, allowing the probe to succeed. This could result in a phantom IIO device being created that only returns garbage data.
[ ... ]
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 156
Quoted 12 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +12
-0+int inv_icm42607_core_probe (struct regmap *regmap,const struct inv_icm42607_hw *hw, +inv_icm42607_bus_setup bus_setup) +{ +struct device *dev =regmap_get_device (regmap); +struct fwnode_handle *fwnode =dev_fwnode (dev); +struct inv_icm42607_state *st; +int irq; +int ret; + + irq =fwnode_irq_get_byname (fwnode,"INT1" ); +if (!(irq >0 )) +return dev_err_probe (dev, -EINVAL ,"Unable to get INT1 interrupt\n" );
Does overriding the error code from fwnode_irq_get_byname() break probe deferral?
If the interrupt controller is not yet ready, fwnode_irq_get_byname() will return -EPROBE_DEFER. By unconditionally squashing the return value into -EINVAL when calling dev_err_probe(), the kernel will permanently fail to probe the device instead of deferring it. Could we propagate the actual irq error code instead?
[ ... ]
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=3
Jonathan Cameron
maintainerRe: [PATCH V7 03/11] iio: imu: inv_icm42607: Add inv_icm42607 Core Driver
In reply to Chris MorganQuoted 7 lines · On Fri, 15 May 2026 08:00:08 -0500 Chris Morgan <[email protected]> wrote:
From: Chris Morgan <[email protected]>
Add the core component of a new
inv_icm42607driver. This includes a few setup functions and the full register definition in the header file.Signed-off-by Chris Morgan <[email protected]>
Sashiko led you into the weeks with irq request return values. It was less broken in v6 :(
As to it's other comments on checking for line high/low values (0x00 / 0xFF) for whoami is something we don't normally bother with but you could if you like. I'm fairly sure we've had both those values turn up as valid in some devices in the past.
Otherwise just trivial stuff I noticed whilst having a fresh read through. All stuff I might have tweaked whilst applying or just let through but seeing as you are going to be doing a v8, please take a look.
Jonathan
Quoted 70 lines
--- drivers/iio/imu/inv_icm42607/inv_icm42607.h | 334 ++++++++++++++++++ .../iio/imu/inv_icm42607/inv_icm42607_core.c | 207 +++++++++++ 2 files changed, 541 insertions(+) create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607.h create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_core.cdrivers/iio/imu/inv_icm42607/inv_icm42607.h new file +57
-0@@ -0,0 +1,334 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* +* Copyright (C) 2026 InvenSense, Inc. +*/ + +#ifndef INV_ICM42607_H_ +#define INV_ICM42607_H_ + +#include <linux/bitfield.h> +#include <linux/bitops.h> +#include <linux/iio/iio.h> +#include <linux/mutex.h> +#include <linux/regmap.h> +#include <linux/regulator/consumer.h> + +enum inv_icm42607_sensor_mode { +INV_ICM42607_SENSOR_MODE_OFF , +INV_ICM42607_SENSOR_MODE_STANDBY , +INV_ICM42607_SENSOR_MODE_LOW_POWER , +INV_ICM42607_SENSOR_MODE_LOW_NOISE , +INV_ICM42607_SENSOR_MODE_NB +}; + +/* gyroscope fullscale values */ +enum inv_icm42607_gyro_fs { +INV_ICM42607_GYRO_FS_2000DPS , +INV_ICM42607_GYRO_FS_1000DPS , +INV_ICM42607_GYRO_FS_500DPS , +INV_ICM42607_GYRO_FS_250DPS , +INV_ICM42607_GYRO_FS_NB +}; + +/* accelerometer fullscale values */ +enum inv_icm42607_accel_fs { +INV_ICM42607_ACCEL_FS_16G , +INV_ICM42607_ACCEL_FS_8G , +INV_ICM42607_ACCEL_FS_4G , +INV_ICM42607_ACCEL_FS_2G , +INV_ICM42607_ACCEL_FS_NB +}; + +/* ODR values */ +enum inv_icm42607_odr { +INV_ICM42607_ODR_1600HZ =5 , +INV_ICM42607_ODR_800HZ , +INV_ICM42607_ODR_400HZ , +INV_ICM42607_ODR_200HZ , +INV_ICM42607_ODR_100HZ , +INV_ICM42607_ODR_50HZ , +INV_ICM42607_ODR_25HZ , +INV_ICM42607_ODR_12_5HZ , +INV_ICM42607_ODR_6_25HZ_LP , +INV_ICM42607_ODR_3_125HZ_LP , +INV_ICM42607_ODR_1_5625HZ_LP , +INV_ICM42607_ODR_NB +}; +
drivers/iio/imu/inv_icm42607/inv_icm42607.h line 67
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h new file +10
-0+enum inv_icm42607_filter_bw { +/* Low-Noise mode sensor data filter (bandwidth) */ +INV_ICM42607_FILTER_BYPASS , +INV_ICM42607_FILTER_BW_180HZ , +INV_ICM42607_FILTER_BW_121HZ , +INV_ICM42607_FILTER_BW_73HZ , +INV_ICM42607_FILTER_BW_53HZ , +INV_ICM42607_FILTER_BW_34HZ , +INV_ICM42607_FILTER_BW_25HZ , +INV_ICM42607_FILTER_BW_16HZ
That isn't a terminating entry so it should have a , Rules on this are a bit obscure - but basically _NB type entries should never have a , anything else should - even if it's a register field enum where we know all values are there.
drivers/iio/imu/inv_icm42607/inv_icm42607.h line 325
Quoted 11 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h new file +9
-0+}; +/* Sleep times required by the driver */ +#define INV_ICM42607_POWER_UP_TIME_US 100000 +#define INV_ICM42607_RESET_TIME_MS 1 +#define INV_ICM42607_ACCEL_STARTUP_TIME_MS 20 +#define INV_ICM42607_GYRO_STARTUP_TIME_MS 60 +#define INV_ICM42607_GYRO_STOP_TIME_MS 150 +#define INV_ICM42607_TEMP_STARTUP_TIME_MS 14 +#define INV_ICM42607_SUSPEND_DELAY_MS 2000
Can we have spec references for these? We often hit problems later with devices that are a little bit slow and no one is sure if it's because the sleeps are wrong or device is actually out of spec. Hence it is useful to be able to quickly check these.
Quoted 32 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h new file +9
-0+ +typedef int (*inv_icm42607_bus_setup )(struct inv_icm42607_state *); + +extern const struct regmap_config inv_icm42607_regmap_config; + +int inv_icm42607_core_probe (struct regmap *regmap,const struct inv_icm42607_hw *hw, +inv_icm42607_bus_setup bus_setup); + +#endif drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +17
-0@@ -0,0 +1,207 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* +* Copyright (C) 2026 InvenSense, Inc. +*/ + +#include <linux/delay.h> +#include <linux/interrupt.h> +#include <linux/iio/iio.h> +#include <linux/irq.h> +#include <linux/module.h> +#include <linux/mutex.h> +#include <linux/property.h> +#include <linux/regmap.h> +#include <linux/regulator/consumer.h> + +#include "inv_icm42607.h" +
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 27
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +10
-0+static int inv_icm42607_set_conf (struct inv_icm42607_state *st, +const struct inv_icm42607_conf *conf) +{ +unsigned int val; +int ret; + + val =FIELD_PREP (INV_ICM42607_PWR_MGMT0_GYRO_MODE_MASK , + conf->gyro.mode); + val |=FIELD_PREP (INV_ICM42607_PWR_MGMT0_ACCEL_MODE_MASK , + conf->accel.mode);
As below - I'm fine with these going on one line (first is 80 chars, second just over)
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 32
Quoted 5 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +5
-0+/* +* No temperature enable reg in datasheet, but BSP driver +* selected RC oscillator clock in LP mode when temperature +* was disabled. +*/
/* * No temperature enable reg in datasheet, but BSP driver selected * RC oscillator clock in LP mode when temperature was disabled. */
Basically go up to 80 chars. Here I think keeping RC oscillator on one line is a good idea though.
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 40
Quoted 8 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +8
-0+if (!conf->temp_en) + val |=INV_ICM42607_PWR_MGMT0_ACCEL_LP_CLK_SEL ; + ret =regmap_write (st->map,INV_ICM42607_REG_PWR_MGMT0 , val); +if (ret) +return ret; + + val =FIELD_PREP (INV_ICM42607_GYRO_CONFIG0_FS_SEL_MASK , + conf->gyro.fs);
It's under 80 chars on one line so don't wrap.
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 42
Quoted 2 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +2
-0+ val |=FIELD_PREP (INV_ICM42607_GYRO_CONFIG0_ODR_MASK , + conf->gyro.odr);
As is this.
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 54
Quoted 12 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +12
-0+ ret =regmap_write (st->map,INV_ICM42607_REG_GYRO_CONFIG0 , val); +if (ret) +return ret; + + val =FIELD_PREP (INV_ICM42607_ACCEL_CONFIG0_FS_SEL_MASK , conf->accel.fs); + val |=FIELD_PREP (INV_ICM42607_ACCEL_CONFIG0_ODR_MASK , conf->accel.odr); + ret =regmap_write (st->map,INV_ICM42607_REG_ACCEL_CONFIG0 , val); +if (ret) +return ret; + + val =FIELD_PREP (INV_ICM42607_GYRO_CONFIG1_FILTER_MASK , + conf->gyro.filter);
Whilst this one and next are a tiny bit over 80 chars, if you want to I don't mind those being a little long as single lines.
Quoted 33 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +33
-0+ ret =regmap_write (st->map,INV_ICM42607_REG_GYRO_CONFIG1 , val); +if (ret) +return ret; + + val =FIELD_PREP (INV_ICM42607_ACCEL_CONFIG1_FILTER_MASK , + conf->accel.filter); + ret =regmap_write (st->map,INV_ICM42607_REG_ACCEL_CONFIG1 , val); +if (ret) +return ret; + + st->conf = *conf; + +return 0 ; +} + +/** +* inv_icm42607_setup() - check and setup chip +* @st: driver internal state +* @bus_setup: callback for setting up bus specific registers +* +* Returns 0 on success, a negative error code otherwise. +*/ +static int inv_icm42607_setup (struct inv_icm42607_state *st, +inv_icm42607_bus_setup bus_setup) +{ +const struct device *dev =regmap_get_device (st->map); +unsigned int val; +int ret; + + ret =regmap_read (st->map,INV_ICM42607_REG_WHOAMI , &val); +if (ret) +return ret; +
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 97
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +10
-0+if (val != st->hw->whoami) +dev_warn (dev,"invalid whoami %#02x expected %#02x (%s)\n" , + val, st->hw->whoami, st->hw->name); + + ret =regmap_write (st->map,INV_ICM42607_REG_SIGNAL_PATH_RESET , +INV_ICM42607_SIGNAL_PATH_RESET_SOFT_RESET ); +if (ret) +return ret; + +fsleep (1000 );
Do we need an explicit sleep here, or is the idea just to save on a read that can't succeed in the poll that follows? I'd be tempted to drop this if it's not absolutely needed just to avoid explaining it. This isn't fast path code. If we need to leave the device alone after reset for a bit then a datasheet reference is needed.
Quoted 27 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +26
-0+ + ret =regmap_read_poll_timeout (st->map,INV_ICM42607_REG_INT_STATUS , + val, val &INV_ICM42607_INT_STATUS_RESET_DONE , +INV_ICM42607_RESET_TIME_MS *100 , +INV_ICM42607_RESET_TIME_MS *1000 ); +if (ret) +return dev_err_probe (dev, ret, +"reset error, reset done bit not set\n" ); + + ret =bus_setup (st); +if (ret) +return ret; + + ret =regmap_set_bits (st->map,INV_ICM42607_REG_INTF_CONFIG0 , +INV_ICM42607_INTF_CONFIG0_SENSOR_DATA_ENDIAN ); +if (ret) +return ret; + + ret =regmap_update_bits (st->map,INV_ICM42607_REG_INTF_CONFIG1 , +INV_ICM42607_INTF_CONFIG1_CLKSEL_MASK , +INV_ICM42607_INTF_CONFIG1_CLKSEL_PLL ); +if (ret) +return ret; + +return inv_icm42607_set_conf (st, st->hw->conf); +}
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 154
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +10
-0+int inv_icm42607_core_probe (struct regmap *regmap,const struct inv_icm42607_hw *hw, +inv_icm42607_bus_setup bus_setup) +{ +struct device *dev =regmap_get_device (regmap); +struct fwnode_handle *fwnode =dev_fwnode (dev); +struct inv_icm42607_state *st; +int irq; +int ret; + + irq =fwnode_irq_get_byname (fwnode,"INT1" );
Trivial but if fwnode is only used here (I didn't check later patches) then put the dev_fwnode() inline.
I've never really understood why we don't have device_ variant of that - perhaps because it's hard to come up with a clear name.
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 156
Quoted 2 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +2
-0+if (!(irq >0 )) +return dev_err_probe (dev, -EINVAL ,"Unable to get INT1 interrupt\n" );
I assume this is in response to sashiko saying fwnode_irq_get_byname() can in some corner cases (where I suspect things are broken enough the system probably won't boot)
return 0. If we are actually going to defend against that then you need
to special case it. New sashiko review correctly reports this breaks probe deferal if say the interrupt chip driver hasn't loaded yet.
if (irq < 0) {
return dev_err_probe(dev, irq, ...);
if (irq == 0)
/* Odd corner case... */
return dev_err_probe(dev, -EINVAL, ...);However I'm deeply suspicious of whether the code paths that return 0 can happen in practice. Given you have a suitable DT, can you try seeing if you can actually make it return 0 by messing around with the interrupt mappings?
Quoted 4 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +4
-0+ + st =devm_kzalloc (dev,sizeof (*st),GFP_KERNEL ); +if (!st) +return -ENOMEM ;
Re: [PATCH V7 03/11] iio: imu: inv_icm42607: Add inv_icm42607 Core Driver
Quoted 19 lines · Jonathan Cameron
Quoted 7 lines · On Fri, 15 May 2026 08:00:08 -0500 Chris Morgan <[email protected]> wrote:
From: Chris Morgan <[email protected]>
Add the core component of a new
inv_icm42607driver. This includes a few setup functions and the full register definition in the header file.Signed-off-by Chris Morgan <[email protected]>Sashiko led you into the weeks with irq request return values. It was less broken in v6 :(
As to it's other comments on checking for line high/low values (
0x00/0xFF) for whoami is something we don't normally bother with but you could if you like. I'm fairly sure we've had both those values turn up as valid in some devices in the past.
Quoted 5 lines
Otherwise just trivial stuff I noticed whilst having a fresh read through. All stuff I might have tweaked whilst applying or just let through but seeing as you are going to be doing a v8, please take a look.
Jonathan
I think I'll ignore that comment about the high-low values, but it does make valid points about using the wrong call to invalidate the regmap cache and also the wrong call to set the SPI_MODE_3 stuff.
All in all I'll try to post another version in another day or two with the recommended fixes (as best I can) and see if it still complains. I'm expecting a few complaints like the 0x00/0xFF or some stuff about "keeping the temp sensor enabled" which is a non-issue per the datasheet. Hopefully I'm near the finish line either way.
Quoted 91 lines
Quoted 72 lines
--- drivers/iio/imu/inv_icm42607/inv_icm42607.h | 334 ++++++++++++++++++ .../iio/imu/inv_icm42607/inv_icm42607_core.c | 207 +++++++++++ 2 files changed, 541 insertions(+) create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607.h create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_core.cdrivers/iio/imu/inv_icm42607/inv_icm42607.h new file +57
-0@@ -0,0 +1,334 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* +* Copyright (C) 2026 InvenSense, Inc. +*/ + +#ifndef INV_ICM42607_H_ +#define INV_ICM42607_H_ + +#include <linux/bitfield.h> +#include <linux/bitops.h> +#include <linux/iio/iio.h> +#include <linux/mutex.h> +#include <linux/regmap.h> +#include <linux/regulator/consumer.h> + +enum inv_icm42607_sensor_mode { +INV_ICM42607_SENSOR_MODE_OFF , +INV_ICM42607_SENSOR_MODE_STANDBY , +INV_ICM42607_SENSOR_MODE_LOW_POWER , +INV_ICM42607_SENSOR_MODE_LOW_NOISE , +INV_ICM42607_SENSOR_MODE_NB +}; + +/* gyroscope fullscale values */ +enum inv_icm42607_gyro_fs { +INV_ICM42607_GYRO_FS_2000DPS , +INV_ICM42607_GYRO_FS_1000DPS , +INV_ICM42607_GYRO_FS_500DPS , +INV_ICM42607_GYRO_FS_250DPS , +INV_ICM42607_GYRO_FS_NB +}; + +/* accelerometer fullscale values */ +enum inv_icm42607_accel_fs { +INV_ICM42607_ACCEL_FS_16G , +INV_ICM42607_ACCEL_FS_8G , +INV_ICM42607_ACCEL_FS_4G , +INV_ICM42607_ACCEL_FS_2G , +INV_ICM42607_ACCEL_FS_NB +}; + +/* ODR values */ +enum inv_icm42607_odr { +INV_ICM42607_ODR_1600HZ =5 , +INV_ICM42607_ODR_800HZ , +INV_ICM42607_ODR_400HZ , +INV_ICM42607_ODR_200HZ , +INV_ICM42607_ODR_100HZ , +INV_ICM42607_ODR_50HZ , +INV_ICM42607_ODR_25HZ , +INV_ICM42607_ODR_12_5HZ , +INV_ICM42607_ODR_6_25HZ_LP , +INV_ICM42607_ODR_3_125HZ_LP , +INV_ICM42607_ODR_1_5625HZ_LP , +INV_ICM42607_ODR_NB +}; +drivers/iio/imu/inv_icm42607/inv_icm42607.h line 67
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h new file +10
-0+enum inv_icm42607_filter_bw { +/* Low-Noise mode sensor data filter (bandwidth) */ +INV_ICM42607_FILTER_BYPASS , +INV_ICM42607_FILTER_BW_180HZ , +INV_ICM42607_FILTER_BW_121HZ , +INV_ICM42607_FILTER_BW_73HZ , +INV_ICM42607_FILTER_BW_53HZ , +INV_ICM42607_FILTER_BW_34HZ , +INV_ICM42607_FILTER_BW_25HZ , +INV_ICM42607_FILTER_BW_16HZ That isn't a terminating entry so it should have a , Rules on this are a bit obscure - but basically
_NBtype entries should never have a , anything else should - even if it's a register field enum where we know all values are there.Quoted 1 line
drivers/iio/imu/inv_icm42607/inv_icm42607.h new file +1
-0+};
Quoted 13 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h line 325
Quoted 8 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h new file +8
-0+/* Sleep times required by the driver */ +#define INV_ICM42607_POWER_UP_TIME_US 100000 +#define INV_ICM42607_RESET_TIME_MS 1 +#define INV_ICM42607_ACCEL_STARTUP_TIME_MS 20 +#define INV_ICM42607_GYRO_STARTUP_TIME_MS 60 +#define INV_ICM42607_GYRO_STOP_TIME_MS 150 +#define INV_ICM42607_TEMP_STARTUP_TIME_MS 14 +#define INV_ICM42607_SUSPEND_DELAY_MS 2000Can we have spec references for these? We often hit problems later with devices that are a little bit slow and no one is sure if it's because the sleeps are wrong or device is actually out of spec. Hence it is useful to be able to quickly check these.
I took these from the driver I basically copied wholesale and changed the registers for according to the datasheet, but I didn't take a very close look at these (which I am now).
The POWER_UP_TIME_US, assuming it's the same as "Supply Ramp Time" from the datasheet is 100ms which matches. Likewise, the "Start-up time for register read/write" listed under "Power-On Reset" shows 1ms, which matches.
The ACCEL_STARTUP_TIME_MS should probably be 10ms, and the GYRO_STARTUP_TIME_MS should probably be 30ms. I don't see a startup time listed for the temperature sensor but I do see "Stabilization Time" which lists 77us. Gyro stop time and suspend delay time I cannot find a reference for... logically if those values are needed I think they should likely be the same as the gyro start time and power up time, respectively right?
The values I am referencing now appear under the electrical characteristics section (section 3) of the datasheet for both the icm42607p (my test devices, over i2c) and the icm42607(c).
Quoted 132 lines
Quoted 33 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h new file +9
-0+ +typedef int (*inv_icm42607_bus_setup )(struct inv_icm42607_state *); + +extern const struct regmap_config inv_icm42607_regmap_config; + +int inv_icm42607_core_probe (struct regmap *regmap,const struct inv_icm42607_hw *hw, +inv_icm42607_bus_setup bus_setup); + +#endif drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +17
-0@@ -0,0 +1,207 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* +* Copyright (C) 2026 InvenSense, Inc. +*/ + +#include <linux/delay.h> +#include <linux/interrupt.h> +#include <linux/iio/iio.h> +#include <linux/irq.h> +#include <linux/module.h> +#include <linux/mutex.h> +#include <linux/property.h> +#include <linux/regmap.h> +#include <linux/regulator/consumer.h> + +#include "inv_icm42607.h" +drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 27
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +10
-0+static int inv_icm42607_set_conf (struct inv_icm42607_state *st, +const struct inv_icm42607_conf *conf) +{ +unsigned int val; +int ret; + + val =FIELD_PREP (INV_ICM42607_PWR_MGMT0_GYRO_MODE_MASK , + conf->gyro.mode); + val |=FIELD_PREP (INV_ICM42607_PWR_MGMT0_ACCEL_MODE_MASK , + conf->accel.mode);As below - I'm fine with these going on one line (first is 80 chars, second just over)
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 32
Quoted 5 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +5
-0+/* +* No temperature enable reg in datasheet, but BSP driver +* selected RC oscillator clock in LP mode when temperature +* was disabled. +*/ /* * No temperature enable reg in datasheet, but BSP driver selected * RC oscillator clock in LP mode when temperature was disabled. */Basically go up to 80 chars. Here I think keeping RC oscillator on one line is a good idea though.
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 40
Quoted 8 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +8
-0+if (!conf->temp_en) + val |=INV_ICM42607_PWR_MGMT0_ACCEL_LP_CLK_SEL ; + ret =regmap_write (st->map,INV_ICM42607_REG_PWR_MGMT0 , val); +if (ret) +return ret; + + val =FIELD_PREP (INV_ICM42607_GYRO_CONFIG0_FS_SEL_MASK , + conf->gyro.fs);It's under 80 chars on one line so don't wrap.
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 42
Quoted 2 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +2
-0+ val |=FIELD_PREP (INV_ICM42607_GYRO_CONFIG0_ODR_MASK , + conf->gyro.odr);As is this.
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 54
Quoted 12 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +12
-0+ ret =regmap_write (st->map,INV_ICM42607_REG_GYRO_CONFIG0 , val); +if (ret) +return ret; + + val =FIELD_PREP (INV_ICM42607_ACCEL_CONFIG0_FS_SEL_MASK , conf->accel.fs); + val |=FIELD_PREP (INV_ICM42607_ACCEL_CONFIG0_ODR_MASK , conf->accel.odr); + ret =regmap_write (st->map,INV_ICM42607_REG_ACCEL_CONFIG0 , val); +if (ret) +return ret; + + val =FIELD_PREP (INV_ICM42607_GYRO_CONFIG1_FILTER_MASK , + conf->gyro.filter);Whilst this one and next are a tiny bit over 80 chars, if you want to I don't mind those being a little long as single lines.
Quoted 41 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +41
-0+ ret =regmap_write (st->map,INV_ICM42607_REG_GYRO_CONFIG1 , val); +if (ret) +return ret; + + val =FIELD_PREP (INV_ICM42607_ACCEL_CONFIG1_FILTER_MASK , + conf->accel.filter); + ret =regmap_write (st->map,INV_ICM42607_REG_ACCEL_CONFIG1 , val); +if (ret) +return ret; + + st->conf = *conf; + +return 0 ; +} + +/** +* inv_icm42607_setup() - check and setup chip +* @st: driver internal state +* @bus_setup: callback for setting up bus specific registers +* +* Returns 0 on success, a negative error code otherwise. +*/ +static int inv_icm42607_setup (struct inv_icm42607_state *st, +inv_icm42607_bus_setup bus_setup) +{ +const struct device *dev =regmap_get_device (st->map); +unsigned int val; +int ret; + + ret =regmap_read (st->map,INV_ICM42607_REG_WHOAMI , &val); +if (ret) +return ret; + +if (val != st->hw->whoami) +dev_warn (dev,"invalid whoami %#02x expected %#02x (%s)\n" , + val, st->hw->whoami, st->hw->name); + + ret =regmap_write (st->map,INV_ICM42607_REG_SIGNAL_PATH_RESET , +INV_ICM42607_SIGNAL_PATH_RESET_SOFT_RESET ); +if (ret) +return ret;
Quoted 9 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 97
Quoted 2 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +2
-0+ +fsleep (1000 );Do we need an explicit sleep here, or is the idea just to save on a read that can't succeed in the poll that follows? I'd be tempted to drop this if it's not absolutely needed just to avoid explaining it. This isn't fast path code. If we need to leave the device alone after reset for a bit then a datasheet reference is needed.
Data sheet only really says that the time required after a *hard* reset is 1ms, it honestly doesn't say anything about a soft reset.
I also thought I got rid of the read_poll_timeout, since I'm already waiting 1ms... if you think this fsleep is needed or not I'll defer to you.
Honestly this whole path thing got messed up when we wanted to code for 3 wire SPI. For 3 wire I need to make sure I enable it as soon as the reset completes, so it's probably not even right here. I need to add bus_setup() before the read not after. So to support 3-wire it needs to go:bus_setup()
whoami check
reset
wait (maybe)bus_setup() again
check int_status (if we can after the bus_setup)
do the rest
whereas if we explicitly say no 3-wire then we can drop the first bus setup and use regmap_read_poll_timeout to get the status.
Quoted 58 lines
Quoted 27 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +26
-0+ + ret =regmap_read_poll_timeout (st->map,INV_ICM42607_REG_INT_STATUS , + val, val &INV_ICM42607_INT_STATUS_RESET_DONE , +INV_ICM42607_RESET_TIME_MS *100 , +INV_ICM42607_RESET_TIME_MS *1000 ); +if (ret) +return dev_err_probe (dev, ret, +"reset error, reset done bit not set\n" ); + + ret =bus_setup (st); +if (ret) +return ret; + + ret =regmap_set_bits (st->map,INV_ICM42607_REG_INTF_CONFIG0 , +INV_ICM42607_INTF_CONFIG0_SENSOR_DATA_ENDIAN ); +if (ret) +return ret; + + ret =regmap_update_bits (st->map,INV_ICM42607_REG_INTF_CONFIG1 , +INV_ICM42607_INTF_CONFIG1_CLKSEL_MASK , +INV_ICM42607_INTF_CONFIG1_CLKSEL_PLL ); +if (ret) +return ret; + +return inv_icm42607_set_conf (st, st->hw->conf); +}drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 154
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +10
-0+int inv_icm42607_core_probe (struct regmap *regmap,const struct inv_icm42607_hw *hw, +inv_icm42607_bus_setup bus_setup) +{ +struct device *dev =regmap_get_device (regmap); +struct fwnode_handle *fwnode =dev_fwnode (dev); +struct inv_icm42607_state *st; +int irq; +int ret; + + irq =fwnode_irq_get_byname (fwnode,"INT1" );Trivial but if fwnode is only used here (I didn't check later patches) then put the
dev_fwnode()inline.I've never really understood why we don't have
device_variant of that - perhaps because it's hard to come up with a clear name.drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 156
Quoted 2 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +2
-0+if (!(irq >0 )) +return dev_err_probe (dev, -EINVAL ,"Unable to get INT1 interrupt\n" );I assume this is in response to sashiko saying
fwnode_irq_get_byname()can in some corner cases (where I suspect things are broken enough the system probably won't boot)
return 0. If we are actually going to defend against that then you need
to special case it. New sashiko review correctly reports this breaks probe deferal if say the interrupt chip driver hasn't loaded yet.if (irq < 0) { return dev_err_probe(dev, irq, ...); if (irq == 0) /* Odd corner case... */ return dev_err_probe(dev, -EINVAL, ...);
Quoted 4 lines
However I'm deeply suspicious of whether the code paths that return 0 can happen in practice. Given you have a suitable DT, can you try seeing if you can actually make it return 0 by messing around with the interrupt mappings?
I will mess with it a bit, but I think I'll just go back to the simple (irq < 0) then return dev_err_probe(dev, irq). Worst case if it's wrong I'm in good company. :-p
Quoted 6 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 160
Quoted 5 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c new file +4
-0+ + st =devm_kzalloc (dev,sizeof (*st),GFP_KERNEL ); +if (!st) +return -ENOMEM ;
I sincerely appreciate all your help on this. Here I was thinking this would be easy and I could focus on a joystick/LED driver next... how wrong I was!
Chris
Jonathan Cameron
maintainerRe: [PATCH V7 03/11] iio: imu: inv_icm42607: Add inv_icm42607 Core Driver
Quoted 30 lines · On Fri, 15 May 2026 20:51:01 -0500 Chris Morgan <[email protected]> wrote:
Quoted 19 lines · Jonathan Cameron
Quoted 7 lines · On Fri, 15 May 2026 08:00:08 -0500 Chris Morgan <[email protected]> wrote:
From: Chris Morgan <[email protected]>
Add the core component of a new
inv_icm42607driver. This includes a few setup functions and the full register definition in the header file.Signed-off-by Chris Morgan <[email protected]>Sashiko led you into the weeks with irq request return values. It was less broken in v6 :(
As to it's other comments on checking for line high/low values (
0x00/0xFF) for whoami is something we don't normally bother with but you could if you like. I'm fairly sure we've had both those values turn up as valid in some devices in the past.Quoted 5 lines
Otherwise just trivial stuff I noticed whilst having a fresh read through. All stuff I might have tweaked whilst applying or just let through but seeing as you are going to be doing a v8, please take a look.
Jonathan
I think I'll ignore that comment about the high-low values, but it does make valid points about using the wrong call to invalidate the regmap cache and also the wrong call to set the
SPI_MODE_3stuff.
Quoted 6 lines
All in all I'll try to post another version in another day or two with the recommended fixes (as best I can) and see if it still complains. I'm expecting a few complaints like the 0x00/0xFF or some stuff about "keeping the temp sensor enabled" which is a non-issue per the datasheet. Hopefully I'm near the finish line either way.
Yup. It's a useful tool but not perfect!
Quoted 39 lines
Quoted 16 lines
Quoted 14 lines
--- drivers/iio/imu/inv_icm42607/inv_icm42607.h | 334 ++++++++++++++++++ .../iio/imu/inv_icm42607/inv_icm42607_core.c | 207 +++++++++++ 2 files changed, 541 insertions(+) create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607.h create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_core.cdrivers/iio/imu/inv_icm42607/inv_icm42607.h new file +0
-0Quoted 13 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h line 325
Quoted 8 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h new file +8
-0+/* Sleep times required by the driver */ +#define INV_ICM42607_POWER_UP_TIME_US 100000 +#define INV_ICM42607_RESET_TIME_MS 1 +#define INV_ICM42607_ACCEL_STARTUP_TIME_MS 20 +#define INV_ICM42607_GYRO_STARTUP_TIME_MS 60 +#define INV_ICM42607_GYRO_STOP_TIME_MS 150 +#define INV_ICM42607_TEMP_STARTUP_TIME_MS 14 +#define INV_ICM42607_SUSPEND_DELAY_MS 2000Can we have spec references for these? We often hit problems later with devices that are a little bit slow and no one is sure if it's because the sleeps are wrong or device is actually out of spec. Hence it is useful to be able to quickly check these.
I took these from the driver I basically copied wholesale and changed the registers for according to the datasheet, but I didn't take a very close look at these (which I am now).
The
POWER_UP_TIME_US, assuming it's the same as "Supply Ramp Time" from the datasheet is 100ms which matches. Likewise, the "Start-up time for register read/write" listed under "Power-On Reset" shows 1ms, which matches.
Quoted 7 lines
The
ACCEL_STARTUP_TIME_MSshould probably be 10ms, and theGYRO_STARTUP_TIME_MSshould probably be 30ms. I don't see a startup time listed for the temperature sensor but I do see "Stabilization Time" which lists 77us. Gyro stop time and suspend delay time I cannot find a reference for... logically if those values are needed I think they should likely be the same as the gyro start time and power up time, respectively right?
Stops tend to be pretty quick as no need to wait for stuff to stabilize. It's pretty rare to have a value for them - however, I guess if there was one in the driver maybe just add a comment that says 'from driver
+ link'.
Quoted 5 lines
The values I am referencing now appear under the electrical characteristics section (section 3) of the datasheet for both the icm42607p (my test devices, over i2c) and the icm42607(c).
Nice.
Quoted 29 lines
Quoted 19 lines
Quoted 19 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h new file +19
-0+static int inv_icm42607_setup (struct inv_icm42607_state *st, +inv_icm42607_bus_setup bus_setup) +{ +const struct device *dev =regmap_get_device (st->map); +unsigned int val; +int ret; + + ret =regmap_read (st->map,INV_ICM42607_REG_WHOAMI , &val); +if (ret) +return ret; + +if (val != st->hw->whoami) +dev_warn (dev,"invalid whoami %#02x expected %#02x (%s)\n" , + val, st->hw->whoami, st->hw->name); + + ret =regmap_write (st->map,INV_ICM42607_REG_SIGNAL_PATH_RESET , +INV_ICM42607_SIGNAL_PATH_RESET_SOFT_RESET ); +if (ret) +return ret;Quoted 9 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h
Quoted 2 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h new file +2
-0+ +fsleep (1000 );Do we need an explicit sleep here, or is the idea just to save on a read that can't succeed in the poll that follows? I'd be tempted to drop this if it's not absolutely needed just to avoid explaining it. This isn't fast path code. If we need to leave the device alone after reset for a bit then a datasheet reference is needed.
Quoted 6 lines
Data sheet only really says that the time required after a *hard* reset is 1ms, it honestly doesn't say anything about a soft reset.
I also thought I got rid of the
read_poll_timeout, since I'm already waiting 1ms... if you think this fsleep is needed or not I'll defer to you.
If you are sleeping long enough a single check + fail if not ready is fine.
Quoted 13 lines
Honestly this whole path thing got messed up when we wanted to code for 3 wire SPI. For 3 wire I need to make sure I enable it as soon as the reset completes, so it's probably not even right here. I need to add
bus_setup()before the read not after. So to support 3-wire it needs to go:bus_setup()
whoami check
reset
wait (maybe)bus_setup()again
checkint_status(if we can after thebus_setup)
do the rest
Quoted 2 lines
whereas if we explicitly say no 3-wire then we can drop the first bus setup and use
regmap_read_poll_timeoutto get the status.
Can do no 3 wire initially as long as we check for dt-binding and error out with a helpful message. It'll be a feature someone else can figure out how to add later.
Quoted 10 lines
Quoted 7 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h
Quoted 6 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h new file +4
-0+ + st =devm_kzalloc (dev,sizeof (*st),GFP_KERNEL ); +if (!st) +return -ENOMEM ;I sincerely appreciate all your help on this. Here I was thinking this would be easy and I could focus on a joystick/LED driver next... how wrong I was!
IMUs are about as hard as it gets for sensors! This one is far from the most complex, but none the less there are a lot of things going on.
Jonathan
Quoted 2 lines
Chris
PATCH v7 4/11 iio: imu: inv_icm42607: Add I2C and SPI For icm42607
In reply to Chris MorganFrom: Chris Morgan <[email protected]>
Add I2C and SPI driver support for InvenSense ICM-42607 devices. Add necessary Kconfig and Makefile to allow building of (incomplete) driver.
--- drivers/iio/imu/Kconfig | 1 + drivers/iio/imu/Makefile | 1 + drivers/iio/imu/inv_icm42607/Kconfig | 30 ++++++ drivers/iio/imu/inv_icm42607/Makefile | 10 ++ drivers/iio/imu/inv_icm42607/inv_icm42607.h | 12 +++ .../iio/imu/inv_icm42607/inv_icm42607_core.c | 88 +++++++++++++-- .../iio/imu/inv_icm42607/inv_icm42607_i2c.c | 89 +++++++++++++++ .../iio/imu/inv_icm42607/inv_icm42607_spi.c | 102 ++++++++++++++++++ 8 files changed, 325 insertions(+), 8 deletions(-) create mode 100644 drivers/iio/imu/inv_icm42607/Kconfig create mode 100644 drivers/iio/imu/inv_icm42607/Makefile create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_i2c.c create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_spi.c
drivers/iio/imu/Kconfig +1 -0
@@ -109,6 +109,7 @@ config KMX61 be called kmx61. source "drivers/iio/imu/inv_icm42600/Kconfig" +source "drivers/iio/imu/inv_icm42607/Kconfig" source "drivers/iio/imu/inv_icm45600/Kconfig" source "drivers/iio/imu/inv_mpu6050/Kconfig"
drivers/iio/imu/Makefile +1 -0
@@ -25,6 +25,7 @@ obj-$(CONFIG_FXOS8700_I2C) += fxos8700_i2c.o obj-$(CONFIG_FXOS8700_SPI) += fxos8700_spi.o obj-y += inv_icm42600/ +obj-y += inv_icm42607/ obj-y += inv_icm45600/ obj-y += inv_mpu6050/
drivers/iio/imu/inv_icm42607/Kconfig new file +30 -0
@@ -0,0 +1,30 @@ +# SPDX-License-Identifier: GPL-2.0-or-later + +config INV_ICM42607 + tristate + select IIO_BUFFER + select IIO_INV_SENSORS_TIMESTAMP + +config INV_ICM42607_I2C + tristate "InvenSense ICM-42607X I2C driver" + depends on I2C + select INV_ICM42607 + select REGMAP_I2C + help + This driver supports the InvenSense ICM-42607 motion tracking + device over I2C. + + This driver can be built as a module. The module will be called + inv-icm42607-i2c. + +config INV_ICM42607_SPI + tristate "InvenSense ICM-42607X SPI driver" + depends on SPI_MASTER + select INV_ICM42607 + select REGMAP_SPI + help + This driver supports the InvenSense ICM-42607 motion tracking + device over SPI. + + This driver can be built as a module. The module will be called + inv-icm42607-spi.
drivers/iio/imu/inv_icm42607/Makefile new file +10 -0
@@ -0,0 +1,10 @@ +# SPDX-License-Identifier: GPL-2.0-or-later + +obj-$(CONFIG_INV_ICM42607) += inv-icm42607.o +inv-icm42607-y += inv_icm42607_core.o + +obj-$(CONFIG_INV_ICM42607_I2C) += inv-icm42607-i2c.o +inv-icm42607-i2c-y += inv_icm42607_i2c.o + +obj-$(CONFIG_INV_ICM42607_SPI) += inv-icm42607-spi.o +inv-icm42607-spi-y += inv_icm42607_spi.o
drivers/iio/imu/inv_icm42607/inv_icm42607.h +12 -0
@@ -13,6 +13,16 @@#include <linux/regmap.h> #include <linux/regulator/consumer.h> +/* serial bus slew rates */ +enum inv_icm42607_slew_rate { +INV_ICM42607_SLEW_RATE_20_60NS , +INV_ICM42607_SLEW_RATE_12_36NS , +INV_ICM42607_SLEW_RATE_6_18NS , +INV_ICM42607_SLEW_RATE_4_12NS , +INV_ICM42607_SLEW_RATE_2_6NS , +INV_ICM42607_SLEW_RATE_INF_2NS +}; +enum inv_icm42607_sensor_mode {INV_ICM42607_SENSOR_MODE_OFF ,INV_ICM42607_SENSOR_MODE_STANDBY ,
@@ -327,6 +337,8 @@ struct inv_icm42607_state {typedef int (*inv_icm42607_bus_setup )(struct inv_icm42607_state *);extern const struct regmap_config inv_icm42607_regmap_config; +extern const struct inv_icm42607_hw inv_icm42607_hw_data; +extern const struct inv_icm42607_hw inv_icm42607p_hw_data;int inv_icm42607_core_probe (struct regmap *regmap,const struct inv_icm42607_hw *hw,inv_icm42607_bus_setup bus_setup);
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +80 -8
112 lines not on this page · raw message
drivers/iio/imu/inv_icm42607/inv_icm42607_i2c.c new file +89 -0
89 lines not on this page · raw message
drivers/iio/imu/inv_icm42607/inv_icm42607_spi.c new file +102 -0
102 lines not on this page · raw message
Signature · 1 line
2.43.0
[email protected]
AI reviewRe: [PATCH V7 04/11] iio: imu: inv_icm42607: Add I2C and SPI For icm42607
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider: - [High] Masking `-EPROBE_DEFER` and strict IRQ naming breaks device probe lifecycle and standard…
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [High] Masking -EPROBE_DEFER and strict IRQ naming breaks device probe lifecycle and standard devicetrees.
- [High] regcache_mark_dirty() usage causes the hardware state to desync, skipping required bus configuration after soft reset.
- [High] SPI 3-wire mode configuration uses a read-modify-write cycle, reading garbage data and corrupting device registers.
- [Medium] Valid error codes from regmap operations are discarded and replaced with -EIO.
--
commit 7dbec8ad22b33274f815169a6c802cbf63590cea
Author: Chris Morgan <[email protected]>
iio: imu: inv_icm42607: Add I2C and SPI For icm42607
This commit adds I2C and SPI driver support for the InvenSense ICM-42607 motion tracking device.
Quoted 5 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_spi.c new file +0
-0
[ ... ]
drivers/iio/imu/inv_icm42607/inv_icm42607_spi.c line 24
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_spi.c new file +10
-0+static int inv_icm42607_spi_bus_setup (struct inv_icm42607_state *st) +{ +const struct device *dev =regmap_get_device (st->map); +const struct spi_device *spi =to_spi_device (dev); +unsigned int val; +int ret; + +if (spi->mode &SPI_3WIRE ) + ret =regmap_clear_bits (st->map,INV_ICM42607_REG_DEVICE_CONFIG , +INV_ICM42607_DEVICE_CONFIG_SPI_AP_4WIRE );
Since the device powers on in 4-wire mode, won't this initial read-modify-write fail for a 3-wire configured host?
The host expects data on MOSI but the device drives MISO, which would result in reading garbage data and permanently corrupting the rest of the configuration bits in DEVICE_CONFIG when written back.
Should a blind regmap_write() be used here instead to safely establish 3-wire mode?
Quoted 4 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +0
-0
[ ... ]
Quoted 14 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +14
-0+static int inv_icm42607_setup (struct inv_icm42607_state *st, +inv_icm42607_bus_setup bus_setup) +{ +const struct device *dev =regmap_get_device (st->map); +unsigned int val; +int ret; + +/* +* Setup the bus first in case we need to set the SPI mode or +* change the slew rate in order. +*/ + ret =bus_setup (st); +if (ret) +return ret;
[ ... ]
Quoted 16 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +13
-1+ ret =regmap_write (st->map,INV_ICM42607_REG_SIGNAL_PATH_RESET , +INV_ICM42607_SIGNAL_PATH_RESET_SOFT_RESET ); +if (ret) +return ret; -fsleep (1000 ); +/* +* In order to confirm a reset is complete, we need to read the reset +* bit, but in certain circumstances we need to set the bus up before +* we can do a read. So we should wait the required amount of time +* per the datasheet first, then set the bus up again, then read to +* ensure the reset status is done. Invalidate the regmap cache since +* we're doing a hardware reset. +*/ +regcache_mark_dirty (st->map);
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c static int inv_icm42607_setup(struct inv_icm42607_state *st, · line 174
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +1
-7- ret =regmap_read_poll_timeout (st->map,INV_ICM42607_REG_INT_STATUS , - val, val &INV_ICM42607_INT_STATUS_RESET_DONE , -INV_ICM42607_RESET_TIME_MS *100 , -INV_ICM42607_RESET_TIME_MS *1000 ); -if (ret) -return dev_err_probe (dev, ret, -"reset error, reset done bit not set\n" ); +fsleep (INV_ICM42607_RESET_TIME_MS *1000 ); ret =bus_setup (st);
Because regcache_mark_dirty() only flags the cache as needing a sync but does not clear the cached values, will regmap_update_bits() in this second bus_setup() call silently skip the hardware writes?
The cache would still show the bits as set from the first bus_setup(), leaving the hardware in its default reset state.
Would regcache_sync() or regcache_drop_region() be more appropriate here to force the actual hardware writes?
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c static int inv_icm42607_setup(struct inv_icm42607_state *st, · line 181
Quoted 7 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +4
-0if (ret)return ret; + ret =regmap_read (st->map,INV_ICM42607_REG_INT_STATUS , &val); +if (ret || (!(val &INV_ICM42607_INT_STATUS_RESET_DONE ))) +return dev_err_probe (dev, -EIO , +"reset error, reset done bit not set\n" );
If the underlying bus read fails (e.g., returning -ENXIO or -ETIMEDOUT), does it make sense to mask the actual error code with a hardcoded -EIO?
Could the original error code be propagated to help debug underlying bus subsystem issues?
[ ... ]
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c
Quoted 12 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +12
-0+int inv_icm42607_core_probe (struct regmap *regmap,const struct inv_icm42607_hw *hw, +inv_icm42607_bus_setup bus_setup) +{ +struct device *dev =regmap_get_device (regmap); +struct fwnode_handle *fwnode =dev_fwnode (dev); +struct inv_icm42607_state *st; +int irq; +int ret; + + irq =fwnode_irq_get_byname (fwnode,"INT1" ); +if (!(irq >0 )) +return dev_err_probe (dev, -EINVAL ,"Unable to get INT1 interrupt\n" );
Does this prevent probe deferral if the interrupt controller isn't ready yet?
Since fwnode_irq_get_byname() would return -EPROBE_DEFER, converting it to -EINVAL causes a permanent probe failure instead of retrying.
Additionally, if the device tree binding specifies interrupt-names as optional, will this strict name enforcement cause a hard failure for valid devicetrees that omit it?
Should the driver fall back to an index-based lookup or use the framework-provided client->irq / spi->irq if the name is missing?
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=4
Jonathan Cameron
maintainerRe: [PATCH V7 04/11] iio: imu: inv_icm42607: Add I2C and SPI For icm42607
In reply to Chris MorganQuoted 7 lines · On Fri, 15 May 2026 08:00:09 -0500 Chris Morgan <[email protected]> wrote:
From: Chris Morgan <[email protected]>
Add I2C and SPI driver support for InvenSense ICM-42607 devices. Add necessary
KconfigandMakefileto allow building of (incomplete) driver.Signed-off-by Chris Morgan <[email protected]>
I'm a little amused that sashiko seems to have halucinated part of the previous patch as part of this one as so repeated some comments. Oh well. Some of it's other comments are correct.
The only thing I added was a few formatting things.
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c
Quoted 4 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +0
-0
BOL_NS_GPL(inv_icm42607p_hw_data, "IIO_ICM42607");
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c static int inv_icm42607_setup(struct inv_icm42607_state *st, · line 143
Quoted 11 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +4
-0+static int inv_icm42607_set_conf (struct inv_icm42607_state *st,const struct inv_icm42607_conf *conf) {@@ -81,6 +138,14 @@ static int inv_icm42607_setup(struct inv_icm42607_state *st,unsigned int val;int ret; +/* +* Setup the bus first in case we need to set the SPI mode or +* change the slew rate in order.
Short wrap. change at least shold be on the line above.
Quoted 12 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +5
-0+*/ + ret =bus_setup (st); +if (ret) +return ret; + ret =regmap_read (st->map,INV_ICM42607_REG_WHOAMI , &val);if (ret)return ret;@@ -94,20 +159,27 @@ static int inv_icm42607_setup(struct inv_icm42607_state *st,if (ret)return ret;
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c static int inv_icm42607_setup(struct inv_icm42607_state *st, · line 170
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +9
-1-fsleep (1000 ); +/* +* In order to confirm a reset is complete, we need to read the reset +* bit, but in certain circumstances we need to set the bus up before +* we can do a read. So we should wait the required amount of time +* per the datasheet first, then set the bus up again, then read to +* ensure the reset status is done. Invalidate the regmap cache since +* we're doing a hardware reset. +*/ +regcache_mark_dirty (st->map);
Sashiko has some comments here as well:
"
Because regcache_mark_dirty() only flags the cache as needing a sync but does not clear the cached values, will regmap_update_bits() in this second bus_setup() call silently skip the hardware writes?
The cache would still show the bits as set from the first bus_setup(), leaving the hardware in its default reset state.
Would regcache_sync() or regcache_drop_region() be more appropriate here to force the actual hardware writes?"
Quoted 6 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +0
-5- ret =regmap_read_poll_timeout (st->map,INV_ICM42607_REG_INT_STATUS , - val, val &INV_ICM42607_INT_STATUS_RESET_DONE , -INV_ICM42607_RESET_TIME_MS *100 , -INV_ICM42607_RESET_TIME_MS *1000 ); -if (ret)
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c static int inv_icm42607_setup(struct inv_icm42607_state *st, · line 179
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +3
-2-return dev_err_probe (dev, ret, -"reset error, reset done bit not set\n" ); +fsleep (INV_ICM42607_RESET_TIME_MS *1000 ); ret =bus_setup (st);if (ret)return ret; + ret =regmap_read (st->map,INV_ICM42607_REG_INT_STATUS , &val); +if (ret || (!(val &INV_ICM42607_INT_STATUS_RESET_DONE )))
I agree with sashiko here. If you get ret you should return it.
if (ret) return dev_err_probe(dev, ret, "reset error\n"); if (!(val & INV...)) return dev_err_probe(dev, -EIO, "reset done bit not set\n");
or something like that.
Quoted 30 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +3
-0+return dev_err_probe (dev, -EIO , +"reset error, reset done bit not set\n" ); + ret =regmap_set_bits (st->map,INV_ICM42607_REG_INTF_CONFIG0 ,INV_ICM42607_INTF_CONFIG0_SENSOR_DATA_ENDIAN );if (ret)drivers/iio/imu/inv_icm42607/inv_icm42607_spi.c new file +17
-0@@ -0,0 +1,102 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* +* Copyright (C) 2026 InvenSense, Inc. +*/ + +#include <linux/device.h> +#include <linux/mod_devicetable.h> +#include <linux/module.h> +#include <linux/property.h> +#include <linux/regmap.h> +#include <linux/spi/spi.h> + +#include "inv_icm42607.h" + +static int inv_icm42607_spi_bus_setup (struct inv_icm42607_state *st) +{ +const struct device *dev =regmap_get_device (st->map);
drivers/iio/imu/inv_icm42607/inv_icm42607_spi.c line 27
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_spi.c new file +10
-0+const struct spi_device *spi =to_spi_device (dev); +unsigned int val; +int ret; + +if (spi->mode &SPI_3WIRE ) + ret =regmap_clear_bits (st->map,INV_ICM42607_REG_DEVICE_CONFIG , +INV_ICM42607_DEVICE_CONFIG_SPI_AP_4WIRE ); +else + ret =regmap_set_bits (st->map,INV_ICM42607_REG_DEVICE_CONFIG , +INV_ICM42607_DEVICE_CONFIG_SPI_AP_4WIRE );
I'm inclined to agree with sashiko on these. You need a 'write' not an update as the read in a read / modify / write cycle will fail if you are in the wrong mode.
https://sashiko.dev/#/patchset/20260515130018.237378-1-macroalpha82%40gmail.com
Given we are near merging this it can be helpful that if you disagree with sashiko's comments reply to say so and why.
Quoted 29 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_spi.c new file +29
-0+if (ret) +return ret; + + ret =regmap_clear_bits (st->map,INV_ICM42607_REG_INTF_CONFIG1 , +INV_ICM42607_INTF_CONFIG1_I3C_DDR_EN | +INV_ICM42607_INTF_CONFIG1_I3C_SDR_EN ); +if (ret) +return ret; + + val =FIELD_PREP (INV_ICM42607_DRIVE_CONFIG3_SPI_MASK , +INV_ICM42607_SLEW_RATE_INF_2NS ); + ret =regmap_update_bits (st->map,INV_ICM42607_REG_DRIVE_CONFIG3 , +INV_ICM42607_DRIVE_CONFIG3_SPI_MASK , val); +if (ret) +return ret; + +return regmap_update_bits (st->map,INV_ICM42607_REG_INTF_CONFIG0 , +INV_ICM42607_INTF_CONFIG0_UI_SIFS_CFG_MASK , +INV_ICM42607_INTF_CONFIG0_UI_SIFS_CFG_I2C_DIS ); +} + +static int inv_icm42607_probe (struct spi_device *spi) +{ +const struct inv_icm42607_hw *hw; +struct regmap *regmap; + + hw =spi_get_device_match_data (spi); +if (!hw) + return dev_err_probe(&spi->dev, -ENODEV,
drivers/iio/imu/inv_icm42607/inv_icm42607_spi.c line 66
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_spi.c new file +10
-0+ "Failed to get SPI data\n"); + + regmap =devm_regmap_init_spi (spi, &inv_icm42607_regmap_config); +if (IS_ERR (regmap)) +return dev_err_probe (&spi->dev,PTR_ERR (regmap), +"Failed to register spi regmap %ld\n" , +PTR_ERR (regmap)); + +return inv_icm42607_core_probe (regmap, hw, + inv_icm42607_spi_bus_setup);
Fits on one line under 80 chars. Have another scan through the whole series for places where edits during revisions might now allow for less wrapping.
Quoted 1 line
drivers/iio/imu/inv_icm42607/inv_icm42607_spi.c new file +1
-0+}
PATCH v7 5/11 iio: imu: inv_icm42607: Add PM support for icm42607
In reply to Chris MorganFrom: Chris Morgan <[email protected]>
Add power management support for the ICM42607 device driver.
--- drivers/iio/imu/inv_icm42607/inv_icm42607.h | 12 ++ .../iio/imu/inv_icm42607/inv_icm42607_core.c | 143 ++++++++++++++++++ .../iio/imu/inv_icm42607/inv_icm42607_i2c.c | 1 + .../iio/imu/inv_icm42607/inv_icm42607_spi.c | 1 + 4 files changed, 157 insertions(+)
drivers/iio/imu/inv_icm42607/inv_icm42607.h +12 -0
@@ -10,6 +10,7 @@#include <linux/bitops.h> #include <linux/iio/iio.h> #include <linux/mutex.h> +#include <linux/pm.h> #include <linux/regmap.h> #include <linux/regulator/consumer.h>
@@ -96,24 +97,34 @@ struct inv_icm42607_hw {const struct inv_icm42607_conf *conf; }; +struct inv_icm42607_suspended { +enum inv_icm42607_sensor_mode gyro; +enum inv_icm42607_sensor_mode accel; +bool temp; +}; +/** * struct inv_icm42607_state - driver state variables * @lock: lock for serializing multiple registers access. * @hw: Hardware specific data. * @map: regmap pointer. * @vddio_supply: I/O voltage regulator for the chip. +* @vddio_en: I/O voltage status for runtime PM. * @irq: chip irq, required to enable/disable and set wakeup * @orientation: sensor chip orientation relative to main hardware. * @conf: chip sensors configurations. +* @suspended: suspended sensors configuration. */ struct inv_icm42607_state {struct mutex lock;const struct inv_icm42607_hw *hw;struct regmap *map;struct regulator *vddio_supply; +bool vddio_en;int irq;struct iio_mount_matrix orientation;struct inv_icm42607_conf conf; +struct inv_icm42607_suspended suspended; };/* Virtual register addresses: @bank on MSB (4 upper bits), @address on LSB */
@@ -339,6 +350,7 @@ typedef int (*inv_icm42607_bus_setup)(struct inv_icm42607_state *);extern const struct regmap_config inv_icm42607_regmap_config;extern const struct inv_icm42607_hw inv_icm42607_hw_data;extern const struct inv_icm42607_hw inv_icm42607p_hw_data; +extern const struct dev_pm_ops inv_icm42607_pm_ops;int inv_icm42607_core_probe (struct regmap *regmap,const struct inv_icm42607_hw *hw,inv_icm42607_bus_setup bus_setup);
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +143 -0
183 lines not on this page · raw message
drivers/iio/imu/inv_icm42607/inv_icm42607_i2c.c +1 -0
@@ -77,6 +77,7 @@ static struct i2c_driver inv_icm42607_driver = { .driver = { .name = "inv-icm42607-i2c", .of_match_table = inv_icm42607_of_matches, + .pm = pm_ptr(&inv_icm42607_pm_ops), }, .id_table = inv_icm42607_id, .probe = inv_icm42607_probe,
drivers/iio/imu/inv_icm42607/inv_icm42607_spi.c +1 -0
@@ -90,6 +90,7 @@ static struct spi_driver inv_icm42607_driver = { .driver = { .name = "inv-icm42607-spi", .of_match_table = inv_icm42607_of_matches, + .pm = pm_ptr(&inv_icm42607_pm_ops), }, .id_table = inv_icm42607_spi_id_table, .probe = inv_icm42607_probe,
Signature · 1 line
2.43.0
[email protected]
AI reviewRe: [PATCH V7 05/11] iio: imu: inv_icm42607: Add PM support for icm42607
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Low] Unconditional assignment of runtime PM callbacks using RUNTIME_PM_OPS causes dead code when…
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Unconditional assignment of runtime PM callbacks using RUNTIME_PM_OPS causes dead code when CONFIG_PM is disabled. --
commit 2b859f6a3a3693a6dff734a7ea031d9f3a2a527f
Author: Chris Morgan <[email protected]>
iio: imu: inv_icm42607: Add PM support for icm42607
Add power management support for the ICM42607 device driver.
Quoted 4 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +0
-0
[ ... ]
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c int inv_icm42607_core_probe(struct regmap *regmap, const struct inv_icm42607_hw · line 416
Quoted 13 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +13
-0+static int inv_icm42607_runtime_resume (struct device *dev) +{ +struct inv_icm42607_state *st =dev_get_drvdata (dev); + +guard (mutex)(&st->lock); + +return inv_icm42607_enable_vddio_reg (st); +} + +EXPORT_NS_GPL_DEV_PM_OPS(inv_icm42607_pm_ops, IIO_ICM42607) = { + SYSTEM_SLEEP_PM_OPS(inv_icm42607_suspend, inv_icm42607_resume) +RUNTIME_PM_OPS (inv_icm42607_runtime_suspend, + inv_icm42607_runtime_resume,NULL )
Will this result in dead code if CONFIG_PM is disabled?
Unlike SYSTEM_SLEEP_PM_OPS which internally wraps its arguments with pm_sleep_ptr(), RUNTIME_PM_OPS does not use pm_ptr() for its callbacks. This leaves the static inv_icm42607_runtime_suspend and inv_icm42607_runtime_resume functions compiled even when PM is disabled.
Could this be updated to use pm_ptr() for the runtime PM callbacks, or alternatively use the DEFINE_RUNTIME_DEV_PM_OPS macro?
Quoted 3 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +2
-0+}; +MODULE_AUTHOR ("InvenSense, Inc." );
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=5
Jonathan Cameron
maintainerRe: [PATCH V7 05/11] iio: imu: inv_icm42607: Add PM support for icm42607
In reply to Chris MorganQuoted 5 lines · On Fri, 15 May 2026 08:00:10 -0500 Chris Morgan <[email protected]> wrote:
From: Chris Morgan <[email protected]>
Add power management support for the ICM42607 device driver.
Signed-off-by Chris Morgan <[email protected]>
Sashiko had a comment but I'd ignore it as it's about the rather complex magic that lets us do various forms of PM configs without lots of __maybe_unused etc and it works so don't touch it :) I'm too lazy to check what the dependency ordering is other than pm_ptr() is true in cases where pm_sleep_ptr() whereas the opposite is not true and that means the actual dead code removal occurs at a different point in the code those macros are producing.
Anyhow a few really minor things inline. Otherwise LGTM
Quoted 23 lines
--- drivers/iio/imu/inv_icm42607/inv_icm42607.h | 12 ++ .../iio/imu/inv_icm42607/inv_icm42607_core.c | 143 ++++++++++++++++++ .../iio/imu/inv_icm42607/inv_icm42607_i2c.c | 1 + .../iio/imu/inv_icm42607/inv_icm42607_spi.c | 1 + 4 files changed, 157 insertions(+)drivers/iio/imu/inv_icm42607/inv_icm42607.h +0
-0drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +0
-0static int inv_icm42607_set_conf (struct inv_icm42607_state *st,const struct inv_icm42607_conf *conf) {@@ -198,11 +255,15 @@ static int inv_icm42607_enable_vddio_reg(struct inv_icm42607_state *st) {int ret;
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c static int inv_icm42607_enable_vddio_reg(struct inv_icm42607_state *st) · line 266
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +4
-0+if (st->vddio_en) +return 0 ; + ret =regulator_enable (st->vddio_supply);if (ret)return ret;fsleep (INV_ICM42607_POWER_UP_TIME_US ); + st->vddio_en =1 ;
It's a bool (which is good) so = true
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c static void inv_icm42607_disable_vddio_reg(void *_data) · line 278
Quoted 11 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +3
-0return 0 ; }@@ -211,7 +272,10 @@ static void inv_icm42607_disable_vddio_reg(void *_data) {struct inv_icm42607_state *st = _data; +if (!st->vddio_en) +return ;regulator_disable (st->vddio_supply); + st->vddio_en =0 ;
= false
Quoted 8 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +5
-0} +static int inv_icm42607_suspend (struct device *dev) +{ +struct inv_icm42607_state *st =dev_get_drvdata (dev); +int ret; +
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c int inv_icm42607_core_probe(struct regmap *regmap, const struct inv_icm42607_hw · line 361
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +10
-0+guard (mutex)(&st->lock); + +if (pm_runtime_suspended (dev)) +return 0 ; + + ret =inv_icm42607_set_pwr_mgmt0 (st,INV_ICM42607_SENSOR_MODE_OFF , +INV_ICM42607_SENSOR_MODE_OFF , + false,NULL ); +if (ret) +return ret;
Trivial but blank line here
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c int inv_icm42607_core_probe(struct regmap *regmap, const struct inv_icm42607_hw · line 389
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +9
-0+inv_icm42607_disable_vddio_reg (st); + +return 0 ; +} + +static int inv_icm42607_runtime_suspend (struct device *dev) +{ +struct inv_icm42607_state *st =dev_get_drvdata (dev); +int ret =0 ;
Assigned in all paths I think? If that stops being true I'd probably still introduce the assignment when it becomes the case even though it's a little more code churn.
Quoted 13 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +13
-0+ +guard (mutex)(&st->lock); + + ret =inv_icm42607_set_pwr_mgmt0 (st,INV_ICM42607_SENSOR_MODE_OFF , +INV_ICM42607_SENSOR_MODE_OFF , false, +NULL ); +if (ret) +return ret; + +inv_icm42607_disable_vddio_reg (st); + +return 0 ; +}
PATCH v7 6/11 iio: imu: inv_icm42607: Add Buffer support for icm42607
In reply to Chris MorganFrom: Chris Morgan <[email protected]>
Add all FIFO parsing and reading functions to support inv_icm42607 hardware.
--- drivers/iio/imu/inv_icm42607/Makefile | 1 + drivers/iio/imu/inv_icm42607/inv_icm42607.h | 27 + .../imu/inv_icm42607/inv_icm42607_buffer.c | 483 ++++++++++++++++++ .../imu/inv_icm42607/inv_icm42607_buffer.h | 93 ++++ .../iio/imu/inv_icm42607/inv_icm42607_core.c | 54 +- 5 files changed, 657 insertions(+), 1 deletion(-) create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.h
drivers/iio/imu/inv_icm42607/Makefile +1 -0
@@ -2,6 +2,7 @@ obj-$(CONFIG_INV_ICM42607) += inv-icm42607.o inv-icm42607-y += inv_icm42607_core.o +inv-icm42607-y += inv_icm42607_buffer.o obj-$(CONFIG_INV_ICM42607_I2C) += inv-icm42607-i2c.o inv-icm42607-i2c-y += inv_icm42607_i2c.o
drivers/iio/imu/inv_icm42607/inv_icm42607.h +27 -0
@@ -14,6 +14,10 @@#include <linux/regmap.h> #include <linux/regulator/consumer.h> +#include <linux/iio/common/inv_sensors_timestamp.h> + +#include "inv_icm42607_buffer.h" +/* serial bus slew rates */ enum inv_icm42607_slew_rate {INV_ICM42607_SLEW_RATE_20_60NS ,
@@ -84,6 +88,7 @@ struct inv_icm42607_sensor_conf {int odr;int filter; }; +#define INV_ICM42607_SENSOR_CONF_INIT {-1, -1, -1, -1}struct inv_icm42607_conf {struct inv_icm42607_sensor_conf gyro;
@@ -114,6 +119,10 @@ struct inv_icm42607_suspended {* @orientation: sensor chip orientation relative to main hardware. * @conf: chip sensors configurations. * @suspended: suspended sensors configuration. +* @indio_gyro: gyroscope IIO device. +* @indio_accel: accelerometer IIO device. +* @fifo: FIFO management structure. +* @buffer: data transfer buffer aligned for DMA. */ struct inv_icm42607_state {struct mutex lock;
@@ -125,6 +134,22 @@ struct inv_icm42607_state {struct iio_mount_matrix orientation;struct inv_icm42607_conf conf;struct inv_icm42607_suspended suspended; +struct iio_dev *indio_gyro; +struct iio_dev *indio_accel; +struct inv_icm42607_fifo fifo; +__be16 buffer[3 ]__aligned(IIO_DMA_MINALIGN) ; +}; + +/** +* struct inv_icm42607_sensor_state - sensor state variables +* @power_mode: sensor requested power mode (for common frequencies) +* @filter: sensor filter. +* @ts: timestamp module states. +*/ +struct inv_icm42607_sensor_state { +enum inv_icm42607_sensor_mode power_mode; +int filter; +struct inv_sensors_timestamp ts; };/* Virtual register addresses: @bank on MSB (4 upper bits), @address on LSB */
@@ -352,6 +377,8 @@ extern const struct inv_icm42607_hw inv_icm42607_hw_data;extern const struct inv_icm42607_hw inv_icm42607p_hw_data;extern const struct dev_pm_ops inv_icm42607_pm_ops; +u32 inv_icm42607_odr_to_period (enum inv_icm42607_odr odr); +int inv_icm42607_core_probe (struct regmap *regmap,const struct inv_icm42607_hw *hw,inv_icm42607_bus_setup bus_setup);
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c new file +483 -0
483 lines not on this page · raw message
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.h new file +93 -0
93 lines not on this page · raw message
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +53 -1
84 lines not on this page · raw message
Signature · 1 line
2.43.0
[email protected]
AI reviewRe: [PATCH V7 06/11] iio: imu: inv_icm42607: Add Buffer support for icm42607
Thank you for your contribution! Sashiko AI review found 6 potential issue(s) to consider: - [High] Missing bounds check in `inv_icm42607_buffer_fifo_read` allows out-of-bounds slab memory read.…
Thank you for your contribution! Sashiko AI review found 6 potential issue(s) to consider:
- [High] Missing bounds check in inv_icm42607_buffer_fifo_read allows out-of-bounds slab memory read.
- [High] Unaligned memory access in inv_icm42607_fifo_is_data_valid() causes undefined behavior and alignment faults.
- [High] Software state desynchronization in inv_icm42607_buffer_predisable due to missing teardown on error paths.
- [Medium] Redundant and potentially destructive assignment logic in inv_icm42607_buffer_set_fifo_en overwrites FIFO configuration.
- [Medium] Dead code for sleep delay in inv_icm42607_buffer_postdisable bypasses required hardware power-down delays.
- [Low] The macro INV_ICM42607_SENSOR_CONF_INIT initializes more elements than the struct contains.
--
commit b372db6e3728fbbbe2a3d28ca15a025d7cf101c5
Author: Chris Morgan <[email protected]>
iio: imu: inv_icm42607: Add Buffer support for icm42607
This commit adds all FIFO parsing and reading functions to support the inv_icm42607 hardware.
Quoted 3 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h +0
-0
[ ... ]
drivers/iio/imu/inv_icm42607/inv_icm42607.h struct inv_icm42607_sensor_conf { · line 91
Quoted 5 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h +1
-0@@ -84,6 +88,7 @@ struct inv_icm42607_sensor_conf {int odr;int filter; }; +#define INV_ICM42607_SENSOR_CONF_INIT {-1, -1, -1, -1}
This isn't a bug, but struct inv_icm42607_sensor_conf is defined with exactly three fields. Will initializing it with four values cause excess elements in struct initializer compiler warnings?
Quoted 3 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c new file +0
-0
[ ... ]
Quoted 6 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c new file +6
-0+int inv_icm42607_buffer_set_fifo_en (struct inv_icm42607_state *st, +unsigned int fifo_en) +{ +unsigned int val; +int ret; +
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c line 122
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c new file +10
-0+/* update FIFO EN bits for accel and gyro */ + val =0 ; +if (fifo_en &INV_ICM42607_SENSOR_GYRO ) + val |=INV_ICM42607_FIFO_CONFIG1_MODE ; +if (fifo_en &INV_ICM42607_SENSOR_ACCEL ) + val |=INV_ICM42607_FIFO_CONFIG1_MODE ; +if (fifo_en &INV_ICM42607_SENSOR_TEMP ) + val |=INV_ICM42607_FIFO_CONFIG1_MODE ; + + ret =regmap_write (st->map,INV_ICM42607_REG_FIFO_CONFIG1 , val);
Does writing 0 to the FIFO_CONFIG1 register here when fifo_en is empty inadvertently overwrite the INV_ICM42607_FIFO_CONFIG1_BYPASS mode set previously in inv_icm42607_buffer_predisable()?
Also, does setting the exact same mask (INV_ICM42607_FIFO_CONFIG1_MODE) for all three sensors properly configure the hardware, or are distinct bits expected here?
[ ... ]
Quoted 2 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c new file +2
-0+static int inv_icm42607_buffer_predisable (struct iio_dev *indio_dev) +{
[ ... ]
Quoted 16 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c new file +16
-0+/* set FIFO in bypass mode */ + ret =regmap_write (st->map,INV_ICM42607_REG_FIFO_CONFIG1 , +INV_ICM42607_FIFO_CONFIG1_BYPASS ); +if (ret) +return ret; + +/* flush FIFO data */ + ret =regmap_write (st->map,INV_ICM42607_REG_SIGNAL_PATH_RESET , +INV_ICM42607_SIGNAL_PATH_RESET_FIFO_FLUSH ); +if (ret) +return ret; + +/* disable FIFO threshold interrupt */ + ret =regmap_update_bits (st->map,INV_ICM42607_REG_INT_SOURCE0 , +INV_ICM42607_INT_SOURCE0_FIFO_THS_INT1_EN ,0 ); +if (ret)
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c line 343
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c new file +10
-0+return ret; + +/* +* FIFO should only be 1 at this point, so explicitly set it to 0 +* instead of decrementing it. +*/ + st->fifo.on =0 ; + +return 0 ; +}
If any of these regmap operations fail and return early, st->fifo.on remains greater than 0. Since the IIO core continues the buffer teardown process even if predisable returns an error, does this leave the software state permanently desynchronized?
If so, future calls to inv_icm42607_buffer_postenable() might see st->fifo.on as non-zero and silently skip initialization, leaving the device unresponsive until the module is reloaded.
[ ... ]
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c new file +10
-0+static int inv_icm42607_buffer_postdisable (struct iio_dev *indio_dev) +{ +struct inv_icm42607_state *st =iio_device_get_drvdata (indio_dev); +struct device *dev =regmap_get_device (st->map); +unsigned int sensor; +unsigned int *watermark; +unsigned int sleep_temp =0 ; +unsigned int sleep_sensor =0 ; +unsigned int sleep; +int ret;
[ ... ]
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c line 383
Quoted 4 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c new file +4
-0+/* sleep maximum required time */ + sleep =max (sleep_sensor, sleep_temp); +if (sleep) +msleep (sleep);
Is there missing logic to update sleep_sensor and sleep_temp?
Since they are initialized to 0 and never changed, this sleep will never occur. Could bypassing this hardware-specific power-down delay lead to issues when rapidly toggling power states?
[ ... ]
Quoted 3 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c new file +3
-0+int inv_icm42607_buffer_fifo_read (struct inv_icm42607_state *st, +unsigned int max) +{
[ ... ]
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c line 452
Quoted 13 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c new file +13
-0+/* compute number of samples for each sensor */ +for (i =0 ; i < st->fifo.count; i += size) { + size =inv_icm42607_fifo_decode_packet (&st->fifo.data[i], + &accel, &gyro, &temp, ×tamp); +/* Make sure the size is at least 1 valid packet. */ +if (size <INV_ICM42607_FIFO_1SENSOR_PACKET_SIZE ) +break ; +if (gyro !=NULL &&inv_icm42607_fifo_is_data_valid (gyro)) + st->fifo.nb.gyro++; +if (accel !=NULL &&inv_icm42607_fifo_is_data_valid (accel)) + st->fifo.nb.accel++; + st->fifo.nb.total++; + }
Can an incomplete partial packet at the end of the read result in size extending past the valid populated data?
There is no validation to ensure that i + size <= st->fifo.count. If st->fifo.count is near the maximum array size, could i + size exceed the bounds of the st->fifo.data array, leading to an out-of-bounds memory read in inv_icm42607_fifo_is_data_valid()?
Quoted 3 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.h new file +0
-0
[ ... ]
Quoted 5 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.h new file +5
-0+/* FIFO data packet */ +struct inv_icm42607_fifo_sensor_data { +__be16 x; +__be16 y; +__be16 z;
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.h line 60
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.h new file +10
-0+}; + +#define INV_ICM42607_FIFO_DATA_INVALID -32768 + +static inline bool +inv_icm42607_fifo_is_data_valid (const struct inv_icm42607_fifo_sensor_data *s) +{ +s16 x, y, z; + + x =be16_to_cpu (s->x);
Because the first field of the packet layout struct (inv_icm42607_fifo_2sensors_packet) is a 1-byte header, the accel and gyro fields reside at odd byte offsets.
Since struct inv_icm42607_fifo_sensor_data is not marked as __packed, the compiler assumes 2-byte alignment for its __be16 fields. Will passing these unaligned pointers into inv_icm42607_fifo_is_data_valid() trigger undefined behavior and alignment faults on architectures that enforce strict alignment?
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=6
Jonathan Cameron
maintainerRe: [PATCH V7 06/11] iio: imu: inv_icm42607: Add Buffer support for icm42607
In reply to Chris MorganQuoted 6 lines · On Fri, 15 May 2026 08:00:11 -0500 Chris Morgan <[email protected]> wrote:
From: Chris Morgan <[email protected]>
Add all FIFO parsing and reading functions to support
inv_icm42607hardware.Signed-off-by Chris Morgan <[email protected]>
Sashiko didn't do so well on this one so some of what it raised looks wrong. E.g. the fifo stuff where you are deliberately clearing bits with the writes rather than 'accidentally' writing over them.
There is one odd misbalance in here for fifo_en() calls that I'd like a some comments on in the code.
It's not unheard of that we can't deal with the complexity of update_scan_mode() only occuring in setup path for buffers but most of the time we can by pushing stuff to posteenable() /predisable()
The model for how the buffer setup flow works vs tear down doesn't quite fit everything despite there being a lot of possible callbacks so what you have may well be the best that we can do. However it isn't obviously correct so a few comments please!
Quoted 38 lines
--- drivers/iio/imu/inv_icm42607/Makefile | 1 + drivers/iio/imu/inv_icm42607/inv_icm42607.h | 27 + .../imu/inv_icm42607/inv_icm42607_buffer.c | 483 ++++++++++++++++++ .../imu/inv_icm42607/inv_icm42607_buffer.h | 93 ++++ .../iio/imu/inv_icm42607/inv_icm42607_core.c | 54 +- 5 files changed, 657 insertions(+), 1 deletion(-) create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.hdrivers/iio/imu/inv_icm42607/Makefile +1
-0@@ -2,6 +2,7 @@ obj-$(CONFIG_INV_ICM42607) += inv-icm42607.o inv-icm42607-y += inv_icm42607_core.o +inv-icm42607-y += inv_icm42607_buffer.o obj-$(CONFIG_INV_ICM42607_I2C) += inv-icm42607-i2c.o inv-icm42607-i2c-y += inv_icm42607_i2c.odrivers/iio/imu/inv_icm42607/inv_icm42607.h +4
-0@@ -14,6 +14,10 @@#include <linux/regmap.h> #include <linux/regulator/consumer.h> +#include <linux/iio/common/inv_sensors_timestamp.h> + +#include "inv_icm42607_buffer.h" +/* serial bus slew rates */ enum inv_icm42607_slew_rate {INV_ICM42607_SLEW_RATE_20_60NS ,
drivers/iio/imu/inv_icm42607/inv_icm42607.h struct inv_icm42607_sensor_conf { · line 91
Quoted 4 lines
drivers/iio/imu/inv_icm42607/inv_icm42607.h +1
-0@@ -84,6 +88,7 @@ struct inv_icm42607_sensor_conf {int odr;int filter; }; +#define INV_ICM42607_SENSOR_CONF_INIT {-1, -1, -1, -1}
Spaces after { and before } but perhaps more interestingly - why is this here given I don't see it used in this patch?
Quoted 22 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c new file +15
-0+ +static int inv_icm42607_buffer_postdisable (struct iio_dev *indio_dev) +{ +struct inv_icm42607_state *st =iio_device_get_drvdata (indio_dev); +struct device *dev =regmap_get_device (st->map); +unsigned int sensor; +unsigned int *watermark; +unsigned int sleep_temp =0 ; +unsigned int sleep_sensor =0 ; +unsigned int sleep; +int ret; + +if (indio_dev == st->indio_gyro) { + sensor =INV_ICM42607_SENSOR_GYRO ; + watermark = &st->fifo.watermark.gyro;
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c line 368
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c new file +10
-0+ }else if (indio_dev == st->indio_accel) { + sensor =INV_ICM42607_SENSOR_ACCEL ; + watermark = &st->fifo.watermark.accel; + }else { +return -EINVAL ; + } + +mutex_lock (&st->lock); + + ret =inv_icm42607_buffer_set_fifo_en (st, st->fifo.en & ~sensor);
This is a little odd as normally I'd expect to see balance between preenable and postdisable.
Seems you are unwinding stuff that ends up ultimately in update_scan_mode If that's absolutely necessary (and you can't shift to the balanced calls
- given it's late in sequence postenable / predisable probably..) then add a comment here.
Quoted 5 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c new file +5
-0+if (ret) + goto out_unlock; + + *watermark =0 ; + ret =inv_icm42607_buffer_update_watermark (st);
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c line 383
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c new file +10
-0+if (ret) + goto out_unlock; + +out_unlock: +mutex_unlock (&st->lock); + +/* sleep maximum required time */ + sleep =max (sleep_sensor, sleep_temp); +if (sleep) +msleep (sleep);
Maybe introduce this stuff only when the values are not 0.
Quoted 29 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c new file +13
-0+ +pm_runtime_put_autosuspend (dev); + +return ret; +} + +const struct iio_buffer_setup_ops inv_icm42607_buffer_ops = { + .preenable = inv_icm42607_buffer_preenable, + .postenable = inv_icm42607_buffer_postenable, + .predisable = inv_icm42607_buffer_predisable, + .postdisable = inv_icm42607_buffer_postdisable, +}; +drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +1
-0@@ -15,6 +15,7 @@#include <linux/regulator/consumer.h> #include "inv_icm42607.h" +#include "inv_icm42607_buffer.h" static bool inv_icm42607_is_volatile_reg (struct device *dev,unsigned int reg) {
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c const struct inv_icm42607_hw inv_icm42607p_hw_data = { · line 82
Quoted 9 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +6
-0@@ -73,6 +74,40 @@ const struct inv_icm42607_hw inv_icm42607p_hw_data = { };EXPORT_SYMBOL_NS_GPL (inv_icm42607p_hw_data,"IIO_ICM42607" ); +u32 inv_icm42607_odr_to_period (enum inv_icm42607_odr odr) +{ +static const u32 odr_periods[INV_ICM42607_ODR_NB ] = { +/* Reserved values */ +0 ,0 ,0 ,0 ,0 , +/* 1600Hz */
[INV_ICM42607_ODR_1600HZ] = 625000,
etc and drop the comments.
Quoted 14 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +14
-0+625000 , +/* 800Hz */ +1250000 , +/* 400Hz */ +2500000 , +/* 200Hz */ +5000000 , +/* 100 Hz */ +10000000 , +/* 50Hz */ +20000000 , +/* 25Hz */ + 40000000, +/* 12.5Hz */
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c const struct inv_icm42607_hw inv_icm42607p_hw_data = { · line 106
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +10
-0+80000000 , +/* 6.25Hz */ +160000000 , +/* 3.125Hz */ +320000000 , +/* 1.5625Hz */ +640000000 , + }; + + odr =clamp (odr,INV_ICM42607_ODR_1600HZ ,INV_ICM42607_ODR_1_5625HZ_LP );
Then this clamp will be more obviously correct.
Quoted 3 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +3
-0+ +return odr_periods[odr]; +}
PATCH v7 7/11 iio: imu: inv_icm42607: Add Temp Support in icm42607
In reply to Chris MorganFrom: Chris Morgan <[email protected]>
Add functions for reading temperature sensor data.
--- drivers/iio/imu/inv_icm42607/Makefile | 1 + drivers/iio/imu/inv_icm42607/inv_icm42607.h | 3 + .../iio/imu/inv_icm42607/inv_icm42607_core.c | 18 +++++ .../iio/imu/inv_icm42607/inv_icm42607_temp.c | 80 +++++++++++++++++++ .../iio/imu/inv_icm42607/inv_icm42607_temp.h | 33 ++++++++ 5 files changed, 135 insertions(+) create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_temp.c create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_temp.h
drivers/iio/imu/inv_icm42607/Makefile +1 -0
@@ -3,6 +3,7 @@ obj-$(CONFIG_INV_ICM42607) += inv-icm42607.o inv-icm42607-y += inv_icm42607_core.o inv-icm42607-y += inv_icm42607_buffer.o +inv-icm42607-y += inv_icm42607_temp.o obj-$(CONFIG_INV_ICM42607_I2C) += inv-icm42607-i2c.o inv-icm42607-i2c-y += inv_icm42607_i2c.o
drivers/iio/imu/inv_icm42607/inv_icm42607.h +3 -0
@@ -379,6 +379,9 @@ extern const struct dev_pm_ops inv_icm42607_pm_ops;u32 inv_icm42607_odr_to_period (enum inv_icm42607_odr odr); +int inv_icm42607_set_temp_conf (struct inv_icm42607_state *st,bool enable, +unsigned int *sleep_ms); +int inv_icm42607_core_probe (struct regmap *regmap,const struct inv_icm42607_hw *hw,inv_icm42607_bus_setup bus_setup);
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +18 -0
@@ -164,6 +164,24 @@ static int inv_icm42607_set_pwr_mgmt0(struct inv_icm42607_state *st,return 0 ; } +int inv_icm42607_set_temp_conf (struct inv_icm42607_state *st,bool enable, +unsigned int *sleep_ms) +{ +unsigned int val; +int ret; + + val =FIELD_PREP (INV_ICM42607_TEMP_CONFIG0_FILTER_MASK , +INV_ICM42607_FILTER_BW_34HZ ); + ret =regmap_update_bits (st->map,INV_ICM42607_REG_TEMP_CONFIG0 , +INV_ICM42607_TEMP_CONFIG0_FILTER_MASK , val); +if (ret) +return ret; + +return inv_icm42607_set_pwr_mgmt0 (st, st->conf.gyro.mode, + st->conf.accel.mode, enable, + sleep_ms); +} +static int inv_icm42607_set_conf (struct inv_icm42607_state *st,const struct inv_icm42607_conf *conf) {
drivers/iio/imu/inv_icm42607/inv_icm42607_temp.c new file +80 -0
80 lines not on this page · raw message
drivers/iio/imu/inv_icm42607/inv_icm42607_temp.h new file +33 -0
@@ -0,0 +1,33 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* +* Copyright (C) 2026 InvenSense, Inc. +*/ + +#ifndef INV_ICM42607_TEMP_H_ +#define INV_ICM42607_TEMP_H_ + +#include <linux/bitops.h> + +struct iio_dev ; +struct iio_chan_spec ; + +#define INV_ICM42607_TEMP_CHAN (_index) \ +{ \ + .type = IIO_TEMP, \ + .info_mask_separate = \ + BIT(IIO_CHAN_INFO_RAW) | \ + BIT(IIO_CHAN_INFO_OFFSET) | \ + BIT(IIO_CHAN_INFO_SCALE), \ + .scan_index = _index, \ + .scan_type = { \ + .sign = 's', \ + .realbits = 16, \ + .storagebits = 16, \ + }, \ +} + +int inv_icm42607_temp_read_raw (struct iio_dev *indio_dev, +struct iio_chan_spec const *chan, +int *val,int *val2,long mask); + +#endif
Signature · 1 line
2.43.0
PATCH v7 8/11 iio: imu: inv_icm42607: Add Accelerometer for icm42607
In reply to Chris MorganFrom: Chris Morgan <[email protected]>
Add icm42607 accelerometer sensor for icm42607.
--- drivers/iio/imu/inv_icm42607/Makefile | 1 + drivers/iio/imu/inv_icm42607/inv_icm42607.h | 27 + .../iio/imu/inv_icm42607/inv_icm42607_accel.c | 586 ++++++++++++++++++ .../imu/inv_icm42607/inv_icm42607_buffer.c | 66 +- .../imu/inv_icm42607/inv_icm42607_buffer.h | 4 +- .../iio/imu/inv_icm42607/inv_icm42607_core.c | 72 +++ 6 files changed, 752 insertions(+), 4 deletions(-) create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c
drivers/iio/imu/inv_icm42607/Makefile +1 -0
@@ -2,6 +2,7 @@ obj-$(CONFIG_INV_ICM42607) += inv-icm42607.o inv-icm42607-y += inv_icm42607_core.o +inv-icm42607-y += inv_icm42607_accel.o inv-icm42607-y += inv_icm42607_buffer.o inv-icm42607-y += inv_icm42607_temp.o
drivers/iio/imu/inv_icm42607/inv_icm42607.h +27 -0
@@ -82,6 +82,17 @@ enum inv_icm42607_filter_bw {INV_ICM42607_FILTER_BW_16HZ }; +enum inv_icm42607_filter_avg { +/* Low-Power mode sensor data filter (averaging) */ +INV_ICM42607_FILTER_AVG_2X =0 , +INV_ICM42607_FILTER_AVG_4X , +INV_ICM42607_FILTER_AVG_8X , +INV_ICM42607_FILTER_AVG_16X , +INV_ICM42607_FILTER_AVG_32X , +INV_ICM42607_FILTER_AVG_64X +/* values 7 and 8 also correspond to 64x. */ +}; +struct inv_icm42607_sensor_conf {int mode;int fs;
@@ -121,6 +132,7 @@ struct inv_icm42607_suspended {* @suspended: suspended sensors configuration. * @indio_gyro: gyroscope IIO device. * @indio_accel: accelerometer IIO device. +* @timestamp: interrupt timestamps. * @fifo: FIFO management structure. * @buffer: data transfer buffer aligned for DMA. */
@@ -136,6 +148,9 @@ struct inv_icm42607_state {struct inv_icm42607_suspended suspended;struct iio_dev *indio_gyro;struct iio_dev *indio_accel; +struct { +s64 accel; + } timestamp;struct inv_icm42607_fifo fifo;__be16 buffer[3 ]__aligned(IIO_DMA_MINALIGN) ; };
@@ -377,12 +392,24 @@ extern const struct inv_icm42607_hw inv_icm42607_hw_data;extern const struct inv_icm42607_hw inv_icm42607p_hw_data;extern const struct dev_pm_ops inv_icm42607_pm_ops; +const struct iio_mount_matrix * +inv_icm42607_get_mount_matrix (struct iio_dev *indio_dev, +const struct iio_chan_spec *chan); +u32 inv_icm42607_odr_to_period (enum inv_icm42607_odr odr); +int inv_icm42607_set_accel_conf (struct inv_icm42607_state *st, +struct inv_icm42607_sensor_conf *conf, +unsigned int *sleep_ms); +int inv_icm42607_set_temp_conf (struct inv_icm42607_state *st,bool enable,unsigned int *sleep_ms);int inv_icm42607_core_probe (struct regmap *regmap,const struct inv_icm42607_hw *hw,inv_icm42607_bus_setup bus_setup); +struct iio_dev *inv_icm42607_accel_init (struct inv_icm42607_state *st); + +int inv_icm42607_accel_parse_fifo (struct iio_dev *indio_dev); +#endif
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c new file +586 -0
586 lines not on this page · raw message
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c +63 -3
118 lines not on this page · raw message
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.h +3 -1
@@ -71,7 +71,7 @@ inv_icm42607_fifo_is_data_valid(const struct inv_icm42607_fifo_sensor_data *s)ssize_t inv_icm42607_fifo_decode_packet (const void *packet,const void **accel,const void **gyro,const s8 **temp, -const void **timestamp); +const void **timestamp,unsigned int *odr);extern const struct iio_buffer_setup_ops inv_icm42607_buffer_ops;
@@ -87,6 +87,8 @@ int inv_icm42607_buffer_update_watermark(struct inv_icm42607_state *st);int inv_icm42607_buffer_fifo_read (struct inv_icm42607_state *st,unsigned int max); +int inv_icm42607_buffer_fifo_parse (struct inv_icm42607_state *st); +int inv_icm42607_buffer_hwfifo_flush (struct inv_icm42607_state *st,unsigned int count);
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +72 -0
109 lines not on this page · raw message
Signature · 1 line
2.43.0
[email protected]
AI reviewRe: [PATCH V7 08/11] iio: imu: inv_icm42607: Add Accelerometer for icm42607
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider: - [High] Reversed bounds check in FIFO parser causes valid packets to be dropped and out-of-bounds reads…
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:
- [High] Reversed bounds check in FIFO parser causes valid packets to be dropped and out-of-bounds reads
- [High] Unprotected lockless access to shared FIFO state leads to data races and corruption
- [High] Missing packet bounds check in inv_icm42607_buffer_fifo_read allows out-of-bounds memory access
- [High] Unsupported TEMP-only scan mask causes silent data drops and userspace deadlock
- [Medium] Reserved array elements exposed as zeroed sampling frequencies in userspace
--
commit 7b72703c452d419fa91a97227176f51c49a6b7cb
Author: Chris Morgan <[email protected]>
iio: imu: inv_icm42607: Add Accelerometer for icm42607
This commit adds accelerometer sensor support to the icm42607 driver. It introduces device configuration, power management, timestamp handling, and data parsing from the hardware FIFO. It also exposes available sampling frequencies and scales to userspace.
Quoted 5 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c new file +0
-0
[ ... ]
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c line 109
Quoted 6 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c new file +6
-0+static const unsigned long inv_icm42607_accel_scan_masks[] = { +INV_ICM42607_SCAN_MASK_ACCEL_3AXIS , +INV_ICM42607_SCAN_MASK_TEMP , +INV_ICM42607_SCAN_MASK_ACCEL_3AXIS |INV_ICM42607_SCAN_MASK_TEMP , +0 +};
Does offering INV_ICM42607_SCAN_MASK_TEMP by itself cause issues? If userspace requests only the temperature channel, inv_icm42607_accel_update_scan_mode() enables only the TEMP sensor. If the hardware generates packets without ACCEL or GYRO headers, inv_icm42607_fifo_decode_packet() returns -EINVAL.
Even if it generates an ACCEL packet, inv_icm42607_accel_parse_fifo() explicitly discards packets lacking accelerometer data. Would this cause the TEMP data to be silently dropped, potentially leaving userspace applications deadlocked waiting for data?
[ ... ]
Quoted 9 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c new file +9
-0+static int inv_icm42607_accel_read_avail (struct iio_dev *indio_dev, +struct iio_chan_spec const *chan, +const int **vals, +int *type,int *length,long mask) +{ +if (chan->type !=IIO_ACCEL ) +return -EINVAL ; + +switch (mask) {
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c line 392
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c new file +10
-0+case IIO_CHAN_INFO_SCALE : + *vals = (const int *)inv_icm42607_accel_scale_nano; + *type =IIO_VAL_INT_PLUS_NANO ; + *length =ARRAY_SIZE (inv_icm42607_accel_scale_nano) *2 ; +return IIO_AVAIL_LIST ; +case IIO_CHAN_INFO_SAMP_FREQ : + *vals = (const int *)inv_icm42607_accel_odr; + *type =IIO_VAL_INT_PLUS_MICRO ; + *length =ARRAY_SIZE (inv_icm42607_accel_odr) *2 ; +return IIO_AVAIL_LIST ;
Can this expose uninitialized array elements to userspace? Because inv_icm42607_accel_odr has indices 0-5 reserved and implicitly initialized to zero, passing the full ARRAY_SIZE() could expose those 0.000000 sampling frequencies as available to userspace.
[ ... ]
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c line 566
Quoted 11 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c new file +11
-0+/* parse all fifo packets */ +for (i =0 , no =0 ; i < st->fifo.count; i += size, ++no) { + size =inv_icm42607_fifo_decode_packet (&st->fifo.data[i], + &accel, &gyro, &temp, ×tamp, &odr); +/* quit if error or FIFO is empty */ +if (size <=0 ) +return size; + +/* If the packet size could cause us to overflow, return. */ +if (i + size <= st->fifo.count) +return -EIO ;
Is this condition reversed? If i + size <= st->fifo.count, the packet fits within the valid buffer limit, but the parser returns -EIO and valid packets are dropped. Conversely, if the packet exceeds the buffer boundaries (i + size > st->fifo.count), it evaluates to false, allowing the parser to read out-of-bounds kernel memory.
Quoted 4 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c new file +4
-0+ +/* skip packet if no accel data or data is invalid */ +if (accel ==NULL || !inv_icm42607_fifo_is_data_valid (accel)) +continue ;
[ ... ]
Quoted 4 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c +0
-0
[ ... ]
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c int inv_icm42607_buffer_fifo_read(struct inv_icm42607_state *st, · line 466
Quoted 9 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c +1
-1@@ -440,7 +460,7 @@ int inv_icm42607_buffer_fifo_read(struct inv_icm42607_state *st,/* compute number of samples for each sensor */ for (i =0 ; i < st->fifo.count; i += size) { size =inv_icm42607_fifo_decode_packet (&st->fifo.data[i], - &accel, &gyro, &temp, ×tamp); + &accel, &gyro, &temp, ×tamp, &odr);/* Make sure the size is at least 1 valid packet. */ if (size <INV_ICM42607_FIFO_1SENSOR_PACKET_SIZE )break ;
Could this code access memory out-of-bounds? If the hardware returns a partial packet at the very end of the st->fifo.data array, the loop does not verify that i + size <= st->fifo.count before passing the decoded pointers. inv_icm42607_fifo_decode_packet() could then yield pointers that point outside the populated bounds, which inv_icm42607_fifo_is_data_valid() would subsequently dereference.
[ ... ]
Quoted 12 lines
int inv_icm42607_buffer_hwfifo_flush(struct
inv_icm42607_state*st,drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c +6
-0unsigned int count) { +struct inv_icm42607_sensor_state *accel_st =iio_priv (st->indio_accel); +struct inv_sensors_timestamp *ts; +s64 accel_ts;int ret; + accel_ts =iio_get_time_ns (st->indio_accel); + ret =inv_icm42607_buffer_fifo_read (st, count); +if (ret)
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c int inv_icm42607_buffer_fifo_read(struct inv_icm42607_state *st, · line 519
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c +8
-1+return ret; -return ret; +if (st->fifo.nb.total ==0 ) +return 0 ; + +if (st->fifo.nb.accel >0 ) { + ts = &accel_st->ts; +inv_sensors_timestamp_interrupt (ts, st->fifo.nb.accel, accel_ts); + ret =inv_icm42607_accel_parse_fifo (st->indio_accel);
Can a data race happen here? inv_icm42607_buffer_fifo_read() properly acquires and releases st->lock, but then inv_icm42607_accel_parse_fifo() is called without holding the lock. A concurrent flush operation could acquire the lock, overwrite st->fifo.data, and reset st->fifo.count while the original thread is mid-parse, leading to memory corruption and out-of-bounds reads.
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=8
Jonathan Cameron
maintainerRe: [PATCH V7 08/11] iio: imu: inv_icm42607: Add Accelerometer for icm42607
In reply to Chris MorganQuoted 5 lines · On Fri, 15 May 2026 08:00:13 -0500 Chris Morgan <[email protected]> wrote:
From: Chris Morgan <[email protected]>
Add icm42607 accelerometer sensor for icm42607.
Signed-off-by Chris Morgan <[email protected]>
Sashiko raised a few things. Otherwise I don't have any comments.
https://sashiko.dev/#/patchset/20260515130018.237378-1-macroalpha82%40gmail.com
PATCH v7 9/11 iio: imu: inv_icm42607: Add Wake on Movement to icm42607
In reply to Chris MorganFrom: Chris Morgan <[email protected]>
Add support for wake on movement for the icm42607 driver.
--- drivers/iio/imu/inv_icm42607/inv_icm42607.h | 33 ++ .../iio/imu/inv_icm42607/inv_icm42607_accel.c | 304 ++++++++++++++++++ .../iio/imu/inv_icm42607/inv_icm42607_core.c | 267 ++++++++++++++- 3 files changed, 594 insertions(+), 10 deletions(-)
drivers/iio/imu/inv_icm42607/inv_icm42607.h +33 -0
@@ -119,6 +119,14 @@ struct inv_icm42607_suspended {bool temp; }; +struct inv_icm42607_apex { +unsigned int on; +struct { +u64 value; +bool enable; + } wom; +}; +/** * struct inv_icm42607_state - driver state variables * @lock: lock for serializing multiple registers access.
@@ -133,6 +141,7 @@ struct inv_icm42607_suspended {* @indio_gyro: gyroscope IIO device. * @indio_accel: accelerometer IIO device. * @timestamp: interrupt timestamps. +* @apex: APEX (Advanced Pedometer and Event detection) management * @fifo: FIFO management structure. * @buffer: data transfer buffer aligned for DMA. */
@@ -151,6 +160,7 @@ struct inv_icm42607_state {struct {s64 accel; } timestamp; +struct inv_icm42607_apex apex;struct inv_icm42607_fifo fifo;__be16 buffer[3 ]__aligned(IIO_DMA_MINALIGN) ; };
@@ -376,6 +386,18 @@ struct inv_icm42607_sensor_state {#define INV_ICM42607P_WHOAMI 0x60#define INV_ICM42607_WHOAMI 0x67 +/* Bank 2/3 register access */ +#define INV_ICM42607_BLK_SEL_W 0x79 +#define INV_ICM42607_MADDR_W 0x7A +#define INV_ICM42607_M_W 0x7B +#define INV_ICM42607_BLK_SEL_R 0x7C +#define INV_ICM42607_MADDR_R 0x7D +#define INV_ICM42607_M_R 0x7E + +#define INV_ICM42607_MREG_1 0x00 +#define INV_ICM42607_MREG_2 0x28 +#define INV_ICM42607_MREG_3 0x50 +/* Sleep times required by the driver */ #define INV_ICM42607_POWER_UP_TIME_US 100000#define INV_ICM42607_RESET_TIME_MS 1
@@ -384,6 +406,7 @@ struct inv_icm42607_sensor_state {#define INV_ICM42607_GYRO_STOP_TIME_MS 150#define INV_ICM42607_TEMP_STARTUP_TIME_MS 14#define INV_ICM42607_SUSPEND_DELAY_MS 2000 +#define INV_ICM42607_MREG_DELAY_US 10typedef int (*inv_icm42607_bus_setup )(struct inv_icm42607_state *);
@@ -392,6 +415,9 @@ extern const struct inv_icm42607_hw inv_icm42607_hw_data;extern const struct inv_icm42607_hw inv_icm42607p_hw_data;extern const struct dev_pm_ops inv_icm42607_pm_ops; +int inv_icm42607_mreg_write (struct regmap *map,unsigned int bank, +u8 reg,u8 data); +const struct iio_mount_matrix *inv_icm42607_get_mount_matrix (struct iio_dev *indio_dev,const struct iio_chan_spec *chan);
@@ -405,6 +431,9 @@ int inv_icm42607_set_accel_conf(struct inv_icm42607_state *st,int inv_icm42607_set_temp_conf (struct inv_icm42607_state *st,bool enable,unsigned int *sleep_ms); +int inv_icm42607_enable_wom (struct inv_icm42607_state *st); +int inv_icm42607_disable_wom (struct inv_icm42607_state *st); +int inv_icm42607_core_probe (struct regmap *regmap,const struct inv_icm42607_hw *hw,inv_icm42607_bus_setup bus_setup);
@@ -412,4 +441,8 @@ struct iio_dev *inv_icm42607_accel_init(struct inv_icm42607_state *st);int inv_icm42607_accel_parse_fifo (struct iio_dev *indio_dev); +void inv_icm42607_accel_handle_events (struct iio_dev *indio_dev, +unsigned int status2,unsigned int status3, +s64 timestamp); +#endif
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c +304 -0
340 lines not on this page · raw message
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +257 -10
339 lines not on this page · raw message
Signature · 1 line
2.43.0
[email protected]
AI reviewRe: [PATCH V7 09/11] iio: imu: inv_icm42607: Add Wake on Movement to icm42607
Thank you for your contribution! Sashiko AI review found 8 potential issue(s) to consider: - [High] TOCTOU race in event configuration leaks PM references and leaves sensor permanently powered on.…
Thank you for your contribution! Sashiko AI review found 8 potential issue(s) to consider:
- [High] TOCTOU race in event configuration leaks PM references and leaves sensor permanently powered on.
- [High] Disabling the IIO buffer unconditionally powers off the accelerometer, breaking Wake-on-Motion.
- [High] Deadlock avoidance in inv_icm42607_suspend() allows the threaded IRQ handler to access a suspended bus.
- [High] I2C failure in inv_icm42607_mreg_write() leaves the device trapped in the wrong register bank.
- [Medium] Error path in WoM enablement leaves the accelerometer's software state cached as ON, causing a permanent power leak.
- [Medium] Error path in ODR write desynchronizes the FIFO watermark and timing state from the hardware.
- [Medium] The driver leaks a runtime PM usage count if unbound while the Wake-on-Motion event is active.
- [Low] The driver silently ignores WoM threshold configurations for the ICM42607P variant while returning success to userspace. --
commit 38592461f791657cf708b555278a27f572c997e7
Author: Chris Morgan <[email protected]>
Subject: iio: imu: inv_icm42607: Add Wake on Movement to icm42607
Add support for wake on movement for the icm42607 driver.
Quoted 4 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c +0
-0
[ ... ]
Quoted 6 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c +2
-0@@ -209,6 +221,181 @@ static int inv_icm42607_accel_read_sensor(struct iio_dev *indio_dev,return 0 ; } +static unsigned int inv_icm42607_accel_convert_roc_to_wom (u64 roc, +int accel_hz,int accel_uhz)
[ ... ]
Quoted 8 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c +8
-0+static int inv_icm42607_accel_set_wom_threshold (struct inv_icm42607_state *st, +u64 value, +int accel_hz,int accel_uhz) +{ +unsigned int threshold; +int i, ret; + +/* convert roc to wom threshold and convert back to handle clipping */
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c static int inv_icm42607_accel_read_sensor(struct iio_dev *indio_dev, · line 275
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c +10
-0+ threshold =inv_icm42607_accel_convert_roc_to_wom (value, accel_hz, accel_uhz); + value =inv_icm42607_accel_convert_wom_to_roc (threshold, accel_hz, accel_uhz); + +dev_dbg (regmap_get_device (st->map),"wom_threshold: 0x%x\n" , threshold); + + st->apex.wom.value = value; + +/* 42607P cannot set WoM threshold. */ +if (st->hw->whoami ==INV_ICM42607P_WHOAMI ) +return 0 ;
Should this return -EOPNOTSUPP instead of 0? Returning 0 updates the cached value in st->apex.wom.value and signals success to userspace, even though the hardware configuration isn't changed for the 42607P variant.
Quoted 27 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c +27
-0+ +/* set accel WoM threshold for the 3 axes */ +for (i =0 ; i <3 ; i++) { + ret =inv_icm42607_mreg_write (st->map,INV_ICM42607_MREG_2 , +INV_ICM42607_REG_ACCEL_WOM_X_THR + i, + threshold); +if (ret) +return ret; + } + +return 0 ; +} + +static int _inv_icm42607_accel_enable_wom (struct iio_dev *indio_dev) +{ +struct inv_icm42607_state *st =iio_device_get_drvdata (indio_dev); +struct inv_icm42607_sensor_state *accel_st =iio_priv (indio_dev); +struct inv_icm42607_sensor_conf conf =INV_ICM42607_SENSOR_CONF_INIT ; +unsigned int sleep_ms =0 ; +int ret; + + scoped_guard(mutex, &st->lock) { +/* turn on accel sensor */ + conf.mode = accel_st->power_mode; + conf.filter = accel_st->filter; + ret =inv_icm42607_set_accel_conf (st, &conf, &sleep_ms); +if (ret)
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c static int inv_icm42607_accel_read_sensor(struct iio_dev *indio_dev, · line 312
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c +10
-0+return ret; + } + +if (sleep_ms) +msleep (sleep_ms); + + scoped_guard(mutex, &st->lock) { + ret =inv_icm42607_enable_wom (st); +if (ret) +return ret;
If inv_icm42607_enable_wom() fails here, does the accelerometer remain powered on? The earlier call to inv_icm42607_set_accel_conf() enabled it, but an early return leaves the hardware in the ON state without reverting st->conf.accel.mode to OFF.
During system or runtime suspend, this ON state would be cached in st->suspended.accel, and on all future resumes, the accelerometer might be redundantly powered on.
Quoted 4 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c +4
-0+ st->apex.on++; + st->apex.wom.enable = true; + } +
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c static int inv_icm42607_accel_read_sensor(struct iio_dev *indio_dev, · line 326
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c +10
-0+return 0 ; +} + +static int inv_icm42607_accel_enable_wom (struct iio_dev *indio_dev) +{ +struct inv_icm42607_state *st =iio_device_get_drvdata (indio_dev); +struct device *pdev =regmap_get_device (st->map); +int ret; + + ret =pm_runtime_resume_and_get (pdev);
Is a devres action or remove callback needed to disable the event and drop the PM runtime usage count? If the device is unbound via sysfs or the module is unloaded while the Wake-on-Motion event is active, the PM usage count might be leaked, keeping the hardware powered on.
Quoted 27 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c +27
-0+if (ret) +return ret; + + ret =_inv_icm42607_accel_enable_wom (indio_dev); +if (ret) { +pm_runtime_put_autosuspend (pdev); +return ret; + } + +return 0 ; +} + +static int _inv_icm42607_accel_disable_wom (struct iio_dev *indio_dev) +{ +struct inv_icm42607_state *st =iio_device_get_drvdata (indio_dev); +struct inv_icm42607_sensor_conf conf =INV_ICM42607_SENSOR_CONF_INIT ; +unsigned int sleep_ms =0 ; +int ret; + + scoped_guard(mutex, &st->lock) { +/* +* Consider that turning off WoM is always working to avoid +* blocking the chip in on mode and prevent going back to sleep. +* If there is an error, the chip will anyway go back to sleep +* and the feature will not work anymore. +*/ + st->apex.wom.enable = false;
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c static int inv_icm42607_accel_read_sensor(struct iio_dev *indio_dev, · line 363
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c +10
-0+ st->apex.on--; +inv_icm42607_disable_wom (st); +/* turn off accel sensor if not used */ +if (!st->apex.on && !iio_buffer_enabled (indio_dev)) { + conf.mode =INV_ICM42607_SENSOR_MODE_OFF ; + ret =inv_icm42607_set_accel_conf (st, &conf, &sleep_ms); +if (ret) +return ret; + } + }
Does disabling the IIO buffer unconditionally power off the accelerometer in inv_icm42607_buffer_postdisable()? If a user enables the Wake-on-Motion feature (which requires the accelerometer to remain in LOW_NOISE mode) and subsequently starts then stops the IIO buffer, it appears the sensor could be physically powered down, preventing the Wake-on-Motion detection from functioning.
[ ... ]
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c static int inv_icm42607_accel_write_odr(struct iio_dev *indio_dev, · line 522
Quoted 8 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c +4
-0@@ -329,6 +516,10 @@ static int inv_icm42607_accel_write_odr(struct iio_dev *indio_dev,if (ret)return ret; + ret =inv_icm42607_accel_set_wom_threshold (st, st->apex.wom.value, val, val2); +if (ret) +return ret; +
If this fails, does it leave the hardware ODR out of sync with the driver's FIFO timing state? The earlier code updated the hardware ODR, but returning early here skips inv_icm42607_buffer_update_fifo_period() and inv_icm42607_buffer_update_watermark().
Quoted 3 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c +0
-0inv_icm42607_buffer_update_fifo_period (st);inv_icm42607_buffer_update_watermark (st);
[ ... ]
Quoted 12 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c +12
-0+static int inv_icm42607_accel_write_event_config (struct iio_dev *indio_dev, +const struct iio_chan_spec *chan, +enum iio_event_type type, +enum iio_event_direction dir, +bool state) +{ +struct inv_icm42607_state *st =iio_device_get_drvdata (indio_dev); + +/* handle only WoM (roc rising) event */ +if (type !=IIO_EV_TYPE_ROC || dir !=IIO_EV_DIR_RISING ) +return -EINVAL ; +
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c static int inv_icm42607_accel_hwfifo_flush(struct iio_dev *indio_dev, · line 706
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_accel.c +10
-0+ scoped_guard(mutex, &st->lock) { +if (st->apex.wom.enable == state) +return 0 ; + } + +if (state) +return inv_icm42607_accel_enable_wom (indio_dev); + +return inv_icm42607_accel_disable_wom (indio_dev); +}
Does this introduce a race condition? Since the lock is dropped before calling inv_icm42607_accel_enable_wom(), if two threads concurrently enable the event, both could pass the check and execute the enable function.
This would call pm_runtime_resume_and_get() twice and increment st->apex.on twice. A subsequent disable operation will only execute once due to the same check, leaking a runtime PM reference and keeping the device powered on.
[ ... ]
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +2
-0@@ -17,6 +17,57 @@#include "inv_icm42607.h" #include "inv_icm42607_buffer.h" +/** +* inv_icm42607_mreg_write() - Write value to user bank
[ ... ]
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c line 63
Quoted 11 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +11
-0+/* +* Write bank, register, and value in one bulk write. Then pause +* the required time according to datasheet. +*/ + ret =regmap_bulk_write (map,INV_ICM42607_BLK_SEL_W , buffer,3 ); +fsleep (INV_ICM42607_MREG_DELAY_US ); +if (ret) +return ret; + +/* Switch back to bank1 and pause the required amount of time. */ + ret =regmap_write (map,INV_ICM42607_BLK_SEL_W ,INV_ICM42607_MREG_1 );
If this regmap_bulk_write() fails, will the device be left permanently in bank 2 or 3? Returning early skips the write to switch back to INV_ICM42607_MREG_1. All subsequent generic register accesses (such as reading INT_STATUS2 in the IRQ handler) would read from the wrong bank and receive invalid data.
Quoted 6 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +6
-0+fsleep (INV_ICM42607_MREG_DELAY_US ); +if (ret) +return ret; + +return 0 ; +}
[ ... ]
Quoted 18 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +3
-4@@ -466,6 +668,9 @@ EXPORT_SYMBOL_NS_GPL(inv_icm42607_core_probe, "IIO_ICM42607");static int inv_icm42607_suspend (struct device *dev) {struct inv_icm42607_state *st =dev_get_drvdata (dev); +struct device *accel_dev; +bool wakeup; +int accel_conf;int ret;guard (mutex)(&st->lock);@@ -482,12 +687,36 @@ static int inv_icm42607_suspend(struct device *dev)return ret; } - ret =inv_icm42607_set_pwr_mgmt0 (st,INV_ICM42607_SENSOR_MODE_OFF , -INV_ICM42607_SENSOR_MODE_OFF , - false,NULL ); -if (ret)
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c static int inv_icm42607_suspend(struct device *dev) · line 697
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +8
-2-return ret; -inv_icm42607_disable_vddio_reg (st); +/* keep chip on and wake-up capable if APEX and wakeup on */ + accel_dev = &st->indio_accel->dev; + wakeup = st->apex.on &&device_may_wakeup (accel_dev); +if (wakeup) { +/* keep accel on and setup irq for wakeup */ + accel_conf = st->conf.accel.mode; +enable_irq_wake (st->irq); +disable_irq_nosync (st->irq);
Could this lead to an I2C/SPI access on a suspended bus?
If the threaded IRQ handler is currently executing and blocked waiting for st->lock, disable_irq_nosync() will return without waiting for it. Once this suspend function drops the lock, the PM core proceeds to suspend the parent controller.
The unblocked IRQ handler would then acquire the lock and attempt to read via regmap_bulk_read(), potentially causing a timeout or kernel panic on the suspended bus.
Quoted 25 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +22
-0+ ret =inv_icm42607_set_pwr_mgmt0 (st,INV_ICM42607_SENSOR_MODE_OFF , + accel_conf, false,NULL ); +if (ret) { +enable_irq (st->irq); +disable_irq_wake (st->irq); +return ret; + } + }else { +/* disable APEX features and accel if wakeup disabled */ +if (st->apex.wom.enable) { + ret =inv_icm42607_disable_wom (st); +if (ret) +return ret; + } + accel_conf =INV_ICM42607_SENSOR_MODE_OFF ; + ret =inv_icm42607_set_pwr_mgmt0 (st,INV_ICM42607_SENSOR_MODE_OFF , +INV_ICM42607_SENSOR_MODE_OFF , + false,NULL ); +if (ret) +return ret; +inv_icm42607_disable_vddio_reg (st); + }return 0 ; }
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=9
Jonathan Cameron
maintainerRe: [PATCH V7 09/11] iio: imu: inv_icm42607: Add Wake on Movement to icm42607
In reply to Chris MorganQuoted 3 lines · On Fri, 15 May 2026 08:00:14 -0500 Chris Morgan <[email protected]> wrote:
From: Chris Morgan <[email protected]>
Add support for wake on movement for the icm42607 driver.
Could you add a bit on what is supported on each of the two parts. Not everything on the 42607P it seems.
There is quite a lot of fairly complex feedback on this in sashiko.
Obviously we are late in the game and I should have suggested this earlier but I would have dropped this for the initial driver just to keep it more manageable to review.
It's very much an add on feature.
Jonathan
Quoted 2 lines
Signed-off-by Chris Morgan <[email protected]>
Jonathan Cameron
maintainerRe: [PATCH V7 09/11] iio: imu: inv_icm42607: Add Wake on Movement to icm42607
Quoted 6 lines · On Fri, 15 May 2026 20:36:29 +0100 Jonathan Cameron <[email protected]> wrote:
Quoted 3 lines · On Fri, 15 May 2026 08:00:14 -0500 Chris Morgan <[email protected]> wrote:
From: Chris Morgan <[email protected]>
Add support for wake on movement for the icm42607 driver.
Quoted 8 lines
Could you add a bit on what is supported on each of the two parts. Not everything on the 42607P it seems.
There is quite a lot of fairly complex feedback on this in sashiko.
Obviously we are late in the game and I should have suggested this earlier but I would have dropped this for the initial driver just to keep it more manageable to review.
With hindsight / v8 I failed to say I meant just the bits related to wake on motion. I'd failed to notice that the fifo interrupt handling is in here as well. That bit is definitely needed.
Quoted 8 lines
It's very much an add on feature.
Jonathan
Quoted 2 lines
Signed-off-by Chris Morgan <[email protected]>
PATCH v7 10/11 iio: imu: inv_icm42607: Add Gyroscope to icm42607
In reply to Chris MorganFrom: Chris Morgan <[email protected]>
Add gyroscope functions to the icm42607 driver.
--- drivers/iio/imu/inv_icm42607/Makefile | 1 + drivers/iio/imu/inv_icm42607/inv_icm42607.h | 9 + .../imu/inv_icm42607/inv_icm42607_buffer.c | 26 +- .../iio/imu/inv_icm42607/inv_icm42607_core.c | 56 +- .../iio/imu/inv_icm42607/inv_icm42607_gyro.c | 545 ++++++++++++++++++ 5 files changed, 633 insertions(+), 4 deletions(-) create mode 100644 drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c
drivers/iio/imu/inv_icm42607/Makefile +1 -0
@@ -2,6 +2,7 @@ obj-$(CONFIG_INV_ICM42607) += inv-icm42607.o inv-icm42607-y += inv_icm42607_core.o +inv-icm42607-y += inv_icm42607_gyro.o inv-icm42607-y += inv_icm42607_accel.o inv-icm42607-y += inv_icm42607_buffer.o inv-icm42607-y += inv_icm42607_temp.o
drivers/iio/imu/inv_icm42607/inv_icm42607.h +9 -0
@@ -158,6 +158,7 @@ struct inv_icm42607_state {struct iio_dev *indio_gyro;struct iio_dev *indio_accel;struct { +s64 gyro;s64 accel; } timestamp;struct inv_icm42607_apex apex;
@@ -428,6 +429,10 @@ int inv_icm42607_set_accel_conf(struct inv_icm42607_state *st,struct inv_icm42607_sensor_conf *conf, unsigned int *sleep_ms); +int inv_icm42607_set_gyro_conf (struct inv_icm42607_state *st, +struct inv_icm42607_sensor_conf *conf, +unsigned int *sleep_ms); +int inv_icm42607_set_temp_conf (struct inv_icm42607_state *st,bool enable,unsigned int *sleep_ms);
@@ -437,6 +442,10 @@ int inv_icm42607_disable_wom(struct inv_icm42607_state *st);int inv_icm42607_core_probe (struct regmap *regmap,const struct inv_icm42607_hw *hw,inv_icm42607_bus_setup bus_setup); +struct iio_dev *inv_icm42607_gyro_init (struct inv_icm42607_state *st); + +int inv_icm42607_gyro_parse_fifo (struct iio_dev *indio_dev); +struct iio_dev *inv_icm42607_accel_init (struct inv_icm42607_state *st);int inv_icm42607_accel_parse_fifo (struct iio_dev *indio_dev);
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c +24 -2
@@ -384,7 +384,9 @@ static int inv_icm42607_buffer_postdisable(struct iio_dev *indio_dev) goto out_unlock; conf.mode =INV_ICM42607_SENSOR_MODE_OFF ; -if (sensor !=INV_ICM42607_SENSOR_GYRO ) +if (sensor ==INV_ICM42607_SENSOR_GYRO ) + ret =inv_icm42607_set_gyro_conf (st, &conf, &sleep_sensor); +else ret =inv_icm42607_set_accel_conf (st, &conf, &sleep_sensor);if (ret) goto out_unlock;
@@ -476,6 +478,7 @@ int inv_icm42607_buffer_fifo_read(struct inv_icm42607_state *st,int inv_icm42607_buffer_fifo_parse (struct inv_icm42607_state *st) { +struct inv_icm42607_sensor_state *gyro_st =iio_priv (st->indio_gyro);struct inv_icm42607_sensor_state *accel_st =iio_priv (st->indio_accel);struct inv_sensors_timestamp *ts;int ret;
@@ -483,6 +486,16 @@ int inv_icm42607_buffer_fifo_parse(struct inv_icm42607_state *st)if (st->fifo.nb.total ==0 )return 0 ; +/* handle gyroscope timestamp and FIFO data parsing */ +if (st->fifo.nb.gyro >0 ) { + ts = &gyro_st->ts; +inv_sensors_timestamp_interrupt (ts, st->fifo.watermark.eff_gyro, + st->timestamp.gyro); + ret =inv_icm42607_gyro_parse_fifo (st->indio_gyro); +if (ret) +return ret; + } +/* handle accelerometer timestamp and FIFO data parsing */ if (st->fifo.nb.accel >0 ) { ts = &accel_st->ts;
@@ -499,9 +512,10 @@ int inv_icm42607_buffer_fifo_parse(struct inv_icm42607_state *st)int inv_icm42607_buffer_hwfifo_flush (struct inv_icm42607_state *st,unsigned int count) { +struct inv_icm42607_sensor_state *gyro_st =iio_priv (st->indio_gyro);struct inv_icm42607_sensor_state *accel_st =iio_priv (st->indio_accel);struct inv_sensors_timestamp *ts; -s64 accel_ts; +s64 gyro_ts, accel_ts;int ret; accel_ts =iio_get_time_ns (st->indio_accel);
@@ -513,6 +527,14 @@ int inv_icm42607_buffer_hwfifo_flush(struct inv_icm42607_state *st,if (st->fifo.nb.total ==0 )return 0 ; +if (st->fifo.nb.gyro >0 ) { + ts = &gyro_st->ts; +inv_sensors_timestamp_interrupt (ts, st->fifo.nb.gyro, gyro_ts); + ret =inv_icm42607_gyro_parse_fifo (st->indio_gyro); +if (ret) +return ret; + } +if (st->fifo.nb.accel >0 ) { ts = &accel_st->ts;inv_sensors_timestamp_interrupt (ts, st->fifo.nb.accel, accel_ts);
drivers/iio/imu/inv_icm42607/inv_icm42607_core.c +54 -2
98 lines not on this page · raw message
drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c new file +545 -0
545 lines not on this page · raw message
Signature · 1 line
2.43.0
[email protected]
AI reviewRe: [PATCH V7 10/11] iio: imu: inv_icm42607: Add Gyroscope to icm42607
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider: - [Critical] The bounds check in `inv_icm42607_gyro_parse_fifo()` is inverted, dropping valid packets and…
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:
- [Critical] The bounds check in inv_icm42607_gyro_parse_fifo() is inverted, dropping valid packets and causing out-of-bounds memory reads.
- [High] The local variable gyro_ts is passed uninitialized to inv_sensors_timestamp_interrupt() in inv_icm42607_buffer_hwfifo_flush().
- [High] Missing lock acquisition in inv_icm42607_gyro_hwfifo_flush() allows concurrent data races over shared FIFO state.
- [High] Missing PM runtime acquisition in inv_icm42607_gyro_hwfifo_set_watermark().
- [Medium] inv_icm42607_gyro_read_avail() exposes uninitialized padding as valid sampling frequencies to user-space. --
commit 207799d1c88894b8f276d2717bc0960a73f7d744
Author: Chris Morgan <[email protected]>
iio: imu: inv_icm42607: Add Gyroscope to icm42607
This commit adds gyroscope functions to the inv_icm42607 driver.
Quoted 4 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c +0
-0
[ ... ]
Quoted 12 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c +2
-1@@ -499,9 +512,10 @@ int inv_icm42607_buffer_fifo_parse(struct inv_icm42607_state *st)int inv_icm42607_buffer_hwfifo_flush (struct inv_icm42607_state *st,unsigned int count) { +struct inv_icm42607_sensor_state *gyro_st =iio_priv (st->indio_gyro);struct inv_icm42607_sensor_state *accel_st =iio_priv (st->indio_accel);struct inv_sensors_timestamp *ts; -s64 accel_ts; +s64 gyro_ts, accel_ts;int ret; accel_ts =iio_get_time_ns (st->indio_accel);
[ ... ]
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c int inv_icm42607_buffer_hwfifo_flush(struct inv_icm42607_state *st, · line 532
Quoted 7 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c +3
-0@@ -513,6 +527,14 @@ int inv_icm42607_buffer_hwfifo_flush(struct inv_icm42607_state *st,if (st->fifo.nb.total ==0 )return 0 ; +if (st->fifo.nb.gyro >0 ) { + ts = &gyro_st->ts; +inv_sensors_timestamp_interrupt (ts, st->fifo.nb.gyro, gyro_ts);
Is it possible that gyro_ts is used uninitialized here? It appears to be declared on the stack but never assigned a value, which would feed kernel stack memory into the timestamp state machine.
Quoted 13 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c +5
-0+ ret =inv_icm42607_gyro_parse_fifo (st->indio_gyro); +if (ret) +return ret; + } +if (st->fifo.nb.accel >0 ) { ts = &accel_st->ts;inv_sensors_timestamp_interrupt (ts, st->fifo.nb.accel, accel_ts);drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c new file +0
-0
[ ... ]
Quoted 8 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c new file +8
-0+static int inv_icm42607_gyro_read_avail (struct iio_dev *indio_dev, +struct iio_chan_spec const *chan, +const int **vals, +int *type,int *length,long mask) +{ +if (chan->type !=IIO_ANGL_VEL ) +return -EINVAL ; +
drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c line 360
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c new file +10
-0+switch (mask) { +case IIO_CHAN_INFO_SCALE : + *vals = (const int *)inv_icm42607_gyro_scale_nano; + *type =IIO_VAL_INT_PLUS_NANO ; + *length =ARRAY_SIZE (inv_icm42607_gyro_scale_nano) *2 ; +return IIO_AVAIL_LIST ; +case IIO_CHAN_INFO_SAMP_FREQ : + *vals = (const int *)inv_icm42607_gyro_odr; + *type =IIO_VAL_INT_PLUS_MICRO ; + *length =ARRAY_SIZE (inv_icm42607_gyro_odr) *2 ;
Could this expose uninitialized padding to user-space?
Because inv_icm42607_gyro_odr is initialized with designated initializers starting at index 5, the first 5 entries are implicitly zero-initialized. Returning the entire array length might expose these 0.000000 values as valid sampling frequencies in the sampling_frequency_available sysfs attribute.
Quoted 5 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c new file +5
-0+return IIO_AVAIL_LIST ; +default : +return -EINVAL ; + } +}
[ ... ]
drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c line 415
Quoted 9 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c new file +9
-0+static int inv_icm42607_gyro_hwfifo_set_watermark (struct iio_dev *indio_dev, +unsigned int val) +{ +struct inv_icm42607_state *st =iio_device_get_drvdata (indio_dev); + +guard (mutex)(&st->lock); + + st->fifo.watermark.gyro = val; +return inv_icm42607_buffer_update_watermark (st);
Is a PM runtime reference required here before updating the watermark?
inv_icm42607_buffer_update_watermark() modifies hardware registers, but this function doesn't acquire a PM runtime reference. This might result in writing to the device while it is suspended.
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c new file +10
-0+} + +static int inv_icm42607_gyro_hwfifo_flush (struct iio_dev *indio_dev, +unsigned int count) +{ +struct inv_icm42607_state *st =iio_device_get_drvdata (indio_dev); +struct device *dev =regmap_get_device (st->map); +int ret; + +if (count ==0 )
drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c line 435
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c new file +10
-0+return 0 ; + +/* Make sure we don't try to count more than the buffer can hold. */ + count =min (count,sizeof (st->fifo.data)); + +PM_RUNTIME_ACQUIRE_AUTOSUSPEND (dev, pm); +if (PM_RUNTIME_ACQUIRE_ERR (&pm)) +return -ENXIO ; + + ret =inv_icm42607_buffer_hwfifo_flush (st, count);
Does this need to acquire st->lock before callinginv_icm42607_buffer_hwfifo_flush()?
Because inv_icm42607_buffer_hwfifo_flush() calls inv_icm42607_gyro_parse_fifo() without holding the lock, an interrupt could fire concurrently and overwrite st->fifo.data and st->fifo.count while they are being parsed locklessly.
Quoted 5 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c new file +5
-0+if (ret) +return ret; + +return st->fifo.nb.gyro; +}
[ ... ]
Quoted 13 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c new file +13
-0+int inv_icm42607_gyro_parse_fifo (struct iio_dev *indio_dev) +{ +struct inv_icm42607_state *st =iio_device_get_drvdata (indio_dev); +struct inv_icm42607_sensor_state *gyro_st =iio_priv (indio_dev); +struct inv_sensors_timestamp *ts = &gyro_st->ts; +ssize_t i, size; +unsigned int no; +const void *accel, *gyro, *timestamp; +const s8 *temp; +unsigned int odr; +s64 ts_val; +struct inv_icm42607_gyro_buffer buffer = { }; +
drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c line 524
Quoted 10 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c new file +10
-0+/* parse all fifo packets */ +for (i =0 , no =0 ; i < st->fifo.count; i += size, ++no) { + size =inv_icm42607_fifo_decode_packet (&st->fifo.data[i], + &accel, &gyro, &temp, ×tamp, &odr); +/* quit if error or FIFO is empty */ +if (size <=0 ) +return size; + +/* If the packet size could cause us to overflow, return. */ +if (i + size <= st->fifo.count)
Is this bounds check inverted?
It appears this condition evaluates to true when the packet fits safely within the buffer, causing it to abort on valid data. Conversely, if a packet size exceeds the buffer, the condition evaluates to false and allows the subsequent memcpy() to read out of bounds.
Quoted 5 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_gyro.c new file +5
-0+return -EIO ; + +/* skip packet if no gyro data or data is invalid */ +if (gyro ==NULL || !inv_icm42607_fifo_is_data_valid (gyro)) +continue ;
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=10
Jonathan Cameron
maintainerRe: [PATCH V7 10/11] iio: imu: inv_icm42607: Add Gyroscope to icm42607
In reply to Chris MorganQuoted 5 lines · On Fri, 15 May 2026 08:00:15 -0500 Chris Morgan <[email protected]> wrote:
From: Chris Morgan <[email protected]>
Add gyroscope functions to the icm42607 driver.
Signed-off-by Chris Morgan <[email protected]>
Hi Chris last one I'm getting to today...
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c int inv_icm42607_buffer_fifo_parse(struct inv_icm42607_state *st) · line 518
Quoted 9 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c +2
-1@@ -499,9 +512,10 @@ int inv_icm42607_buffer_fifo_parse(struct inv_icm42607_state *st)int inv_icm42607_buffer_hwfifo_flush (struct inv_icm42607_state *st,unsigned int count) { +struct inv_icm42607_sensor_state *gyro_st =iio_priv (st->indio_gyro);struct inv_icm42607_sensor_state *accel_st =iio_priv (st->indio_accel);struct inv_sensors_timestamp *ts; -s64 accel_ts; +s64 gyro_ts, accel_ts;
Most of what sashiko got matched the earlier accelerometer driver but this is a good catch. you never initialize gyro_ts unlike accel_ts:
accel_ts = iio_get_time_ns(st->indio_accel);
Quoted 18 lines
drivers/iio/imu/inv_icm42607/inv_icm42607_buffer.c +8
-0int ret; accel_ts =iio_get_time_ns (st->indio_accel);@@ -513,6 +527,14 @@ int inv_icm42607_buffer_hwfifo_flush(struct inv_icm42607_state *st,if (st->fifo.nb.total ==0 )return 0 ; +if (st->fifo.nb.gyro >0 ) { + ts = &gyro_st->ts; +inv_sensors_timestamp_interrupt (ts, st->fifo.nb.gyro, gyro_ts); + ret =inv_icm42607_gyro_parse_fifo (st->indio_gyro); +if (ret) +return ret; + } +if (st->fifo.nb.accel >0 ) { ts = &accel_st->ts;inv_sensors_timestamp_interrupt (ts, st->fifo.nb.accel, accel_ts);
PATCH v7 11/11 arm64: dts: rockchip: Add icm42607p IMU for RG-DS
In reply to Chris MorganFrom: Chris Morgan <[email protected]>
Add the Invensense ICM42607P IMU for the Anbernic RG-DS. Mount-matrix was tested with iio-sensor-proxy and reports correct orientation.
--- .../dts/rockchip/rk3568-anbernic-rg-ds.dts | 20 ++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3568-anbernic-rg-ds.dts +19 -1
@@ -871,7 +871,18 @@ aw87391_pa_r: audio-codec@5b { sound-name-prefix = "Right Amp"; }; - /* invensense,icm42607p at 0x68 */ + icm42607p: imu@68 { + compatible = "invensense,icm42607p"; + reg = <0x68>; + interrupt-names = "INT1"; + interrupt-parent = <&gpio0>; + interrupts = <RK_PD6 IRQ_TYPE_EDGE_FALLING>; + mount-matrix = "-1", "0", "0", + "0", "1", "0", + "0", "0", "-1"; + pinctrl-0 = <&accel_irq>; + pinctrl-names = "default"; + }; }; &i2c3 {
@@ -932,6 +943,13 @@ &i2s1_8ch { }; &pinctrl { + accel { + accel_irq: accel-irq { + rockchip,pins = + <0 RK_PD6 RK_FUNC_GPIO &pcfg_pull_up>; + }; + }; + gpio-keys { vol_keys_l: vol-keys_l { rockchip,pins =
Signature · 1 line
2.43.0