This pass covered the local drivers that were not the focus of the
2026-04-30 cross-driver audit: rk_tsadc, rk_saradc, rk_efuse,
rk_adc_keys, stk3311, magnetometer, mpu6500, and
gpio_vibrator. The references were Linux mainline where a driver
exists, Rockchip downstream for RK818-family battery/charger behavior,
and the OpenBSD/FreeBSD style constraint that bus transfers and GPIO
operations must not be hidden inside unsafe interrupt/callout paths.
Fixed in this pass
| Severity | Driver | Finding | Resolution |
|---|---|---|---|
| High | src/sys/arm64/rockchip/rk_tsadc.c | The driver treated RK3399 data, alarm, and shutdown registers as a v3 block. Linux drivers/thermal/rockchip_thermal.c::rk3399_tsadc_data uses rk_tsadcv3_initialize, but still uses the v2 callbacks for get_temp, set_alarm_temp, and set_tshut_temp. | Temperature reads now use TSADCV2_DATA(chn) = 0x20 + chn*4; trip programming now uses TSADCV2_COMP_INT(chn) = 0x30 + chn*4 and TSADCV2_COMP_SHUT(chn) = 0x40 + chn*4. |
| High | src/sys/dev/iicbus/stk3311.c | The proximity threshold registers were set to 0x20/0x22. Linux drivers/iio/light/stk3310.c programs high/low proximity thresholds at 0x06/0x08; our data and flag registers already matched Linux. | STK3311_REG_THDH_PS and STK3311_REG_THDL_PS now match the working driver. IRQ-backed near/far transitions should no longer depend on chip defaults. |
| Medium | src/sys/arm64/rockchip/rk_saradc.c | The driver acquired vref-supply and used its voltage, but never enabled the regulator. Linux drivers/iio/adc/rockchip_saradc.c enables vref during probe/resume and disables it during remove/suspend. | Attach now enables vref-supply before reading voltage, and detach disables/releases it. Attach-fail and detach paths also disable enabled clocks before release. |
| Medium | src/sys/dev/evdev/gpio_vibrator.c | The driver acquired and enabled vcc-supply, then detached without releasing the regulator handle. It also played uploaded rumble effects even when both magnitudes were zero. | Detach now disables and releases vcc-supply, guarded by an enable flag. Zero-magnitude rumble now stops instead of buzzing. |
| Medium | src/sys/dev/evdev/gpio_vibrator.c | gpio_pin_set_active() was still called from the callout path under sc->mtx, while Linux drivers/input/misc/gpio-vibra.c uses workqueue context and sleepable GPIO helpers. | Callouts now only update desired state and enqueue set_task; GPIO and regulator operations run on taskqueue_thread. |
| Medium | src/sys/dev/evdev/gpio_vibrator.c | The regulator remained enabled for the whole attach lifetime. Linux enables the regulator when vibration starts and disables it when vibration stops. | vcc-supply is now optional and is enabled only while the motor is requested active. Stop, timeout, suspend, and detach drive the desired state inactive. |
| Medium | src/sys/dev/iicbus/magnetometer.c | magnetometer_axis_sysctl() held an MTX_DEF mutex across I2C transfers and DELAY() in magnetometer_sample_locked(). Linux AF8133J uses a sleepable mutex around regmap transactions. | The sampling lock is now an sx lock, so the sysctl path can serialize single-shot samples without holding a non-sleepable mutex across I2C. |
| Low | src/sys/arm64/rockchip/rk_efuse.c | The failure path after a bad efuse read could release MMIO without disabling/releasing pclk. The success detach path did disable/release it. | Attach failure now calls the common detach cleanup path. pclk_enabled records whether the gate was actually enabled before detach disables it. |
| Low | src/sys/dev/iicbus/magnetometer.c | The first probe-read failure returned before destroying the newly initialized lock. | That path now goes through the common fail: cleanup label. |
Still open
| Severity | Driver | Risk | Why it matters |
|---|---|---|---|
| Low | src/sys/dev/iicbus/mpu6500.c | No register mismatch found in the init sequence against Linux inv_mpu_*; remaining concern is only that the driver is still a minimal polled sysctl implementation. | Not a correctness finding from this pass. |
Looks reasonable
rk_adc_keys matches Linux’s ADC-key threshold shape: our SARADC helper
returns microvolts, so the local thresholds correctly stay in microvolts
instead of converting to millivolts like Linux’s IIO path.
rk_efuse matches the Rockchip read sequence: strobe address, wait for
finish, copy one word at a time, then shut the controller back down.
mpu6500 did not show an obvious register-order bug in the basic reset,
clock, range, and DLPF programming pass.
Next patch candidates
- Bench-check the fixed TSADC comparator by heating the SoC past the interrupt threshold only after normal idle/load sysctls look sane.
- Bench-check haptic rumble with and without
vcc-supplyin the DTS, because the software state machine now intentionally mirrors Linux’s power shape. - Turn the MPU-6500 scaffold from sysctl polling into an event/consumer shape once a userspace sensor stack is ready.