1. 17 11月, 2016 2 次提交
  2. 14 11月, 2016 1 次提交
  3. 05 11月, 2016 1 次提交
    • V
      i2c: core: fix NULL pointer dereference under race condition · 147b36d5
      Vladimir Zapolskiy 提交于
      Race condition between registering an I2C device driver and
      deregistering an I2C adapter device which is assumed to manage that
      I2C device may lead to a NULL pointer dereference due to the
      uninitialized list head of driver clients.
      
      The root cause of the issue is that the I2C bus may know about the
      registered device driver and thus it is matched by bus_for_each_drv(),
      but the list of clients is not initialized and commonly it is NULL,
      because I2C device drivers define struct i2c_driver as static and
      clients field is expected to be initialized by I2C core:
      
        i2c_register_driver()             i2c_del_adapter()
          driver_register()                 ...
            bus_add_driver()                ...
              ...                           bus_for_each_drv(..., __process_removed_adapter)
            ...                               i2c_do_del_adapter()
          ...                                   list_for_each_entry_safe(..., &driver->clients, ...)
          INIT_LIST_HEAD(&driver->clients);
      
      To solve the problem it is sufficient to do clients list head
      initialization before calling driver_register().
      
      The problem was found while using an I2C device driver with a sluggish
      registration routine on a bus provided by a physically detachable I2C
      master controller, but practically the oops may be reproduced under
      the race between arbitraty I2C device driver registration and managing
      I2C bus device removal e.g. by unbinding the latter over sysfs:
      
      % echo 21a4000.i2c > /sys/bus/platform/drivers/imx-i2c/unbind
        Unable to handle kernel NULL pointer dereference at virtual address 00000000
        Internal error: Oops: 17 [#1] SMP ARM
        CPU: 2 PID: 533 Comm: sh Not tainted 4.9.0-rc3+ #61
        Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
        task: e5ada400 task.stack: e4936000
        PC is at i2c_do_del_adapter+0x20/0xcc
        LR is at __process_removed_adapter+0x14/0x1c
        Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
        Control: 10c5387d  Table: 35bd004a  DAC: 00000051
        Process sh (pid: 533, stack limit = 0xe4936210)
        Stack: (0xe4937d28 to 0xe4938000)
        Backtrace:
        [<c0667be0>] (i2c_do_del_adapter) from [<c0667cc0>] (__process_removed_adapter+0x14/0x1c)
        [<c0667cac>] (__process_removed_adapter) from [<c0516998>] (bus_for_each_drv+0x6c/0xa0)
        [<c051692c>] (bus_for_each_drv) from [<c06685ec>] (i2c_del_adapter+0xbc/0x284)
        [<c0668530>] (i2c_del_adapter) from [<bf0110ec>] (i2c_imx_remove+0x44/0x164 [i2c_imx])
        [<bf0110a8>] (i2c_imx_remove [i2c_imx]) from [<c051a838>] (platform_drv_remove+0x2c/0x44)
        [<c051a80c>] (platform_drv_remove) from [<c05183d8>] (__device_release_driver+0x90/0x12c)
        [<c0518348>] (__device_release_driver) from [<c051849c>] (device_release_driver+0x28/0x34)
        [<c0518474>] (device_release_driver) from [<c0517150>] (unbind_store+0x80/0x104)
        [<c05170d0>] (unbind_store) from [<c0516520>] (drv_attr_store+0x28/0x34)
        [<c05164f8>] (drv_attr_store) from [<c0298acc>] (sysfs_kf_write+0x50/0x54)
        [<c0298a7c>] (sysfs_kf_write) from [<c029801c>] (kernfs_fop_write+0x100/0x214)
        [<c0297f1c>] (kernfs_fop_write) from [<c0220130>] (__vfs_write+0x34/0x120)
        [<c02200fc>] (__vfs_write) from [<c0221088>] (vfs_write+0xa8/0x170)
        [<c0220fe0>] (vfs_write) from [<c0221e74>] (SyS_write+0x4c/0xa8)
        [<c0221e28>] (SyS_write) from [<c0108a20>] (ret_fast_syscall+0x0/0x1c)
      Signed-off-by: NVladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
      Signed-off-by: NWolfram Sang <wsa@the-dreams.de>
      Cc: stable@kernel.org
      147b36d5
  4. 25 10月, 2016 1 次提交
  5. 24 9月, 2016 2 次提交
  6. 23 9月, 2016 1 次提交
    • M
      i2c / ACPI: Do not touch an I2C device if it belongs to another adapter · 318ce278
      Mika Westerberg 提交于
      When enumerating I2C devices connected to an I2C adapter we scan the whole
      namespace (as it is possible to have devices anywhere in that namespace,
      not just below the I2C adapter device) and add each found device to the I2C
      bus in question.
      
      Now after commit 525e6fab ("i2c / ACPI: add support for ACPI
      reconfigure notifications") checking of the adapter handle to the one found
      in the I2cSerialBus() resource was moved to happen after resources of the
      I2C device has been parsed. This means that if the I2cSerialBus() resource
      points to an adapter that does not exists in the system we still parse
      those resources. This is problematic in particular because
      acpi_dev_resource_interrupt() tries to configure GSI if the device also has
      an Interrupt() resource. Failing to do that results errrors like this to be
      printed on the console:
      
        [   10.409490] ERROR: Unable to locate IOAPIC for GSI 37
      
      To fix this we pass the I2C adapter to i2c_acpi_get_info() and make sure
      the handle matches the one in the I2cSerialBus() resource before doing
      anything else to the device.
      Reported-by: NNicolai Stange <nicstange@gmail.com>
      Signed-off-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      Reviewed-by: NNicolai Stange <nicstange@gmail.com>
      Signed-off-by: NWolfram Sang <wsa@the-dreams.de>
      318ce278
  7. 31 8月, 2016 2 次提交
  8. 26 8月, 2016 3 次提交
    • J
      i2c: core: Add function for finding the bus speed from ACPI, take 2 · 5853b22d
      Jarkko Nikula 提交于
      ACPI 5 specification doesn't have property for the I2C bus speed but
      I2cSerialBus resource descriptor which define each controller-slave
      connection define the maximum speed supported by that connection.
      
      Thus finding the maximum safe speed for the bus is to walk through all
      I2cSerialBus resources that are associated to I2C controller and use the
      speed of slowest connection.
      
      Add function i2c_acpi_find_bus_speed() to the i2c-core that adapter
      drivers can call prior registering itself to core.
      
      This implies two-step walk through the I2cSerialBus resources: call to
      i2c_acpi_find_bus_speed() does the first scan and finds the safe bus
      speed that adapter drivers can set up. Adapter driver registration does
      the second scan when i2c-core creates the I2C slaves by calling the
      i2c_acpi_register_devices(). In that way the bus speed is set in case
      slave device probe gets called during registration and does communication.
      
      Previous version commit 55d38d06 ("i2c: core: Add function for finding
      the bus speed from ACPI") got reverted due merge conflicts from
      commit 525e6fab ("i2c / ACPI: add support for ACPI reconfigure
      notifications").
      
      This version is a bit bigger than previous version but is still sharing
      the lowest and complicated part of I2cSerialBus lookup routines with the
      existing code.
      Signed-off-by: NJarkko Nikula <jarkko.nikula@linux.intel.com>
      Reviewed-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Signed-off-by: NWolfram Sang <wsa@the-dreams.de>
      5853b22d
    • J
      i2c: core: Cleanup I2C ACPI namespace, take 2 · aec809fc
      Jarkko Nikula 提交于
      I2C ACPI enumeration was originally implemented in another module under
      drivers/acpi/ but was later moved into i2c-core with added support for
      I2C ACPI operation region.
      
      Rename these acpi_i2c_ prefixed functions, structures and defines in
      i2c-core to i2c_acpi_ in order to have more consistent name space.
      
      This is updated version from commit a7003b65 ("i2c: core: Cleanup I2C
      ACPI namespace") that got reverted due merge conflicts from
      commit 525e6fab ("i2c / ACPI: add support for ACPI reconfigure
      notifications").
      Signed-off-by: NJarkko Nikula <jarkko.nikula@linux.intel.com>
      Reviewed-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Signed-off-by: NWolfram Sang <wsa@the-dreams.de>
      aec809fc
    • P
      i2c: add i2c_trylock_bus wrapper, use it · fb79e09a
      Peter Rosin 提交于
      This unifies usage with i2c_lock_bus and i2c_unlock_bus, and paves the
      way for the next patch which looks a bit saner with this preparatory
      work taken care of beforehand.
      Signed-off-by: NPeter Rosin <peda@axentia.se>
      Signed-off-by: NWolfram Sang <wsa@the-dreams.de>
      fb79e09a
  9. 19 7月, 2016 2 次提交
  10. 14 7月, 2016 9 次提交
  11. 09 7月, 2016 1 次提交
    • O
      i2c / ACPI: add support for ACPI reconfigure notifications · 525e6fab
      Octavian Purdila 提交于
      This patch adds supports for I2C device enumeration and removal via
      ACPI reconfiguration notifications that are send as a result of an
      ACPI table load or unload operation.
      
      The code is very similar with the device tree reconfiguration code
      with only small differences in the way we test and set the enumerated
      state of the device:
      
       * the equivalent of device tree's OF_POPULATED flag is the
         flags.visited field in the ACPI device and the following
         wrappers are used to manipulate it: acpi_device_enumerated(),
         acpi_device_set_enumerated() and acpi_device_clear_enumerated()
      
       * the device tree code checks of status of the OF_POPULATED flag to
         avoid trying to create duplicate Linux devices in two places: once
         when the controller is probed, and once when the reconfigure event
         is received; in the ACPI code the check is performed only once when
         the ACPI namespace is searched because this code path is invoked in
         both of the two mentioned cases
      
      The rest of the enumeration handling is similar with device tree: when
      the Linux device is unregistered the ACPI device is marked as not
      enumerated; also, when a device remove notification is received we
      check that the device is in the enumerated state before continuing
      with the removal of the Linux device.
      Signed-off-by: NOctavian Purdila <octavian.purdila@intel.com>
      Reviewed-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      Acked-by: NWolfram Sang <wsa@the-dreams.de>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      525e6fab
  12. 30 6月, 2016 1 次提交
  13. 14 6月, 2016 1 次提交
    • J
      i2c: Add generic support passing secondary devices addresses · 0f614d83
      Jean-Michel Hautbois 提交于
      Some I2C devices have multiple addresses assigned, for example each address
      corresponding to a different internal register map page of the device.
      So far drivers which need support for this have handled this with a driver
      specific and non-generic implementation, e.g. passing the additional address
      via platform data.
      
      This patch provides a new helper function called i2c_new_secondary_device()
      which is intended to provide a generic way to get the secondary address
      as well as instantiate a struct i2c_client for the secondary address.
      
      The function expects a pointer to the primary i2c_client, a name
      for the secondary address and an optional default address. The name is used
      as a handle to specify which secondary address to get.
      
      The default address is used as a fallback in case no secondary address
      was explicitly specified. In case no secondary address and no default
      address were specified the function returns NULL.
      
      For now the function only supports look-up of the secondary address
      from devicetree, but it can be extended in the future
      to for example support board files and/or ACPI.
      Signed-off-by: NJean-Michel Hautbois <jean-michel.hautbois@veo-labs.com>
      Acked-by: NRob Herring <robh@kernel.org>
      Acked-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      Signed-off-by: NWolfram Sang <wsa@the-dreams.de>
      0f614d83
  14. 13 5月, 2016 1 次提交
  15. 05 5月, 2016 3 次提交
    • P
      i2c: mux: relax locking of the top i2c adapter during mux-locked muxing · 6ef91fcc
      Peter Rosin 提交于
      With a i2c topology like the following
      
                             GPIO ---|  ------ BAT1
                              |      v /
         I2C  -----+----------+---- MUX
                   |                   \
                 EEPROM                 ------ BAT2
      
      there is a locking problem with the GPIO controller since it is a client
      on the same i2c bus that it muxes. Transfers to the mux clients (e.g. BAT1)
      will lock the whole i2c bus prior to attempting to switch the mux to the
      correct i2c segment. In the above case, the GPIO device is an I/O expander
      with an i2c interface, and since the GPIO subsystem knows nothing (and
      rightfully so) about the lockless needs of the i2c mux code, this results
      in a deadlock when the GPIO driver issues i2c transfers to modify the
      mux.
      
      So, observing that while it is needed to have the i2c bus locked during the
      actual MUX update in order to avoid random garbage on the slave side, it
      is not strictly a must to have it locked over the whole sequence of a full
      select-transfer-deselect mux client operation. The mux itself needs to be
      locked, so transfers to clients behind the mux are serialized, and the mux
      needs to be stable during all i2c traffic (otherwise individual mux slave
      segments might see garbage, or worse).
      
      Introduce this new locking concept as "mux-locked" muxes, and call the
      pre-existing mux locking scheme "parent-locked".
      
      Modify the i2c mux locking so that muxes that are "mux-locked" locks only
      the muxes on the parent adapter instead of the whole i2c bus when there is
      a transfer to the slave side of the mux. This lock serializes transfers to
      the slave side of the muxes on the parent adapter.
      
      Add code to i2c-mux-gpio and i2c-mux-pinctrl that checks if all involved
      gpio/pinctrl devices have a parent that is an i2c adapter in the same
      adapter tree that is muxed, and request a "mux-locked mux" if that is the
      case.
      
      Modify the select-transfer-deselect code for "mux-locked" muxes so
      that each of the select-transfer-deselect ops locks the mux parent
      adapter individually.
      Signed-off-by: NPeter Rosin <peda@axentia.se>
      Signed-off-by: NWolfram Sang <wsa@the-dreams.de>
      6ef91fcc
    • P
      i2c: muxes always lock the parent adapter · fa96f0cb
      Peter Rosin 提交于
      Instead of checking for i2c parent adapters for every lock/unlock, simply
      override the locking for muxes to always lock/unlock the parent adapter
      directly.
      Signed-off-by: NPeter Rosin <peda@axentia.se>
      Signed-off-by: NWolfram Sang <wsa@the-dreams.de>
      fa96f0cb
    • P
      i2c: allow adapter drivers to override the adapter locking · 8320f495
      Peter Rosin 提交于
      Add i2c_lock_bus() and i2c_unlock_bus(), which call the new lock_bus and
      unlock_bus ops in the adapter. These funcs/ops take an additional flags
      argument that indicates for what purpose the adapter is locked.
      
      There are two flags, I2C_LOCK_ROOT_ADAPTER and I2C_LOCK_SEGMENT, but they
      are both implemented the same. For now. Locking the root adapter means
      that the whole bus is locked, locking the segment means that only the
      current bus segment is locked (i.e. i2c traffic on the parent side of
      a mux is still allowed even if the child side of the mux is locked).
      
      Also support a trylock_bus op (but no function to call it, as it is not
      expected to be needed outside of the i2c core).
      
      Implement i2c_lock_adapter/i2c_unlock_adapter in terms of the new locking
      scheme (i.e. lock with the I2C_LOCK_ROOT_ADAPTER flag).
      
      Locking the root adapter and locking the segment is the same thing for
      all root adapters (e.g. in the normal case of a simple topology with no
      i2c muxes). The two locking variants are also the same for traditional
      muxes (aka parent-locked muxes). These muxes traverse the tree, locking
      each level as they go until they reach the root. This patch is preparatory
      for a later patch in the series introducing mux-locked muxes, which behave
      differently depending on the requested locking. Since all current users
      are using i2c_lock_adapter, which is a wrapper for I2C_LOCK_ROOT_ADAPTER,
      we only need to annotate the calls that will not need to lock the root
      adapter for mux-locked muxes. I.e. the instances that needs to use
      I2C_LOCK_SEGMENT instead of i2c_lock_adapter/I2C_LOCK_ROOT_ADAPTER. Those
      instances are in the i2c_transfer and i2c_smbus_xfer functions, so that
      mux-locked muxes can single out normal i2c accesses to its slave side
      and adjust the locking for those accesses.
      Signed-off-by: NPeter Rosin <peda@axentia.se>
      Signed-off-by: NWolfram Sang <wsa@the-dreams.de>
      8320f495
  16. 13 4月, 2016 1 次提交
    • L
      i2c: let I2C masters ignore their children for PM · 04f59143
      Linus Walleij 提交于
      When using a certain I2C device with runtime PM enabled on
      a certain I2C bus adaper the following happens:
      
      struct amba_device *foo
         \
         struct i2c_adapter *bar
            \
            struct i2c_client *baz
      
      The AMBA device foo has its device PM struct set to ignore
      children with pm_suspend_ignore_children(&foo->dev, true).
      This makes runtime PM work just fine locally in the driver:
      the fact that devices on the bus are suspended or resumed
      individually does not affect its operation, and the hardware
      does not power up unless transferring messages.
      
      However this child ignorance property is not inherited into
      the struct i2c_adapter *bar.
      
      On system suspend things will work fine.
      
      On system resume the following annoying phenomenon occurs:
      
      - In the pm_runtime_force_resume() path of
        struct i2c_client *baz, pm_runtime_set_active(&baz->dev); is
        eventually called.
      
      - This becomes __pm_runtime_set_status(&baz->dev, RPM_ACTIVE);
      
      - __pm_runtime_set_status() detects that RPM state is changed,
        and checks whether the parent is:
        not active (RPM_ACTIVE) and not ignoring its children
        If this happens it concludes something is wrong, because
        a parent that is not ignoring its children must be active
        before any children activate.
      
      - Since the struct i2c_adapter *bar does not ignore
        its children, the PM core thinks that it must indeed go
        online before its children, the check bails out with
        -EBUSY, i.e. the i2c_client *baz thinks it can't work
        because it's parent is not online, and it respects its
        parent.
      
      - In the driver the .resume() callback returns -EBUSY from
        the runtime_force_resume() call as per above. This leaves
        the device in a suspended state, leading to bad behaviour
        later when the device is used. The following debug
        print is made with an extra printg patch but illustrates
        the problem:
      
      [   17.040832] bh1780 2-0029: parent (i2c-2) is not active
                     parent->power.ignore_children = 0
      [   17.040832] bh1780 2-0029: pm_runtime_force_resume:
                     pm_runtime_set_active() failed (-16)
      [   17.040863] dpm_run_callback():
                     pm_runtime_force_resume+0x0/0x88 returns -16
      [   17.040863] PM: Device 2-0029 failed to resume: error -16
      
      Fix this by letting all struct i2c_adapter:s ignore their
      children: i2c children have no business doing keeping
      their parents awake: they are completely autonomous
      devices that just use their parent to talk, a usecase
      which must be power managed in the host on a per-message
      basis.
      Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
      Reviewed-by: NUlf Hansson <ulf.hansson@linaro.org>
      Signed-off-by: NWolfram Sang <wsa@the-dreams.de>
      04f59143
  17. 12 4月, 2016 1 次提交
  18. 30 3月, 2016 1 次提交
    • W
      i2c: prevent endless uevent loop with CONFIG_I2C_DEBUG_CORE · 8dcf3217
      Wolfram Sang 提交于
      Jan reported this:
      
      ===
      After enabling CONFIG_I2C_DEBUG_CORE my system was broken
      (no network, console login not possible). System log was
      flooded with the this message:
      
       ...
      [  608.052077] rtc-ds1307 0-0068: uevent
      [  608.052500] rtc-ds1307 0-0068: uevent
      [  608.052925] rtc-ds1307 0-0068: uevent
       ...
      
      The culprit is the dev_dbg printk in the i2c uevent handler.
      If this is activated (for instance by CONFIG_I2C_DEBUG_CORE)
      it results in an endless loop with systemd-journald.
      
      This happens if user-space scans the system log and reads the uevent
      file to get information about a newly created device, which seems fair
      use to me. Unfortunately reading the "uevent" file uses the same
      function that runs for creating the uevent for a new device,
      generating the next syslog entry.
      
      Ideally user-space would implement a recursion detection and
      after reading the same device file for the 1000th time call it a
      day, but nevertheless I think we should avoid this problem by
      removing the debug print completely or using another print variant.
      
      The same problem seems to be reported here:
      https://bugs.freedesktop.org/show_bug.cgi?id=76886
      ===
      
      His patch converted the message to pr_debug, but I think the debug can
      simply go. We have other means to see code paths these days. This
      enables us to clean up the function some more while we are here.
      Reported-by: NJan Glauber <jglauber@cavium.com>
      Signed-off-by: NWolfram Sang <wsa@the-dreams.de>
      Acked-by: NAlexander Sverdlin <alexander.sverdlin@nokia.com>
      Tested-by: NJan Glauber <jglauber@cavium.com>
      8dcf3217
  19. 15 3月, 2016 1 次提交
  20. 12 3月, 2016 1 次提交
  21. 21 2月, 2016 1 次提交
  22. 10 1月, 2016 1 次提交
  23. 18 12月, 2015 1 次提交
  24. 14 12月, 2015 1 次提交