--- /dev/null
+From 36e3fa6a38e135e9478a2f75dec9bf6ff1e6480e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 26 Oct 2016 16:30:33 +0300
+Subject: drm/dp/mst: Clear port->pdt when tearing down the i2c adapter
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 36e3fa6a38e135e9478a2f75dec9bf6ff1e6480e upstream.
+
+The i2c adapter is only relevant for some peer device types, so
+let's clear the pdt if it's still the same as the old_pdt when we
+tear down the i2c adapter.
+
+I don't really like this design pattern of updating port->whatever
+before doing the accompanying changes and passing around old_whatever
+to figure stuff out. Would make much more sense to me to the pass the
+new value around and only update the port->whatever when things are
+consistent. But let's try to work with what we have right now.
+
+Quoting a follow-up from Ville:
+
+"And naturally I forgot to amend the commit message w.r.t. this guy
+[the change in drm_dp_destroy_port]. We don't really need to do this
+here, but I figured I'd try to be a bit more consistent by having it,
+just to avoid accidental mistakes if/when someone changes this stuff
+again later."
+
+v2: Clear port->pdt in the caller, if needed (Daniel)
+
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: Carlos Santa <carlos.santa@intel.com>
+Cc: Kirill A. Shutemov <kirill@shutemov.name>
+Tested-by: Carlos Santa <carlos.santa@intel.com> (v1)
+Tested-by: Kirill A. Shutemov <kirill@shutemov.name> (v1)
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97666
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1477488633-16544-1-git-send-email-ville.syrjala@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -909,6 +909,7 @@ static void drm_dp_destroy_port(struct k
+ /* no need to clean up vcpi
+ * as if we have no connector we never setup a vcpi */
+ drm_dp_port_teardown_pdt(port, port->pdt);
++ port->pdt = DP_PEER_DEVICE_NONE;
+ }
+ kfree(port);
+ }
+@@ -2872,6 +2873,7 @@ static void drm_dp_destroy_connector_wor
+ mgr->cbs->destroy_connector(mgr, port->connector);
+
+ drm_dp_port_teardown_pdt(port, port->pdt);
++ port->pdt = DP_PEER_DEVICE_NONE;
+
+ if (!port->input && port->vcpi.vcpi > 0) {
+ drm_dp_mst_reset_vcpi_slots(mgr, port);
--- /dev/null
+From 147b36d5b70c083cc76770c47d60b347e8eaf231 Mon Sep 17 00:00:00 2001
+From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+Date: Mon, 31 Oct 2016 21:46:24 +0200
+Subject: i2c: core: fix NULL pointer dereference under race condition
+
+From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+
+commit 147b36d5b70c083cc76770c47d60b347e8eaf231 upstream.
+
+Race condition between registering an I2C device driver and
+deregistering an I2C adapter device which is assumed to manage that
+I2C device may lead to a NULL pointer dereference due to the
+uninitialized list head of driver clients.
+
+The root cause of the issue is that the I2C bus may know about the
+registered device driver and thus it is matched by bus_for_each_drv(),
+but the list of clients is not initialized and commonly it is NULL,
+because I2C device drivers define struct i2c_driver as static and
+clients field is expected to be initialized by I2C core:
+
+ i2c_register_driver() i2c_del_adapter()
+ driver_register() ...
+ bus_add_driver() ...
+ ... bus_for_each_drv(..., __process_removed_adapter)
+ ... i2c_do_del_adapter()
+ ... list_for_each_entry_safe(..., &driver->clients, ...)
+ INIT_LIST_HEAD(&driver->clients);
+
+To solve the problem it is sufficient to do clients list head
+initialization before calling driver_register().
+
+The problem was found while using an I2C device driver with a sluggish
+registration routine on a bus provided by a physically detachable I2C
+master controller, but practically the oops may be reproduced under
+the race between arbitraty I2C device driver registration and managing
+I2C bus device removal e.g. by unbinding the latter over sysfs:
+
+% echo 21a4000.i2c > /sys/bus/platform/drivers/imx-i2c/unbind
+ Unable to handle kernel NULL pointer dereference at virtual address 00000000
+ Internal error: Oops: 17 [#1] SMP ARM
+ CPU: 2 PID: 533 Comm: sh Not tainted 4.9.0-rc3+ #61
+ Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
+ task: e5ada400 task.stack: e4936000
+ PC is at i2c_do_del_adapter+0x20/0xcc
+ LR is at __process_removed_adapter+0x14/0x1c
+ Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
+ Control: 10c5387d Table: 35bd004a DAC: 00000051
+ Process sh (pid: 533, stack limit = 0xe4936210)
+ Stack: (0xe4937d28 to 0xe4938000)
+ Backtrace:
+ [<c0667be0>] (i2c_do_del_adapter) from [<c0667cc0>] (__process_removed_adapter+0x14/0x1c)
+ [<c0667cac>] (__process_removed_adapter) from [<c0516998>] (bus_for_each_drv+0x6c/0xa0)
+ [<c051692c>] (bus_for_each_drv) from [<c06685ec>] (i2c_del_adapter+0xbc/0x284)
+ [<c0668530>] (i2c_del_adapter) from [<bf0110ec>] (i2c_imx_remove+0x44/0x164 [i2c_imx])
+ [<bf0110a8>] (i2c_imx_remove [i2c_imx]) from [<c051a838>] (platform_drv_remove+0x2c/0x44)
+ [<c051a80c>] (platform_drv_remove) from [<c05183d8>] (__device_release_driver+0x90/0x12c)
+ [<c0518348>] (__device_release_driver) from [<c051849c>] (device_release_driver+0x28/0x34)
+ [<c0518474>] (device_release_driver) from [<c0517150>] (unbind_store+0x80/0x104)
+ [<c05170d0>] (unbind_store) from [<c0516520>] (drv_attr_store+0x28/0x34)
+ [<c05164f8>] (drv_attr_store) from [<c0298acc>] (sysfs_kf_write+0x50/0x54)
+ [<c0298a7c>] (sysfs_kf_write) from [<c029801c>] (kernfs_fop_write+0x100/0x214)
+ [<c0297f1c>] (kernfs_fop_write) from [<c0220130>] (__vfs_write+0x34/0x120)
+ [<c02200fc>] (__vfs_write) from [<c0221088>] (vfs_write+0xa8/0x170)
+ [<c0220fe0>] (vfs_write) from [<c0221e74>] (SyS_write+0x4c/0xa8)
+ [<c0221e28>] (SyS_write) from [<c0108a20>] (ret_fast_syscall+0x0/0x1c)
+
+Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/i2c-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/i2c-core.c
++++ b/drivers/i2c/i2c-core.c
+@@ -1876,6 +1876,7 @@ int i2c_register_driver(struct module *o
+ /* add the driver to the list of i2c drivers in the driver core */
+ driver->driver.owner = owner;
+ driver->driver.bus = &i2c_bus_type;
++ INIT_LIST_HEAD(&driver->clients);
+
+ /* When registration returns, the driver core
+ * will have called probe() for all matching-but-unbound devices.
+@@ -1886,7 +1887,6 @@ int i2c_register_driver(struct module *o
+
+ pr_debug("i2c-core: driver [%s] registered\n", driver->driver.name);
+
+- INIT_LIST_HEAD(&driver->clients);
+ /* Walk the adapters that are already present */
+ i2c_for_each_dev(driver, __process_new_driver);
+
--- /dev/null
+From 533169d164c6b4c8571d0d48779f6ff6be593d72 Mon Sep 17 00:00:00 2001
+From: Stefan Agner <stefan@agner.ch>
+Date: Mon, 26 Sep 2016 17:18:58 -0700
+Subject: i2c: imx: defer probe if bus recovery GPIOs are not ready
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Agner <stefan@agner.ch>
+
+commit 533169d164c6b4c8571d0d48779f6ff6be593d72 upstream.
+
+Some SoC might load the GPIO driver after the I2C driver and
+using the I2C bus recovery mechanism via GPIOs. In this case
+it is crucial to defer probing if the GPIO request functions
+do so, otherwise the I2C driver gets loaded without recovery
+mechanisms enabled.
+
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-imx.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -1002,10 +1002,13 @@ static void i2c_imx_init_recovery_info(s
+ rinfo->scl_gpio = of_get_named_gpio_flags(pdev->dev.of_node,
+ "scl-gpios", 0, NULL);
+
+- if (!gpio_is_valid(rinfo->sda_gpio) ||
+- !gpio_is_valid(rinfo->scl_gpio) ||
+- IS_ERR(i2c_imx->pinctrl_pins_default) ||
+- IS_ERR(i2c_imx->pinctrl_pins_gpio)) {
++ if (rinfo->sda_gpio == -EPROBE_DEFER ||
++ rinfo->scl_gpio == -EPROBE_DEFER) {
++ return -EPROBE_DEFER;
++ } else if (!gpio_is_valid(rinfo->sda_gpio) ||
++ !gpio_is_valid(rinfo->scl_gpio) ||
++ IS_ERR(i2c_imx->pinctrl_pins_default) ||
++ IS_ERR(i2c_imx->pinctrl_pins_gpio)) {
+ dev_dbg(&pdev->dev, "recovery information incomplete\n");
+ return;
+ }
--- /dev/null
+From 399c168ab5ab5e12ed55b6c91d61c24eb84c9164 Mon Sep 17 00:00:00 2001
+From: David Wu <david.wu@rock-chips.com>
+Date: Sat, 22 Oct 2016 16:43:42 +0800
+Subject: i2c: rk3x: Give the tuning value 0 during rk3x_i2c_v0_calc_timings
+
+From: David Wu <david.wu@rock-chips.com>
+
+commit 399c168ab5ab5e12ed55b6c91d61c24eb84c9164 upstream.
+
+We found a bug that i2c transfer sometimes failed on 3066a board with
+stabel-4.8, the con register would be updated by uninitialized tuning
+value, it made the i2c transfer failed.
+
+So give the tuning value to be zero during rk3x_i2c_v0_calc_timings.
+
+Signed-off-by: David Wu <david.wu@rock-chips.com>
+Tested-by: Andy Yan <andy.yan@rock-chips.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-rk3x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-rk3x.c
++++ b/drivers/i2c/busses/i2c-rk3x.c
+@@ -600,6 +600,8 @@ static int rk3x_i2c_calc_divs(unsigned l
+ *div_low = *div_low - 1;
+ *div_high = *div_high - 1;
+
++ /* Give the tuning value 0, that would not update con register */
++ t_calc->tuning = 0;
+ /* Maximum divider supported by hw is 0xffff */
+ if (*div_low > 0xffff) {
+ *div_low = 0xffff;
--- /dev/null
+From 603616017c35f4d0fbdbcace72adf9bf949c4a65 Mon Sep 17 00:00:00 2001
+From: Hoan Tran <hotran@apm.com>
+Date: Mon, 10 Oct 2016 10:13:10 -0700
+Subject: i2c: xgene: Avoid dma_buffer overrun
+
+From: Hoan Tran <hotran@apm.com>
+
+commit 603616017c35f4d0fbdbcace72adf9bf949c4a65 upstream.
+
+SMBus block command uses the first byte of buffer for the data length.
+The dma_buffer should be increased by 1 to avoid the overrun issue.
+
+Reported-by: Phil Endecott <phil_gjouf_endecott@chezphil.org>
+Signed-off-by: Hoan Tran <hotran@apm.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-xgene-slimpro.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-xgene-slimpro.c
++++ b/drivers/i2c/busses/i2c-xgene-slimpro.c
+@@ -105,7 +105,7 @@ struct slimpro_i2c_dev {
+ struct mbox_chan *mbox_chan;
+ struct mbox_client mbox_client;
+ struct completion rd_complete;
+- u8 dma_buffer[I2C_SMBUS_BLOCK_MAX];
++ u8 dma_buffer[I2C_SMBUS_BLOCK_MAX + 1]; /* dma_buffer[0] is used for length */
+ u32 *resp_msg;
+ };
+
--- /dev/null
+i2c-imx-defer-probe-if-bus-recovery-gpios-are-not-ready.patch
+i2c-rk3x-give-the-tuning-value-0-during-rk3x_i2c_v0_calc_timings.patch
+i2c-xgene-avoid-dma_buffer-overrun.patch
+i2c-core-fix-null-pointer-dereference-under-race-condition.patch
+drm-dp-mst-clear-port-pdt-when-tearing-down-the-i2c-adapter.patch
--- /dev/null
+i2c-imx-defer-probe-if-bus-recovery-gpios-are-not-ready.patch
+i2c-rk3x-give-the-tuning-value-0-during-rk3x_i2c_v0_calc_timings.patch
+i2c-xgene-avoid-dma_buffer-overrun.patch
+i2c-core-fix-null-pointer-dereference-under-race-condition.patch
+drm-dp-mst-clear-port-pdt-when-tearing-down-the-i2c-adapter.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
