Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

staging: most: remove broken i2c driver

The MOST I2C driver has been completely broken for five years without
anyone noticing so remove the driver from staging.

Specifically, commit 723de0f9171e ("staging: most: remove device from
interface structure") started requiring drivers to set the interface
device pointer before registration, but the I2C driver was never updated
which results in a NULL pointer dereference if anyone ever tries to
probe it.

Fixes: 723de0f9171e ("staging: most: remove device from interface structure")
Cc: Christian Gromm <christian.gromm@microchip.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251029093442.29256-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Johan Hovold and committed by
Greg Kroah-Hartman
495df2da d68eb909

-394
-2
drivers/staging/most/Kconfig
··· 24 24 25 25 source "drivers/staging/most/dim2/Kconfig" 26 26 27 - source "drivers/staging/most/i2c/Kconfig" 28 - 29 27 endif
-1
drivers/staging/most/Makefile
··· 3 3 obj-$(CONFIG_MOST_NET) += net/ 4 4 obj-$(CONFIG_MOST_VIDEO) += video/ 5 5 obj-$(CONFIG_MOST_DIM2) += dim2/ 6 - obj-$(CONFIG_MOST_I2C) += i2c/
-13
drivers/staging/most/i2c/Kconfig
··· 1 - # SPDX-License-Identifier: GPL-2.0 2 - # 3 - # MOST I2C configuration 4 - # 5 - 6 - config MOST_I2C 7 - tristate "I2C" 8 - depends on I2C 9 - help 10 - Say Y here if you want to connect via I2C to network transceiver. 11 - 12 - To compile this driver as a module, choose M here: the 13 - module will be called most_i2c.
-4
drivers/staging/most/i2c/Makefile
··· 1 - # SPDX-License-Identifier: GPL-2.0 2 - obj-$(CONFIG_MOST_I2C) += most_i2c.o 3 - 4 - most_i2c-objs := i2c.o
-374
drivers/staging/most/i2c/i2c.c
··· 1 - // SPDX-License-Identifier: GPL-2.0 2 - /* 3 - * i2c.c - Hardware Dependent Module for I2C Interface 4 - * 5 - * Copyright (C) 2013-2015, Microchip Technology Germany II GmbH & Co. KG 6 - */ 7 - 8 - #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 9 - 10 - #include <linux/init.h> 11 - #include <linux/module.h> 12 - #include <linux/slab.h> 13 - #include <linux/i2c.h> 14 - #include <linux/interrupt.h> 15 - #include <linux/err.h> 16 - #include <linux/most.h> 17 - 18 - enum { CH_RX, CH_TX, NUM_CHANNELS }; 19 - 20 - #define MAX_BUFFERS_CONTROL 32 21 - #define MAX_BUF_SIZE_CONTROL 256 22 - 23 - /** 24 - * list_first_mbo - get the first mbo from a list 25 - * @ptr: the list head to take the mbo from. 26 - */ 27 - #define list_first_mbo(ptr) \ 28 - list_first_entry(ptr, struct mbo, list) 29 - 30 - static unsigned int polling_rate; 31 - module_param(polling_rate, uint, 0644); 32 - MODULE_PARM_DESC(polling_rate, "Polling rate [Hz]. Default = 0 (use IRQ)"); 33 - 34 - struct hdm_i2c { 35 - struct most_interface most_iface; 36 - struct most_channel_capability capabilities[NUM_CHANNELS]; 37 - struct i2c_client *client; 38 - struct rx { 39 - struct delayed_work dwork; 40 - struct list_head list; 41 - bool int_disabled; 42 - unsigned int delay; 43 - } rx; 44 - char name[64]; 45 - }; 46 - 47 - static inline struct hdm_i2c *to_hdm(struct most_interface *iface) 48 - { 49 - return container_of(iface, struct hdm_i2c, most_iface); 50 - } 51 - 52 - static irqreturn_t most_irq_handler(int, void *); 53 - static void pending_rx_work(struct work_struct *); 54 - 55 - /** 56 - * configure_channel - called from MOST core to configure a channel 57 - * @most_iface: interface the channel belongs to 58 - * @ch_idx: channel to be configured 59 - * @channel_config: structure that holds the configuration information 60 - * 61 - * Return 0 on success, negative on failure. 62 - * 63 - * Receives configuration information from MOST core and initialize the 64 - * corresponding channel. 65 - */ 66 - static int configure_channel(struct most_interface *most_iface, 67 - int ch_idx, 68 - struct most_channel_config *channel_config) 69 - { 70 - int ret; 71 - struct hdm_i2c *dev = to_hdm(most_iface); 72 - unsigned int delay, pr; 73 - 74 - BUG_ON(ch_idx < 0 || ch_idx >= NUM_CHANNELS); 75 - 76 - if (channel_config->data_type != MOST_CH_CONTROL) { 77 - pr_err("bad data type for channel %d\n", ch_idx); 78 - return -EPERM; 79 - } 80 - 81 - if (channel_config->direction != dev->capabilities[ch_idx].direction) { 82 - pr_err("bad direction for channel %d\n", ch_idx); 83 - return -EPERM; 84 - } 85 - 86 - if (channel_config->direction == MOST_CH_RX) { 87 - if (!polling_rate) { 88 - if (dev->client->irq <= 0) { 89 - pr_err("bad irq: %d\n", dev->client->irq); 90 - return -ENOENT; 91 - } 92 - dev->rx.int_disabled = false; 93 - ret = request_irq(dev->client->irq, most_irq_handler, 0, 94 - dev->client->name, dev); 95 - if (ret) { 96 - pr_err("request_irq(%d) failed: %d\n", 97 - dev->client->irq, ret); 98 - return ret; 99 - } 100 - } else { 101 - delay = msecs_to_jiffies(MSEC_PER_SEC / polling_rate); 102 - dev->rx.delay = delay ? delay : 1; 103 - pr = MSEC_PER_SEC / jiffies_to_msecs(dev->rx.delay); 104 - pr_info("polling rate is %u Hz\n", pr); 105 - } 106 - } 107 - 108 - return 0; 109 - } 110 - 111 - /** 112 - * enqueue - called from MOST core to enqueue a buffer for data transfer 113 - * @most_iface: intended interface 114 - * @ch_idx: ID of the channel the buffer is intended for 115 - * @mbo: pointer to the buffer object 116 - * 117 - * Return 0 on success, negative on failure. 118 - * 119 - * Transmit the data over I2C if it is a "write" request or push the buffer into 120 - * list if it is an "read" request 121 - */ 122 - static int enqueue(struct most_interface *most_iface, 123 - int ch_idx, struct mbo *mbo) 124 - { 125 - struct hdm_i2c *dev = to_hdm(most_iface); 126 - int ret; 127 - 128 - BUG_ON(ch_idx < 0 || ch_idx >= NUM_CHANNELS); 129 - 130 - if (ch_idx == CH_RX) { 131 - /* RX */ 132 - if (!polling_rate) 133 - disable_irq(dev->client->irq); 134 - cancel_delayed_work_sync(&dev->rx.dwork); 135 - list_add_tail(&mbo->list, &dev->rx.list); 136 - if (dev->rx.int_disabled || polling_rate) 137 - pending_rx_work(&dev->rx.dwork.work); 138 - if (!polling_rate) 139 - enable_irq(dev->client->irq); 140 - } else { 141 - /* TX */ 142 - ret = i2c_master_send(dev->client, mbo->virt_address, 143 - mbo->buffer_length); 144 - if (ret <= 0) { 145 - mbo->processed_length = 0; 146 - mbo->status = MBO_E_INVAL; 147 - } else { 148 - mbo->processed_length = mbo->buffer_length; 149 - mbo->status = MBO_SUCCESS; 150 - } 151 - mbo->complete(mbo); 152 - } 153 - 154 - return 0; 155 - } 156 - 157 - /** 158 - * poison_channel - called from MOST core to poison buffers of a channel 159 - * @most_iface: pointer to the interface the channel to be poisoned belongs to 160 - * @ch_idx: corresponding channel ID 161 - * 162 - * Return 0 on success, negative on failure. 163 - * 164 - * If channel direction is RX, complete the buffers in list with 165 - * status MBO_E_CLOSE 166 - */ 167 - static int poison_channel(struct most_interface *most_iface, 168 - int ch_idx) 169 - { 170 - struct hdm_i2c *dev = to_hdm(most_iface); 171 - struct mbo *mbo; 172 - 173 - BUG_ON(ch_idx < 0 || ch_idx >= NUM_CHANNELS); 174 - 175 - if (ch_idx == CH_RX) { 176 - if (!polling_rate) 177 - free_irq(dev->client->irq, dev); 178 - cancel_delayed_work_sync(&dev->rx.dwork); 179 - 180 - while (!list_empty(&dev->rx.list)) { 181 - mbo = list_first_mbo(&dev->rx.list); 182 - list_del(&mbo->list); 183 - 184 - mbo->processed_length = 0; 185 - mbo->status = MBO_E_CLOSE; 186 - mbo->complete(mbo); 187 - } 188 - } 189 - 190 - return 0; 191 - } 192 - 193 - static void do_rx_work(struct hdm_i2c *dev) 194 - { 195 - struct mbo *mbo; 196 - unsigned char msg[MAX_BUF_SIZE_CONTROL]; 197 - int ret; 198 - u16 pml, data_size; 199 - 200 - /* Read PML (2 bytes) */ 201 - ret = i2c_master_recv(dev->client, msg, 2); 202 - if (ret <= 0) { 203 - pr_err("Failed to receive PML\n"); 204 - return; 205 - } 206 - 207 - pml = (msg[0] << 8) | msg[1]; 208 - if (!pml) 209 - return; 210 - 211 - data_size = pml + 2; 212 - 213 - /* Read the whole message, including PML */ 214 - ret = i2c_master_recv(dev->client, msg, data_size); 215 - if (ret <= 0) { 216 - pr_err("Failed to receive a Port Message\n"); 217 - return; 218 - } 219 - 220 - mbo = list_first_mbo(&dev->rx.list); 221 - list_del(&mbo->list); 222 - 223 - mbo->processed_length = min(data_size, mbo->buffer_length); 224 - memcpy(mbo->virt_address, msg, mbo->processed_length); 225 - mbo->status = MBO_SUCCESS; 226 - mbo->complete(mbo); 227 - } 228 - 229 - /** 230 - * pending_rx_work - Read pending messages through I2C 231 - * @work: definition of this work item 232 - * 233 - * Invoked by the Interrupt Service Routine, most_irq_handler() 234 - */ 235 - static void pending_rx_work(struct work_struct *work) 236 - { 237 - struct hdm_i2c *dev = container_of(work, struct hdm_i2c, rx.dwork.work); 238 - 239 - if (list_empty(&dev->rx.list)) 240 - return; 241 - 242 - do_rx_work(dev); 243 - 244 - if (polling_rate) { 245 - schedule_delayed_work(&dev->rx.dwork, dev->rx.delay); 246 - } else { 247 - dev->rx.int_disabled = false; 248 - enable_irq(dev->client->irq); 249 - } 250 - } 251 - 252 - /* 253 - * most_irq_handler - Interrupt Service Routine 254 - * @irq: irq number 255 - * @_dev: private data 256 - * 257 - * Schedules a delayed work 258 - * 259 - * By default the interrupt line behavior is Active Low. Once an interrupt is 260 - * generated by the device, until driver clears the interrupt (by reading 261 - * the PMP message), device keeps the interrupt line in low state. Since i2c 262 - * read is done in work queue, the interrupt line must be disabled temporarily 263 - * to avoid ISR being called repeatedly. Re-enable the interrupt in workqueue, 264 - * after reading the message. 265 - * 266 - * Note: If we use the interrupt line in Falling edge mode, there is a 267 - * possibility to miss interrupts when ISR is getting executed. 268 - * 269 - */ 270 - static irqreturn_t most_irq_handler(int irq, void *_dev) 271 - { 272 - struct hdm_i2c *dev = _dev; 273 - 274 - disable_irq_nosync(irq); 275 - dev->rx.int_disabled = true; 276 - schedule_delayed_work(&dev->rx.dwork, 0); 277 - 278 - return IRQ_HANDLED; 279 - } 280 - 281 - /* 282 - * i2c_probe - i2c probe handler 283 - * @client: i2c client device structure 284 - * @id: i2c client device id 285 - * 286 - * Return 0 on success, negative on failure. 287 - * 288 - * Register the i2c client device as a MOST interface 289 - */ 290 - static int i2c_probe(struct i2c_client *client) 291 - { 292 - struct hdm_i2c *dev; 293 - int ret, i; 294 - 295 - dev = kzalloc(sizeof(*dev), GFP_KERNEL); 296 - if (!dev) 297 - return -ENOMEM; 298 - 299 - /* ID format: i2c-<bus>-<address> */ 300 - snprintf(dev->name, sizeof(dev->name), "i2c-%d-%04x", 301 - client->adapter->nr, client->addr); 302 - 303 - for (i = 0; i < NUM_CHANNELS; i++) { 304 - dev->capabilities[i].data_type = MOST_CH_CONTROL; 305 - dev->capabilities[i].num_buffers_packet = MAX_BUFFERS_CONTROL; 306 - dev->capabilities[i].buffer_size_packet = MAX_BUF_SIZE_CONTROL; 307 - } 308 - dev->capabilities[CH_RX].direction = MOST_CH_RX; 309 - dev->capabilities[CH_RX].name_suffix = "rx"; 310 - dev->capabilities[CH_TX].direction = MOST_CH_TX; 311 - dev->capabilities[CH_TX].name_suffix = "tx"; 312 - 313 - dev->most_iface.interface = ITYPE_I2C; 314 - dev->most_iface.description = dev->name; 315 - dev->most_iface.num_channels = NUM_CHANNELS; 316 - dev->most_iface.channel_vector = dev->capabilities; 317 - dev->most_iface.configure = configure_channel; 318 - dev->most_iface.enqueue = enqueue; 319 - dev->most_iface.poison_channel = poison_channel; 320 - 321 - INIT_LIST_HEAD(&dev->rx.list); 322 - 323 - INIT_DELAYED_WORK(&dev->rx.dwork, pending_rx_work); 324 - 325 - dev->client = client; 326 - i2c_set_clientdata(client, dev); 327 - 328 - ret = most_register_interface(&dev->most_iface); 329 - if (ret) { 330 - pr_err("Failed to register i2c as a MOST interface\n"); 331 - kfree(dev); 332 - return ret; 333 - } 334 - 335 - return 0; 336 - } 337 - 338 - /* 339 - * i2c_remove - i2c remove handler 340 - * @client: i2c client device structure 341 - * 342 - * Return 0 on success. 343 - * 344 - * Unregister the i2c client device as a MOST interface 345 - */ 346 - static void i2c_remove(struct i2c_client *client) 347 - { 348 - struct hdm_i2c *dev = i2c_get_clientdata(client); 349 - 350 - most_deregister_interface(&dev->most_iface); 351 - kfree(dev); 352 - } 353 - 354 - static const struct i2c_device_id i2c_id[] = { 355 - { "most_i2c" }, 356 - { } /* Terminating entry */ 357 - }; 358 - 359 - MODULE_DEVICE_TABLE(i2c, i2c_id); 360 - 361 - static struct i2c_driver i2c_driver = { 362 - .driver = { 363 - .name = "hdm_i2c", 364 - }, 365 - .probe = i2c_probe, 366 - .remove = i2c_remove, 367 - .id_table = i2c_id, 368 - }; 369 - 370 - module_i2c_driver(i2c_driver); 371 - 372 - MODULE_AUTHOR("Andrey Shvetsov <andrey.shvetsov@k2l.de>"); 373 - MODULE_DESCRIPTION("I2C Hardware Dependent Module"); 374 - MODULE_LICENSE("GPL");