<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/drivers/i2c, branch v7.2-rc6</title>
<subtitle>Linux kernel source tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/'/>
<entry>
<title>i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers</title>
<updated>2026-07-28T21:34:16+00:00</updated>
<author>
<name>Wenmeng Liu</name>
<email>wenmeng.liu@oss.qualcomm.com</email>
</author>
<published>2026-06-25T09:42:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=b08c9857aa1f5f3a81d375d6d4bb1d8b92f22ebc'/>
<id>b08c9857aa1f5f3a81d375d6d4bb1d8b92f22ebc</id>
<content type='text'>
cci_resume() unconditionally calls cci_resume_runtime() regardless of
the runtime PM state.

If the device is already runtime-suspended before system suspend,
the clock is re-enabled while runtime_status remains RPM_SUSPENDED.
As a result, pm_request_autosuspend() does not arm the timer,
leaving the clock permanently enabled.

Fixes: e517526195de ("i2c: Add Qualcomm CCI I2C driver")
Signed-off-by: Wenmeng Liu &lt;wenmeng.liu@oss.qualcomm.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v5.8+
Reviewed-by: Vladimir Zapolskiy &lt;vladimir.zapolskiy@linaro.org&gt;
Reviewed-by: Konrad Dybcio &lt;konrad.dybcio@oss.qualcomm.com&gt;
Reviewed-by: Loic Poulain &lt;loic.poulain@oss.qualcomm.com&gt;
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260625-cci-v1-1-a100cda673ce@oss.qualcomm.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
cci_resume() unconditionally calls cci_resume_runtime() regardless of
the runtime PM state.

If the device is already runtime-suspended before system suspend,
the clock is re-enabled while runtime_status remains RPM_SUSPENDED.
As a result, pm_request_autosuspend() does not arm the timer,
leaving the clock permanently enabled.

Fixes: e517526195de ("i2c: Add Qualcomm CCI I2C driver")
Signed-off-by: Wenmeng Liu &lt;wenmeng.liu@oss.qualcomm.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v5.8+
Reviewed-by: Vladimir Zapolskiy &lt;vladimir.zapolskiy@linaro.org&gt;
Reviewed-by: Konrad Dybcio &lt;konrad.dybcio@oss.qualcomm.com&gt;
Reviewed-by: Loic Poulain &lt;loic.poulain@oss.qualcomm.com&gt;
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260625-cci-v1-1-a100cda673ce@oss.qualcomm.com
</pre>
</div>
</content>
</entry>
<entry>
<title>i2c: imx: Cancel hrtimer before clearing slave pointer</title>
<updated>2026-07-28T21:24:03+00:00</updated>
<author>
<name>Liem</name>
<email>liem16213@gmail.com</email>
</author>
<published>2026-06-29T02:38:29+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f'/>
<id>6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f</id>
<content type='text'>
In i2c_imx_unreg_slave(), the slave pointer is set to NULL after
disabling interrupts.  However, a pending interrupt might already
have started the hrtimer (i2c_imx_slave_timeout) before the pointer
was cleared.  If the hrtimer fires after i2c_imx-&gt;slave is set to
NULL, the timer callback i2c_imx_slave_finish_op() will call
i2c_imx_slave_event() with a NULL slave pointer, which results in a
use-after-free / NULL pointer dereference.

Fix by canceling the hrtimer and waiting for it to complete after
disabling interrupts, before clearing the slave pointer.

Fixes: f7414cd6923f ("i2c: imx: support slave mode for imx I2C driver")
Signed-off-by: Liem &lt;liem16213@gmail.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v5.11+
Acked-by: Carlos Song &lt;carlos.song@nxp.com&gt;
Reviewed-by: Frank Li &lt;Frank.Li@nxp.com&gt;
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260629023829.152651-3-liem16213@gmail.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In i2c_imx_unreg_slave(), the slave pointer is set to NULL after
disabling interrupts.  However, a pending interrupt might already
have started the hrtimer (i2c_imx_slave_timeout) before the pointer
was cleared.  If the hrtimer fires after i2c_imx-&gt;slave is set to
NULL, the timer callback i2c_imx_slave_finish_op() will call
i2c_imx_slave_event() with a NULL slave pointer, which results in a
use-after-free / NULL pointer dereference.

Fix by canceling the hrtimer and waiting for it to complete after
disabling interrupts, before clearing the slave pointer.

Fixes: f7414cd6923f ("i2c: imx: support slave mode for imx I2C driver")
Signed-off-by: Liem &lt;liem16213@gmail.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v5.11+
Acked-by: Carlos Song &lt;carlos.song@nxp.com&gt;
Reviewed-by: Frank Li &lt;Frank.Li@nxp.com&gt;
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260629023829.152651-3-liem16213@gmail.com
</pre>
</div>
</content>
</entry>
<entry>
<title>i2c: imx: Fix slave registration race and error handling</title>
<updated>2026-07-28T21:23:20+00:00</updated>
<author>
<name>Liem</name>
<email>liem16213@gmail.com</email>
</author>
<published>2026-06-29T02:38:28+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=d64ec362c369bbc33833f7936d5f3a706b0d5c45'/>
<id>d64ec362c369bbc33833f7936d5f3a706b0d5c45</id>
<content type='text'>
In i2c_imx_reg_slave(), the slave pointer was assigned before
pm_runtime_resume_and_get().  If pm_runtime_resume_and_get() failed,
the error path returned without clearing i2c_imx-&gt;slave, leaving it
non-NULL and causing all subsequent registration attempts to fail
with -EBUSY.

Additionally, because this driver uses a shared IRQ, the interrupt
handler i2c_imx_isr() can execute concurrently and, after acquiring
slave_lock, dereference i2c_imx-&gt;slave.  The previous fix attempt
added a lockless i2c_imx-&gt;slave = NULL on the error path, but that
could race with the ISR under the lock and still cause a NULL pointer
dereference.

Fix both issues by deferring the assignment of i2c_imx-&gt;slave and
i2c_imx-&gt;last_slave_event to after a successful resume, and by
performing the assignment inside the slave_lock critical section.
This guarantees that the slave pointer is never left stale on the
error path and is always valid when observed by the interrupt handler.

Fixes: f7414cd6923f ("i2c: imx: support slave mode for imx I2C driver")
Signed-off-by: Liem &lt;liem16213@gmail.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v5.11+
Reviewed-by: Frank Li &lt;Frank.Li@nxp.com&gt;
Acked-by: Carlos Song &lt;carlos.song@nxp.com&gt;
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260629023829.152651-2-liem16213@gmail.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In i2c_imx_reg_slave(), the slave pointer was assigned before
pm_runtime_resume_and_get().  If pm_runtime_resume_and_get() failed,
the error path returned without clearing i2c_imx-&gt;slave, leaving it
non-NULL and causing all subsequent registration attempts to fail
with -EBUSY.

Additionally, because this driver uses a shared IRQ, the interrupt
handler i2c_imx_isr() can execute concurrently and, after acquiring
slave_lock, dereference i2c_imx-&gt;slave.  The previous fix attempt
added a lockless i2c_imx-&gt;slave = NULL on the error path, but that
could race with the ISR under the lock and still cause a NULL pointer
dereference.

Fix both issues by deferring the assignment of i2c_imx-&gt;slave and
i2c_imx-&gt;last_slave_event to after a successful resume, and by
performing the assignment inside the slave_lock critical section.
This guarantees that the slave pointer is never left stale on the
error path and is always valid when observed by the interrupt handler.

Fixes: f7414cd6923f ("i2c: imx: support slave mode for imx I2C driver")
Signed-off-by: Liem &lt;liem16213@gmail.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v5.11+
Reviewed-by: Frank Li &lt;Frank.Li@nxp.com&gt;
Acked-by: Carlos Song &lt;carlos.song@nxp.com&gt;
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260629023829.152651-2-liem16213@gmail.com
</pre>
</div>
</content>
</entry>
<entry>
<title>i2c: iproc: reset bus after timeout if START_BUSY is stuck</title>
<updated>2026-07-28T20:44:48+00:00</updated>
<author>
<name>Jonas Gorski</name>
<email>jonas.gorski@bisdn.de</email>
</author>
<published>2026-07-17T08:55:07+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=98f2e9e6d6f91a6abb43f166b244b428ba85fa2b'/>
<id>98f2e9e6d6f91a6abb43f166b244b428ba85fa2b</id>
<content type='text'>
If a transaction times out, the START_BUSY signal can stay up, and
subsequent transactaction attempts will fail as the bus is still
considered busy.

I can easily trigger this by attempting to read from an address with no
device, e.g. when running i2cdetect. After the first read times out, all
subsequent read attempts return busy.

To get to a working state again, the controller needs to be reset to
clear the START_BUSY signal. So check for START_BUSY still asserted on a
timeout, and do reset in case it is,

This is also done by the original non-upstream iproc-smbus driver
implementation [1].

Works around situations like:

    bcm-iproc-2c 1803b000.i2c: transaction timed out
    bcm-iproc-2c 1803b000.i2c: bus is busy
    bcm-iproc-2c 1803b000.i2c: bus is busy
    bcm-iproc-2c 1803b000.i2c: bus is busy
    bcm-iproc-2c 1803b000.i2c: bus is busy
    bcm-iproc-2c 1803b000.i2c: bus is busy
    ...

where the bus never recovers after a timeout.

[1] https://github.com/opencomputeproject/onie/blob/master/patches/kernel/3.2.69/driver-iproc-smbus.patch

Fixes: e6e5dd3566e0 ("i2c: iproc: Add Broadcom iProc I2C Driver")
Signed-off-by: Jonas Gorski &lt;jonas.gorski@bisdn.de&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v4.0+
Acked-by: Ray Jui &lt;ray.jui@broadcom.com&gt;
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260717085507.34209-1-jonas.gorski@bisdn.de
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
If a transaction times out, the START_BUSY signal can stay up, and
subsequent transactaction attempts will fail as the bus is still
considered busy.

I can easily trigger this by attempting to read from an address with no
device, e.g. when running i2cdetect. After the first read times out, all
subsequent read attempts return busy.

To get to a working state again, the controller needs to be reset to
clear the START_BUSY signal. So check for START_BUSY still asserted on a
timeout, and do reset in case it is,

This is also done by the original non-upstream iproc-smbus driver
implementation [1].

Works around situations like:

    bcm-iproc-2c 1803b000.i2c: transaction timed out
    bcm-iproc-2c 1803b000.i2c: bus is busy
    bcm-iproc-2c 1803b000.i2c: bus is busy
    bcm-iproc-2c 1803b000.i2c: bus is busy
    bcm-iproc-2c 1803b000.i2c: bus is busy
    bcm-iproc-2c 1803b000.i2c: bus is busy
    ...

where the bus never recovers after a timeout.

[1] https://github.com/opencomputeproject/onie/blob/master/patches/kernel/3.2.69/driver-iproc-smbus.patch

Fixes: e6e5dd3566e0 ("i2c: iproc: Add Broadcom iProc I2C Driver")
Signed-off-by: Jonas Gorski &lt;jonas.gorski@bisdn.de&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v4.0+
Acked-by: Ray Jui &lt;ray.jui@broadcom.com&gt;
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260717085507.34209-1-jonas.gorski@bisdn.de
</pre>
</div>
</content>
</entry>
<entry>
<title>i2c: imx: mark I2C adapter when hardware is powered down</title>
<updated>2026-07-28T15:33:07+00:00</updated>
<author>
<name>Carlos Song</name>
<email>carlos.song@nxp.com</email>
</author>
<published>2026-05-25T03:04:00+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=00d86dd5c2034e0e139e4806137b3b43e07ddd83'/>
<id>00d86dd5c2034e0e139e4806137b3b43e07ddd83</id>
<content type='text'>
On some i.MX platforms, certain I2C client drivers keep a periodic
workqueue which continues to trigger I2C transfers.

During system suspend/resume, there exists a time window between:
  - suspend_noirq and the system entering suspend
  - the system starting to resume and resume_noirq

In this window, the I2C controller resources such as clock and pinctrl
may already be disabled or not yet restored.

If a workqueue triggers an I2C transfer in this period, the driver
attempts to access I2C registers while the hardware resources are
unavailable, which may lead to system hang.

Mark the I2C adapter as suspended during noirq suspend and block new
transfers until resume, ensuring that I2C transfers are only issued
when hardware resources are available.

Fixes: 358025ac091e ("i2c: imx: make controller available until system suspend_noirq() and from resume_noirq()")
Signed-off-by: Carlos Song &lt;carlos.song@nxp.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v6.14+
Reviewed-by: Frank Li &lt;Frank.Li@nxp.com&gt;
Acked-by: Oleksij Rempel &lt;o.rempel@pengutronix.de&gt;
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260525030400.3182911-1-carlos.song@oss.nxp.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
On some i.MX platforms, certain I2C client drivers keep a periodic
workqueue which continues to trigger I2C transfers.

During system suspend/resume, there exists a time window between:
  - suspend_noirq and the system entering suspend
  - the system starting to resume and resume_noirq

In this window, the I2C controller resources such as clock and pinctrl
may already be disabled or not yet restored.

If a workqueue triggers an I2C transfer in this period, the driver
attempts to access I2C registers while the hardware resources are
unavailable, which may lead to system hang.

Mark the I2C adapter as suspended during noirq suspend and block new
transfers until resume, ensuring that I2C transfers are only issued
when hardware resources are available.

Fixes: 358025ac091e ("i2c: imx: make controller available until system suspend_noirq() and from resume_noirq()")
Signed-off-by: Carlos Song &lt;carlos.song@nxp.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v6.14+
Reviewed-by: Frank Li &lt;Frank.Li@nxp.com&gt;
Acked-by: Oleksij Rempel &lt;o.rempel@pengutronix.de&gt;
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260525030400.3182911-1-carlos.song@oss.nxp.com
</pre>
</div>
</content>
</entry>
<entry>
<title>i2c: designware: defer probe if child GpioInt controllers are not bound</title>
<updated>2026-07-28T08:24:35+00:00</updated>
<author>
<name>Hardik Prakash</name>
<email>hardikprakash.official@gmail.com</email>
</author>
<published>2026-07-18T05:43:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=0a4bb2abc3e56d7be6e69b050c88ba52c87e22bf'/>
<id>0a4bb2abc3e56d7be6e69b050c88ba52c87e22bf</id>
<content type='text'>
I2C controllers may have child devices with GpioInt resources that
depend on GPIO controllers being fully initialized. If the I2C
controller probes and enumerates children before the referenced GPIO
controller has completed probe, GPIO interrupts may not be properly
configured, leading to device failures.

On Lenovo Yoga 7 14AGP11, the WACF2200 touchscreen (child of
AMDI0010:02) has a GpioInt resource pointing to GPIO 157 on the
pinctrl-amd controller (AMDI0030:00). When i2c-designware probes
AMDI0010:02 before pinctrl-amd finishes initializing, I2C transactions
fail with lost arbitration errors:

  0.285952  amd_gpio_probe: registering gpiochip  &lt;- GPIO chip visible
  0.287121  amd_gpio_probe: requesting parent IRQ &lt;- probe still running
  0.301454  AMDI0010:02 dw_i2c_plat_probe: start  &lt;- races here
  2.348157  lost arbitration

Add a dependency check that walks ACPI child devices and defers probe
until any referenced GPIO controller is bound.

Fixes: 3812a9e84265 ("pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11")
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221494
Suggested-by: Mario Limonciello &lt;mario.limonciello@amd.com&gt;
Suggested-by: Andy Shevchenko &lt;andriy.shevchenko@intel.com&gt;
Signed-off-by: Hardik Prakash &lt;hardikprakash.official@gmail.com&gt;
Assisted-by: Claude:claude-sonnet-5
Assisted-by: DeepSeek:deepseek-v4-pro
Cc: &lt;stable@vger.kernel.org&gt; # v7.1+
Acked-by: Bartosz Golaszewski &lt;bartosz.golaszewski@oss.qualcomm.com&gt;
Reviewed-by: Andy Shevchenko &lt;andriy.shevchenko@intel.com&gt;
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260718054330.8975-2-hardikprakash.official@gmail.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
I2C controllers may have child devices with GpioInt resources that
depend on GPIO controllers being fully initialized. If the I2C
controller probes and enumerates children before the referenced GPIO
controller has completed probe, GPIO interrupts may not be properly
configured, leading to device failures.

On Lenovo Yoga 7 14AGP11, the WACF2200 touchscreen (child of
AMDI0010:02) has a GpioInt resource pointing to GPIO 157 on the
pinctrl-amd controller (AMDI0030:00). When i2c-designware probes
AMDI0010:02 before pinctrl-amd finishes initializing, I2C transactions
fail with lost arbitration errors:

  0.285952  amd_gpio_probe: registering gpiochip  &lt;- GPIO chip visible
  0.287121  amd_gpio_probe: requesting parent IRQ &lt;- probe still running
  0.301454  AMDI0010:02 dw_i2c_plat_probe: start  &lt;- races here
  2.348157  lost arbitration

Add a dependency check that walks ACPI child devices and defers probe
until any referenced GPIO controller is bound.

Fixes: 3812a9e84265 ("pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11")
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221494
Suggested-by: Mario Limonciello &lt;mario.limonciello@amd.com&gt;
Suggested-by: Andy Shevchenko &lt;andriy.shevchenko@intel.com&gt;
Signed-off-by: Hardik Prakash &lt;hardikprakash.official@gmail.com&gt;
Assisted-by: Claude:claude-sonnet-5
Assisted-by: DeepSeek:deepseek-v4-pro
Cc: &lt;stable@vger.kernel.org&gt; # v7.1+
Acked-by: Bartosz Golaszewski &lt;bartosz.golaszewski@oss.qualcomm.com&gt;
Reviewed-by: Andy Shevchenko &lt;andriy.shevchenko@intel.com&gt;
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260718054330.8975-2-hardikprakash.official@gmail.com
</pre>
</div>
</content>
</entry>
<entry>
<title>i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock</title>
<updated>2026-07-27T20:56:08+00:00</updated>
<author>
<name>H. Nikolaus Schaller</name>
<email>hns@goldelico.com</email>
</author>
<published>2026-07-19T20:19:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=d99607c888f26e8a4e9fe9772860cef4aff86bb4'/>
<id>d99607c888f26e8a4e9fe9772860cef4aff86bb4</id>
<content type='text'>
Fix a severe AB/BA deadlock between the Common Clock Framework (CCF)
and the I2C adapter lock, which triggers when an I2C-controlled clock
generator client (like the Si5351) is registered or modified under the CCF.

During an i2c client clock (generator) frequency change, the CCF acquires its global
'prepare_lock' mutex and the driver calls i2c_transfer() to update the client's
chip registers, stalling for the adapter's I2C bus lock.

Concurrently, an independent, parallel transfer on the same bus (e.g., a GPIO
expander handling LEDs) can hold the I2C adapter lock. Inside this parallel
transfer path, jz4780_i2c_set_speed() calls clk_get_rate() on the host
controller's input clock to calculate bus timings. This call attempts to acquire
the blocked CCF 'prepare_lock', creating a circular dependency that freezes
the system.

The jz4780 host controller clock itself is static and never changes at runtime.

However, calling clk_get_rate() inside the active transfer path introduces
an unnecessary dependency on the CCF internal locks.

Eliminate this synchronous clk_get_rate() call from the active transfer
path by caching the static host peripheral clock rate once - inside the private
jz4780_i2c structure during jz4780_i2c_probe(). Update jz4780_i2c_set_speed()
to use this cached value, safely decoupling active I2C transactions from the
CCF internal locks without any risk of stale timings.

Assisted-by web based Google AI (pinpointing the bug and writing the message).

Fixes: ba92222ed63a12 ("i2c: jz4780: Add i2c bus controller driver for Ingenic JZ4780")
Signed-off-by: H. Nikolaus Schaller &lt;hns@goldelico.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v4.1+
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/2db6fd233aceb7238474e4833f4d25ca681c3ffb.1784492382.git.hns@goldelico.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Fix a severe AB/BA deadlock between the Common Clock Framework (CCF)
and the I2C adapter lock, which triggers when an I2C-controlled clock
generator client (like the Si5351) is registered or modified under the CCF.

During an i2c client clock (generator) frequency change, the CCF acquires its global
'prepare_lock' mutex and the driver calls i2c_transfer() to update the client's
chip registers, stalling for the adapter's I2C bus lock.

Concurrently, an independent, parallel transfer on the same bus (e.g., a GPIO
expander handling LEDs) can hold the I2C adapter lock. Inside this parallel
transfer path, jz4780_i2c_set_speed() calls clk_get_rate() on the host
controller's input clock to calculate bus timings. This call attempts to acquire
the blocked CCF 'prepare_lock', creating a circular dependency that freezes
the system.

The jz4780 host controller clock itself is static and never changes at runtime.

However, calling clk_get_rate() inside the active transfer path introduces
an unnecessary dependency on the CCF internal locks.

Eliminate this synchronous clk_get_rate() call from the active transfer
path by caching the static host peripheral clock rate once - inside the private
jz4780_i2c structure during jz4780_i2c_probe(). Update jz4780_i2c_set_speed()
to use this cached value, safely decoupling active I2C transactions from the
CCF internal locks without any risk of stale timings.

Assisted-by web based Google AI (pinpointing the bug and writing the message).

Fixes: ba92222ed63a12 ("i2c: jz4780: Add i2c bus controller driver for Ingenic JZ4780")
Signed-off-by: H. Nikolaus Schaller &lt;hns@goldelico.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v4.1+
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/2db6fd233aceb7238474e4833f4d25ca681c3ffb.1784492382.git.hns@goldelico.com
</pre>
</div>
</content>
</entry>
<entry>
<title>i2c: amd-mp2: Unregister callback on adapter add failure</title>
<updated>2026-07-27T20:52:34+00:00</updated>
<author>
<name>Myeonghun Pak</name>
<email>mhun512@gmail.com</email>
</author>
<published>2026-07-21T14:41:47+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=82048795242f04275a3f49ffc66ad851b6120954'/>
<id>82048795242f04275a3f49ffc66ad851b6120954</id>
<content type='text'>
amd_mp2_register_cb() stores the platform I2C context in the MP2 PCI
driver's callback table before the adapter is registered. If
i2c_add_adapter() fails, probe returns and devres frees the context,
but the PCI driver can still dereference the stale pointer from its IRQ
and system-sleep callbacks.

Unregister the callback before returning the adapter registration error.

Fixes: 529766e0a011 ("i2c: Add drivers for the AMD PCIe MP2 I2C controller")
Co-developed-by: Ijae Kim &lt;ae878000@gmail.com&gt;
Signed-off-by: Ijae Kim &lt;ae878000@gmail.com&gt;
Signed-off-by: Myeonghun Pak &lt;mhun512@gmail.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v5.2+
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260721144147.31150-1-mhun512@gmail.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
amd_mp2_register_cb() stores the platform I2C context in the MP2 PCI
driver's callback table before the adapter is registered. If
i2c_add_adapter() fails, probe returns and devres frees the context,
but the PCI driver can still dereference the stale pointer from its IRQ
and system-sleep callbacks.

Unregister the callback before returning the adapter registration error.

Fixes: 529766e0a011 ("i2c: Add drivers for the AMD PCIe MP2 I2C controller")
Co-developed-by: Ijae Kim &lt;ae878000@gmail.com&gt;
Signed-off-by: Ijae Kim &lt;ae878000@gmail.com&gt;
Signed-off-by: Myeonghun Pak &lt;mhun512@gmail.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v5.2+
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260721144147.31150-1-mhun512@gmail.com
</pre>
</div>
</content>
</entry>
<entry>
<title>i2c: spacemit: request IRQ after controller initialization</title>
<updated>2026-07-27T20:52:34+00:00</updated>
<author>
<name>Linmao Li</name>
<email>lilinmao@kylinos.cn</email>
</author>
<published>2026-07-23T02:11:40+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=cdac670237258c8ca063aa8a16998f680d81b80d'/>
<id>cdac670237258c8ca063aa8a16998f680d81b80d</id>
<content type='text'>
spacemit_i2c_probe() requests the IRQ before it enables the clocks, resets
the controller and runs init_completion(). If an interrupt is already
pending, the handler runs too early: it reads registers while the clocks
are still off and calls complete() on an uninitialized completion. Request
the IRQ after the controller and completion are initialized, but still
before the adapter is registered.

Fixes: 5ea558473fa3 ("i2c: spacemit: add support for SpacemiT K1 SoC")
Signed-off-by: Linmao Li &lt;lilinmao@kylinos.cn&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v6.15+
Reviewed-by: Troy Mitchell &lt;troy.mitchell@linux.spacemit.com&gt;
Reviewed-by: Alex Elder &lt;elder@riscstar.com&gt;
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260723021140.2293844-1-lilinmao@kylinos.cn
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
spacemit_i2c_probe() requests the IRQ before it enables the clocks, resets
the controller and runs init_completion(). If an interrupt is already
pending, the handler runs too early: it reads registers while the clocks
are still off and calls complete() on an uninitialized completion. Request
the IRQ after the controller and completion are initialized, but still
before the adapter is registered.

Fixes: 5ea558473fa3 ("i2c: spacemit: add support for SpacemiT K1 SoC")
Signed-off-by: Linmao Li &lt;lilinmao@kylinos.cn&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v6.15+
Reviewed-by: Troy Mitchell &lt;troy.mitchell@linux.spacemit.com&gt;
Reviewed-by: Alex Elder &lt;elder@riscstar.com&gt;
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260723021140.2293844-1-lilinmao@kylinos.cn
</pre>
</div>
</content>
</entry>
<entry>
<title>i2c: mediatek: fix WRRD for SoCs without auto_restart option</title>
<updated>2026-07-14T22:21:51+00:00</updated>
<author>
<name>Roman Vivchar</name>
<email>rva333@protonmail.com</email>
</author>
<published>2026-07-09T13:31:29+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=deb35336b5bfed5db9231b5348bc1514db930797'/>
<id>deb35336b5bfed5db9231b5348bc1514db930797</id>
<content type='text'>
MediaTek mt65xx family SoCs have no auto restart, however, they still
support the WRRD mode in the hardware. Because auto_restart is set to 0,
the WRRD mode will be never enabled, leading to read errors.

Fix this by removing auto_restart check from the WRRD enable path.

Fixes: b49218365280 ("i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD")
Signed-off-by: Roman Vivchar &lt;rva333@protonmail.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v6.18+
Reviewed-by: AngeloGioacchino Del Regno &lt;angelogioacchino.delregno@collabora.com&gt;
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260709-6572-6595-i2c-v2-1-b2fb8510d1d3@protonmail.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
MediaTek mt65xx family SoCs have no auto restart, however, they still
support the WRRD mode in the hardware. Because auto_restart is set to 0,
the WRRD mode will be never enabled, leading to read errors.

Fix this by removing auto_restart check from the WRRD enable path.

Fixes: b49218365280 ("i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD")
Signed-off-by: Roman Vivchar &lt;rva333@protonmail.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v6.18+
Reviewed-by: AngeloGioacchino Del Regno &lt;angelogioacchino.delregno@collabora.com&gt;
Signed-off-by: Andi Shyti &lt;andi.shyti@kernel.org&gt;
Link: https://lore.kernel.org/r/20260709-6572-6595-i2c-v2-1-b2fb8510d1d3@protonmail.com
</pre>
</div>
</content>
</entry>
</feed>
