port-arm/53171: Broadcom (and other ARM SoC i2c drivers) mis-handle indirect configuration of devices

[thorpej%me.com@localhost]

>Number:         53171
>Category:       port-arm
>Synopsis:       Broadcom (and other ARM SoC i2c drivers) mis-handle indirect configuration of devices
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-arm-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Apr 10 04:35:00 +0000 2018
>Originator:     Jason Thorpe
>Release:        NetBSD 8.99.14 Mon Apr  9 21:30:42 PDT 2018
>Organization:
>Environment:
NetBSD nixie-dev 8.99.14 NetBSD 8.99.14 (thorpej-RPI-NixieClock) #9: Mon Apr  9 21:09:00 PDT 2018  thorpej@BigMac.local:/Volumes/Data0/Users/thorpej/hack/NetBSD/current/src/sys/arch/evbarm/compile/thorpej-RPI-NixieClock evbarm
>Description:
The ?iic? driver supports both direct configuration of devices (for board configs with a known set of devices on the i2c), as well as indirect config, which searches for devices specified in the kernel config file.

It looks like this code has changed a bit since I wrote it 15 years ago.  If the parent driver (bsciic, in this case) provides a prop_array_t as iba->iba_child_devices, then indirect configuration is bypassed.  If it does not, then there?s a dance to check for i2c-indirect-config == false or if the parent has i2c-child-devices as a property on itself, in which case, again, indirect config is skipped.

The problem in the bsciic driver is that if there is not i2c-child-devices property, then an empty array is assigned to iba->iba_child_devices.  This makes the check against NULL fail, and thus no indirect config devices will be found.
>How-To-Repeat:
Attempt to enable indirect configuration of non-standard i2c devices on a Raspberry Pi.
>Fix:
Fix for Raspberry Pi attached.  Other i2c host controller drivers for ARM SoCs have a similar bug.

Index: bcm2835_bsc.c
===================================================================
RCS file: /cvsroot/src/sys/arch/arm/broadcom/bcm2835_bsc.c,v
retrieving revision 1.10
diff -u -p -r1.10 bcm2835_bsc.c
--- bcm2835_bsc.c	3 Mar 2018 16:03:38 -0000	1.10
+++ bcm2835_bsc.c	10 Apr 2018 04:22:17 -0000
@@ -184,7 +184,7 @@ bsciic_attach(device_t parent, device_t 
	if (iba.iba_child_devices)
		prop_object_retain(iba.iba_child_devices);
	else
-		iba.iba_child_devices = prop_array_create();
+		iba.iba_child_devices = NULL;
	prop_object_release(devs);

	config_found_ia(self, "i2cbus", &iba, iicbus_print);