kernel/git/stable/linux.git/drivers/i3c/master, branch linux-6.6.y

i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode

2026-09-14T11:29:56+00:00

[ Upstream commit 308ecb824db329a8e22dd0b10f2a3411a6fbbde3 ] In PIO mode initialization, STAT_IBI_STATUS_THLD was missing from pio->enabled_irqs. As a result, the host controller interrupt signal for IBI threshold was never enabled when transfer starts, preventing IBI status descriptors from being properly processed in PIO mode. Include STAT_IBI_STATUS_THLD in pio->enabled_irqs so that the IBI threshold interrupt is activated alongside error interrupts upon the first transfer. Fixes: 9ad9a52cce28 ("i3c/master: introduce the mipi-i3c-hci driver") Co-developed-by: Patrick Yen Signed-off-by: Patrick Yen Signed-off-by: Jian-Ming Liao Reviewed-by: Frank Li Link: https://patch.msgid.link/20260818104106.763772-2-Jm_Liao@asmedia.com.tw Signed-off-by: Alexandre Belloni Signed-off-by: Sasha Levin

i3c: mipi-i3c-hci: Refactor PIO register initialization

2026-09-14T11:29:55+00:00

[ Upstream commit ca4d4682d353bf4e7e5db7b025e9ecd80bc67b27 ] Move the PIO register setup logic out of hci_pio_init() into a new helper, __hci_pio_init(). This refactoring prepares for Runtime PM support by allowing PIO registers to be reinitialized independently after resume. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260113072702.16268-13-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni Stable-dep-of: 308ecb824db3 ("i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode") Signed-off-by: Sasha Levin

i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc()

2026-09-14T11:29:55+00:00

[ Upstream commit 11d17c2855bfc04550557017eae02e92f3eeab1c ] The driver already uses managed resources, so convert the PIO data structure allocation to devm_zalloc(). Remove the manual kfree(). Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260113072702.16268-7-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni Stable-dep-of: 308ecb824db3 ("i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode") Signed-off-by: Sasha Levin

i3c: mipi-i3c-hci: Quieten initialization messages

2026-09-14T11:29:55+00:00

[ Upstream commit 581d5b7953b8f24d2f379c8c56ceaa7d163488ce ] The copious initialization messages are at most useful only for debugging. Change them from dev_info() or dev_notice() to dev_dbg(). Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260106164416.67074-4-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni Stable-dep-of: 308ecb824db3 ("i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode") Signed-off-by: Sasha Levin

i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1

2026-09-14T11:29:55+00:00

[ Upstream commit be90ae1ba14a83962b33c4d4c854ef081186b0e4 ] I was wrong about the TABLE_SIZE field description in the commit 0676bfebf576 ("i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes"). For the MIPI I3C HCI versions 1.0 and earlier the TABLE_SIZE field in the registers DAT_SECTION_OFFSET and DCT_SECTION_OFFSET is indeed defined in DWORDs and not number of entries like it is defined in later versions. Where above fix allowed driver initialization to continue the wrongly interpreted TABLE_SIZE field leads variables DAT_entries being twice and DCT_entries four times as big as they really are. That in turn leads clearing the DAT table over the boundary in the dat_v1.c: hci_dat_v1_init(). So interprete the TABLE_SIZE field in DWORDs for HCI versions < 1.1 and fix number of DAT/DCT entries accordingly. Fixes: 0676bfebf576 ("i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes") Signed-off-by: Jarkko Nikula Signed-off-by: Alexandre Belloni Stable-dep-of: 308ecb824db3 ("i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode") Signed-off-by: Sasha Levin

i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes

2026-09-14T11:29:55+00:00

[ Upstream commit 0676bfebf5766f0a60549f74ba597115028fa39c ] MIPI I3C HCI specification v1.1 describes the ENTRY_SIZE field for the Device Address Table (DAT) and the Device Characteristics Table (DCT) section offset registers (DAT_SECTION_OFFSET and DCT_SECTION_OFFSET). That field is not documented in earlier version. ENTRY_SIZE value 0 is meant to be backward compatible. For the DAT entry size it is interpreted as 2 DWORDs (8-bytes) and for the DCT entry size as 4 DWORDs (16-bytes). Values 1-15 are reserved for future use. New version I believe fixes also the TABLE_SIZE field description. Before it was defined in DWORDs which I believe is incorrect since the DAT/DCT table entry structures, and sizes, are described having 8-bytes/16-bytes entries. This is more clear in the specification v1.1 which states the TABLE_SIZE fields are interpreted as number of entries in the DAT/DCT tables. I believe this same holds also in earlier version, at least it makes more sense. Fix code accordingly and let the DAT_entry_size and the DCT_entry_size variables carry the size as bytes. Which is how it is already interpreted in the dat_v1.c: hci_dat_v1_init(). Signed-off-by: Jarkko Nikula Link: https://lore.kernel.org/r/20230921055704.1087277-4-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni Stable-dep-of: 308ecb824db3 ("i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode") Signed-off-by: Sasha Levin

i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices

2026-09-14T11:29:30+00:00

[ Upstream commit 038cf48b3170af26a70bf2dee4f8c3ac910f5176 ] On an empty bus ENTDAA assigns nothing, so cmd->rx_len (the count of addresses left unassigned) equals master->maxdevs. The GENMASK() index master->maxdevs - cmd->rx_len - 1 then becomes -1, which trips up UBSAN. This happens every time on boot on a Gigabyte/AMD server: UBSAN: shift-out-of-bounds in drivers/i3c/master/dw-i3c-master.c:905:12 shift exponent 64 is too large for 64-bit type 'long unsigned int' CPU: 7 UID: 0 PID: 963 Comm: (udev-worker) Not tainted 7.0.11-200.fc44.x86_64 #1 PREEMPT(lazy) Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R32_F45 04/01/2026 Call Trace: dump_stack_lvl+0x5d/0x80 ubsan_epilogue+0x5/0x2b __ubsan_handle_shift_out_of_bounds.cold+0xd7/0x1ab dw_i3c_master_daa.cold+0x1b/0x96 [dw_i3c_master] i3c_master_do_daa_ext.part.0+0x3e/0xf0 [i3c] Skip the mask when no new device was assigned. Fixes: 1dd728f5d4d4 ("i3c: master: Add driver for Synopsys DesignWare IP") Signed-off-by: Jakub Kicinski Reviewed-by: Frank Li Link: https://patch.msgid.link/20260630172904.2662160-1-kuba@kernel.org Signed-off-by: Alexandre Belloni Signed-off-by: Sasha Levin

i3c: master: svc: bound IBI payload to the requested max_payload_len

2026-09-14T11:28:36+00:00

commit e2bda39d7f9f285ec803e200b5c1f17143d0b483 upstream. svc_i3c_master_handle_ibi() reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size (SVC_I3C_FIFO_SIZE), not by the slot size. slot->data points into the IBI pool, which i3c_generic_ibi_alloc_pool() sizes at max_payload_len per slot. svc_i3c_master_request_ibi() only rejects a max_payload_len larger than SVC_I3C_FIFO_SIZE, so a driver can request a smaller one. mctp-i3c requests 1. Each readsb() then copies the controller RXCOUNT bytes (up to 31) with no check against the slot size. A device that sends more bytes than the slot holds writes past slot->data, an out-of-bounds write into the IBI pool. Bound the loop by dev->ibi->max_payload_len and clamp each read to the space left in the slot, the same way dw-i3c does. A device can still send more than the requested payload. Flush the leftover bytes from the RX FIFO so they do not leak into the next transfer. Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") Cc: stable@vger.kernel.org Co-developed-by: Kaixuan Li Signed-off-by: Kaixuan Li Signed-off-by: Maoyi Xie Reviewed-by: Frank Li Link: https://patch.msgid.link/178227747353.2931373.15868718612134648277@maoyixie.com Signed-off-by: Alexandre Belloni Signed-off-by: Greg Kroah-Hartman

i3c: mipi-i3c-hci: fix IBI payload length calculation for final status

2026-05-23T11:03:20+00:00

[ Upstream commit d35a6db887eeae7c57b719521e39d64f929c6dc3 ] In DMA mode, the IBI status descriptor encodes the payload using CHUNKS (number of chunks) and DATA_LENGTH (valid bytes in the last chunk). All preceding chunks are implicitly full-sized. The current code accumulates full chunk sizes for non-final status descriptors, but for the final status descriptor it only adds DATA_LENGTH. This ignores the contribution of the preceding full chunks described by the same final status entry. As a result, the computed IBI payload length is truncated whenever the final status spans multiple chunks. For example, with a chunk size of 4 bytes, CHUNKS=2 and DATA_LENGTH=1 should result in a total payload size of 5 bytes, but the current code reports only 1 byte. Fix the calculation by adding the size of (CHUNKS - 1) full chunks plus DATA_LENGTH for the last chunk. Fixes: 9ad9a52cce28 ("i3c/master: introduce the mipi-i3c-hci driver") Signed-off-by: Billy Tsai Reviewed-by: Frank Li Link: https://patch.msgid.link/20260407-i3c-hci-dma-v2-1-a583187b9d22@aspeedtech.com Signed-off-by: Alexandre Belloni Signed-off-by: Sasha Levin

i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor

2026-03-25T10:05:55+00:00

commit ec3cfd835f7c4bbd23bc9ad909d2fdc772a578bb upstream. The internal control command descriptor used for no-op commands includes a Transaction ID (TID) field, but the no-op command constructed in hci_dma_dequeue_xfer() omitted it. As a result, the hardware receives a no-op descriptor without the expected TID. This bug has gone unnoticed because the TID is currently not validated in the no-op completion path, but the descriptor format requires it to be present. Add the missing TID field when generating a no-op descriptor so that its layout matches the defined command structure. Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-10-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni Signed-off-by: Greg Kroah-Hartman