From: Greg Kroah-Hartman Date: Tue, 17 Mar 2026 14:53:21 +0000 (+0100) Subject: 6.1-stable patches X-Git-Tag: v6.18.19~33 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d0ce29d8bff62fa1d41bf5290bf72140e4b555a4;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: i3c-mipi-i3c-hci-add-missing-tid-field-to-no-op-command-descriptor.patch i3c-mipi-i3c-hci-restart-dma-ring-correctly-after-dequeue-abort.patch i3c-mipi-i3c-hci-use-etimedout-instead-of-etime-for-timeout-errors.patch --- diff --git a/queue-6.1/i3c-mipi-i3c-hci-add-missing-tid-field-to-no-op-command-descriptor.patch b/queue-6.1/i3c-mipi-i3c-hci-add-missing-tid-field-to-no-op-command-descriptor.patch new file mode 100644 index 0000000000..7bab029ad0 --- /dev/null +++ b/queue-6.1/i3c-mipi-i3c-hci-add-missing-tid-field-to-no-op-command-descriptor.patch @@ -0,0 +1,54 @@ +From ec3cfd835f7c4bbd23bc9ad909d2fdc772a578bb Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Fri, 6 Mar 2026 09:24:46 +0200 +Subject: i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor + +From: Adrian Hunter + +commit ec3cfd835f7c4bbd23bc9ad909d2fdc772a578bb upstream. + +The internal control command descriptor used for no-op commands includes a +Transaction ID (TID) field, but the no-op command constructed in +hci_dma_dequeue_xfer() omitted it. As a result, the hardware receives a +no-op descriptor without the expected TID. + +This bug has gone unnoticed because the TID is currently not validated in +the no-op completion path, but the descriptor format requires it to be +present. + +Add the missing TID field when generating a no-op descriptor so that its +layout matches the defined command structure. + +Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") +Cc: stable@vger.kernel.org +Signed-off-by: Adrian Hunter +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260306072451.11131-10-adrian.hunter@intel.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master/mipi-i3c-hci/cmd.h | 1 + + drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/i3c/master/mipi-i3c-hci/cmd.h ++++ b/drivers/i3c/master/mipi-i3c-hci/cmd.h +@@ -17,6 +17,7 @@ + #define CMD_0_TOC W0_BIT_(31) + #define CMD_0_ROC W0_BIT_(30) + #define CMD_0_ATTR W0_MASK(2, 0) ++#define CMD_0_TID W0_MASK(6, 3) + + /* + * Response Descriptor Structure +--- a/drivers/i3c/master/mipi-i3c-hci/dma.c ++++ b/drivers/i3c/master/mipi-i3c-hci/dma.c +@@ -473,7 +473,7 @@ static bool hci_dma_dequeue_xfer(struct + u32 *ring_data = rh->xfer + rh->xfer_struct_sz * idx; + + /* store no-op cmd descriptor */ +- *ring_data++ = FIELD_PREP(CMD_0_ATTR, 0x7); ++ *ring_data++ = FIELD_PREP(CMD_0_ATTR, 0x7) | FIELD_PREP(CMD_0_TID, xfer->cmd_tid); + *ring_data++ = 0; + if (hci->cmd == &mipi_i3c_hci_cmd_v2) { + *ring_data++ = 0; diff --git a/queue-6.1/i3c-mipi-i3c-hci-restart-dma-ring-correctly-after-dequeue-abort.patch b/queue-6.1/i3c-mipi-i3c-hci-restart-dma-ring-correctly-after-dequeue-abort.patch new file mode 100644 index 0000000000..e7c49def06 --- /dev/null +++ b/queue-6.1/i3c-mipi-i3c-hci-restart-dma-ring-correctly-after-dequeue-abort.patch @@ -0,0 +1,41 @@ +From b6d586431ae20d5157ee468d0ef62ad26798ef13 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Fri, 6 Mar 2026 09:24:47 +0200 +Subject: i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort + +From: Adrian Hunter + +commit b6d586431ae20d5157ee468d0ef62ad26798ef13 upstream. + +The DMA dequeue path attempts to restart the ring after aborting an +in-flight transfer, but the current sequence is incomplete. The controller +must be brought out of the aborted state and the ring control registers +must be programmed in the correct order: first clearing ABORT, then +re-enabling the ring and asserting RUN_STOP to resume operation. + +Add the missing controller resume step and update the ring control writes +so that the ring is restarted using the proper sequence. + +Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") +Cc: stable@vger.kernel.org +Signed-off-by: Adrian Hunter +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260306072451.11131-11-adrian.hunter@intel.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master/mipi-i3c-hci/dma.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/i3c/master/mipi-i3c-hci/dma.c ++++ b/drivers/i3c/master/mipi-i3c-hci/dma.c +@@ -491,7 +491,9 @@ static bool hci_dma_dequeue_xfer(struct + } + + /* restart the ring */ ++ mipi_i3c_hci_resume(hci); + rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE); ++ rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE | RING_CTRL_RUN_STOP); + + return did_unqueue; + } diff --git a/queue-6.1/i3c-mipi-i3c-hci-use-etimedout-instead-of-etime-for-timeout-errors.patch b/queue-6.1/i3c-mipi-i3c-hci-use-etimedout-instead-of-etime-for-timeout-errors.patch new file mode 100644 index 0000000000..5b38ebe589 --- /dev/null +++ b/queue-6.1/i3c-mipi-i3c-hci-use-etimedout-instead-of-etime-for-timeout-errors.patch @@ -0,0 +1,78 @@ +From 4167b8914463132654e01e16259847d097f8a7f7 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Fri, 6 Mar 2026 09:24:38 +0200 +Subject: i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors + +From: Adrian Hunter + +commit 4167b8914463132654e01e16259847d097f8a7f7 upstream. + +The MIPI I3C HCI driver currently returns -ETIME for various timeout +conditions, while other I3C master drivers consistently use -ETIMEDOUT +for the same class of errors. Align the HCI driver with the rest of the +subsystem by replacing all uses of -ETIME with -ETIMEDOUT. + +Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") +Cc: stable@vger.kernel.org +Signed-off-by: Adrian Hunter +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260306072451.11131-2-adrian.hunter@intel.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master/mipi-i3c-hci/cmd_v1.c | 2 +- + drivers/i3c/master/mipi-i3c-hci/cmd_v2.c | 2 +- + drivers/i3c/master/mipi-i3c-hci/core.c | 6 +++--- + 3 files changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/i3c/master/mipi-i3c-hci/cmd_v1.c ++++ b/drivers/i3c/master/mipi-i3c-hci/cmd_v1.c +@@ -335,7 +335,7 @@ static int hci_cmd_v1_daa(struct i3c_hci + hci->io->queue_xfer(hci, xfer, 1); + if (!wait_for_completion_timeout(&done, HZ) && + hci->io->dequeue_xfer(hci, xfer, 1)) { +- ret = -ETIME; ++ ret = -ETIMEDOUT; + break; + } + if (RESP_STATUS(xfer[0].response) == RESP_ERR_NACK && +--- a/drivers/i3c/master/mipi-i3c-hci/cmd_v2.c ++++ b/drivers/i3c/master/mipi-i3c-hci/cmd_v2.c +@@ -277,7 +277,7 @@ static int hci_cmd_v2_daa(struct i3c_hci + hci->io->queue_xfer(hci, xfer, 2); + if (!wait_for_completion_timeout(&done, HZ) && + hci->io->dequeue_xfer(hci, xfer, 2)) { +- ret = -ETIME; ++ ret = -ETIMEDOUT; + break; + } + if (RESP_STATUS(xfer[0].response) != RESP_SUCCESS) { +--- a/drivers/i3c/master/mipi-i3c-hci/core.c ++++ b/drivers/i3c/master/mipi-i3c-hci/core.c +@@ -237,7 +237,7 @@ static int i3c_hci_send_ccc_cmd(struct i + goto out; + if (!wait_for_completion_timeout(&done, HZ) && + hci->io->dequeue_xfer(hci, xfer, nxfers)) { +- ret = -ETIME; ++ ret = -ETIMEDOUT; + goto out; + } + for (i = prefixed; i < nxfers; i++) { +@@ -311,7 +311,7 @@ static int i3c_hci_priv_xfers(struct i3c + goto out; + if (!wait_for_completion_timeout(&done, HZ) && + hci->io->dequeue_xfer(hci, xfer, nxfers)) { +- ret = -ETIME; ++ ret = -ETIMEDOUT; + goto out; + } + for (i = 0; i < nxfers; i++) { +@@ -359,7 +359,7 @@ static int i3c_hci_i2c_xfers(struct i2c_ + goto out; + if (!wait_for_completion_timeout(&done, HZ) && + hci->io->dequeue_xfer(hci, xfer, nxfers)) { +- ret = -ETIME; ++ ret = -ETIMEDOUT; + goto out; + } + for (i = 0; i < nxfers; i++) { diff --git a/queue-6.1/series b/queue-6.1/series index d74aa5630e..73537da6c2 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -270,3 +270,6 @@ iio-chemical-bme680-fix-measurement-wait-duration-calculation.patch iio-gyro-mpu3050-core-fix-pm_runtime-error-handling.patch iio-gyro-mpu3050-i2c-fix-pm_runtime-error-handling.patch iio-imu-inv_icm42600-fix-odr-switch-to-the-same-value.patch +i3c-mipi-i3c-hci-use-etimedout-instead-of-etime-for-timeout-errors.patch +i3c-mipi-i3c-hci-restart-dma-ring-correctly-after-dequeue-abort.patch +i3c-mipi-i3c-hci-add-missing-tid-field-to-no-op-command-descriptor.patch