--- /dev/null
+From ec3cfd835f7c4bbd23bc9ad909d2fdc772a578bb Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Fri, 6 Mar 2026 09:24:46 +0200
+Subject: i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit ec3cfd835f7c4bbd23bc9ad909d2fdc772a578bb upstream.
+
+The internal control command descriptor used for no-op commands includes a
+Transaction ID (TID) field, but the no-op command constructed in
+hci_dma_dequeue_xfer() omitted it. As a result, the hardware receives a
+no-op descriptor without the expected TID.
+
+This bug has gone unnoticed because the TID is currently not validated in
+the no-op completion path, but the descriptor format requires it to be
+present.
+
+Add the missing TID field when generating a no-op descriptor so that its
+layout matches the defined command structure.
+
+Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260306072451.11131-10-adrian.hunter@intel.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i3c/master/mipi-i3c-hci/cmd.h | 1 +
+ drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/i3c/master/mipi-i3c-hci/cmd.h
++++ b/drivers/i3c/master/mipi-i3c-hci/cmd.h
+@@ -17,6 +17,7 @@
+ #define CMD_0_TOC W0_BIT_(31)
+ #define CMD_0_ROC W0_BIT_(30)
+ #define CMD_0_ATTR W0_MASK(2, 0)
++#define CMD_0_TID W0_MASK(6, 3)
+
+ /*
+ * Response Descriptor Structure
+--- a/drivers/i3c/master/mipi-i3c-hci/dma.c
++++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
+@@ -482,7 +482,7 @@ static bool hci_dma_dequeue_xfer(struct
+ u32 *ring_data = rh->xfer + rh->xfer_struct_sz * idx;
+
+ /* store no-op cmd descriptor */
+- *ring_data++ = FIELD_PREP(CMD_0_ATTR, 0x7);
++ *ring_data++ = FIELD_PREP(CMD_0_ATTR, 0x7) | FIELD_PREP(CMD_0_TID, xfer->cmd_tid);
+ *ring_data++ = 0;
+ if (hci->cmd == &mipi_i3c_hci_cmd_v2) {
+ *ring_data++ = 0;
--- /dev/null
+From b6d586431ae20d5157ee468d0ef62ad26798ef13 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Fri, 6 Mar 2026 09:24:47 +0200
+Subject: i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit b6d586431ae20d5157ee468d0ef62ad26798ef13 upstream.
+
+The DMA dequeue path attempts to restart the ring after aborting an
+in-flight transfer, but the current sequence is incomplete. The controller
+must be brought out of the aborted state and the ring control registers
+must be programmed in the correct order: first clearing ABORT, then
+re-enabling the ring and asserting RUN_STOP to resume operation.
+
+Add the missing controller resume step and update the ring control writes
+so that the ring is restarted using the proper sequence.
+
+Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260306072451.11131-11-adrian.hunter@intel.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i3c/master/mipi-i3c-hci/dma.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/i3c/master/mipi-i3c-hci/dma.c
++++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
+@@ -500,7 +500,9 @@ static bool hci_dma_dequeue_xfer(struct
+ }
+
+ /* restart the ring */
++ mipi_i3c_hci_resume(hci);
+ rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE);
++ rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE | RING_CTRL_RUN_STOP);
+
+ return did_unqueue;
+ }
--- /dev/null
+From 4167b8914463132654e01e16259847d097f8a7f7 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Fri, 6 Mar 2026 09:24:38 +0200
+Subject: i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 4167b8914463132654e01e16259847d097f8a7f7 upstream.
+
+The MIPI I3C HCI driver currently returns -ETIME for various timeout
+conditions, while other I3C master drivers consistently use -ETIMEDOUT
+for the same class of errors. Align the HCI driver with the rest of the
+subsystem by replacing all uses of -ETIME with -ETIMEDOUT.
+
+Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260306072451.11131-2-adrian.hunter@intel.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i3c/master/mipi-i3c-hci/cmd_v1.c | 2 +-
+ drivers/i3c/master/mipi-i3c-hci/cmd_v2.c | 2 +-
+ drivers/i3c/master/mipi-i3c-hci/core.c | 6 +++---
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/i3c/master/mipi-i3c-hci/cmd_v1.c
++++ b/drivers/i3c/master/mipi-i3c-hci/cmd_v1.c
+@@ -334,7 +334,7 @@ static int hci_cmd_v1_daa(struct i3c_hci
+ hci->io->queue_xfer(hci, xfer, 1);
+ if (!wait_for_completion_timeout(&done, HZ) &&
+ hci->io->dequeue_xfer(hci, xfer, 1)) {
+- ret = -ETIME;
++ ret = -ETIMEDOUT;
+ break;
+ }
+ if ((RESP_STATUS(xfer->response) == RESP_ERR_ADDR_HEADER ||
+--- a/drivers/i3c/master/mipi-i3c-hci/cmd_v2.c
++++ b/drivers/i3c/master/mipi-i3c-hci/cmd_v2.c
+@@ -277,7 +277,7 @@ static int hci_cmd_v2_daa(struct i3c_hci
+ hci->io->queue_xfer(hci, xfer, 2);
+ if (!wait_for_completion_timeout(&done, HZ) &&
+ hci->io->dequeue_xfer(hci, xfer, 2)) {
+- ret = -ETIME;
++ ret = -ETIMEDOUT;
+ break;
+ }
+ if (RESP_STATUS(xfer[0].response) != RESP_SUCCESS) {
+--- a/drivers/i3c/master/mipi-i3c-hci/core.c
++++ b/drivers/i3c/master/mipi-i3c-hci/core.c
+@@ -236,7 +236,7 @@ static int i3c_hci_send_ccc_cmd(struct i
+ goto out;
+ if (!wait_for_completion_timeout(&done, HZ) &&
+ hci->io->dequeue_xfer(hci, xfer, nxfers)) {
+- ret = -ETIME;
++ ret = -ETIMEDOUT;
+ goto out;
+ }
+ for (i = prefixed; i < nxfers; i++) {
+@@ -348,7 +348,7 @@ static int i3c_hci_priv_xfers(struct i3c
+ goto out;
+ if (!wait_for_completion_timeout(&done, HZ) &&
+ hci->io->dequeue_xfer(hci, xfer, nxfers)) {
+- ret = -ETIME;
++ ret = -ETIMEDOUT;
+ goto out;
+ }
+ for (i = 0; i < nxfers; i++) {
+@@ -402,7 +402,7 @@ static int i3c_hci_i2c_xfers(struct i2c_
+ goto out;
+ if (!wait_for_completion_timeout(&done, HZ) &&
+ hci->io->dequeue_xfer(hci, xfer, nxfers)) {
+- ret = -ETIME;
++ ret = -ETIMEDOUT;
+ goto out;
+ }
+ for (i = 0; i < nxfers; i++) {
iio-imu-inv_icm42600-fix-odr-switch-to-the-same-value.patch
iio-imu-inv_icm42600-fix-odr-switch-when-turning-buffer-off.patch
iio-proximity-hx9023s-protect-against-division-by-zero-in-set_samp_freq.patch
+i3c-mipi-i3c-hci-use-etimedout-instead-of-etime-for-timeout-errors.patch
+i3c-mipi-i3c-hci-restart-dma-ring-correctly-after-dequeue-abort.patch
+i3c-mipi-i3c-hci-add-missing-tid-field-to-no-op-command-descriptor.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
