kernel/drivers/i3c/master/mipi-i3c-hci/hci.h, branch linux-rolling-stable

i3c: mipi-i3c-hci: Fix race in DMA ring dequeue

2026-03-19T15:15:32Z

commit 1dca8aee80eea76d2aae21265de5dd64f6ba0f09 upstream. The HCI DMA dequeue path (hci_dma_dequeue_xfer()) may be invoked for multiple transfers that timeout around the same time. However, the function is not serialized and can race with itself. When a timeout occurs, hci_dma_dequeue_xfer() stops the ring, processes incomplete transfers, and then restarts the ring. If another timeout triggers a parallel call into the same function, the two instances may interfere with each other - stopping or restarting the ring at unexpected times. Add a mutex so that hci_dma_dequeue_xfer() is serialized with respect to itself. Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-7-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni Signed-off-by: Greg Kroah-Hartman

i3c: mipi-i3c-hci: Consolidate spinlocks

2026-03-19T15:15:31Z

commit fa12bb903bc3ed1826e355d267fe134bde95e23c upstream. The MIPI I3C HCI driver currently uses separate spinlocks for different contexts (PIO vs. DMA rings). This split is unnecessary and complicates upcoming fixes. The driver does not support concurrent PIO and DMA operation, and it only supports a single DMA ring, so a single lock is sufficient for all paths. Introduce a unified spinlock in struct i3c_hci, switch both PIO and DMA code to use it, and remove the per-context locks. No functional change is intended in this patch. Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-5-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni Signed-off-by: Greg Kroah-Hartman

i3c: mipi-i3c-hci: Convert remaining DBG() prints to dev_dbg()

2025-09-16T15:06:42Z

Get rid of local DBG() macro and convert remaining debug prints to dev_dbg() which can be controlled without code recompile when kernel is built with dynamic debug support. Signed-off-by: Jarkko Nikula Link: https://lore.kernel.org/r/20250827103009.243771-6-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni

i3c: mipi-i3c-hci: Use core helpers for DMA mapping and bounce buffering

2025-09-16T15:06:42Z

So far only I3C private and I2C transfers have required a bounce buffer for DMA transfers when buffer is not DMA'able. It was observed that when the device DMA is IOMMU mapped and the receive length is not a multiple of DWORDs (32-bit), the last DWORD is padded with stale data from the RX FIFO, corrupting 1-3 bytes beyond the expected data. A similar issue, though less severe, occurs when an I3C target returns less data than requested. In this case, the padding does not exceed the requested number of bytes, assuming the device DMA is not IOMMU mapped. Therefore, all I3C private transfer, CCC command payload and I2C transfer receive buffers must be properly sized for the DMA being IOMMU mapped. Even if those buffers are already DMA safe, their size may not be DWORD aligned. To prepare for the device DMA being IOMMU mapped and to address the above issue, use helpers from I3C core for DMA mapping and bounce buffering for all DMA transfers. For now, require bounce buffer only when the buffer is in the vmalloc() area to avoid unnecessary copying with CCC commands and DMA-safe I2C transfers. Signed-off-by: Jarkko Nikula Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250822105630.2820009-3-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni

i3c: mipi-i3c-hci: Handle interrupts according to current specifications

2024-10-31T23:06:14Z

Current MIPI I3C HCI specification versions pre-1.0, 1.0. 1.1 and 1.2 don't have cascaded interrupt bits for the PIO and DMA (ring headers) in the INTR_STATUS register as implemented currently in the code. Instead bits 9:0 are marked as reserved with unspecified reset value. To my understanding they were planned to be introduced in the version 2 and the original commit 9ad9a52cce28 ("i3c/master: introduce the mipi-i3c-hci driver") was coding ahead according to a draft. With remarks though. This is causing that the DMA handler is not called until at least one reserved bit 7:0 is set in the INTR_STATUS. Since it looks that idea was dropped in later official versions and to make able to handle DMA interrupts on an HW that is implemented according to current specifications call assigned PIO or DMA IO handler unconditionally. While doing so remove cascaded interrupt bit definitions and the mask argument passed to the handler functions. Signed-off-by: Jarkko Nikula Link: https://lore.kernel.org/r/20240920144432.62370-3-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni

i3c: mipi-i3c-hci: Add a quirk to set Response buffer threshold

2024-09-05T16:34:09Z

The current driver sets the response buffer threshold value to 1 (N+1, 2 DWORDS) in the QUEUE THRESHOLD register. However, the AMD I3C controller only generates interrupts when the response buffer threshold value is set to 0 (1 DWORD). Therefore, a quirk is added to set the response buffer threshold value to 0. Reviewed-by: Jarkko Nikula Co-developed-by: Krishnamoorthi M Signed-off-by: Krishnamoorthi M Co-developed-by: Guruvendra Punugupati Signed-off-by: Guruvendra Punugupati Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20240829091713.736217-7-Shyam-sundar.S-k@amd.com Signed-off-by: Alexandre Belloni

i3c: mipi-i3c-hci: Add a quirk to set timing parameters

2024-09-05T16:34:09Z

The AMD HCI controller is currently unstable at 12.5 MHz. To address this, a quirk is added to configure the clock rate to 9 MHz as a workaround, with proportional adjustments to the Open-Drain (OD) and Push-Pull (PP) values. Reviewed-by: Jarkko Nikula Co-developed-by: Guruvendra Punugupati Signed-off-by: Guruvendra Punugupati Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20240829091713.736217-6-Shyam-sundar.S-k@amd.com Signed-off-by: Alexandre Belloni

i3c: mipi-i3c-hci: Relocate helper macros to HCI header file

2024-09-05T16:34:09Z

The reg_* helper macros are currently limited to core.c. Moving them to hci.h will allow their functionality to be utilized in other files outside of core.c. Reviewed-by: Jarkko Nikula Co-developed-by: Guruvendra Punugupati Signed-off-by: Guruvendra Punugupati Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20240829091713.736217-5-Shyam-sundar.S-k@amd.com Signed-off-by: Alexandre Belloni

i3c: mipi-i3c-hci: Add a quirk to set PIO mode

2024-09-05T16:34:08Z

The AMD HCI controller currently only supports PIO mode but exposes DMA rings to the OS, which leads to the controller being configured in DMA mode. To address this, add a quirk to avoid configuring the controller in DMA mode and default to PIO mode. Additionally, introduce a generic quirk infrastructure to the mipi-i3c-hci driver to facilitate seamless future quirk additions. Reviewed-by: Jarkko Nikula Co-developed-by: Krishnamoorthi M Signed-off-by: Krishnamoorthi M Co-developed-by: Guruvendra Punugupati Signed-off-by: Guruvendra Punugupati Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20240829091713.736217-4-Shyam-sundar.S-k@amd.com Signed-off-by: Alexandre Belloni

i3c: mipi-i3c-hci: Add DMA bounce buffer for private transfers

2023-11-16T22:36:44Z

Implement a local bounce buffer for private I3C SDR and I2C transfers when using DMA and the buffer attached to the transfer is not DMA safe. Otherwise the DMA transfer will fail and with following warning: [ 11.411059] i3c mipi-i3c-hci.0: rejecting DMA map of vmalloc memory [ 11.417313] WARNING: CPU: 3 PID: 357 at include/linux/dma-mapping.h:332 hci_dma_queue_xfer+0x2e2/0x300 [mipi_i3c_hci] Strictly speaking private I3C SDR transfers are expected to pass a DMA-able buffer. However I fear this requirement may easily be slipped or go unnoticed when I3C interface support is added into a existing device driver that use regmap API to read/write stack variables. For example this is the case with the commit 2660b0080bb2 ("iio: imu: st_lsm6dsx: add i3c basic support for LSM6DSO and LSM6DSR"). Buffer of an I2C message is not required to be DMA safe and the I2C core provides i2c_(get|put)_dma_safe_msg_buf() helpers for the host controllers that do DMA and that is also recommendation for the i2c_xfers() callback from the I3C core. However due to above I3C private transfers reason I decided to implement a bounce buffer for them and reuse the same code for the I2C transfers too. Since this driver is currently the only I3C host controller driver that can do DMA the implementation is done here and not in I3C core. Signed-off-by: Jarkko Nikula Link: https://lore.kernel.org/r/20231109133708.653950-5-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni