kernel/linux.git/drivers/i3c, branch master

i3c: mipi-i3c-hci: fix IBI payload length calculation for final status

2026-04-12T20:06:02+00:00

In DMA mode, the IBI status descriptor encodes the payload using CHUNKS (number of chunks) and DATA_LENGTH (valid bytes in the last chunk). All preceding chunks are implicitly full-sized. The current code accumulates full chunk sizes for non-final status descriptors, but for the final status descriptor it only adds DATA_LENGTH. This ignores the contribution of the preceding full chunks described by the same final status entry. As a result, the computed IBI payload length is truncated whenever the final status spans multiple chunks. For example, with a chunk size of 4 bytes, CHUNKS=2 and DATA_LENGTH=1 should result in a total payload size of 5 bytes, but the current code reports only 1 byte. Fix the calculation by adding the size of (CHUNKS - 1) full chunks plus DATA_LENGTH for the last chunk. Fixes: 9ad9a52cce28 ("i3c/master: introduce the mipi-i3c-hci driver") Signed-off-by: Billy Tsai Reviewed-by: Frank Li Link: https://patch.msgid.link/20260407-i3c-hci-dma-v2-1-a583187b9d22@aspeedtech.com Signed-off-by: Alexandre Belloni

i3c: master: adi: Fix error propagation for CCCs

2026-04-12T14:54:37+00:00

adi_i3c_master_send_ccc_cmd() always returned 0, ignoring the transfer result populated in the completion path. As a consequence, CCC command errors were silently dropped, including the default -ETIMEDOUT and later overwritten by adi_i3c_master_end_xfer_locked(). Fix this by returning xfer->ret so that callers correctly receive any transfer error codes. Fixes: a79ac2cdc91d ("i3c: master: Add driver for Analog Devices I3C Controller IP") Reviewed-by: Adrian Hunter Reviewed-by: Frank Li Signed-off-by: Jorge Marques Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-5-30bdc68004be@analog.com Signed-off-by: Alexandre Belloni

i3c: master: Fix error codes at send_ccc_cmd

2026-04-12T14:54:37+00:00

i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive, Mx codes) to the ret variable, cascading down multiple methods until reaching methods that explicitly stated they would return 0 on success or negative error code. For example, the call chain: i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <- master->ops.enable_ibi <- i3c_master_enec_locked <- i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked Fix this by returning the ret value, callers can still read the cmd->err value if ret is negative. All corner cases where the Mx codes do need to be handled individually, are resolved in previous commits. Those corner cases are all scenarios when I3C_ERROR_M2 is expected and acceptable. The prerequisite patches for the fix are: i3c: master: Move rstdaa error suppression i3c: master: Move entdaa error suppression i3c: master: Move bus_init error suppression Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-iio/aYXvT5FW0hXQwhm_@stanley.mountain/ Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") Reviewed-by: Adrian Hunter Signed-off-by: Jorge Marques Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-4-30bdc68004be@analog.com Signed-off-by: Alexandre Belloni

i3c: master: Move bus_init error suppression

2026-04-12T14:54:37+00:00

Prepare to fix improper Mx positive error propagation in later commits by handling Mx error codes where the i3c_ccc_cmd command is allocated. The CCC DISEC to broadcast address is invoked with i3c_master_enec_disec_locked() and yields error I3C_ERROR_M2 if there are no devices active on the bus. This is expected at the bus initialization stage, where it is not known yet that there are no active devices on the bus. Add bool suppress_m2 argument to i3c_master_enec_disec_locked() and update the call site at i3c_master_bus_init() with the exact corner case to not require propagating positive Mx error codes. Other call site should not suppress the error code, for example, if a driver requests to peripheral to disable events and the transfer is not acknowledged, this is an error and should not proceed. Reviewed-by: Frank Li Reviewed-by: Adrian Hunter Signed-off-by: Jorge Marques Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-3-30bdc68004be@analog.com Signed-off-by: Alexandre Belloni

i3c: master: Move entdaa error suppression

2026-04-12T14:54:37+00:00

Prepare to fix improper Mx positive error propagation in later commits by handling Mx error codes where the i3c_ccc_cmd command is allocated. The CCC ENTDAA is invoked with i3c_master_entdaa_locked() and yields error I3C_ERROR_M2 if there are no devices active on the bus. Some controllers may also yield if there are no more devices need an dynamic address, since the sequence do always end in a NACK. Handle inside i3c_master_entdaa_locked(), checking cmd->err directly. Both call sites are updated, adi_i3c_master_do_daa() and cdns_i3c_master_do_daa(). Reviewed-by: Frank Li Reviewed-by: Adrian Hunter Signed-off-by: Jorge Marques Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-2-30bdc68004be@analog.com Signed-off-by: Alexandre Belloni

i3c: master: Move rstdaa error suppression

2026-04-12T14:54:37+00:00

Prepare to fix improper Mx positive error propagation in later commits by handling Mx error codes where the i3c_ccc_cmd command is allocated. Two of the four i3c_master_rstdaa_locked() are error paths that already suppressed the return value, the remaining two are changed to handle the I3C_ERROR_M2 Mx error code inside i3c_master_rstdaa_locked(), checking cmd->err directly. Reviewed-by: Frank Li Reviewed-by: Adrian Hunter Signed-off-by: Jorge Marques Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-1-30bdc68004be@analog.com Signed-off-by: Alexandre Belloni

i3c: dw: Simplify xfer cleanup with __free(kfree)

2026-04-12T14:52:32+00:00

Convert dw-i3c-master to use __free(kfree) guards for struct dw_i3c_xfer allocations. This frees xfer objects automatically on scope exit, and removes the now-unused dw_i3c_master_free_xfer() helper. Signed-off-by: Felix Gu Reviewed-by: Frank Li Link: https://patch.msgid.link/20260404-dw-i3c-2-v3-2-8f7d146549c1@gmail.com Signed-off-by: Alexandre Belloni

i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers()

2026-04-12T14:52:32+00:00

The dw_i3c_master_i3c_xfers() function allocates memory for the xfer structure using dw_i3c_master_alloc_xfer(). If pm_runtime_resume_and_get() fails, the function returns without freeing the allocated xfer, resulting in a memory leak. Since dw_i3c_master_free_xfer() is a thin wrapper around kfree(), use the __free(kfree) cleanup attribute to handle the free automatically on all exit paths. Fixes: 62fe9d06f570 ("i3c: dw: Add power management support") Signed-off-by: Felix Gu Reviewed-by: Frank Li Link: https://patch.msgid.link/20260404-dw-i3c-2-v3-1-8f7d146549c1@gmail.com Signed-off-by: Alexandre Belloni

i3c: master: renesas: Use __free(kfree) for xfer cleanup in renesas_i3c_send_ccc_cmd()

2026-04-12T14:47:13+00:00

Use __free(kfree) for automatic cleanup, matching the pattern already used in other functions in this driver. Signed-off-by: Felix Gu Tested-by: Tommaso Merciai Reviewed-by: Tommaso Merciai Reviewed-by: Frank Li Link: https://patch.msgid.link/20260406-renesas-v3-2-4b724d7708f4@gmail.com Signed-off-by: Alexandre Belloni

i3c: master: renesas: Fix memory leak in renesas_i3c_i3c_xfers()

2026-04-12T14:47:13+00:00

The xfer structure allocated by renesas_i3c_alloc_xfer() was never freed in the renesas_i3c_i3c_xfers() function. Use the __free(kfree) cleanup attribute to automatically free the memory when the variable goes out of scope. Fixes: d028219a9f14 ("i3c: master: Add basic driver for the Renesas I3C controller") Tested-by: Tommaso Merciai Reviewed-by: Tommaso Merciai Reviewed-by: Frank Li Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260406-renesas-v3-1-4b724d7708f4@gmail.com Signed-off-by: Alexandre Belloni