Merge tag 'v6.6.76' into for/openbmc/dev-6.6

This is the 6.6.76 stable release

Conflicts:
arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts

Conflicts were resolved in favour of our side a

Merge tag 'v6.6.76' into for/openbmc/dev-6.6

This is the 6.6.76 stable release

Conflicts:
arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts

Conflicts were resolved in favour of our side as the upstream stable
branches cherry-picked a small number of changes out of a much large
series, which has already been backported.

show more ...

i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition

[ Upstream commit b75439c945b94dd8a2b645355bdb56f948052601 ]

In dw_i3c_common_probe, &master->hj_work is bound with
dw_i3c_

i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition

[ Upstream commit b75439c945b94dd8a2b645355bdb56f948052601 ]

In dw_i3c_common_probe, &master->hj_work is bound with
dw_i3c_hj_work. And dw_i3c_master_irq_handler can call
dw_i3c_master_irq_handle_ibis function to start the work.

If we remove the module which will call dw_i3c_common_remove to
make cleanup, it will free master->base through i3c_master_unregister
while the work mentioned above will be used. The sequence of operations
that may lead to a UAF bug is as follows:

CPU0 CPU1

| dw_i3c_hj_work
dw_i3c_common_remove |
i3c_master_unregister(&master->base) |
device_unregister(&master->dev) |
device_release |
//free master->base |
| i3c_master_do_daa(&master->base)
| //use master->base

Fix it by ensuring that the work is canceled before proceeding with
the cleanup in dw_i3c_common_remove.

Fixes: 1dd728f5d4d4 ("i3c: master: Add driver for Synopsys DesignWare IP")
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Acked-by: Mukesh Kumar Savaliya <quic_msavaliy@quicinc.com>
Link: https://lore.kernel.org/r/bfc49c9527be5b513e7ceafeba314ca40a5be4bc.1732703537.git.xiaopei01@kylinos.cn
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

show more ...

i3c: dw: Add hot-join support.

[ Upstream commit 1d08326020fba690cbb7b8f1b38ab4eab6745969 ]

Add hot-join support for dw i3c master controller.
By default, the hot-join acknowledgment is disabled, a

i3c: dw: Add hot-join support.

[ Upstream commit 1d08326020fba690cbb7b8f1b38ab4eab6745969 ]

Add hot-join support for dw i3c master controller.
By default, the hot-join acknowledgment is disabled, and the hardware will
automatically send the DISEC CCC when it receives the hot-join request.
Users can use the sys entry to enable it.

Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
Link: https://lore.kernel.org/r/20240429073624.256830-1-billy_tsai@aspeedtech.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Stable-dep-of: b75439c945b9 ("i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition")
Signed-off-by: Sasha Levin <sashal@kernel.org>

show more ...

Merge tag 'v6.6.23' into dev-6.6

Linux 6.6.23

i3c: dw: Disable IBI IRQ depends on hot-join and SIR enabling

[ Upstream commit 10201396ef6455a68ac671fa0163205d327ebb70 ]

Disable IBI IRQ signal and status only when hot-join and SIR enabling of
a

i3c: dw: Disable IBI IRQ depends on hot-join and SIR enabling

[ Upstream commit 10201396ef6455a68ac671fa0163205d327ebb70 ]

Disable IBI IRQ signal and status only when hot-join and SIR enabling of
all target devices attached to the bus are disabled.

Fixes: e389b1d72a62 ("i3c: dw: Add support for in-band interrupts")

Signed-off-by: Dylan Hung <dylan_hung@aspeedtech.com>
Link: https://lore.kernel.org/r/20240119054547.983693-1-dylan_hung@aspeedtech.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

show more ...

Merge branch 'next' into for-linus

Prepare input updates for 6.6 merge window.

Merge tag 'v6.4' into next

Sync up with mainline to bring in updates to shared infrastructure.

Merge branch 'for-6.5/apple' into for-linus

- improved support for Keychron K8 keyboard (Lasse Brun)

Merge drm/drm-next into drm-misc-next-fixes

Backmerging to sync drm-misc-next-fixes with drm-misc-next.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>

Merge branch 'drm-next' of git://anongit.freedesktop.org/drm/drm into msm-next-lumag-base

Merge the drm-next tree to pick up the DRM DSC helpers (merged via
drm-intel-next tree). MSM DSC v1.2 patche

Merge branch 'drm-next' of git://anongit.freedesktop.org/drm/drm into msm-next-lumag-base

Merge the drm-next tree to pick up the DRM DSC helpers (merged via
drm-intel-next tree). MSM DSC v1.2 patches depend on these helpers.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>

show more ...

Merge tag 'v6.4-rc4' into wpan-next/staging

Linux 6.4-rc4

Merge drm/drm-next into drm-intel-gt-next

For conflict avoidance we need the following commit:

c9a9f18d3ad8 drm/i915/huc: use const struct bus_type pointers

Signed-off-by: Tvrtko Ursulin <tvrtko

Merge drm/drm-next into drm-intel-gt-next

For conflict avoidance we need the following commit:

c9a9f18d3ad8 drm/i915/huc: use const struct bus_type pointers

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>

show more ...

Merge drm/drm-next into drm-intel-next

Backmerge to get some hwmon dependencies.

Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

Merge drm/drm-fixes into drm-misc-fixes

Let's bring 6.4-rc1 in drm-misc-fixes to start the new fix cycle.

Signed-off-by: Maxime Ripard <maxime@cerno.tech>

Merge drm/drm-next into drm-misc-next

Start the 6.5 release cycle.

Signed-off-by: Maxime Ripard <maxime@cerno.tech>

Merge branch 'next' into for-linus

Prepare input updates for 6.4 merge window.

Merge tag 'i3c/for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux

Pull i3c updates from Alexandre Belloni:
"Subsystem:
- OF alias bus numbering
- convert to platform remove c

Merge tag 'i3c/for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux

Pull i3c updates from Alexandre Belloni:
"Subsystem:
- OF alias bus numbering
- convert to platform remove callback returning void

New driver:
- AST2600 controller, based on Synopsys DesignWare IP

Driver update:
- dw: add infrastructure to support different platform integrations"

* tag 'i3c/for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux:
i3c: ast2600: set variable ast2600_i3c_ops storage-class-specifier to static
i3c: ast2600: fix register setting for 545 ohm pullups
i3c: ast2600: enable IBI support
i3c: dw: Add a platform facility for IBI PEC workarounds
i3c: dw: Add support for in-band interrupts
i3c: dw: Turn DAT array entry into a struct
i3c: dw: Create a generic fifo read function
i3c: Allow OF-alias-based persistent bus numbering
i3c: ast2600: Add AST2600 platform-specific driver
dt-bindings: i3c: Add AST2600 i3c controller
i3c: dw: Add infrastructure for platform-specific implementations
i3c: dw: use bus mode rather than device reg for conditional tCAS setting
i3c: dw: Return the length from a read priv_xfer
i3c: svc: Convert to platform remove callback returning void
i3c: mipi-i3c-hci: Convert to platform remove callback returning void
i3c: cdns: Convert to platform remove callback returning void
i3c: dw: Convert to platform remove callback returning void
i3c: Make i3c_master_unregister() return void
i3c: dw: drop of_match_ptr for ID table
i3c: Correct reference to the I²C device data type

show more ...

i3c: dw: Add a platform facility for IBI PEC workarounds

On the AST2600 i3c controller, we'll need to apply a workaround for a
hardware issue with IBI payloads.

Introduce a platform hook to allow d

i3c: dw: Add a platform facility for IBI PEC workarounds

On the AST2600 i3c controller, we'll need to apply a workaround for a
hardware issue with IBI payloads.

Introduce a platform hook to allow dw i3c platform implementations to
modify the DAT entry in IBI enable/disable to allow this workaround in a
future change.

Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/d5d76a8d2336d2a71886537f42e71d51db184df6.1680161823.git.jk@codeconstruct.com.au
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>

show more ...

i3c: dw: Add support for in-band interrupts

This change adds support for receiving and dequeueing i3c IBIs.

By setting struct dw_i3c_master->ibi_capable before probe, a platform
implementation can

i3c: dw: Add support for in-band interrupts

This change adds support for receiving and dequeueing i3c IBIs.

By setting struct dw_i3c_master->ibi_capable before probe, a platform
implementation can select the IBI-enabled version of the i3c_master_ops,
enabling the global IBI infrastrcture for that controller.

Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/79daeefd7ccb7c935d0c159149df21a6c9a73ffa.1680161823.git.jk@codeconstruct.com.au
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>

show more ...

i3c: dw: Turn DAT array entry into a struct

In an upcoming change, we will want to store additional data about the
devices we have in the data address table.

Change the type of the DAT entries into

i3c: dw: Turn DAT array entry into a struct

In an upcoming change, we will want to store additional data about the
devices we have in the data address table.

Change the type of the DAT entries into a struct, which currently just
has the address data.

Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/9dc0d9e2857e851a0cf04819df48e5d31921f83e.1680161823.git.jk@codeconstruct.com.au
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>

show more ...

i3c: dw: Create a generic fifo read function

In a future change we'll want to read from the IBI FIFO too, so turn
dw_i3c_read_rx_fifo() into a generic read with the FIFO register as a
parameter.

Si

i3c: dw: Create a generic fifo read function

In a future change we'll want to read from the IBI FIFO too, so turn
dw_i3c_read_rx_fifo() into a generic read with the FIFO register as a
parameter.

Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/827204789583dd86addffb47ecaeab9d67cf95d5.1680161823.git.jk@codeconstruct.com.au
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>

show more ...

i3c: dw: Add infrastructure for platform-specific implementations

The dw i3c core can be integrated into various SoC devices. Platforms
that use this core may need a little configuration that is spe

i3c: dw: Add infrastructure for platform-specific implementations

The dw i3c core can be integrated into various SoC devices. Platforms
that use this core may need a little configuration that is specific to
that platform.

Add some infrastructure to allow platform-specific behaviour: common
probe/remove functions, a set of platform hook operations, and a pointer
for platform-specific data in struct dw_i3c_master. Move the common api
into a new (i3c local) header file.

Platforms will provide their own struct platform_driver, which allocates
struct dw_i3c_master, does any platform-specific probe behaviour, and
calls into the common probe.

A future change will add new platform support that uses this
infrastructure.

Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20230331091501.3800299-2-jk@codeconstruct.com.au
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>

show more ...

i3c: dw: use bus mode rather than device reg for conditional tCAS setting

In the clock setup path, we set the hardware DEV_CTRL_I2C_SLAVE_PRESENT
bit on a shared mode bus, then read-back this bit fo

i3c: dw: use bus mode rather than device reg for conditional tCAS setting

In the clock setup path, we set the hardware DEV_CTRL_I2C_SLAVE_PRESENT
bit on a shared mode bus, then read-back this bit for the conditional
tCAS set.

Instead, just use the bus->mode setting for the conditional test.

While we're at it, add a little comment about why the conditional is
there.

Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
Link: https://lore.kernel.org/r/92a933566f7846708a00ad7f5a16ee8e6ed32d0e.1680156630.git.jk@codeconstruct.com.au
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>

show more ...

i3c: dw: Return the length from a read priv_xfer

We currently assume that the rx_len of a read command will be as
submitted, but we may have a shorter read than expected.

This change populates the

i3c: dw: Return the length from a read priv_xfer

We currently assume that the rx_len of a read command will be as
submitted, but we may have a shorter read than expected.

This change populates the output i3c xfer length from the actually-read
length.

Signed-off-by: Matt Johnston <matt@codeconstruct.com.au>
Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
Link: https://lore.kernel.org/r/f4fff7ab18dee1f662dc7a5a4111fcd921e6792b.1680156630.git.jk@codeconstruct.com.au
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>

show more ...

Merge branch 'for-6.4/amd-sfh' into for-linus

- assorted functional fixes for amd-sfh driver (Basavaraj Natikar)