From: Adrian Hunter <adrian.hunter@intel.com>
To: alexandre.belloni@bootlin.com
Cc: Frank.Li@nxp.com, linux-i3c@lists.infradead.org,
linux-kernel@vger.kernel.org
Subject: [PATCH V2 0/7] i3c: Fix IBI race, address handling, and reconcile DAA
Date: Mon, 8 Jun 2026 10:57:53 +0300 [thread overview]
Message-ID: <20260608075801.16111-1-adrian.hunter@intel.com> (raw)
Hi
Patches 1-2 fix a use-after-free race in the MIPI I3C HCI driver's IBI
handling and make IBI teardown resilient to DISEC failures.
Patches 3-7 fix address management issues in the I3C core and HCI
driver that arise when Dynamic Address Assignment (DAA) does not complete
cleanly, culminating in a reconciliation step that detects and resolves
inconsistencies between assigned address slots and registered devices.
Patches are based on top of:
[PATCH V3 0/8] i3c: Hot-Join improvements and MIPI HCI Hot-Join support
https://lore.kernel.org/linux-i3c/20260608054312.10604-1-adrian.hunter@intel.com
which, in turn, applies on top of:
[PATCH V5 00/17] i3c: mipi-i3c-hci: DMA abort, recovery and related improvements
https://lore.kernel.org/linux-i3c/20260603090754.16252-1-adrian.hunter@intel.com
Changes in V2:
i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()
Factor out __i3c_hci_disable_ibi() to facilitate also clearing
ibi_devs[dat_idx] upon IBI free, and update commit message
accordingly.
Demote a message in PIO and DMA IBI handling, and update commit
message accordingly.
i3c: mipi-i3c-hci: Ignore DISEC failures when disabling IBIs
Re-base due to changes in previous patch.
i3c: master: Prevent reuse of dynamic address on device add failure
Fix 'if (IS_ERR(newdev)' error path.
Be defensive and do not change the addr_slot_status if it is not
free, and update commit message accordingly.
Amend commit message to note removal of unnecesary 'if (!master)'
check.
Add Fixes tag.
i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA
None
i3c: master: Make i3c_master_add_i3c_dev_locked() return void
Re-base due to changes in previous patches.
i3c: master: Move DAA API functions after i3c_master_add_i3c_dev_locked()
None
i3c: master: Reconcile dynamic addresses after DAA
Add bitmap.h include for bitmap_zero() etc.
Re-base due to changes in previous patches.
Adrian Hunter (7):
i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()
i3c: mipi-i3c-hci: Ignore DISEC failures when disabling IBIs
i3c: master: Prevent reuse of dynamic address on device add failure
i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA
i3c: master: Make i3c_master_add_i3c_dev_locked() return void
i3c: master: Move DAA API functions after i3c_master_add_i3c_dev_locked()
i3c: master: Reconcile dynamic addresses after DAA
drivers/i3c/master.c | 275 ++++++++++++++++++++++---------
drivers/i3c/master/mipi-i3c-hci/cmd_v1.c | 4 +-
drivers/i3c/master/mipi-i3c-hci/cmd_v2.c | 4 +-
drivers/i3c/master/mipi-i3c-hci/core.c | 45 ++++-
drivers/i3c/master/mipi-i3c-hci/dma.c | 7 +-
drivers/i3c/master/mipi-i3c-hci/hci.h | 1 +
drivers/i3c/master/mipi-i3c-hci/ibi.h | 13 +-
drivers/i3c/master/mipi-i3c-hci/pio.c | 7 +-
include/linux/i3c/master.h | 3 +-
9 files changed, 250 insertions(+), 109 deletions(-)
Regards
Adrian
--
linux-i3c mailing list
linux-i3c@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-i3c
WARNING: multiple messages have this Message-ID (diff)
From: Adrian Hunter <adrian.hunter@intel.com>
To: alexandre.belloni@bootlin.com
Cc: Frank.Li@nxp.com, linux-i3c@lists.infradead.org,
linux-kernel@vger.kernel.org
Subject: [PATCH V2 0/7] i3c: Fix IBI race, address handling, and reconcile DAA
Date: Mon, 8 Jun 2026 10:57:53 +0300 [thread overview]
Message-ID: <20260608075801.16111-1-adrian.hunter@intel.com> (raw)
Hi
Patches 1-2 fix a use-after-free race in the MIPI I3C HCI driver's IBI
handling and make IBI teardown resilient to DISEC failures.
Patches 3-7 fix address management issues in the I3C core and HCI
driver that arise when Dynamic Address Assignment (DAA) does not complete
cleanly, culminating in a reconciliation step that detects and resolves
inconsistencies between assigned address slots and registered devices.
Patches are based on top of:
[PATCH V3 0/8] i3c: Hot-Join improvements and MIPI HCI Hot-Join support
https://lore.kernel.org/linux-i3c/20260608054312.10604-1-adrian.hunter@intel.com
which, in turn, applies on top of:
[PATCH V5 00/17] i3c: mipi-i3c-hci: DMA abort, recovery and related improvements
https://lore.kernel.org/linux-i3c/20260603090754.16252-1-adrian.hunter@intel.com
Changes in V2:
i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()
Factor out __i3c_hci_disable_ibi() to facilitate also clearing
ibi_devs[dat_idx] upon IBI free, and update commit message
accordingly.
Demote a message in PIO and DMA IBI handling, and update commit
message accordingly.
i3c: mipi-i3c-hci: Ignore DISEC failures when disabling IBIs
Re-base due to changes in previous patch.
i3c: master: Prevent reuse of dynamic address on device add failure
Fix 'if (IS_ERR(newdev)' error path.
Be defensive and do not change the addr_slot_status if it is not
free, and update commit message accordingly.
Amend commit message to note removal of unnecesary 'if (!master)'
check.
Add Fixes tag.
i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA
None
i3c: master: Make i3c_master_add_i3c_dev_locked() return void
Re-base due to changes in previous patches.
i3c: master: Move DAA API functions after i3c_master_add_i3c_dev_locked()
None
i3c: master: Reconcile dynamic addresses after DAA
Add bitmap.h include for bitmap_zero() etc.
Re-base due to changes in previous patches.
Adrian Hunter (7):
i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()
i3c: mipi-i3c-hci: Ignore DISEC failures when disabling IBIs
i3c: master: Prevent reuse of dynamic address on device add failure
i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA
i3c: master: Make i3c_master_add_i3c_dev_locked() return void
i3c: master: Move DAA API functions after i3c_master_add_i3c_dev_locked()
i3c: master: Reconcile dynamic addresses after DAA
drivers/i3c/master.c | 275 ++++++++++++++++++++++---------
drivers/i3c/master/mipi-i3c-hci/cmd_v1.c | 4 +-
drivers/i3c/master/mipi-i3c-hci/cmd_v2.c | 4 +-
drivers/i3c/master/mipi-i3c-hci/core.c | 45 ++++-
drivers/i3c/master/mipi-i3c-hci/dma.c | 7 +-
drivers/i3c/master/mipi-i3c-hci/hci.h | 1 +
drivers/i3c/master/mipi-i3c-hci/ibi.h | 13 +-
drivers/i3c/master/mipi-i3c-hci/pio.c | 7 +-
include/linux/i3c/master.h | 3 +-
9 files changed, 250 insertions(+), 109 deletions(-)
Regards
Adrian
next reply other threads:[~2026-06-08 7:58 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-08 7:57 Adrian Hunter [this message]
2026-06-08 7:57 ` [PATCH V2 0/7] i3c: Fix IBI race, address handling, and reconcile DAA Adrian Hunter
2026-06-08 7:57 ` [PATCH V2 1/7] i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() Adrian Hunter
2026-06-08 7:57 ` Adrian Hunter
2026-06-08 7:57 ` [PATCH V2 2/7] i3c: mipi-i3c-hci: Ignore DISEC failures when disabling IBIs Adrian Hunter
2026-06-08 7:57 ` Adrian Hunter
2026-06-08 7:57 ` [PATCH V2 3/7] i3c: master: Prevent reuse of dynamic address on device add failure Adrian Hunter
2026-06-08 7:57 ` Adrian Hunter
2026-06-08 7:57 ` [PATCH V2 4/7] i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA Adrian Hunter
2026-06-08 7:57 ` Adrian Hunter
2026-06-08 7:57 ` [PATCH V2 5/7] i3c: master: Make i3c_master_add_i3c_dev_locked() return void Adrian Hunter
2026-06-08 7:57 ` Adrian Hunter
2026-06-08 7:57 ` [PATCH V2 6/7] i3c: master: Move DAA API functions after i3c_master_add_i3c_dev_locked() Adrian Hunter
2026-06-08 7:57 ` Adrian Hunter
2026-06-08 7:58 ` [PATCH V2 7/7] i3c: master: Reconcile dynamic addresses after DAA Adrian Hunter
2026-06-08 7:58 ` Adrian Hunter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260608075801.16111-1-adrian.hunter@intel.com \
--to=adrian.hunter@intel.com \
--cc=Frank.Li@nxp.com \
--cc=alexandre.belloni@bootlin.com \
--cc=linux-i3c@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.