linux/drivers/i3c, branch v6.12

i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition

2024-09-17T14:51:45Z

In the svc_i3c_master_probe function, &master->hj_work is bound with svc_i3c_master_hj_work, &master->ibi_work is bound with svc_i3c_master_ibi_work. And svc_i3c_master_ibi_work can start the hj_work, svc_i3c_master_irq_handler can start the ibi_work. If we remove the module which will call svc_i3c_master_remove to make cleanup, it will free master->base through i3c_master_unregister while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | svc_i3c_master_hj_work svc_i3c_master_remove | i3c_master_unregister(&master->base)| device_unregister(&master->dev) | device_release | //free master->base | | i3c_master_do_daa(&master->base) | //use master->base Fix it by ensuring that the work is canceled before proceeding with the cleanup in svc_i3c_master_remove. Fixes: 0f74f8b6675c ("i3c: Make i3c_master_unregister() return void") Cc: stable@vger.kernel.org Signed-off-by: Kaixin Wang Reviewed-by: Miquel Raynal Reviewed-by: Frank Li Link: https://lore.kernel.org/stable/20240914154030.180-1-kxwang23%40m.fudan.edu.cn Link: https://lore.kernel.org/r/20240914163932.253-1-kxwang23@m.fudan.edu.cn Signed-off-by: Alexandre Belloni

i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition

2024-09-17T14:50:18Z

In the cdns_i3c_master_probe function, &master->hj_work is bound with cdns_i3c_master_hj. And cdns_i3c_master_interrupt can call cnds_i3c_master_demux_ibis function to start the work. If we remove the module which will call cdns_i3c_master_remove to make cleanup, it will free master->base through i3c_master_unregister while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | cdns_i3c_master_hj cdns_i3c_master_remove | i3c_master_unregister(&master->base) | device_unregister(&master->dev) | device_release | //free master->base | | i3c_master_do_daa(&master->base) | //use master->base Fix it by ensuring that the work is canceled before proceeding with the cleanup in cdns_i3c_master_remove. Signed-off-by: Kaixin Wang Link: https://lore.kernel.org/r/20240911153544.848398-1-kxwang23@m.fudan.edu.cn Signed-off-by: Alexandre Belloni

i3c: master: svc: adjust SDR according to i3c spec

2024-09-17T14:48:40Z

According to I3C Specification(Version 1.1) 5.1.2.4 "Use of Clock Speed to Prevent Legacy I2C Devices From Seeing I3C traffic", when slow i2c devices(FM/FM+ rate i2c frequency without 50ns filter) works on i3c bus, i3c SDR should work at FM/FM+ rate. Adjust timing for difference mode. Signed-off-by: Clark Wang Signed-off-by: Carlos Song Signed-off-by: Frank Li Acked-by: Miquel Raynal Link: https://lore.kernel.org/r/20240719080233.842771-1-carlos.song@nxp.com Signed-off-by: Alexandre Belloni

i3c: master: svc: use slow speed for first broadcast address

2024-09-17T14:46:22Z

I3C controller should support adjusting open drain timing for the first broadcast address to make I3C device working as a i2c device can see slow broadcast address to close its Spike Filter to change working at i3c mode. Signed-off-by: Carlos Song Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20240910051626.4052552-2-carlos.song@nxp.com Signed-off-by: Alexandre Belloni

i3c: master: support to adjust first broadcast address speed

2024-09-17T14:46:22Z

According to I3C spec 6.2 Timing Specification, the Open Drain High Period of SCL Clock timing for first broadcast address should be adjusted to 200ns at least. I3C device working as i2c device will see the broadcast to close its Spike Filter then change to work at I3C mode. After that I3C open drain SCL high level should be adjusted back. Signed-off-by: Carlos Song Reviewed-by: Miquel Raynal Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20240910051626.4052552-1-carlos.song@nxp.com Signed-off-by: Alexandre Belloni

i3c/master: cmd_v1: Fix the rule for getting i3c mode

2024-09-06T15:36:02Z

Based on the I3C TCRI specification, the rules for determining the I3C mode are as follows: I3C SCL rate > 8MHz: use SDR0, as SDR1 has a maximum data rate of 8MHz I3C SCL rate > 6MHz: use SDR1, as SDR2 has a maximum data rate of 6MHz I3C SCL rate > 4MHz: use SDR2, as SDR3 has a maximum data rate of 4MHz I3C SCL rate > 2MHz: use SDR3, as SDR4 has a maximum data rate of 2MHz Otherwise, use SDR4 Signed-off-by: Billy Tsai Link: https://lore.kernel.org/r/20240826033821.175591-1-billy_tsai@aspeedtech.com Signed-off-by: Alexandre Belloni

i3c: master: cdns: fix module autoloading

2024-09-05T16:46:19Z

Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table. Signed-off-by: Liao Chen Link: https://lore.kernel.org/r/20240826123957.379212-1-liaochen4@huawei.com Signed-off-by: Alexandre Belloni

i3c: mipi-i3c-hci: Add a quirk to set Response buffer threshold

2024-09-05T16:34:09Z

The current driver sets the response buffer threshold value to 1 (N+1, 2 DWORDS) in the QUEUE THRESHOLD register. However, the AMD I3C controller only generates interrupts when the response buffer threshold value is set to 0 (1 DWORD). Therefore, a quirk is added to set the response buffer threshold value to 0. Reviewed-by: Jarkko Nikula Co-developed-by: Krishnamoorthi M Signed-off-by: Krishnamoorthi M Co-developed-by: Guruvendra Punugupati Signed-off-by: Guruvendra Punugupati Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20240829091713.736217-7-Shyam-sundar.S-k@amd.com Signed-off-by: Alexandre Belloni

i3c: mipi-i3c-hci: Add a quirk to set timing parameters

2024-09-05T16:34:09Z

The AMD HCI controller is currently unstable at 12.5 MHz. To address this, a quirk is added to configure the clock rate to 9 MHz as a workaround, with proportional adjustments to the Open-Drain (OD) and Push-Pull (PP) values. Reviewed-by: Jarkko Nikula Co-developed-by: Guruvendra Punugupati Signed-off-by: Guruvendra Punugupati Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20240829091713.736217-6-Shyam-sundar.S-k@amd.com Signed-off-by: Alexandre Belloni

i3c: mipi-i3c-hci: Relocate helper macros to HCI header file

2024-09-05T16:34:09Z

The reg_* helper macros are currently limited to core.c. Moving them to hci.h will allow their functionality to be utilized in other files outside of core.c. Reviewed-by: Jarkko Nikula Co-developed-by: Guruvendra Punugupati Signed-off-by: Guruvendra Punugupati Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20240829091713.736217-5-Shyam-sundar.S-k@amd.com Signed-off-by: Alexandre Belloni