From nobody Tue Jun 9 00:00:21 2026 Received: from smtp1-g21.free.fr (smtp1-g21.free.fr [212.27.42.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 23DCF2B9A4; Mon, 25 May 2026 11:24:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=212.27.42.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779708290; cv=none; b=PNRHNndWxU6zMYJicObCWui/zLhJJ1Vd9xiGHB27QDP0fS1YF4WxX1hqhLWFb//F6ZzDxzA3tndnGoUXQ8FAcj2VWdRKifDDv/qGzdTUfShLGtHeykJiWPujJGSRKheuoTipDiVJgFbknpbHoNHIninY918lPRDsTtObaR36tTE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779708290; c=relaxed/simple; bh=47xlOO5JbId46R5ZNpfziDDo8V+XnFuCW1yJNrzdW3U=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=TI6TMxxkD9Yu8pTD9hDVPn47Y18EYYm7kGXfLdW4HDk6I09dTeN85OQmUFEiwxaSWDTnIbIEAe7+L6AsDhFWK+DEgDvJoDo/ZzetAeZLnZNVH6jQ8c4ateRWH1xyiP8UTVBFexq7DLo2qIK0/EabPFUQ5Zb8zmCdhAMW0vnC9I8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=free.fr; spf=pass smtp.mailfrom=free.fr; dkim=pass (2048-bit key) header.d=free.fr header.i=@free.fr header.b=GC5+QXQy; arc=none smtp.client-ip=212.27.42.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=free.fr Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=free.fr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=free.fr header.i=@free.fr header.b="GC5+QXQy" Received: from [127.0.1.1] (unknown [91.160.0.144]) (Authenticated sender: vjardin@free.fr) by smtp1-g21.free.fr (Postfix) with ESMTPSA id 49895B0059C; Mon, 25 May 2026 13:24:29 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=free.fr; s=smtp-20201208; t=1779708287; bh=47xlOO5JbId46R5ZNpfziDDo8V+XnFuCW1yJNrzdW3U=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=GC5+QXQyrM/L8pDABN5U+N6oqFJw1qGBvBh+sJt0SXW5J5YrETyGLTwx85gQMFt6T iy1OB9KAi2KRROBi+oK/e/B3BvgLkZtW/hFfu2C5tgmuTAgYPdnrXCnD9Fe8iXl1v9 ANTofiUA/NPvDoCIqm2pkmF/HiCgDKwNkjqsJWzVr4aWWqACdPmX2BmhS9nhTpkqBt LCLz60n/v1SBqL0RHAqu3SCaPZ4cHKcL330woF7cM/vPj/AUIUSg64q8+0RpIK9rKf kgV1lf113lcdHlHG32ylLkr4h+CznbAh5LOBWzxMusVghpAOoxJ+nuPefdNIDBxLig qlS+9dk9gYQJQ== From: Vincent Jardin Date: Mon, 25 May 2026 13:24:02 +0200 Subject: [PATCH 1/2] i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260525-for-upstream-i2c-lx2160-fix-v1-v1-1-f30ab53dd97c@free.fr> References: <20260525-for-upstream-i2c-lx2160-fix-v1-v1-0-f30ab53dd97c@free.fr> In-Reply-To: <20260525-for-upstream-i2c-lx2160-fix-v1-v1-0-f30ab53dd97c@free.fr> To: Oleksij Rempel , Pengutronix Kernel Team , Andi Shyti , Frank Li , Sascha Hauer , Fabio Estevam , Wolfram Sang , Kaushal Butala , Shawn Guo , Stefan Eichenberger Cc: linux-i2c@vger.kernel.org, imx@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Vincent Jardin , stable@vger.kernel.org X-Mailer: b4 0.13.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1779708249; l=1759; i=vjardin@free.fr; s=20260525; h=from:subject:message-id; bh=47xlOO5JbId46R5ZNpfziDDo8V+XnFuCW1yJNrzdW3U=; b=2eo7uMa1GLjy9XOUrlVsSrBMoV+sMK2Dc9T5c68PVvADPOD6V2VISAuCyCV/8lho3kg5+hk1L Iaf5oB8SqXjAK8k9smeYquWY1LfjradUGe0gBniikkvzvBBskr96KOu X-Developer-Key: i=vjardin@free.fr; a=ed25519; pk=hppgLeFpGpKOi7LNwGEZ4jOYofJCoGd4Jf1ltAabiLw= SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic (polling) path rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has already started, so the target keeps holding SDA and the bus stays stuck until a power cycle for this i2c controller. Accept count=3D0: NACK the in-flight dummy byte (TXAK) and extend msgs->len so the existing last-byte handling emits STOP. The dummy byte is discarded; block-read callers only consume buf[0..count-1]. The interrupt-driven path has the same flaw from a later commit and is fixed separately, as it carries a different Fixes: Fixes: 8e8782c71595 ("i2c: imx: add SMBus block read support") Cc: # v3.16+ Signed-off-by: Vincent Jardin --- drivers/i2c/busses/i2c-imx.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c index a208fefd3c3b..0cd4f5892591 100644 --- a/drivers/i2c/busses/i2c-imx.c +++ b/drivers/i2c/busses/i2c-imx.c @@ -1436,8 +1436,19 @@ static int i2c_imx_atomic_read(struct imx_i2c_struct= *i2c_imx, */ if ((!i) && block_data) { len =3D imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR); - if ((len =3D=3D 0) || (len > I2C_SMBUS_BLOCK_MAX)) + if (len > I2C_SMBUS_BLOCK_MAX) return -EPROTO; + if (len =3D=3D 0) { + /* + * SMBus 3.1 6.5.7: support count byte of 0. + */ + temp =3D imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR); + temp |=3D I2CR_TXAK; + imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR); + msgs->buf[0] =3D 0; + msgs->len =3D 2; + continue; + } dev_dbg(&i2c_imx->adapter.dev, "<%s> read length: 0x%X\n", __func__, len); --=20 2.43.0 From nobody Tue Jun 9 00:00:21 2026 Received: from smtp1-g21.free.fr (smtp1-g21.free.fr [212.27.42.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BA64333BBD9; Mon, 25 May 2026 11:25:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=212.27.42.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779708309; cv=none; b=M/IzAecgJMTHuv4QkG/6m1VjQQwqByrdL43DKmtyykZPEhTOQ4kaFWLLzLE+dREMApCe+O2i32meKNRbRy6F0iQEsWU04EjPW8IbqTWUTgl8DIHzZIh7qpalllzgDR2cGp0NFw+FogMn0pNw+b0xPlN0PoUVhKBEqazG2G0op54= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779708309; c=relaxed/simple; bh=QI+F4s3l2reRW12v8sYKUXXffhbNq76K46I/ps3EMWw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=A8uAsIqCR0n9mByUDQVhNhUMxSKAT/zvzSb2bzRORRLJ8bxrtCvxSfSYY1EF+PxdSfJsZfnkIdlQv0rNhQG+pxAaUJYuNsbnIv6ajbuNELXRVFU+yk5ngO8nAettXmH9aJ48C8bHvcvcO6UJCZsIxJeVMgxDzgyWSQ6nvupv7kk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=free.fr; spf=pass smtp.mailfrom=free.fr; dkim=pass (2048-bit key) header.d=free.fr header.i=@free.fr header.b=CTA6+bZG; arc=none smtp.client-ip=212.27.42.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=free.fr Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=free.fr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=free.fr header.i=@free.fr header.b="CTA6+bZG" Received: from [127.0.1.1] (unknown [91.160.0.144]) (Authenticated sender: vjardin@free.fr) by smtp1-g21.free.fr (Postfix) with ESMTPSA id EA1F2B00596; Mon, 25 May 2026 13:24:47 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=free.fr; s=smtp-20201208; t=1779708306; bh=QI+F4s3l2reRW12v8sYKUXXffhbNq76K46I/ps3EMWw=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=CTA6+bZGOui1FpWIZFA65ZS55voHN9neOqzEHsRBiY7XIxXX1DCQyfMMzmf/r4mxL 8F++ywor5VLGprwzyvNPqWF2iPfshkp8yWP2NJ8z6JSgTsF8uOuJ+rSEpjrecy1Hfb or7A5qUlMfWcS50GJDZu9zzIfnsmGpa0Hr7ttA+yNbAi7bdAbm5okoTGw/6gmZlvkq vSKnpj7dB63KfCQj3aTtkmWQiVYedDEfv/sSFsIUTLutNiftSguMfvEgX8/kdiEKRr YCdQ1sbXmesIk+eEpkydm2HXOX/lGOpeeuf7Ega6Aw+zwu8W7tQcgk58JWKJ9hfatm a63mBfLJ8WNQg== From: Vincent Jardin Date: Mon, 25 May 2026 13:24:03 +0200 Subject: [PATCH 2/2] i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260525-for-upstream-i2c-lx2160-fix-v1-v1-2-f30ab53dd97c@free.fr> References: <20260525-for-upstream-i2c-lx2160-fix-v1-v1-0-f30ab53dd97c@free.fr> In-Reply-To: <20260525-for-upstream-i2c-lx2160-fix-v1-v1-0-f30ab53dd97c@free.fr> To: Oleksij Rempel , Pengutronix Kernel Team , Andi Shyti , Frank Li , Sascha Hauer , Fabio Estevam , Wolfram Sang , Kaushal Butala , Shawn Guo , Stefan Eichenberger Cc: linux-i2c@vger.kernel.org, imx@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Vincent Jardin , stable@vger.kernel.org X-Mailer: b4 0.13.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1779708249; l=2194; i=vjardin@free.fr; s=20260525; h=from:subject:message-id; bh=QI+F4s3l2reRW12v8sYKUXXffhbNq76K46I/ps3EMWw=; b=9E/1geMmLSMLu7ab1ocRO4B32jedOSXKFDbwcYcO46aNg3xmG0FMf6lFwxLHOenQrI+Jz+xBj VMUF8FUJxH6CSBh0QyCKGT3mTdU5RCcIIUUL4dx/H61no6SjC3A/29V X-Developer-Key: i=vjardin@free.fr; a=ed25519; pk=hppgLeFpGpKOi7LNwGEZ4jOYofJCoGd4Jf1ltAabiLw= SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has already started, so the target keeps holding SDA and the bus stays stuck until a power cycle of this i2c controller. Accept count=3D0: NACK the in-flight dummy byte (TXAK) and set msg->len to 2 so i2c_imx_isr_read_continue() emits STOP via its normal last-byte path. The dummy byte is discarded; block-read callers only consume buf[0..count-1]. While here, return early on the I2C_SMBUS_BLOCK_MAX error path instead of falling through and overwriting msg->len/msg->buf with the rejected count byte. The atomic path regressed earlier (v3.16) and is fixed separately; this patch covers only the v6.13 state-machine rework. Fixes: 5f5c2d4579ca ("i2c: imx: prevent rescheduling in non dma mode") Cc: # v6.13+ Signed-off-by: Vincent Jardin --- drivers/i2c/busses/i2c-imx.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c index 0cd4f5892591..8792cb5cb9a8 100644 --- a/drivers/i2c/busses/i2c-imx.c +++ b/drivers/i2c/busses/i2c-imx.c @@ -1061,11 +1061,26 @@ static inline enum imx_i2c_state i2c_imx_isr_read_c= ontinue(struct imx_i2c_struct static inline void i2c_imx_isr_read_block_data_len(struct imx_i2c_struct *= i2c_imx) { u8 len =3D imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR); + unsigned int temp; =20 - if (len =3D=3D 0 || len > I2C_SMBUS_BLOCK_MAX) { + if (len > I2C_SMBUS_BLOCK_MAX) { i2c_imx->isr_result =3D -EPROTO; i2c_imx->state =3D IMX_I2C_STATE_FAILED; wake_up(&i2c_imx->queue); + return; + } + + if (len =3D=3D 0) { + /* + * SMBus 3.1 6.5.7 "Block Write/Read": byte count can be 0 + */ + temp =3D imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR); + temp |=3D I2CR_TXAK; + imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR); + + i2c_imx->msg->buf[i2c_imx->msg_buf_idx++] =3D 0; + i2c_imx->msg->len =3D 2; + return; } i2c_imx->msg->len +=3D len; i2c_imx->msg->buf[i2c_imx->msg_buf_idx++] =3D len; --=20 2.43.0