Pull i2c fixes from Andi Shyti:
 "Fixes mainly for teardown and resource handling, runtime PM and
  hardware-specific controller issues:

   - fix debugfs use-after-free when removing the adapter

   - designware: apply interrupt mask quirk for HJMC3001

   - imx-lpi2c: avoid target accesses on master-only controllers

   - mux: release channel node when adapter registration fails

   - qcom-cci: fix autosuspend and runtime PM cleanup on removal

   - qcom-geni: fix timing parameters for 32 MHz clock"

* tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
  i2c: core: fix debugfs UAF on adapter removal
  i2c: imx-lpi2c: avoid accessing target registers on master-only controllers
  i2c: qcom-cci: fix autosuspend cleanup
  i2c: designware: Enable interrupt mask workaround for HJMC3001
  i2c: qcom-geni: update frequency table to fix timing parameters
  i2c: mux: Fix channel node leak on adapter add failure

Pull more drm updates from Dave Airlie:
 "As mentioned last week, an msm pull request fell down the side of the
  couch or whatever the email equivalent of that is. This has the msm
  next stuff + the usual fixes for amd/intel.

  core:
   - use drm_warn instead of warn

  msm:
   - Bindings:
      - Added Shikra support
      - Document a840, a704, a722
   - Core:
      - Use drm_client buffers for fbdev emulation
      - teardown fixes
      - ARM32 DMA fixup
      - Remove objects from evict list when re-validated
      - Bunch of corner case and error path fixes
   - DPU:
      - Dropped dev_pm_opp_set_rate(0) preventing burnout
      - Fixed SSPP offsets of Kaanapali
   - DP:
      - Dropped dev_pm_opp_set_rate(0) preventing burnout
      - Cleaned up core code in preparation for MST support
      - Fixed prepare() to let Pipewire continue in case of the unplugged cable
   - GPU:
      - Add support for a704
      - Add support for a722
   - HDMI:
      - Simplifed register access

  amdgpu:
   - eGPU fixes
   - Runtime PM fix
   - UserQ fixes
   - Backlight fix
   - Discovery sysfs fix
   - Reset handling fixes
   - Buffer func handling fix for xgmi
   - VCN boundary check fix
   - DC lut handling fixes
   - MES fixes
   - UVD fix
   - VCE 3 fix
   - Enforce isolation fix
   - HPD fix for VGA/LVDS
   - DML fix
   - DCN 6 fixes
   - DC gpu reset fix

  amdkfd:
   - Fix return value
   - CU occupancy for GFX 11
   - CU occupancy for GFX 12/12.1
   - Queue bounds checking fix
   - SVM fixes
   - CRIU bounds checking fix

  radeon:
   - iMac display fix

  xe:
   - error message cleanups
   - i2c global register definitions as dependency for xe/i2c fixes
   - Media workardound
   - Add CCS to gt_idle debugfs print
   - Page fault related fix
   - i2c related fixes
   - System Controller mailbox bit fix"

* tag 'drm-next-2026-08-29' of https://gitlab.freedesktop.org/drm/kernel: (121 commits)
  drm/xe/sysctrl: Read mailbox phase bit from hardware
  drm/xe/i2c: Keep the i2c controller always enabled
  drm/xe/i2c: Fix the interrupt handling
  i2c: designware: Global register definitions
  drm/xe: Reject page faults from non-fault-mode scratch VMs
  drm/xe/xe_gt_idle: Add CCS to the powergating info print
  drm/xe: Do not apply WA 14025883347 to media 3503
  drm/amd/display: fix dc_lock leak on GPU reset error paths
  drm/amd/display: Fix redundant GPUVMEnable checks in dcn6 flip schedule
  drm/amd/display: Fix wrong bytes-per-pixel value for dml2_422_packed_10
  drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
  drm/amdgpu/userq: fix lock missing for userq fence error set
  drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
  drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
  drm/amd/display: Log details when failing to register HPD IRQ
  drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE
  drm/amdgpu: clamp the isolation index for rings outside a partition
  drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
  drm/amdgpu: Fix VCE 3 ring align_mask
  drm/kfd: Add CU occupancy support to GFX12.1
  ...

i2c_del_adapter() frees the adapter's debugfs directory before it
unregisters the adapter device, but the new_device sysfs attribute
stays writable until device_del(). A write racing with removal still
reaches i2c_device_probe(), which passes the freed adap->debugfs to
debugfs_create_dir() as the new client's parent:

  BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430
  Read of size 4 at addr ffff88803ef87810 by task syz.0.61/6090
   lookup_noperm_common+0x407/0x430
   simple_start_creating+0x9c/0x110
   debugfs_start_creating+0xdb/0x1a0
   debugfs_create_dir+0x24/0x350
   i2c_device_probe+0x814/0xbf0

It's technically possible to create a client after i2c_deregister_clients
has run. That client will never be unregistered and make
wait_for_completion hang.

Close the window by removing the new_device attribute at the start of
i2c_del_adapter(). device_remove_file() will drain any clients left.

Fixes: 73febd775bdb ("i2c: create debugfs entry per adapter")
Reported-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=23ad911c819b923238b7
Signed-off-by: Vasileios Almpanis <vasilisalmpanis@gmail.com>
Cc: <stable@vger.kernel.org> # v6.8+
Tested-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20260812-i2c-v2-1-5efaab4c3334@gmail.com

Not all LPI2C controller instances implement the Target block.
Since commit 90311787f483 ("i2c: imx-lpi2c: reset controller in
probe stage"), the driver unconditionally resets both the Master
and Target blocks during probe.

On controllers that do not support target mode, accessing the
Target registers triggers an asynchronous SError and prevents the
driver from probing successfully. For example on i.MX8QM:

  SError Interrupt on CPU2, code 0x00000000bf000002 -- SError
  Hardware name: Freescale i.MX8QM MEK (DT)
  pc : lpi2c_imx_probe+0x280/0x594
  lr : lpi2c_imx_probe+0x224/0x594
  Kernel panic - not syncing: Asynchronous SError Interrupt

The VERID register is implemented in the Master block and can be
safely accessed on all controller variants. Its FEATURE field
indicates whether target mode is supported.

Read VERID during probe and use it to determine whether the
Target block is present. Only access Target registers when target
mode is supported and reject target registration requests with
-EOPNOTSUPP otherwise.

Fixes: 90311787f483 ("i2c: imx-lpi2c: reset controller in probe stage")
Signed-off-by: Carlos Song <carlos.song@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20260803032705.2250373-1-carlos.song@oss.nxp.com

cci_probe() calls pm_runtime_use_autosuspend(), but the remove path
does not call the matching pm_runtime_dont_use_autosuspend() before
disabling runtime PM.

If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without undoing the autosuspend setting during
teardown, this reference is not dropped and usage_count remains
unbalanced.

Use devm_pm_runtime_set_active_enabled() to manage the runtime PM
state. Its managed cleanup disables autosuspend and runtime PM and
restores the suspended state on probe failure and driver removal.
Remove the now redundant manual runtime PM cleanup.

This issue was found by manual code inspection.

Fixes: e517526195de ("i2c: Add Qualcomm CCI I2C driver")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Cc: <stable@vger.kernel.org> # v5.8+
Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20260812094425.3515179-1-lgs201920130244@gmail.com

On HJMicro ARM64 servers, the DesignWare I2C controller does not
retrigger a pending interrupt if the interrupt status changes after
the current status bits have been cleared.

The issue is exposed under heavy system load when the corresponding
SPI is routed across sockets to a core in the remote socket. The
interrupt is then lost and the I2C transfer times out.

Enable ACCESS_INTR_MASK for HJMC3001. This toggles DW_IC_INTR_MASK
before returning from the interrupt handler and retriggers any
pending interrupt.

Fixes: 6816ce57c479 ("i2c: designware: Add a new ACPI HID for HJMC01 I2C controller")
Signed-off-by: Hongbo Yao <andy.xu@hj-micro.com>
Cc: <stable@vger.kernel.org> # v6.13+
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20260826070547.268672-1-andy.xu@hj-micro.com

In IPQ5424, to meet the setup and hold timing requirements in the
standard mode, update the frequency table with the values recommended by
HW design team.

Also remove the stray space in the I2C_MAX_FAST_MODE_FREQ entry.

Fixes: 85c34532849d ("i2c: qcom-geni: fix I2C frequency table to achieve accurate bus rates")
Fixes: 506bb2ab0075 ("i2c: qcom-geni: Support systems with 32MHz serial engine clock")
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Cc: <stable@vger.kernel.org> # v6.13+
Reviewed-by: Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20260812-ipq5424_i2c_scl_updates-v2-1-e09cd39d01d7@oss.qualcomm.com

Moving the register definitions to a global header file
include/linux/designware_i2c.h. That removes the need to
duplicate them in the adaptation layers for this driver
outside of drivers/i2c/busses/. There is at least one of
those in drivers/gpu/drm/xe/xe_i2c.c.

Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Suggested-by: Raag Jadav <raag.jadav@intel.com>
Reviewed-by: Raag Jadav <raag.jadav@intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Link: https://patch.msgid.link/20260811121008.1493015-2-heikki.krogerus@linux.intel.com
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
(cherry picked from commit 2ab2fb31411a494e4579dfacda986a2672f80e65)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

i2c_mux_add_adapter() takes a reference to the Device Tree channel node
before registering the new adapter. If adapter registration fails, the
error path frees the private data without dropping that reference.

Release the channel node before freeing the private data.

Fixes: bc45449b1444 ("i2c/of: Automatically populate i2c mux busses from device tree data.")
Signed-off-by: Ahmad Byagowi <ahmadexp@gmail.com>
Cc: <stable@vger.kernel.org> # v3.5+
Acked-by: Peter Rosin <peda@lysator.liu.se>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/b3e46bbee781b3cb4029aca9a71316cc5e36dc17.1787502619.git.ahmadexp@gmail.com

Pull more i2c updates from Andi Shyti:
 "Fixes and cleanups around probe error handling, resource management
  and a minor Rust cleanup.

  Drivers:
   - several drivers: drop duplicate IRQ error reporting
   - imx-lpi2c: improve probe initialization and error cleanup
   - mxs: fix DMA channel leak on probe failure
   - ocores: fix clock cleanup on resume failure
   - rcar: handle reset controllers without status support

  Muxes:
   - demux-pinctrl: fix OF node leak on allocation failure

  Rust:
   - mark trivial I2cAdapter reference-counting methods inline"

* tag 'i2c-7.3-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
  i2c: rust: mark I2cAdapter methods as inline
  i2c: rcar: fix reset handling for Gen5
  i2c: mxs: fix DMA channel leak on probe error
  i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
  i2c: ocores: Disable clock on failed resume
  i2c: imx-lpi2c: reset controller in probe stage
  i2c: imx-lpi2c: properly unwind resources on probe failure
  i2c: busses: drop redundant dev_err_probe() around irq helpers