[PATCH RESEND v2 0/2] i2c: cadence: Add support for Axiado AX3000

[PATCH RESEND v2 0/2] i2c: cadence: Add support for Axiado AX3000

[Swark Yang]

This patch series adds support for the Cadence I2C controller
integrated into the Axiado AX3000 SoC and enables SMBus Quick
command functionality.

The Axiado AX3000 utilizes the Cadence I2C IP core (version r1p14).
While it is largely compatible with the existing i2c-cadence
driver logic, the AX3000 hardware specifically supports SMBus Quick
commands. This feature is currently disabled by default in the
i2c-cadence driver (masked out from I2C_FUNC_SMBUS_EMUL).

To enable this functionality, this series introduces a new
platform-specific quirk (CDNS_I2C_QUIRK_SMBUS_QUICK) and uses driver
match data for the "axiado,ax3000-i2c" compatible string. This allows
tools like 'i2cdetect' to properly scan the bus using quick write
commands.

The DT binding update follows the recommended fallback structure,
referencing the 'cdns,i2c-r1p14' fallback to ensure compatibility with
older kernels while allowing the new quirk to be enabled on AX3000.

Changes in RESEND:
- Resending as the original submission seems to have slipped through the cracks.
- No code changes since the original submission.
- Collected Conor Dooley's Acked-by for Patch 1.

Patch breakdown:

Patch 1: dt-bindings: i2c: cadence: Add Axiado AX3000
Patch 2: i2c: cadence: Add support for Axiado AX3000

These patches are expected to go via the I2C subsystem tree.

Feedback is welcome.

Signed-off-by: Swark Yang <syang@axiado.com>
---
Changes in v2:
- EDITME: describe what is new in this series revision.
- EDITME: use bulletpoints and terse descriptions.
- Link to v1: https://lore.kernel.org/r/20260504-axiado-ax3000-cadence-i2c-support-v1-0-97ed2fdc0b7b@axiado.com

---
Swark Yang (2):
      dt-bindings: i2c: cadence: Add Axiado AX3000
      i2c: cadence: Add support for Axiado AX3000

 Documentation/devicetree/bindings/i2c/cdns,i2c-r1p10.yaml | 10 +++++++---
 drivers/i2c/busses/i2c-cadence.c                          | 10 ++++++++++
 2 files changed, 17 insertions(+), 3 deletions(-)
---
base-commit: 63804fed149a6750ffd28610c5c1c98cce6bd377
change-id: 20260111-axiado-ax3000-cadence-i2c-support-53ec117bb074

Best regards,
-- 
Swark Yang <syang@axiado.com>

[PATCH RESEND v2 1/2] dt-bindings: i2c: cadence: Add Axiado AX3000

[Swark Yang]

The Axiado AX3000 SoC integrates the Cadence I2C controller.
Add a specific compatible string "axiado,ax3000-i2c" to support
its hardware features, including SMBus Quick command capability.

Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Swark Yang <syang@axiado.com>
---
 Documentation/devicetree/bindings/i2c/cdns,i2c-r1p10.yaml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/Documentation/devicetree/bindings/i2c/cdns,i2c-r1p10.yaml b/Documentation/devicetree/bindings/i2c/cdns,i2c-r1p10.yaml
index 9f1d35ce1fe8..de2110376a3f 100644
--- a/Documentation/devicetree/bindings/i2c/cdns,i2c-r1p10.yaml
+++ b/Documentation/devicetree/bindings/i2c/cdns,i2c-r1p10.yaml
@@ -14,9 +14,13 @@ allOf:
 
 properties:
   compatible:
-    enum:
-      - cdns,i2c-r1p10 # cadence i2c controller version 1.0
-      - cdns,i2c-r1p14 # cadence i2c controller version 1.4
+    oneOf:
+      - items:
+          - const: axiado,ax3000-i2c
+          - const: cdns,i2c-r1p14
+      - enum:
+          - cdns,i2c-r1p10 # cadence i2c controller version 1.0
+          - cdns,i2c-r1p14 # cadence i2c controller version 1.4
 
   reg:
     maxItems: 1

-- 
2.34.1

[PATCH RESEND v2 2/2] i2c: cadence: Add support for Axiado AX3000

[Swark Yang]

The Axiado AX3000 SoC integrates a Cadence I2C controller
that supports SMBus Quick commands.

Introduce the "axiado,ax3000-i2c" compatible string and
add a new quirk CDNS_I2C_QUIRK_SMBUS_QUICK to enable
this functionality. This allows the controller to support
I2C_FUNC_SMBUS_QUICK, enabling features such as bus scanning
via quick write commands.

Signed-off-by: Swark Yang <syang@axiado.com>
---
 drivers/i2c/busses/i2c-cadence.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
index 0fb728ade92e..8079c045f936 100644
--- a/drivers/i2c/busses/i2c-cadence.c
+++ b/drivers/i2c/busses/i2c-cadence.c
@@ -128,6 +128,7 @@
 #define CDNS_I2C_TIMEOUT_MAX	0xFF
 
 #define CDNS_I2C_BROKEN_HOLD_BIT	BIT(0)
+#define CDNS_I2C_QUIRKS_ENABLE_SMBUS_QUICK_CFG BIT(1)
 #define CDNS_I2C_POLL_US	100000
 #define CDNS_I2C_POLL_US_ATOMIC	10
 #define CDNS_I2C_TIMEOUT_US	500000
@@ -1175,10 +1176,14 @@ static int cdns_i2c_master_xfer_atomic(struct i2c_adapter *adap, struct i2c_msg
  */
 static u32 cdns_i2c_func(struct i2c_adapter *adap)
 {
+	struct cdns_i2c *id = adap->algo_data;
 	u32 func = I2C_FUNC_I2C | I2C_FUNC_10BIT_ADDR |
 			(I2C_FUNC_SMBUS_EMUL & ~I2C_FUNC_SMBUS_QUICK) |
 			I2C_FUNC_SMBUS_BLOCK_DATA;
 
+	if (id->quirks & CDNS_I2C_QUIRKS_ENABLE_SMBUS_QUICK_CFG)
+		func |= I2C_FUNC_SMBUS_QUICK;
+
 #if IS_ENABLED(CONFIG_I2C_SLAVE)
 	func |= I2C_FUNC_SLAVE;
 #endif
@@ -1442,9 +1447,14 @@ static const struct cdns_platform_data r1p10_i2c_def = {
 	.quirks = CDNS_I2C_BROKEN_HOLD_BIT,
 };
 
+static const struct cdns_platform_data ax3000_i2c_def = {
+	.quirks = CDNS_I2C_QUIRKS_ENABLE_SMBUS_QUICK_CFG,
+};
+
 static const struct of_device_id cdns_i2c_of_match[] = {
 	{ .compatible = "cdns,i2c-r1p10", .data = &r1p10_i2c_def },
 	{ .compatible = "cdns,i2c-r1p14",},
+	{ .compatible = "axiado,ax3000-i2c", .data = &ax3000_i2c_def },
 	{ /* end of table */ }
 };
 MODULE_DEVICE_TABLE(of, cdns_i2c_of_match);

-- 
2.34.1

Re: [PATCH RESEND v2 2/2] i2c: cadence: Add support for Axiado AX3000

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

New issues:
- [High] Enabling I2C_FUNC_SMBUS_QUICK advertises 0-length reads, which the Cadence IP does not natively support, leading to bus hangs.

Pre-existing issues:
- [Critical] A state confusion vulnerability in `cdns_i2c_master_isr` leads to a Use-After-Free read when a 0-length read follows a failed transmit transfer.
- [High] Atomic transfers completely ignore hardware errors (such as NACKs), leading to false success reports or unacceptable polling timeouts.
--

commit ff52e0b03cba3111fdadd1c1d340a29ac8a5b77f
Author: Swark Yang <syang@axiado.com>

i2c: cadence: Add support for Axiado AX3000

The Axiado AX3000 SoC integrates a Cadence I2C controller that supports SMBus
Quick commands. This patch introduces the "axiado,ax3000-i2c" compatible
string and a new quirk to enable this functionality.

> diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
> index 0fb728ade92e4..8079c045f9365 100644
> --- a/drivers/i2c/busses/i2c-cadence.c
> +++ b/drivers/i2c/busses/i2c-cadence.c
[ ... ]
> @@ -1175,10 +1176,14 @@ static int cdns_i2c_master_xfer_atomic(struct i2c_adapter *adap, struct i2c_msg
>   */
>  static u32 cdns_i2c_func(struct i2c_adapter *adap)
>  {
> +	struct cdns_i2c *id = adap->algo_data;
>  	u32 func = I2C_FUNC_I2C | I2C_FUNC_10BIT_ADDR |
>  			(I2C_FUNC_SMBUS_EMUL & ~I2C_FUNC_SMBUS_QUICK) |
>  			I2C_FUNC_SMBUS_BLOCK_DATA;
>  
> +	if (id->quirks & CDNS_I2C_QUIRKS_ENABLE_SMBUS_QUICK_CFG)
> +		func |= I2C_FUNC_SMBUS_QUICK;
> +

[Severity: High]
Does adding I2C_FUNC_SMBUS_QUICK allow the I2C core to send unsupported
0-length reads to the adapter?

The Cadence controller does not natively support 0-length reads. If a 0-length
read is processed, cdns_i2c_mrecv() writes 0 to the Transfer Size Register
(CDNS_I2C_XFER_SIZE_OFFSET). This unsupported hardware state can cause the I2C
bus to hang or trigger rogue transfers.

Should the adapter's quirks be populated with I2C_AQ_NO_ZERO_LEN_READ to safely
support Quick commands?

[Severity: High]
This isn't a bug introduced by this patch, but do atomic transfers completely
ignore hardware errors like NACKs?

In atomic mode, cdns_i2c_process_msg() polls for completion by waiting
specifically for the CDNS_I2C_IXR_COMP bit. It entirely ignores error bits such
as CDNS_I2C_IXR_NACK. If a NACK occurs without COMP being set, the polling macro
blocks for the full timeout instead of failing fast.

Additionally, cdns_i2c_master_common_xfer() checks id->err_status_atomic to
report atomic errors, but this variable is never assigned anywhere in the driver.

Could this lead to system stalls during operations like SMBus Quick scanning?

[Severity: Critical]
This is a pre-existing issue, but does exposing 0-length reads via SMBUS_QUICK
trigger a state confusion vulnerability in cdns_i2c_master_isr()?

When a master transmit transfer fails (e.g., due to a NACK), the cleanup routine
does not reset id->send_count or id->p_send_buf.

If a subsequent 0-length read is issued (where msg->buf is NULL),
cdns_i2c_mrecv() sets id->p_recv_buf = NULL but leaves id->send_count and
id->p_send_buf containing stale values.

Upon interrupt completion, the ISR cdns_i2c_master_isr() evaluates
!id->p_recv_buf as true, erroneously enters the transmit completion block, loops
over id->send_count, and dereferences the previously freed id->p_send_buf.

Can this write unmapped or freed kernel memory to the hardware FIFO?

>  #if IS_ENABLED(CONFIG_I2C_SLAVE)
>  	func |= I2C_FUNC_SLAVE;
>  #endif

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260611-axiado-ax3000-cadence-i2c-support-v2-0-cfdad0534afa@axiado.com?part=2