* Re: [PATCH v2] i3c: master: dw-i3c-master: Add HDR-DDR support to Designware Controller.
2026-11-01 0:52 ` [PATCH v2] " Dineshkumar Parameswaran
@ 2026-11-01 1:06 ` sashiko-bot
2026-11-02 21:37 ` Frank Li
2026-11-11 2:11 ` [PATCH v3] " Dineshkumar Parameswaran
2 siblings, 0 replies; 8+ messages in thread
From: sashiko-bot @ 2026-11-01 1:06 UTC (permalink / raw)
To: Dineshkumar Parameswaran; +Cc: linux-i3c, Frank.Li, Alexandre Belloni
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] i3c: master: dw: broken HDR-DDR direction check in dw_i3c_master_i3c_xfers()
- [High] i3c: master: dw: missing HDR command code in dw_i3c_master_i3c_xfers()
--
commit c62ca5b32f1bbdaf98b64129620fa93cf49be278
Author: Dineshkumar Parameswaran <Dineshkumar.Parameswaran@synopsys.com>
i3c: master: dw-i3c-master: Add HDR-DDR support to Designware Controller.
This commit adds HDR-DDR private transfer support to the DesignWare I3C
master driver by advertising I3C_HDR_DDR in dw_i3c_master_bus_init() and
configuring COMMAND_PORT_CP and DW_I3C_HDR_DDR_SPEED in
dw_i3c_master_i3c_xfers().
> diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
> index d1119f203d1b6..6a95e982f59d7 100644
> --- a/drivers/i3c/master/dw-i3c-master.c
> +++ b/drivers/i3c/master/dw-i3c-master.c
[ ... ]
> @@ -1003,20 +1007,25 @@ static int dw_i3c_master_i3c_xfers(struct i3c_dev_desc *dev,
> if (i3c_xfers[i].rnw) {
> cmd->rx_buf = i3c_xfers[i].data.in;
> cmd->rx_len = i3c_xfers[i].len;
> - cmd->cmd_lo = COMMAND_PORT_READ_TRANSFER |
> - COMMAND_PORT_SPEED(dev->info.max_read_ds);
> + cmd->cmd_lo = COMMAND_PORT_READ_TRANSFER;
>
> } else {
> cmd->tx_buf = i3c_xfers[i].data.out;
> cmd->tx_len = i3c_xfers[i].len;
> - cmd->cmd_lo =
> - COMMAND_PORT_SPEED(dev->info.max_write_ds);
> }
[Severity: High]
Does checking i3c_xfers[i].rnw directly misclassify HDR-DDR write transfers
with non-zero command codes as reads?
In struct i3c_xfer (include/linux/i3c/device.h), rnw and cmd share an
anonymous union:
struct i3c_xfer {
union {
u8 rnw;
u8 cmd;
};
In I3C_HDR_DDR mode, callers populate cmd with the 8-bit HDR command word,
where bit 7 (I3C_HDR_CMD_RNW) encodes the transfer direction (0x00..0x7f
for write, 0x80..0xff for read) and bits 6:0 (I3C_HDR_CMD_CODE) hold the
7-bit command code.
Because dw_i3c_master_i3c_xfers() tests if (i3c_xfers[i].rnw) directly in
three places:
for (i = 0; i < i3c_nxfers; i++) {
if (i3c_xfers[i].rnw)
nrxwords += DIV_ROUND_UP(i3c_xfers[i].len, 4);
else
ntxwords += DIV_ROUND_UP(i3c_xfers[i].len, 4);
}
...
if (i3c_xfers[i].rnw) {
cmd->rx_buf = i3c_xfers[i].data.in;
cmd->rx_len = i3c_xfers[i].len;
cmd->cmd_lo = COMMAND_PORT_READ_TRANSFER;
} else {
cmd->tx_buf = i3c_xfers[i].data.out;
cmd->tx_len = i3c_xfers[i].len;
}
...
if (i3c_xfers[i].rnw)
i3c_xfers[i].len = cmd->rx_len;
any HDR-DDR write transfer with a non-zero command code (0x01..0x7f) has
i3c_xfers[i].rnw != 0. As a result, its payload is counted in nrxwords
instead of ntxwords, the command is programmed with
COMMAND_PORT_READ_TRANSFER, nothing is written to the TX FIFO, and
dw_i3c_master_end_xfer_locked() -> dw_i3c_master_read_rx_fifo() overwrites
the caller's const data.out buffer via cmd->rx_buf (which aliases data.out
in union data).
Should the direction check in dw_i3c_master_i3c_xfers() inspect
(i3c_xfers[i].cmd & I3C_HDR_CMD_RNW) when mode == I3C_HDR_DDR, similar to
i3c_hci_rnw() in drivers/i3c/master/mipi-i3c-hci/core.c and
svc_i3c_master_i3c_xfers() in drivers/i3c/master/svc-i3c-master.c?
>
> cmd->cmd_lo |= COMMAND_PORT_TID(i) |
> COMMAND_PORT_DEV_INDEX(data->index) |
> COMMAND_PORT_ROC;
>
> + if (mode == I3C_HDR_DDR)
> + cmd->cmd_lo |= COMMAND_PORT_CP |
> + COMMAND_PORT_SPEED(DW_I3C_HDR_DDR_SPEED);
[Severity: High]
Where is the 7-bit HDR command code from i3c_xfers[i].cmd programmed into
cmd->cmd_lo?
When mode == I3C_HDR_DDR, setting COMMAND_PORT_CP marks the command field
COMMAND_PORT_CMD (bits 14:7) as valid for the HDR command code, but
COMMAND_PORT_CMD(i3c_xfers[i].cmd & I3C_HDR_CMD_CODE) is never ORed into
cmd->cmd_lo. Since xfer is zero-allocated in dw_i3c_master_alloc_xfer(),
bits 14:7 remain 0x00 and every HDR-DDR transfer sends command code 0x00 on
the bus regardless of i3c_xfers[i].cmd.
Should this also OR in COMMAND_PORT_CMD(i3c_xfers[i].cmd & I3C_HDR_CMD_CODE)
when mode == I3C_HDR_DDR?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261101005243.4739-1-parame@synopsys.com?part=1
--
linux-i3c mailing list
linux-i3c@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-i3c
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH v2] i3c: master: dw-i3c-master: Add HDR-DDR support to Designware Controller.
2026-11-01 0:52 ` [PATCH v2] " Dineshkumar Parameswaran
2026-11-01 1:06 ` sashiko-bot
@ 2026-11-02 21:37 ` Frank Li
2026-11-11 2:11 ` [PATCH v3] " Dineshkumar Parameswaran
2 siblings, 0 replies; 8+ messages in thread
From: Frank Li @ 2026-11-02 21:37 UTC (permalink / raw)
To: Dineshkumar Parameswaran
Cc: Frank.Li, alexandre.belloni, linux-i3c, linux-kernel
On Sun, Nov 01, 2026 at 06:22:43AM +0530, Dineshkumar Parameswaran wrote:
> Implement HDR-DDR transfer support for the DesignWare Controller.
> Only support for private transfers and does not support sending CCC
> commands in HDR mode.
>
> Key differences:
> - Sends ENTHDR CCC for entering to HDR-DDR mode before sending data.
> To do that we are setting the ENTHDR in controller cmd. Sets the speed
Send ENTHDR CCC before sending data by setting the ENTHDR in controller cmd.
> to HDR_DDR_SPEED(6) to do data transfer in HDR-DDR mode.
> - HDR exit pattern must be sent instead of send a stop after transfer
> completion.
Send HDR exit pattern instead of STOP after transfer completion.
>
> Signed-off-by: Dineshkumar Parameswaran <parame@synopsys.com>
>
> ---
Do NOT post new version at old thread, which will cause patchwork and other
tools.
> changes in v2:
> - Add HDR-DDR capability advertisement in dw_i3c_master_bus_init()
> - ENTHDR0 CCC is generated by the hardware. No need to put that in the
> command.
> - Fix the speed field corruption in COMMAND_PORT_SPEED.
>
> drivers/i3c/master/dw-i3c-master.c | 17 +++++++++++++----
> 1 file changed, 13 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
> index 05584ddaf104..149982a05477 100644
> --- a/drivers/i3c/master/dw-i3c-master.c
> +++ b/drivers/i3c/master/dw-i3c-master.c
> @@ -232,6 +232,8 @@
> #define I3C_BUS_I2C_FMP_TLOW_MIN_NS 500
> #define I3C_BUS_THIGH_MAX_NS 41
>
> +#define DW_I3C_HDR_DDR_SPEED 6
> +
> #define XFER_TIMEOUT (msecs_to_jiffies(1000))
> #define RPM_AUTOSUSPEND_TIMEOUT 1000 /* ms */
>
> @@ -726,6 +728,8 @@ static int dw_i3c_master_bus_init(struct i3c_master_controller *m)
> memset(&info, 0, sizeof(info));
> info.dyn_addr = ret;
>
> + info.hdr_cap = I3C_CCC_HDR_MODE(I3C_HDR_DDR);
> +
> ret = i3c_master_set_info(&master->base, &info);
> if (ret)
> goto rpm_out;
> @@ -1003,20 +1007,25 @@ static int dw_i3c_master_i3c_xfers(struct i3c_dev_desc *dev,
> if (i3c_xfers[i].rnw) {
At HDR mode, rnw is u8 command, bit 7 indicate read or write. And where
you send cmd?
Frank
> cmd->rx_buf = i3c_xfers[i].data.in;
> cmd->rx_len = i3c_xfers[i].len;
> - cmd->cmd_lo = COMMAND_PORT_READ_TRANSFER |
> - COMMAND_PORT_SPEED(dev->info.max_read_ds);
> + cmd->cmd_lo = COMMAND_PORT_READ_TRANSFER;
>
> } else {
> cmd->tx_buf = i3c_xfers[i].data.out;
> cmd->tx_len = i3c_xfers[i].len;
> - cmd->cmd_lo =
> - COMMAND_PORT_SPEED(dev->info.max_write_ds);
> }
>
> cmd->cmd_lo |= COMMAND_PORT_TID(i) |
> COMMAND_PORT_DEV_INDEX(data->index) |
> COMMAND_PORT_ROC;
>
> + if (mode == I3C_HDR_DDR)
> + cmd->cmd_lo |= COMMAND_PORT_CP |
> + COMMAND_PORT_SPEED(DW_I3C_HDR_DDR_SPEED);
> + else
> + cmd->cmd_lo |= (i3c_xfers[i].rnw) ?
> + COMMAND_PORT_SPEED(dev->info.max_read_ds) :
> + COMMAND_PORT_SPEED(dev->info.max_write_ds);
> +
> if (i == (i3c_nxfers - 1))
> cmd->cmd_lo |= COMMAND_PORT_TOC;
> }
> --
> 2.34.1
>
--
linux-i3c mailing list
linux-i3c@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-i3c
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH v3] i3c: master: dw-i3c-master: Add HDR-DDR support to Designware Controller.
2026-11-01 0:52 ` [PATCH v2] " Dineshkumar Parameswaran
2026-11-01 1:06 ` sashiko-bot
2026-11-02 21:37 ` Frank Li
@ 2026-11-11 2:11 ` Dineshkumar Parameswaran
2026-11-11 2:54 ` sashiko-bot
2 siblings, 1 reply; 8+ messages in thread
From: Dineshkumar Parameswaran @ 2026-11-11 2:11 UTC (permalink / raw)
To: Dineshkumar.Parameswaran
Cc: Frank.Li, alexandre.belloni, linux-i3c, linux-kernel,
Dineshkumar Parameswaran
Implement HDR-DDR transfer support for the DesignWare Controller.
Only support for private transfers and does not support sending CCC
commands in HDR mode.
Key differences:
- Sets the speed to HDR_DDR_SPEED(6) and COMMAND_PORT_CP to do
data transfer in HDR-DDR mode. Hardware will generate the ENTHDR0
based on this.
- HDR exit pattern will generated from the hardware when it sees
the TOC on HDR-DDR mode.
Signed-off-by: Dineshkumar Parameswaran <parame@synopsys.com>
---
changes in v3:
- Updated commit message.
- Sets the HDR-DDR Read and Write based on cmd.
drivers/i3c/master/dw-i3c-master.c | 29 ++++++++++++++++++++++++-----
1 file changed, 24 insertions(+), 5 deletions(-)
diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
index 05584ddaf104..d4a0b1d316a9 100644
--- a/drivers/i3c/master/dw-i3c-master.c
+++ b/drivers/i3c/master/dw-i3c-master.c
@@ -65,6 +65,8 @@
#define COMMAND_PORT_DEV_COUNT(x) (((x) << 21) & GENMASK(25, 21))
#define COMMAND_PORT_ADDR_ASSGN_CMD 0x03
+#define HDR_DDR_CMD_READ 0x80
+
#define RESPONSE_QUEUE_PORT 0x10
#define RESPONSE_PORT_ERR_STATUS(x) (((x) & GENMASK(31, 28)) >> 28)
#define RESPONSE_NO_ERROR 0
@@ -232,6 +234,8 @@
#define I3C_BUS_I2C_FMP_TLOW_MIN_NS 500
#define I3C_BUS_THIGH_MAX_NS 41
+#define DW_I3C_HDR_DDR_SPEED 6
+
#define XFER_TIMEOUT (msecs_to_jiffies(1000))
#define RPM_AUTOSUSPEND_TIMEOUT 1000 /* ms */
@@ -381,6 +385,11 @@ static void dw_i3c_master_read_ibi_fifo(struct dw_i3c_master *master,
i3c_readl_fifo(master->regs + IBI_QUEUE_STATUS, bytes, nbytes);
}
+static bool dw_cmd_is_read(u32 rnw_cmd, enum i3c_xfer_mode mode)
+{
+ return (mode == I3C_HDR_DDR) ? (rnw_cmd & HDR_DDR_CMD_READ) : rnw_cmd;
+}
+
static struct dw_i3c_xfer *
dw_i3c_master_alloc_xfer(struct dw_i3c_master *master, unsigned int ncmds)
{
@@ -726,6 +735,8 @@ static int dw_i3c_master_bus_init(struct i3c_master_controller *m)
memset(&info, 0, sizeof(info));
info.dyn_addr = ret;
+ info.hdr_cap = I3C_CCC_HDR_MODE(I3C_HDR_DDR);
+
ret = i3c_master_set_info(&master->base, &info);
if (ret)
goto rpm_out;
@@ -995,28 +1006,36 @@ static int dw_i3c_master_i3c_xfers(struct i3c_dev_desc *dev,
}
for (i = 0; i < i3c_nxfers; i++) {
+ u32 rnw_cmd = (mode == I3C_SDR) ? i3c_xfers[i].rnw : i3c_xfers[i].cmd;
+ bool rnw = dw_cmd_is_read(rnw_cmd, mode);
struct dw_i3c_cmd *cmd = &xfer->cmds[i];
cmd->cmd_hi = COMMAND_PORT_ARG_DATA_LEN(i3c_xfers[i].len) |
COMMAND_PORT_TRANSFER_ARG;
- if (i3c_xfers[i].rnw) {
+ if (rnw) {
cmd->rx_buf = i3c_xfers[i].data.in;
cmd->rx_len = i3c_xfers[i].len;
- cmd->cmd_lo = COMMAND_PORT_READ_TRANSFER |
- COMMAND_PORT_SPEED(dev->info.max_read_ds);
+ cmd->cmd_lo = COMMAND_PORT_READ_TRANSFER;
} else {
cmd->tx_buf = i3c_xfers[i].data.out;
cmd->tx_len = i3c_xfers[i].len;
- cmd->cmd_lo =
- COMMAND_PORT_SPEED(dev->info.max_write_ds);
}
cmd->cmd_lo |= COMMAND_PORT_TID(i) |
COMMAND_PORT_DEV_INDEX(data->index) |
COMMAND_PORT_ROC;
+ if (mode == I3C_HDR_DDR) {
+ cmd->cmd_lo |= COMMAND_PORT_CMD(rnw_cmd) | COMMAND_PORT_CP |
+ COMMAND_PORT_SPEED(DW_I3C_HDR_DDR_SPEED);
+ } else {
+ cmd->cmd_lo |= (i3c_xfers[i].rnw) ?
+ COMMAND_PORT_SPEED(dev->info.max_read_ds) :
+ COMMAND_PORT_SPEED(dev->info.max_write_ds);
+ }
+
if (i == (i3c_nxfers - 1))
cmd->cmd_lo |= COMMAND_PORT_TOC;
}
--
2.34.1
--
linux-i3c mailing list
linux-i3c@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-i3c
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH v3] i3c: master: dw-i3c-master: Add HDR-DDR support to Designware Controller.
2026-11-11 2:11 ` [PATCH v3] " Dineshkumar Parameswaran
@ 2026-11-11 2:54 ` sashiko-bot
0 siblings, 0 replies; 8+ messages in thread
From: sashiko-bot @ 2026-11-11 2:54 UTC (permalink / raw)
To: Dineshkumar Parameswaran; +Cc: linux-i3c, Frank.Li, Alexandre Belloni
Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] i3c: master: dw: broken HDR-DDR direction check in
dw_i3c_master_i3c_xfers()
--
commit e898c32aed081cceae7f567f3da1c50b825f55c6
Author: Dineshkumar Parameswaran <Dineshkumar.Parameswaran@synopsys.com>
i3c: master: dw-i3c-master: Add HDR-DDR support to Designware Controller.
This commit adds HDR-DDR private transfer support to the Synopsys
DesignWare I3C controller driver.
> diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
> index 34aa8f8e1a0a2..aba27abb79272 100644
> --- a/drivers/i3c/master/dw-i3c-master.c
> +++ b/drivers/i3c/master/dw-i3c-master.c
[ ... ]
> @@ -995,28 +1006,36 @@ static int dw_i3c_master_i3c_xfers(struct i3c_dev_desc *dev,
> }
>
> for (i = 0; i < i3c_nxfers; i++) {
> + u32 rnw_cmd = (mode == I3C_SDR) ? i3c_xfers[i].rnw : i3c_xfers[i].cmd;
> + bool rnw = dw_cmd_is_read(rnw_cmd, mode);
> struct dw_i3c_cmd *cmd = &xfer->cmds[i];
>
> cmd->cmd_hi = COMMAND_PORT_ARG_DATA_LEN(i3c_xfers[i].len) |
> COMMAND_PORT_TRANSFER_ARG;
>
> - if (i3c_xfers[i].rnw) {
> + if (rnw) {
> cmd->rx_buf = i3c_xfers[i].data.in;
> cmd->rx_len = i3c_xfers[i].len;
> - cmd->cmd_lo = COMMAND_PORT_READ_TRANSFER |
> - COMMAND_PORT_SPEED(dev->info.max_read_ds);
> + cmd->cmd_lo = COMMAND_PORT_READ_TRANSFER;
>
> } else {
> cmd->tx_buf = i3c_xfers[i].data.out;
> cmd->tx_len = i3c_xfers[i].len;
> - cmd->cmd_lo =
> - COMMAND_PORT_SPEED(dev->info.max_write_ds);
> }
[Severity: High]
As reported by Frank Li on v2 [1], should the FIFO depth check loop and
the post-transfer length update loop in dw_i3c_master_i3c_xfers() also
use dw_cmd_is_read() instead of testing i3c_xfers[i].rnw directly?
In struct i3c_xfer, rnw and cmd share an anonymous union:
include/linux/i3c/device.h:
struct i3c_xfer {
union {
u8 rnw;
u8 cmd;
};
For any HDR-DDR write with a non-zero command code (0x01..0x7f),
i3c_xfers[i].rnw is non-zero even though bit 7 (HDR_DDR_CMD_READ) is
clear. The other two loops in dw_i3c_master_i3c_xfers() still check
if (i3c_xfers[i].rnw), so HDR-DDR writes with cmd in 0x01..0x7f are
counted into nrxwords instead of ntxwords during the datafifodepth check,
and on completion their i3c_xfers[i].len is overwritten with cmd->rx_len
(0).
[1] https://lore.kernel.org/r/aukCf1reB8LWbuzq@lizhi-Precision-Tower-5810
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261111021151.58380-1-parame@synopsys.com?part=1
--
linux-i3c mailing list
linux-i3c@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-i3c
^ permalink raw reply [flat|nested] 8+ messages in thread