Skip to contentSkip to conversation

dmaengine: dw-edma: Add Xilinx CPM6 DMA Device ID

PATCH In review Devendra K Verma 2 participants 3 messages May 28

Subsystems (2)
dmaengine DesignWare edma core IP driver
lore
Share & tools
lore

Devendra K Verma

author
#0 lore raw

PATCH 1/1 dmaengine: dw-edma: Add Xilinx CPM6 DMA Device ID

From: Devendra K Verma <[email protected]>

Add Device ID for Xilinx CPM6 DMA IP.
This IP enables 64 Read and 64 Write Channels.

Adding the relevant dw_edma_pcie_data to use all the 64 Read and 64 Write Channels.

Signed-off-by Devendra K Verma <[email protected]>
---
 drivers/dma/dw-edma/dw-edma-pcie.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
drivers/dma/dw-edma/dw-edma-pcie.c +16 -0
index 0b30ce138503..c5e041142869 100644
@@ -27,6 +27,7 @@
 
 /* AMD MDB (Xilinx) specific defines */
 #define PCI_DEVICE_ID_XILINX_B054		0xb054
+#define PCI_DEVICE_ID_XILINX_B00F		0xb00f
 
 #define DW_PCIE_XILINX_MDB_VSEC_DMA_ID		0x6
 #define DW_PCIE_XILINX_MDB_VSEC_ID		0x20

@@ -125,6 +126,19 @@ static const struct dw_edma_pcie_data xilinx_mdb_data = {
 	.rd_ch_cnt			= 8,
 };
 
+static const struct dw_edma_pcie_data xilinx_cpm6_dma_data = {
+	/* MDB registers location */
+	.rg.bar				= BAR_0,
+	.rg.off				= SZ_4K,	/*  4 Kbytes */
+	.rg.sz				= SZ_8K,	/*  8 Kbytes */
+
+	/* Other */
+	.mf				= EDMA_MF_HDMA_NATIVE,
+	.irqs				= 1,
+	.wr_ch_cnt			= 64,
+	.rd_ch_cnt			= 64,
+};
+
 static void dw_edma_set_chan_region_offset(struct dw_edma_pcie_data *pdata,
 					   enum pci_barno bar, off_t start_off,
 					   off_t ll_off_gap, size_t ll_size,

@@ -547,6 +561,8 @@ static const struct pci_device_id dw_edma_pcie_id_table[] = {
 	{ PCI_DEVICE_DATA(SYNOPSYS, EDDA, &snps_edda_data) },
 	{ PCI_VDEVICE(XILINX, PCI_DEVICE_ID_XILINX_B054),
 	  (kernel_ulong_t)&xilinx_mdb_data },
+	{ PCI_VDEVICE(XILINX, PCI_DEVICE_ID_XILINX_B00F),
+	  (kernel_ulong_t)&xilinx_cpm6_dma_data },
 	{ }
 };
 MODULE_DEVICE_TABLE(pci, dw_edma_pcie_id_table);
Signature · 1 line
2.43.0
AI review
#1 lore raw
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Critical] Configuring 64 read and write channels for the new Xilinx CPM6 DMA device causes severe heap…

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Configuring 64 read and write channels for the new Xilinx CPM6 DMA device causes severe heap out-of-bounds reads during probe. --

commit f926ec7cda085a4bb6bcd59ed57d0e183c1d998f
Author: Devendra K Verma <[email protected]>

dmaengine: dw-edma: Add Xilinx CPM6 DMA Device ID

This commit adds the device ID and configuration for the Xilinx CPM6 DMA IP. It sets up the device data to support 64 read and 64 write channels.

Quoted 4 lines
drivers/dma/dw-edma/dw-edma-pcie.c +0 -0
index 0b30ce1385036..c5e0411428693 100644

[ ... ]

Quoted 5 lines
drivers/dma/dw-edma/dw-edma-pcie.c +1 -0
@@ -125,6 +126,19 @@ static const struct dw_edma_pcie_data xilinx_mdb_data = {
 	.rd_ch_cnt			= 8,
 };
 
+static const struct dw_edma_pcie_data xilinx_cpm6_dma_data = {

drivers/dma/dw-edma/dw-edma-pcie.c static const struct dw_edma_pcie_data xilinx_mdb_data = { · line 139

Quoted 10 lines
drivers/dma/dw-edma/dw-edma-pcie.c +10 -0
+	/* MDB registers location */
+	.rg.bar				= BAR_0,
+	.rg.off				= SZ_4K,	/*  4 Kbytes */
+	.rg.sz				= SZ_8K,	/*  8 Kbytes */
+
+	/* Other */
+	.mf				= EDMA_MF_HDMA_NATIVE,
+	.irqs				= 1,
+	.wr_ch_cnt			= 64,
+	.rd_ch_cnt			= 64,

[Severity: Critical]
Will setting these channel counts to 64 cause out-of-bounds reads during probe?

Looking at struct dw_edma_pcie_data, the ll_wr array is statically sized to EDMA_MAX_WR_CH (which is 8).

While out-of-bounds writes are prevented because Xilinx devices implicitly set non_ll = true, several loops in dw_edma_pcie_probe() unconditionally iterate up to wr_ch_cnt and rd_ch_cnt without checking non_ll.

For example, the loop computing the PCI BAR region mask executes mask |= BIT(vsec_data->ll_wr[i].bar) for i up to 63. This will read significantly past the end of the vsec_data structure.

Can this corrupt the BAR mask with garbage data and lead to an immediate kernel panic if the allocation is near a page boundary or has KASAN redzones?

Quoted 2 lines
drivers/dma/dw-edma/dw-edma-pcie.c +2 -0
+};
+
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
author
#2 lore raw
In reply to Devendra K Verma

AMD General

Hi All

Please ignore this patch. This patch has some issues that's why withdrawing it. Will submit a new patch.

NACKed by Devendra K Verma <[email protected]>

Regards,
Devendra

Quoted 69 lines

-----Original Message-----
From: Devendra K Verma <[email protected]>
Sent: Thursday, May 28, 2026 15:42
To: [email protected]; [email protected]; [email protected]; [email protected]
Cc: [email protected]; [email protected]; Simek, Michal <[email protected]>; Verma, Devendra <[email protected]>
Subject: [PATCH v1] dmaengine: dw-edma: Add Xilinx CPM6 DMA Device ID

From: Devendra K Verma <[email protected]>

Add Device ID for Xilinx CPM6 DMA IP.
This IP enables 64 Read and 64 Write Channels.

Adding the relevant dw_edma_pcie_data to use all the 64 Read and 64 Write Channels.

Signed-off-by Devendra K Verma <[email protected]>
---
 drivers/dma/dw-edma/dw-edma-pcie.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
drivers/dma/dw- renamed from drivers/dma/dw-edma/dw-edma-pcie.c +0 -0

edma/dw-edma-pcie.c
index 0b30ce138503..c5e041142869 100644

drivers/dma/dw-edma/dw-edma-pcie.c +14 -0
@@ -27,6 +27,7 @@
 
 /* AMD MDB (Xilinx) specific defines */
 #define PCI_DEVICE_ID_XILINX_B054            0xb054
+#define PCI_DEVICE_ID_XILINX_B00F            0xb00f
 
 #define DW_PCIE_XILINX_MDB_VSEC_DMA_ID               0x6
 #define DW_PCIE_XILINX_MDB_VSEC_ID           0x20

@@ -125,6 +126,19 @@ static const struct dw_edma_pcie_data
 xilinx_mdb_data = {
      .rd_ch_cnt                      = 8,
 };
 
+static const struct dw_edma_pcie_data xilinx_cpm6_dma_data = {
+     /* MDB registers location */
+     .rg.bar                         = BAR_0,
+     .rg.off                         = SZ_4K,        /*  4 Kbytes */
+     .rg.sz                          = SZ_8K,        /*  8 Kbytes */
+
+     /* Other */
+     .mf                             = EDMA_MF_HDMA_NATIVE,
+     .irqs                           = 1,
+     .wr_ch_cnt                      = 64,
+     .rd_ch_cnt                      = 64,
+};
+
 static void dw_edma_set_chan_region_offset(struct dw_edma_pcie_data
 *pdata,

enum pci_barno bar, off_t start_off, off_t ll_off_gap, size_t ll_size, @@ -
547,6 +561,8 @@ static const struct pci_device_id dw_edma_pcie_id_table[]

= {
      { PCI_DEVICE_DATA(SYNOPSYS, EDDA, &snps_edda_data) },
      { PCI_VDEVICE(XILINX, PCI_DEVICE_ID_XILINX_B054),
        (kernel_ulong_t)&xilinx_mdb_data },
drivers/dma/dw-edma/dw-edma-pcie.c +2 -1
+     { PCI_VDEVICE(XILINX, PCI_DEVICE_ID_XILINX_B00F),
+       (kernel_ulong_t)&xilinx_cpm6_dma_data },
      { }
 };
 MODULE_DEVICE_TABLE(pci, dw_edma_pcie_id_table);
--

2.43.0