[PATCH v1] dmaengine: dw-edma: Add Xilinx CPM6 DMA Device ID

[PATCH v1] dmaengine: dw-edma: Add Xilinx CPM6 DMA Device ID

[Devendra K Verma]

From: Devendra K Verma <devverma@amd.com>

Add Device ID for Xilinx CPM6 DMA IP.
This IP enables 64 Read and 64 Write Channels.

Adding the relevant dw_edma_pcie_data to use all the
64 Read and 64 Write Channels.

Signed-off-by: Devendra K Verma <devendra.verma@amd.com>
---
 drivers/dma/dw-edma/dw-edma-pcie.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/dma/dw-edma/dw-edma-pcie.c b/drivers/dma/dw-edma/dw-edma-pcie.c
index 0b30ce138503..c5e041142869 100644
--- a/drivers/dma/dw-edma/dw-edma-pcie.c
+++ b/drivers/dma/dw-edma/dw-edma-pcie.c
@@ -27,6 +27,7 @@
 
 /* AMD MDB (Xilinx) specific defines */
 #define PCI_DEVICE_ID_XILINX_B054		0xb054
+#define PCI_DEVICE_ID_XILINX_B00F		0xb00f
 
 #define DW_PCIE_XILINX_MDB_VSEC_DMA_ID		0x6
 #define DW_PCIE_XILINX_MDB_VSEC_ID		0x20
@@ -125,6 +126,19 @@ static const struct dw_edma_pcie_data xilinx_mdb_data = {
 	.rd_ch_cnt			= 8,
 };
 
+static const struct dw_edma_pcie_data xilinx_cpm6_dma_data = {
+	/* MDB registers location */
+	.rg.bar				= BAR_0,
+	.rg.off				= SZ_4K,	/*  4 Kbytes */
+	.rg.sz				= SZ_8K,	/*  8 Kbytes */
+
+	/* Other */
+	.mf				= EDMA_MF_HDMA_NATIVE,
+	.irqs				= 1,
+	.wr_ch_cnt			= 64,
+	.rd_ch_cnt			= 64,
+};
+
 static void dw_edma_set_chan_region_offset(struct dw_edma_pcie_data *pdata,
 					   enum pci_barno bar, off_t start_off,
 					   off_t ll_off_gap, size_t ll_size,
@@ -547,6 +561,8 @@ static const struct pci_device_id dw_edma_pcie_id_table[] = {
 	{ PCI_DEVICE_DATA(SYNOPSYS, EDDA, &snps_edda_data) },
 	{ PCI_VDEVICE(XILINX, PCI_DEVICE_ID_XILINX_B054),
 	  (kernel_ulong_t)&xilinx_mdb_data },
+	{ PCI_VDEVICE(XILINX, PCI_DEVICE_ID_XILINX_B00F),
+	  (kernel_ulong_t)&xilinx_cpm6_dma_data },
 	{ }
 };
 MODULE_DEVICE_TABLE(pci, dw_edma_pcie_id_table);
-- 
2.43.0

Re: [PATCH v1] dmaengine: dw-edma: Add Xilinx CPM6 DMA Device ID

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Configuring 64 read and write channels for the new Xilinx CPM6 DMA device causes severe heap out-of-bounds reads during probe.
--

commit f926ec7cda085a4bb6bcd59ed57d0e183c1d998f
Author: Devendra K Verma <devverma@amd.com>

dmaengine: dw-edma: Add Xilinx CPM6 DMA Device ID

This commit adds the device ID and configuration for the Xilinx CPM6 DMA IP.
It sets up the device data to support 64 read and 64 write channels.

> diff --git a/drivers/dma/dw-edma/dw-edma-pcie.c b/drivers/dma/dw-edma/dw-edma-pcie.c
> index 0b30ce1385036..c5e0411428693 100644
> --- a/drivers/dma/dw-edma/dw-edma-pcie.c
> +++ b/drivers/dma/dw-edma/dw-edma-pcie.c
[ ... ]
> @@ -125,6 +126,19 @@ static const struct dw_edma_pcie_data xilinx_mdb_data = {
>  	.rd_ch_cnt			= 8,
>  };
>  
> +static const struct dw_edma_pcie_data xilinx_cpm6_dma_data = {
> +	/* MDB registers location */
> +	.rg.bar				= BAR_0,
> +	.rg.off				= SZ_4K,	/*  4 Kbytes */
> +	.rg.sz				= SZ_8K,	/*  8 Kbytes */
> +
> +	/* Other */
> +	.mf				= EDMA_MF_HDMA_NATIVE,
> +	.irqs				= 1,
> +	.wr_ch_cnt			= 64,
> +	.rd_ch_cnt			= 64,

[Severity: Critical]
Will setting these channel counts to 64 cause out-of-bounds reads during probe?

Looking at struct dw_edma_pcie_data, the ll_wr array is statically sized
to EDMA_MAX_WR_CH (which is 8).

While out-of-bounds writes are prevented because Xilinx devices implicitly set
non_ll = true, several loops in dw_edma_pcie_probe() unconditionally iterate
up to wr_ch_cnt and rd_ch_cnt without checking non_ll.

For example, the loop computing the PCI BAR region mask executes
mask |= BIT(vsec_data->ll_wr[i].bar) for i up to 63. This will read
significantly past the end of the vsec_data structure.

Can this corrupt the BAR mask with garbage data and lead to an immediate
kernel panic if the allocation is near a page boundary or has KASAN redzones?

> +};
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260528101202.1244624-1-devendra.verma@amd.com?part=1

RE: [PATCH v1] dmaengine: dw-edma: Add Xilinx CPM6 DMA Device ID

[Verma, Devendra]

AMD General

Hi All

Please ignore this patch. This patch has some issues that's why withdrawing it. Will submit a new patch.

NACKed by Devendra K Verma <devendra.verma@amd.com>

Regards,
Devendra

> -----Original Message-----
> From: Devendra K Verma <devendra.verma@amd.com>
> Sent: Thursday, May 28, 2026 15:42
> To: bhelgaas@google.com; mani@kernel.org; vkoul@kernel.org;
> Frank.Li@kernel.org
> Cc: dmaengine@vger.kernel.org; linux-kernel@vger.kernel.org; Simek, Michal
> <michal.simek@amd.com>; Verma, Devendra <Devendra.Verma@amd.com>
> Subject: [PATCH v1] dmaengine: dw-edma: Add Xilinx CPM6 DMA Device ID
>
> From: Devendra K Verma <devverma@amd.com>
>
> Add Device ID for Xilinx CPM6 DMA IP.
> This IP enables 64 Read and 64 Write Channels.
>
> Adding the relevant dw_edma_pcie_data to use all the
> 64 Read and 64 Write Channels.
>
> Signed-off-by: Devendra K Verma <devendra.verma@amd.com>
> ---
>  drivers/dma/dw-edma/dw-edma-pcie.c | 16 ++++++++++++++++
>  1 file changed, 16 insertions(+)
>
> diff --git a/drivers/dma/dw-edma/dw-edma-pcie.c b/drivers/dma/dw-
> edma/dw-edma-pcie.c
> index 0b30ce138503..c5e041142869 100644
> --- a/drivers/dma/dw-edma/dw-edma-pcie.c
> +++ b/drivers/dma/dw-edma/dw-edma-pcie.c
> @@ -27,6 +27,7 @@
>
>  /* AMD MDB (Xilinx) specific defines */
>  #define PCI_DEVICE_ID_XILINX_B054            0xb054
> +#define PCI_DEVICE_ID_XILINX_B00F            0xb00f
>
>  #define DW_PCIE_XILINX_MDB_VSEC_DMA_ID               0x6
>  #define DW_PCIE_XILINX_MDB_VSEC_ID           0x20
> @@ -125,6 +126,19 @@ static const struct dw_edma_pcie_data
> xilinx_mdb_data = {
>       .rd_ch_cnt                      = 8,
>  };
>
> +static const struct dw_edma_pcie_data xilinx_cpm6_dma_data = {
> +     /* MDB registers location */
> +     .rg.bar                         = BAR_0,
> +     .rg.off                         = SZ_4K,        /*  4 Kbytes */
> +     .rg.sz                          = SZ_8K,        /*  8 Kbytes */
> +
> +     /* Other */
> +     .mf                             = EDMA_MF_HDMA_NATIVE,
> +     .irqs                           = 1,
> +     .wr_ch_cnt                      = 64,
> +     .rd_ch_cnt                      = 64,
> +};
> +
>  static void dw_edma_set_chan_region_offset(struct dw_edma_pcie_data
> *pdata,
>                                          enum pci_barno bar, off_t start_off,
>                                          off_t ll_off_gap, size_t ll_size, @@ -
> 547,6 +561,8 @@ static const struct pci_device_id dw_edma_pcie_id_table[]
> = {
>       { PCI_DEVICE_DATA(SYNOPSYS, EDDA, &snps_edda_data) },
>       { PCI_VDEVICE(XILINX, PCI_DEVICE_ID_XILINX_B054),
>         (kernel_ulong_t)&xilinx_mdb_data },
> +     { PCI_VDEVICE(XILINX, PCI_DEVICE_ID_XILINX_B00F),
> +       (kernel_ulong_t)&xilinx_cpm6_dma_data },
>       { }
>  };
>  MODULE_DEVICE_TABLE(pci, dw_edma_pcie_id_table);
> --
> 2.43.0