Re: [PATCH v3 6/8] can: rcar_canfd: Add support for Renesas RZ/G3S

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Allowing 'renesas,no-can-fd' on hardware that does not support classical CAN-only mode can cause RX FIFO corruption or unintended behavior.
--

--- Patch [6]: [PATCH v3 6/8] can: rcar_canfd: Add support for Renesas RZ/G3S ---
commit 72c4132759d04f40214ddc81cfa2c30db8c17906
Author: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>

can: rcar_canfd: Add support for Renesas RZ/G3S

The Renesas RZ/G3S CAN-FD controller is largely compatible with the
variant found on the Renesas RZ/G3E. The RZ/G3S provides 16 AFL pages,
supports two channels, operates only in CAN-FD mode, and includes an
internal divider for the CAN FD clock source.

> diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c
> index 5cb6048d610e9..2eabe4a8be8dc 100644
> --- a/drivers/net/can/rcar/rcar_canfd.c
> +++ b/drivers/net/can/rcar/rcar_canfd.c
> @@ -661,6 +661,26 @@ static const struct rcar_canfd_hw_info rzg2l_hw_info = {
>  	.mode_select_na = 0,
>  };
>  
> +static const struct rcar_canfd_hw_info r9a08g045_hw_info = {
> +	.nom_bittiming = &rcar_canfd_gen4_nom_bittiming_const,
> +	.data_bittiming = &rcar_canfd_gen4_data_bittiming_const,
> +	.tdc_const = &rcar_canfd_gen4_tdc_const,
> +	.regs = &rcar_gen4_regs,
> +	.sh = &rcar_gen4_shift_data,
> +	.rnc_field_width = 16,
> +	.max_aflpn = 15,
> +	.max_cftml = 31,
> +	.max_channels = 2,
> +	.postdiv = 2,
> +	.shared_global_irqs = 0,
> +	.multi_channel_irqs = 1,
> +	.ch_interface_mode = 1,
> +	.shared_can_regs = 1,
> +	.external_clk = 1,
> +	.fcan_pclk = 1,
> +	.mode_select_na = 1,

[Severity: High]
Since this hardware does not implement mode select bits and operates
exclusively in CAN-FD mode, could it cause internal hardware FIFO RAM overflow
if a device tree is ported over with the renesas,no-can-fd property?

In rcar_canfd_probe(), the renesas,no-can-fd property unconditionally forces
gpriv->fdmode = false.

If gpriv->fdmode is false:
1. rcar_canfd_configure_controller() will skip setting RCANFD_GCFG_CMPOC
   which normally truncates oversized payloads.
2. rcar_canfd_configure_rx() will incorrectly configure the RX FIFO payload size
   for 8 bytes (rfpls = 0).

Since the hardware is physically fixed in CAN-FD mode, would receiving a CAN-FD
frame larger than 8 bytes then write the full payload to the 8-byte FIFO slots
without truncation and corrupt memory?

> +};
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714173315.1981708-1-claudiu.beznea+renesas@tuxon.dev?part=6