Thread (19 messages) flat view 19 messages, 7 authors, 9d ago

Re: [PATCH v2 08/10] riscv: dts: ultrarisc: Add initial device tree for UltraRISC DP1000

From: sashiko-bot@kernel.org
Date: 2026-09-07 10:13:04
Also in: dmaengine

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The DMAC `reg` size is too small for the configured number of DMA channels, causing out-of-bounds memory accesses.
--

commit ef5ee935e58a066d2f6001b254b02cd3ebe039d4
Author: Jia Wang [off-list ref]

riscv: dts: ultrarisc: Add initial device tree for UltraRISC DP1000
    
Add the base device tree for the UltraRISC DP1000 SoC. It describes
eight CP100 CPU cores, their cache topology, and essential peripherals
including CLINT, PLIC, the clock controller, pinctrl, GPIO, UART, SPI,
I2C, PCIe, GMAC, and the DMA controller.
quoted hunk ↗ jump to hunk
diff --git a/arch/riscv/boot/dts/ultrarisc/dp1000.dtsi b/arch/riscv/boot/dts/ultrarisc/dp1000.dtsi
new file mode 100644
index 0000000000000..5c51fddaeb2bb
--- /dev/null
+++ b/arch/riscv/boot/dts/ultrarisc/dp1000.dtsi
[ ... ]
+		dmac: dma-controller@39000000 {
+			compatible = "ultrarisc,dp1000-axi-dma", "snps,axi-dma-1.01a";
+			reg = <0x0 0x39000000 0x0 0x400>;
+			clocks = <&clkc DP1000_CLK_SYSPLL_DIV2>,
+				 <&clkc DP1000_CLK_SUBSYS>;
+			clock-names = "core-clk", "cfgr-clk";
+			#dma-cells = <1>;
+			dma-channels = <8>;
[Severity: High]
Does this reg size limit of 0x400 provide enough space for 8 DMA channels?

The Synopsys DW AXI DMA IP driver (dw-axi-dmac-platform.c) maps channel
registers starting at chip->regs + 0x100 + i * 0x100. For 8 channels, the
maximum base offset is 0x800 (channel 7).

In axi_dma_hw_init(), the driver iterates over these channels and writes to
their registers (e.g., CH_INTSTATUS_ENA at offset 0x080, hitting offset
0x880). Since the reg property defines a window of only 0x400 bytes,
accesses for channels 3 through 7 will fall completely outside the declared
memory region, leading to out-of-bounds memory accesses.
+			interrupt-parent = <&plic>;
+			interrupts = <152>, <153>, <154>, <155>,
+				     <156>, <157>, <158>, <159>;
+			snps,dma-masters = <1>;
+			snps,data-width = <4>;
+			snps,block-size = <512 512 512 512 512 512 512 512>;
+			snps,priority = <0 1 2 3 4 5 6 7>;
+			snps,axi-max-burst-len = <256>;
+		};
+	};
+};
-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260907-ultrarisc-dts-v2-0-5eb4c97477c5@ultrarisc.com?part=8
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help