Re: [PATCH v1 3/3] PCI: Add PCI1008 to switchtec NTB DMA alias quirk

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Incorrect pointer arithmetic when reading the upper 32 bits of `ep_map` results in reading from the wrong MMIO offset.
--

--- Patch [3]: [PATCH v1 3/3] PCI: Add PCI1008 to switchtec NTB DMA alias quirk ---
commit 7f63ba41929ba7abb0f74f406090b22d57b6bc5e
Author: Logan Gunthorpe <logang@deltatee.com>
PCI: Add PCI1008 to switchtec NTB DMA alias quirk

Add the PCI1008 device ID to the quirk_switchtec_ntb_dma_alias
PCI fixup table. Without it, DMA transactions from a PCI1008 switch's
NTB function are not given the correct requester ID alias, which can
misdirect them under an IOMMU.

> diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
> index b09f27f7846fc..44ccee48349c3 100644
> --- a/drivers/pci/quirks.c
> +++ b/drivers/pci/quirks.c
> @@ -6090,6 +6090,7 @@ SWITCHTEC_PCI100X_QUIRK(0x1003);  /* PCI1003XG4 */
>  SWITCHTEC_PCI100X_QUIRK(0x1004);  /* PCI1004XG4 */
>  SWITCHTEC_PCI100X_QUIRK(0x1005);  /* PCI1005XG4 */
>  SWITCHTEC_PCI100X_QUIRK(0x1006);  /* PCI1006XG4 */
> +SWITCHTEC_PCI100X_QUIRK(0x1008);  /* PCI1008XG4 */

[Severity: High]
This isn't a bug introduced by this patch, but while looking at the function
triggered by this quirk (quirk_switchtec_ntb_dma_alias()), I noticed an
incorrect pointer arithmetic issue.

In drivers/pci/quirks.c:quirk_switchtec_ntb_dma_alias():

	partition_map = ioread32(&mmio_ntb->ep_map);
	partition_map |= ((u64) ioread32(&mmio_ntb->ep_map + 4)) << 32;

Since mmio_ntb->ep_map is a u64, does the + 4 advance the pointer by 32
bytes (4 * sizeof(u64)) instead of the intended 4 bytes?

Looking at struct ntb_info_regs, this would read from offset 36
(target_part_low) instead of the upper 32 bits of ep_map at offset 8. This
populates the upper 32 bits of partition_map with unintended data, causing
the device initialization loop to process invalid partition IDs, which
could potentially access out-of-bounds MMIO registers or create incorrect
DMA aliases.

Could this read be corrected to avoid scaling by the type size?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714212010.230606-1-logang@deltatee.com?part=3