Re: [PATCH RFC 2/3] dmaengine: dma-axi-dmac: Switch to bitmap-based address width masks

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Undefined behavior in core DMA alignment evaluation due to `dma_dev->copy_align` being assigned a linear byte count instead of a log2 `enum dmaengine_alignment` value.
--

commit 2d09a8a33c5c8dffff764bd74b8c4ad0ea6d4224
Author: Nuno Sá <nuno.sa@analog.com>

dmaengine: dma-axi-dmac: Switch to bitmap-based address width masks

This commit advertises the source and destination bus widths through the new
address mask helpers instead of open-coding the legacy mask. It moves the
driver onto a representation that can express widths of 32 bytes and above.

> diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c
> index d47ff27e1408f..19c258d511ca3 100644
> --- a/drivers/dma/dma-axi-dmac.c
> +++ b/drivers/dma/dma-axi-dmac.c
[ ... ]
> @@ -1262,8 +1262,12 @@ static int axi_dmac_probe(struct platform_device *pdev)
>  	dma_dev->device_terminate_all = axi_dmac_terminate_all;
>  	dma_dev->device_synchronize = axi_dmac_synchronize;
>  	dma_dev->dev = &pdev->dev;
> -	dma_dev->src_addr_widths = BIT(dmac->chan.src_width);
> -	dma_dev->dst_addr_widths = BIT(dmac->chan.dest_width);
> +	ret = dma_set_src_addr_mask(dma_dev, &dmac->chan.src_width, 1);
> +	if (ret)
> +		return ret;
> +	ret = dma_set_dst_addr_mask(dma_dev, &dmac->chan.dest_width, 1);
> +	if (ret)
> +		return ret;
>  	dma_dev->directions = BIT(dmac->chan.direction);
>  	dma_dev->residue_granularity = DMA_RESIDUE_GRANULARITY_DESCRIPTOR;
>  	dma_dev->max_sg_burst = 31; /* 31 SGs maximum in one burst */

[Severity: High]
This is a pre-existing issue, but does assigning a linear byte count to
copy_align cause undefined behavior now that bus widths of 32 bytes and
above are supported?

Looking further down in axi_dmac_probe():

	dma_dev->copy_align = (dmac->chan.address_align_mask + 1);

The copy_align field expects an enum dmaengine_alignment representing the
log2 of the required alignment bytes, rather than a linear byte count.

If a bus width of 32 bytes is used, copy_align evaluates to 32. When the
DMA core uses is_dma_copy_aligned(), it calculates (1 << copy_align) - 1.
Could shifting a 32-bit integer by 32 cause undefined behavior and wrap
around to 1 on some architectures, completely bypassing DMA alignment
constraints?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260616-dmaengine-support-wider-dma-masks-v1-0-da23a8dcb756@analog.com?part=2