[PATCH 0/3] dmaengine: generalize dmaengine_prep_rio_sg() as dmaengine_prep_slave_sg_context()

[PATCH 0/3] dmaengine: generalize dmaengine_prep_rio_sg() as dmaengine_prep_slave_sg_context()

[Frank.Li]

The dmaengine_prep_rio_sg() helper was only available under
CONFIG_RAPIDIO_DMA_ENGINE and used a RapidIO-specific context pointer
type. Several drivers need to pass an opaque context to
device_prep_slave_sg() without depending on RapidIO.

This series renames dmaengine_prep_rio_sg() to
dmaengine_prep_slave_sg_context(), changes the context parameter from
'struct rio_dma_ext *' to 'void *', and removes the
CONFIG_RAPIDIO_DMA_ENGINE guard so the helper is unconditionally
available.

Existing callers (RapidIO and Xilinx AXI Ethernet) and the Spreadtrum
PCM DMA driver are updated to use the new API.

No functional change. Prepare to make struct dma_device private to the DMA
engine.

Because only 3 user, which use context when prep slave_sg. Suggest direct
go through DMA engine tree.

Signed-off-by: Frank Li <Frank.Li@nxp.com>
---
Frank Li (3):
      dmaengine/rio: rename dmaengine_prep_rio_sg() to dmaengine_prep_slave_sg_context()
      net: xilinx: axienet: use dmaengine_prep_slave_sg_context()
      ASoC: sprd: use dmaengine_prep_slave_sg_context() instead of device_prep_slave_sg()

 drivers/net/ethernet/xilinx/xilinx_axienet_main.c |  7 ++++---
 drivers/rapidio/rio.c                             | 15 ++++++++-------
 include/linux/dmaengine.h                         |  9 +++------
 sound/soc/sprd/sprd-pcm-compress.c                |  6 +++---
 sound/soc/sprd/sprd-pcm-dma.c                     |  6 +++---
 5 files changed, 21 insertions(+), 22 deletions(-)
---
base-commit: 8dc06c1b6e41742c38fb4f35f32ae88b74fd58c8
change-id: 20261105-rio_sg-ac6ae89a7c15

Best regards,
--  
Frank Li <Frank.Li@nxp.com>

[PATCH 1/3] dmaengine/rio: rename dmaengine_prep_rio_sg() to dmaengine_prep_slave_sg_context()

[Frank.Li]

From: Frank Li <Frank.Li@nxp.com>

Generalize dmaengine_prep_rio_sg() by renaming it to
dmaengine_prep_slave_sg_context() and changing the context parameter type
from 'struct rio_dma_ext *' to 'void *', making it suitable for
any DMA engine user that needs to pass context to device_prep_slave_sg().

Remove the CONFIG_RAPIDIO_DMA_ENGINE guard so the helper is
unconditionally available.

Update drivers/rapidio/rio.c to use the new API.

No functional change. Prepare to make struct dma_device private to the DMA
engine.

Signed-off-by: Frank Li <Frank.Li@nxp.com>
---
Need go through DMA engineer tree to avoid build break.
---
 drivers/rapidio/rio.c     | 15 ++++++++-------
 include/linux/dmaengine.h |  9 +++------
 2 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/drivers/rapidio/rio.c b/drivers/rapidio/rio.c
index f45e58b0971f5..9bba811f75da7 100644
--- a/drivers/rapidio/rio.c
+++ b/drivers/rapidio/rio.c
@@ -1804,20 +1804,21 @@ struct dma_async_tx_descriptor *rio_dma_prep_xfer(struct dma_chan *dchan,
 	u16 destid, struct rio_dma_data *data,
 	enum dma_transfer_direction direction, unsigned long flags)
 {
+	struct dma_async_tx_descriptor *tx;
 	struct rio_dma_ext rio_ext;
 
-	if (!dchan->device->device_prep_slave_sg) {
-		pr_err("%s: prep_rio_sg == NULL\n", __func__);
-		return NULL;
-	}
-
 	rio_ext.destid = destid;
 	rio_ext.rio_addr_u = data->rio_addr_u;
 	rio_ext.rio_addr = data->rio_addr;
 	rio_ext.wr_type = data->wr_type;
 
-	return dmaengine_prep_rio_sg(dchan, data->sg, data->sg_len,
-				     direction, flags, &rio_ext);
+	tx = dmaengine_prep_slave_sg_context(dchan, data->sg, data->sg_len,
+					     direction, flags, &rio_ext);
+
+	if (!tx)
+		pr_err("%s: prep_rio_sg == NULL\n", __func__);
+
+	return tx;
 }
 EXPORT_SYMBOL_GPL(rio_dma_prep_xfer);
 
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 9452bb2c04af7..d0906bcdabd6c 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -1070,20 +1070,17 @@ dmaengine_prep_config_single_safe(struct dma_chan *chan, dma_addr_t buf,
 	return dmaengine_prep_config_sg_safe(chan, &sg, 1, dir, flags, config);
 }
 
-#ifdef CONFIG_RAPIDIO_DMA_ENGINE
-struct rio_dma_ext;
-static inline struct dma_async_tx_descriptor *dmaengine_prep_rio_sg(
+static inline struct dma_async_tx_descriptor *dmaengine_prep_slave_sg_context(
 	struct dma_chan *chan, struct scatterlist *sgl,	unsigned int sg_len,
 	enum dma_transfer_direction dir, unsigned long flags,
-	struct rio_dma_ext *rio_ext)
+	void *context)
 {
 	if (!chan || !chan->device || !chan->device->device_prep_slave_sg)
 		return NULL;
 
 	return chan->device->device_prep_slave_sg(chan, sgl, sg_len,
-						  dir, flags, rio_ext);
+						  dir, flags, context);
 }
-#endif
 
 static inline struct dma_async_tx_descriptor *dmaengine_prep_dma_cyclic(
 		struct dma_chan *chan, dma_addr_t buf_addr, size_t buf_len,

-- 
2.43.0

[PATCH 2/3] net: xilinx: axienet: use dmaengine_prep_slave_sg_context()

[Frank.Li]

From: Frank Li <Frank.Li@nxp.com>

Replace the direct call to dma_dev->device_prep_slave_sg() with the
dmaengine_prep_slave_sg_context() helper, which handles NULL checks and
passes the context pointer cleanly.

No functional change. Prepare to make struct dma_device private to the DMA
engine.

Signed-off-by: Frank Li <Frank.Li@nxp.com>
---
Suggest go through DMA engine tree. this is only one of 3 user, which
use context at prep sg.
---
 drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 7e83c4b5f1931..55d1b39caf7ed 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1006,9 +1006,10 @@ axienet_start_xmit_dmaengine(struct sk_buff *skb, struct net_device *ndev)
 		app_metadata[0] |= 2; /* Tx Full Checksum Offload Enabled */
 	}
 
-	dma_tx_desc = dma_dev->device_prep_slave_sg(lp->tx_chan, skbuf_dma->sgl,
-			sg_len, DMA_MEM_TO_DEV,
-			DMA_PREP_INTERRUPT, (void *)app_metadata);
+	dma_tx_desc = dmaengine_prep_slave_sg_context(lp->tx_chan, skbuf_dma->sgl,
+						      sg_len, DMA_MEM_TO_DEV,
+						      DMA_PREP_INTERRUPT,
+						      (void *)app_metadata);
 	if (!dma_tx_desc)
 		goto xmit_error_unmap_sg;
 

-- 
2.43.0

Re: [PATCH 2/3] net: xilinx: axienet: use dmaengine_prep_slave_sg_context()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] net: xilinx: axienet: unused dma_dev left in
  axienet_start_xmit_dmaengine()
It also noticed 1 related pre-existing issue this patch does not
introduce:
- [Critical] net: axienet: use-after-free in axienet_stop() [1]
--

commit b4bb968eb4c8d380631e7d9eb4acd99d61288c16
Author: Frank Li <Frank.Li@nxp.com>

net: xilinx: axienet: use dmaengine_prep_slave_sg_context()

This commit replaces the direct call to dma_dev->device_prep_slave_sg() in
axienet_start_xmit_dmaengine() with dmaengine_prep_slave_sg_context().

> diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> index 8a50cad1c104f..fff3530d9359d 100644
> --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> @@ -1006,9 +1006,10 @@ axienet_start_xmit_dmaengine(struct sk_buff *skb, struct net_device *ndev)
>  		app_metadata[0] |= 2; /* Tx Full Checksum Offload Enabled */
>  	}
>  
> -	dma_tx_desc = dma_dev->device_prep_slave_sg(lp->tx_chan, skbuf_dma->sgl,
> -			sg_len, DMA_MEM_TO_DEV,
> -			DMA_PREP_INTERRUPT, (void *)app_metadata);
> +	dma_tx_desc = dmaengine_prep_slave_sg_context(lp->tx_chan, skbuf_dma->sgl,
> +						      sg_len, DMA_MEM_TO_DEV,
> +						      DMA_PREP_INTERRUPT,
> +						      (void *)app_metadata);
>  	if (!dma_tx_desc)
>  		goto xmit_error_unmap_sg;

[Severity: Low]
Does replacing dma_dev->device_prep_slave_sg() leave dma_dev unused in
axienet_start_xmit_dmaengine()?

Earlier in axienet_start_xmit_dmaengine(), dma_dev is still declared and
assigned from lp->tx_chan->device:

drivers/net/ethernet/xilinx/xilinx_axienet_main.c:axienet_start_xmit_dmaengine() {
	...
	struct dma_device *dma_dev;
	...
	dma_dev = lp->tx_chan->device;
	...
}

With its only reader removed, this triggers a -Wunused-but-set-variable
compiler warning and keeps a direct reference to struct dma_device and
lp->tx_chan->device.

[Severity: Critical]
This problem wasn't introduced by this patch, but can axienet_stop() cause
a use-after-free on lp->tx_skb_ring [1] while
axienet_start_xmit_dmaengine() is running?

When lp->use_dmaengine is enabled, axienet_stop() frees lp->tx_skb_ring and
its entries without quiescing the transmit path:

drivers/net/ethernet/xilinx/xilinx_axienet_main.c:axienet_stop() {
	...
	if (!lp->use_dmaengine) {
		WRITE_ONCE(lp->stopping, true);
		flush_work(&lp->dma_err_task);

		napi_disable(&lp->napi_tx);
		napi_disable(&lp->napi_rx);
	}
	...
		for (i = 0; i < TX_BD_NUM_MAX; i++) {
			skbuf_dma = lp->tx_skb_ring[i];
			...
			kfree(skbuf_dma);
		}
		kfree(lp->tx_skb_ring);
	...
}

CPU0                              CPU1
axienet_stop()
                                  axienet_start_xmit_dmaengine()
  kfree(skbuf_dma)
  kfree(lp->tx_skb_ring)
                                    axienet_get_tx_desc()
                                      <-- use-after-free

A concurrent transmit on CPU1 can fetch and use a descriptor from
lp->tx_skb_ring after CPU0 has freed it, corrupting memory or crashing the
kernel.

[1] https://sashiko.dev/#/bug/linux-6b22a4e9-355d-4ab5-829f-c56ef38ce667

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106-rio_sg-v1-0-bc54b4bd8c95@nxp.com?part=2

Re: [PATCH 2/3] net: xilinx: axienet: use dmaengine_prep_slave_sg_context()

[Gupta, Suraj]

On 11/7/2026 4:13 AM, Frank.Li@oss.nxp.com wrote:
> From: Frank Li <Frank.Li@nxp.com>
> 
> Replace the direct call to dma_dev->device_prep_slave_sg() with the
> dmaengine_prep_slave_sg_context() helper, which handles NULL checks and
> passes the context pointer cleanly.
> 
> No functional change. Prepare to make struct dma_device private to the DMA
> engine.
> 
> Signed-off-by: Frank Li <Frank.Li@nxp.com>
> ---
> Suggest go through DMA engine tree. this is only one of 3 user, which
> use context at prep sg.
> ---
>   drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 7 ++++---
>   1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> index 7e83c4b5f1931..55d1b39caf7ed 100644
> --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> @@ -1006,9 +1006,10 @@ axienet_start_xmit_dmaengine(struct sk_buff *skb, struct net_device *ndev)
>   		app_metadata[0] |= 2; /* Tx Full Checksum Offload Enabled */
>   	}
>   
> -	dma_tx_desc = dma_dev->device_prep_slave_sg(lp->tx_chan, skbuf_dma->sgl,
> -			sg_len, DMA_MEM_TO_DEV,
> -			DMA_PREP_INTERRUPT, (void *)app_metadata);
> +	dma_tx_desc = dmaengine_prep_slave_sg_context(lp->tx_chan, skbuf_dma->sgl,
> +						      sg_len, DMA_MEM_TO_DEV,
> +						      DMA_PREP_INTERRUPT,
> +						      (void *)app_metadata);

After this change, dma_dev looks unused & can be removed. Shashiko bot 
also pointed same.

Thanks,
Suraj


>   	if (!dma_tx_desc)
>   		goto xmit_error_unmap_sg;
>   
> 

[PATCH 3/3] ASoC: sprd: use dmaengine_prep_slave_sg_context() instead of device_prep_slave_sg()

[Frank.Li]

From: Frank Li <Frank.Li@nxp.com>

Replace direct calls to chan->device->device_prep_slave_sg() with the
dmaengine_prep_slave_sg_context() helper in both sprd-pcm-dma.c and
sprd-pcm-compress.c.

No functional change. Prepare to make struct dma_device private to the DMA
engine.

Signed-off-by: Frank Li <Frank.Li@nxp.com>
---
Last user use prep_sg with context argument. Suggest go through DMA Engine
tree directly.
---
 sound/soc/sprd/sprd-pcm-compress.c | 6 +++---
 sound/soc/sprd/sprd-pcm-dma.c      | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/sound/soc/sprd/sprd-pcm-compress.c b/sound/soc/sprd/sprd-pcm-compress.c
index a810c9c8a0b5b..228cb8741c438 100644
--- a/sound/soc/sprd/sprd-pcm-compress.c
+++ b/sound/soc/sprd/sprd-pcm-compress.c
@@ -236,9 +236,9 @@ static int sprd_platform_compr_dma_config(struct snd_soc_component *component,
 	 * We configure the DMA request mode, interrupt mode, channel
 	 * mode and channel trigger mode by the flags.
 	 */
-	dma->desc = dma->chan->device->device_prep_slave_sg(dma->chan, sg,
-							    sg_num, dir,
-							    flags, &link);
+	dma->desc = dmaengine_prep_slave_sg_context(dma->chan, sg,
+						    sg_num, dir,
+						    flags, &link);
 	if (!dma->desc) {
 		dev_err(dev, "failed to prepare slave sg\n");
 		ret = -ENOMEM;
diff --git a/sound/soc/sprd/sprd-pcm-dma.c b/sound/soc/sprd/sprd-pcm-dma.c
index 968901ae4c335..bb72cb272d4b3 100644
--- a/sound/soc/sprd/sprd-pcm-dma.c
+++ b/sound/soc/sprd/sprd-pcm-dma.c
@@ -277,9 +277,9 @@ static int sprd_pcm_hw_params(struct snd_soc_component *component,
 		 */
 		flags = SPRD_DMA_FLAGS(SPRD_DMA_CHN_MODE_NONE, SPRD_DMA_NO_TRG,
 				       SPRD_DMA_FRAG_REQ, SPRD_DMA_TRANS_INT);
-		data->desc = chan->device->device_prep_slave_sg(chan, sg,
-								sg_num, dir,
-								flags, &link);
+		data->desc = dmaengine_prep_slave_sg_context(chan, sg,
+							     sg_num, dir,
+							     flags, &link);
 		if (!data->desc) {
 			dev_err(component->dev, "failed to prepare slave sg\n");
 			ret = -ENOMEM;

-- 
2.43.0

Re: [PATCH 3/3] ASoC: sprd: use dmaengine_prep_slave_sg_context() instead of device_prep_slave_sg()

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 325 bytes --]

On Fri, Nov 06, 2026 at 05:43:10PM -0500, Frank.Li@oss.nxp.com wrote:
> From: Frank Li <Frank.Li@nxp.com>
> 
> Replace direct calls to chan->device->device_prep_slave_sg() with the
> dmaengine_prep_slave_sg_context() helper in both sprd-pcm-dma.c and
> sprd-pcm-compress.c.

Acked-by: Mark Brown <broonie@kernel.org>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH 3/3] ASoC: sprd: use dmaengine_prep_slave_sg_context() instead of device_prep_slave_sg()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] ASoC: sprd: double-free in sprd_platform_compr_free() [1]
--

commit 7137d268eefd6fca1c12f5ab33b970d39d707688
Author: Frank Li <Frank.Li@nxp.com>

ASoC: sprd: use dmaengine_prep_slave_sg_context() instead of device_prep_slave_sg()

This commit replaces direct calls to chan->device->device_prep_slave_sg()
with dmaengine_prep_slave_sg_context() in sprd-pcm-compress.c and
sprd-pcm-dma.c.

> diff --git a/sound/soc/sprd/sprd-pcm-compress.c b/sound/soc/sprd/sprd-pcm-compress.c
> index f790b959cd4e4..7188adfa3f402 100644
> --- a/sound/soc/sprd/sprd-pcm-compress.c
> +++ b/sound/soc/sprd/sprd-pcm-compress.c
> @@ -236,9 +236,9 @@ static int sprd_platform_compr_dma_config(struct snd_soc_component *component,
>  	 * We configure the DMA request mode, interrupt mode, channel
>  	 * mode and channel trigger mode by the flags.
>  	 */
> -	dma->desc = dma->chan->device->device_prep_slave_sg(dma->chan, sg,
> -							    sg_num, dir,
> -							    flags, &link);
> +	dma->desc = dmaengine_prep_slave_sg_context(dma->chan, sg,
> +						    sg_num, dir,
> +						    flags, &link);
>  	if (!dma->desc) {
>  		dev_err(dev, "failed to prepare slave sg\n");
>  		ret = -ENOMEM;

[Severity: Critical]
This problem wasn't introduced by this patch, but can a failure in
sprd_platform_compr_dma_config() or sprd_platform_compr_set_params()
cause a double free of dma->chan in sprd_platform_compr_free() [1]?

The error paths in both functions call dma_release_channel() without
clearing dma->chan to NULL:

sound/soc/sprd/sprd-pcm-compress.c:sprd_platform_compr_dma_config() {
	...
config_err:
	kfree(sg);
sg_err:
	dma_release_channel(dma->chan);
	return ret;
}

sound/soc/sprd/sprd-pcm-compress.c:sprd_platform_compr_set_params() {
	...
params_err:
	dma_release_channel(stream->dma[0].chan);
config_err:
	dma_release_channel(stream->dma[1].chan);
	return ret;
}

When the stream is later closed, sprd_platform_compr_free() checks
if (dma->chan) and calls dma_release_channel() a second time on the same
channel pointer.

[1] https://sashiko.dev/#/bug/linux-2a0aea76-9cc7-47d0-8767-b0cd95e62054

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106-rio_sg-v1-0-bc54b4bd8c95@nxp.com?part=3