Re: [PATCH v4] arm64: dts: imx95: Increase PCIe outbound address space to 4GB

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unaligned 4GB PCIe outbound memory window causes iATU wrap-around and address translation failure.
--

commit 2c9468d72c0c22f965e76ce9a1c6ea0cf04f99fa
Author: Richard Zhu <hongxing.zhu@nxp.com>

arm64: dts: imx95: Increase PCIe outbound address space to 4GB

This commit increases the PCIe outbound memory region size to 4GB to
match the actual hardware-supported memory space. It updates the ranges
for both pcie0 and pcie1.

> diff --git a/arch/arm64/boot/dts/freescale/imx95.dtsi b/arch/arm64/boot/dts/freescale/imx95.dtsi
> index adcc0e1d3696b..d8a6a18ddfa1c 100644
> --- a/arch/arm64/boot/dts/freescale/imx95.dtsi
> +++ b/arch/arm64/boot/dts/freescale/imx95.dtsi
> @@ -1940,7 +1940,7 @@ pcie0: pcie@4c300000 {
>  			      <0 0x4c340000 0 0x4000>;
>  			reg-names = "dbi", "config", "atu", "app";
>  			ranges = <0x81000000 0x0 0x00000000 0x0 0x6ff00000 0 0x00100000>,
> -				 <0x82000000 0x0 0x10000000 0x9 0x10000000 0 0x10000000>;
> +				 <0x83000000 0x0 0x10000000 0x9 0x00000000 1 0x00000000>;

Will this unaligned 4GB PCIe outbound memory window cause an iATU
wrap-around and address translation failure?

The child PCI base address is left at 0x10000000. With a size of 4GB (1 0x0),
the PCI address range extends from 0x10000000 to 0x10FFFFFFF, which crosses
a 32-bit boundary.

The i.MX95 uses a DesignWare PCIe controller. Its internal Address Translation
Unit (iATU) generates outbound PCI target addresses by adding the CPU-side
offset to a 32-bit lower target register.

Since this 32-bit adder does not propagate a carry bit to the upper 32-bit
address register, the 32-bit addition overflows when the CPU accesses the top
256MB of the new memory window (e.g., offsets >= 0xF0000000).

Instead of correctly crossing into the 0x100000000 PCI address space, the
hardware silently wraps around to 0x00000000. This limitation will lead to
PCI access failures or memory corruption if devices are allocated BARs in the
upper section of the window.

Should the child PCI address be 4GB-aligned (e.g., 0x0 0x00000000) to match
the CPU alignment and ensure safe address translation?

[ ... ]

> @@ -2015,7 +2015,7 @@ pcie1: pcie@4c380000 {
>  			      <0 0x4c3c0000 0 0x4000>;
>  			reg-names = "dbi", "config", "atu", "app";
>  			ranges = <0x81000000 0 0x00000000 0x8 0x8ff00000 0 0x00100000>,
> -				 <0x82000000 0 0x10000000 0xa 0x10000000 0 0x10000000>;
> +				 <0x83000000 0 0x10000000 0xa 0x00000000 1 0x00000000>;

Does this node have the same address translation issue as pcie0?

Like pcie0, the child PCI base address is 0x10000000 and the size is 4GB,
which will also overflow the 32-bit iATU adder and wrap around.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260513034456.1554188-1-hongxing.zhu@nxp.com?part=1