[PATCH v7] arm64: dts: imx95: Correct PCIe outbound address space configuration

[PATCH v7] arm64: dts: imx95: Correct PCIe outbound address space configuration

[Richard Zhu]

Fix the PCIe outbound memory ranges for both pcie0 and pcie1
controllers on i.MX95.

The memory window size was incorrectly set to 256MB during initial
bring-up, but the hardware supports up to 4GB of outbound address space
per controller.

Additionally, the ECAM region cannot be mapped as I/O space. Use a
memory-mapped region for I/O space instead, and relocate the 1MB I/O
region to immediately follow the memory region at offset 0xf0000000
within each window.

Update the outbound address space layout per controller as follows:

  - 3.5GB  64-bit prefetchable memory
  - 256MB  32-bit non-prefetchable memory
  - 1MB    I/O

Fixes: 3b1d5deb29ff ("arm64: dts: imx95: add pcie[0,1] and pcie-ep[0,1] support")
Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
---
 arch/arm64/boot/dts/freescale/imx95.dtsi | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)
---
Changes in v6:
- Map the large outbound window into 64-bit PCI address, to eliminate both
the inbound DMA routing conflict and the IOVA exhaustion problem.

Changes in v5:
- Expand the outbound address space from 256MB to 3840MB, starting at the
base of each controller's assigned CPU address range.
- Use a memory region to map the I/O space.

Changes in v4:
Update the flag from 0x82000000 to 0x83000000 to declare a 64-bit PCI space.

Changes in v3:
Update the commit message, and set the region size to the max hardware-supported memory space 4G.

Changes in v2:
Add the Fixes tag, and rebase to latest imx/dt64 branch.

diff --git a/arch/arm64/boot/dts/freescale/imx95.dtsi b/arch/arm64/boot/dts/freescale/imx95.dtsi
index adcc0e1d3696..d776cd350c4b 100644
--- a/arch/arm64/boot/dts/freescale/imx95.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx95.dtsi
@@ -1939,8 +1939,9 @@ pcie0: pcie@4c300000 {
 			      <0 0x4c360000 0 0x10000>,
 			      <0 0x4c340000 0 0x4000>;
 			reg-names = "dbi", "config", "atu", "app";
-			ranges = <0x81000000 0x0 0x00000000 0x0 0x6ff00000 0 0x00100000>,
-				 <0x82000000 0x0 0x10000000 0x9 0x10000000 0 0x10000000>;
+			ranges = <0x43000000 0x9 0x00000000 0x9 0x00000000 0x0 0xe0000000>,
+				 <0x82000000 0x0 0x00000000 0x9 0xe0000000 0x0 0x10000000>,
+				 <0x81000000 0x0 0x00000000 0x9 0xf0000000 0x0 0x00100000>;
 			#address-cells = <3>;
 			#size-cells = <2>;
 			device_type = "pci";
@@ -2014,8 +2015,9 @@ pcie1: pcie@4c380000 {
 			      <0 0x4c3e0000 0 0x10000>,
 			      <0 0x4c3c0000 0 0x4000>;
 			reg-names = "dbi", "config", "atu", "app";
-			ranges = <0x81000000 0 0x00000000 0x8 0x8ff00000 0 0x00100000>,
-				 <0x82000000 0 0x10000000 0xa 0x10000000 0 0x10000000>;
+			ranges = <0x43000000 0xa 0x00000000 0xa 0x00000000 0x0 0xe0000000>,
+				 <0x82000000 0x0 0x00000000 0xa 0xe0000000 0x0 0x10000000>,
+				 <0x81000000 0x0 0x00000000 0xa 0xf0000000 0x0 0x00100000>;
 			#address-cells = <3>;
 			#size-cells = <2>;
 			device_type = "pci";
-- 
2.37.1

Re: [PATCH v7] arm64: dts: imx95: Correct PCIe outbound address space configuration

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The 32-bit non-prefetchable memory region is mapped to PCI bus address 0x00000000, which breaks identity mapping, risks BAR allocation at 0x0, and causes inbound DMA routing conflicts with low IOVAs.
--

commit e0f5ac7bad631db9fb55f3b3093d93a9bac757ae
Author: Richard Zhu <hongxing.zhu@nxp.com>

arm64: dts: imx95: Correct PCIe outbound address space configuration

This commit fixes the PCIe outbound memory ranges for both pcie0 and pcie1
controllers on i.MX95 by expanding the outbound address space window size.
It also relocates the 1MB I/O region to use a memory-mapped region instead
of I/O space.

> diff --git a/arch/arm64/boot/dts/freescale/imx95.dtsi b/arch/arm64/boot/dts/freescale/imx95.dtsi
> index 71394871d8dd0..2c058f6105550 100644
> --- a/arch/arm64/boot/dts/freescale/imx95.dtsi
> +++ b/arch/arm64/boot/dts/freescale/imx95.dtsi
> @@ -1852,8 +1852,9 @@ pcie0: pcie@4c300000 {

[ ... ]

> -			ranges = <0x81000000 0x0 0x00000000 0x0 0x6ff00000 0 0x00100000>,
> -				 <0x82000000 0x0 0x10000000 0x9 0x10000000 0 0x10000000>;
> +			ranges = <0x43000000 0x9 0x00000000 0x9 0x00000000 0x0 0xe0000000>,
> +				 <0x82000000 0x0 0x00000000 0x9 0xe0000000 0x0 0x10000000>,

[Severity: High]
Does mapping the 32-bit non-prefetchable memory region to PCI bus address
0x00000000 break identity mapping and risk inbound DMA routing conflicts?

By assigning the PCI base address to 0x0, the PCIe Root Port's Type 1
configuration space will be programmed with a Memory Base of 0x0. If a
downstream device initiates inbound DMA to system RAM using an IOMMU-assigned
IOVA that falls within this low address range, the Root Port might interpret
the transaction as a peer-to-peer access.

Could this cause the transaction to be routed back downstream to the PCIe
bus instead of being forwarded upstream to the system bus and IOMMU? To
prevent this, should the PCI address be set to a high non-zero value, such
as 0xe0000000, matching the lower 32 bits of the CPU address?

> +				 <0x81000000 0x0 0x00000000 0x9 0xf0000000 0x0 0x00100000>;
>  			#address-cells = <3>;

[ ... ]

> @@ -1927,8 +1928,9 @@ pcie1: pcie@4c380000 {

[ ... ]

> -			ranges = <0x81000000 0 0x00000000 0x8 0x8ff00000 0 0x00100000>,
> -				 <0x82000000 0 0x10000000 0xa 0x10000000 0 0x10000000>;
> +			ranges = <0x43000000 0xa 0x00000000 0xa 0x00000000 0x0 0xe0000000>,
> +				 <0x82000000 0x0 0x00000000 0xa 0xe0000000 0x0 0x10000000>,

[Severity: High]
Will this have the same DMA routing conflict with low IOVAs as the pcie0
controller above, since it is also mapped to PCI bus address 0x00000000?

> +				 <0x81000000 0x0 0x00000000 0xa 0xf0000000 0x0 0x00100000>;
>  			#address-cells = <3>;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260520035642.2207511-1-hongxing.zhu@nxp.com?part=1