Re: [PATCH v4 4/6] PCI: dwc: Expose endpoint DMA resources

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The doorbell resource is incorrectly hidden and auxiliary resource queries fail entirely when the eDMA provider is registered in non-LL mode, contradicting the commit intent.
--

--- Patch [4]: [PATCH v4 4/6] PCI: dwc: Expose endpoint DMA resources ---
commit 14327ef69239f572929efa8665a21b5950efac88
Author: Koichiro Den <den@valinux.co.jp>

PCI: dwc: Expose endpoint DMA resources

This patch exposes the DesignWare endpoint-integrated eDMA register window,
logical DMA channels, and linked-list descriptor memories through the EPC
auxiliary resource API. It also handles the interrupt-emulation doorbell
when its register offset is valid.

> diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c
> index 7d2794945704e..dd47537f390e5 100644
> --- a/drivers/pci/controller/dwc/pcie-designware-ep.c
> +++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
> @@ -865,14 +897,34 @@ dw_pcie_ep_get_aux_resources_count(struct pci_epc *epc, u8 func_no,
>  	struct dw_pcie_ep *ep = epc_get_drvdata(epc);
>  	struct dw_pcie *pci = to_dw_pcie_from_ep(ep);
>  	struct dw_edma_chip *edma = &pci->edma;
> +	int ret;
> +	int count = 0;
>  
>  	if (!pci->edma_reg_size)
>  		return 0;
>  
> -	if (edma->db_offset == ~0)
> -		return 0;
> +	ret = dw_pcie_ep_check_edma_vfunc(vfunc_no);
> +	if (ret)
> +		return ret;
> +
> +	if (edma->dw) {
> +		ret = dw_pcie_ep_check_edma_ll_regions(edma->ll_region_wr,
> +						       edma->ll_wr_cnt);
> +		if (ret)
> +			return ret;

[Severity: High]
The commit message states the doorbell remains reported, but if eDMA lacks
linked-list memory, dw_pcie_ep_check_edma_ll_regions() returns -EOPNOTSUPP,
which causes this function to return an error. Does this inadvertently hide
the doorbell resource and cause the entire query to fail in non-LL mode?

[ ... ]

> @@ -909,6 +962,76 @@ dw_pcie_ep_get_aux_resources(struct pci_epc *epc, u8 func_no, u8 vfunc_no,
>  	if (rsvd && rsvd->size < dma_reg_size)
>  		dma_reg_size = rsvd->size;
>  
> +	count = 0;
> +	if (edma->dw) {
> +		resources[count++] = (struct pci_epc_aux_resource) {
> +			.type = PCI_EPC_AUX_DMA_CTRL_MMIO,

[Severity: High]
If dw_pcie_ep_get_aux_resources_count() is updated to ignore the eDMA
channels instead of returning an error, this unconditionally populates the
eDMA resources when edma->dw is true. Could this cause an out-of-bounds
write to the resources array since the array would have been allocated
based on the smaller count?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260710082156.2395844-1-den@valinux.co.jp?part=4