Re: [PATCH v6 04/10] dmaengine: dw-edma: Pass down dw_edma_chan to reduce one level of indirection

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but there is a preexisting endianness bug in local DMA descriptor initialization for big-endian architectures, leading to memory corruption.
--

--- Patch [4]: [PATCH v6 04/10] dmaengine: dw-edma: Pass down dw_edma_chan to reduce one level of indirection ---
commit 8719a22bd4ff9eee44469b7d4192520551bd05a3
Author: Frank Li <Frank.Li@nxp.com>

    dmaengine: dw-edma: Pass down dw_edma_chan to reduce one level of indirection
    
    Some helper functions do not use any information from dw_edma_chunk, so
    passing a dw_edma_chan pointer directly avoids an unnecessary level of
    pointer dereferencing and simplifies data access.

> diff --git a/drivers/dma/dw-edma/dw-edma-v0-core.c b/drivers/dma/dw-edma/dw-edma-v0-core.c
> index 51e50f1fdcac4..c341aa5343417 100644
> --- a/drivers/dma/dw-edma/dw-edma-v0-core.c
> +++ b/drivers/dma/dw-edma/dw-edma-v0-core.c
> @@ -276,13 +276,12 @@ dw_edma_v0_core_handle_int(struct dw_edma_irq *dw_irq, enum dw_edma_dir dir,
>  	return ret;
>  }
>  
> -static void dw_edma_v0_write_ll_data(struct dw_edma_chunk *chunk, int i,
> +static void dw_edma_v0_write_ll_data(struct dw_edma_chan *chan, int i,
>  				     u32 control, u32 size, u64 sar, u64 dar)
>  {
>  	ptrdiff_t ofs = i * sizeof(struct dw_edma_v0_lli);
> -	struct dw_edma_chan *chan = chunk->chan;
>  
> -	if (chunk->chan->dw->chip->flags & DW_EDMA_CHIP_LOCAL) {
> +	if (chan->dw->chip->flags & DW_EDMA_CHIP_LOCAL) {
>  		struct dw_edma_v0_lli *lli = chan->ll_region.vaddr.mem + ofs;
>  
>  		lli->transfer_size = size;

[Severity: High]
This problem wasn't introduced by this patch, but there is a preexisting
endianness bug in local DMA descriptor initialization for big-endian
architectures here.

Since the hardware expects little-endian values, does assigning native CPU
values directly to the memory-mapped descriptor structs in the local path
corrupt the DMA layout on big-endian CPUs?

The non-local path correctly uses writel() and writeq() which perform
implicit CPU-to-LE conversions, but writing 64-bit values natively to the
reg union member places the most-significant bits into the lsb field on
big-endian systems:

dw_edma_v0_write_ll_data() {
    ...
    if (chan->dw->chip->flags & DW_EDMA_CHIP_LOCAL) {
        ...
        lli->transfer_size = size;
        lli->sar.reg = sar;
        lli->dar.reg = dar;
        dma_wmb();
        lli->control = control;
    ...
}

This could cause the DMA controller to read mangled addresses and swapped
transfer sizes, potentially leading to memory corruption.

The same pattern appears to be present in dw_edma_v0_write_ll_link(),
dw_hdma_v0_write_ll_data(), and dw_hdma_v0_write_ll_link().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260710-edma_ll-v6-0-1471d278b73a@nxp.com?part=4