Re: [net-next,v5,3/3] net: ipa: Grab IMEM slice base/size from DTS

[Jakub Kicinski <kuba@kernel.org>]

This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.

For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html
---
net: ipa: Grab IMEM slice base/size from DTS

This commit changes IPA driver initialization to retrieve IMEM slice
base and size from the device tree instead of hardcoded platform data,
with fallback to the old method for backwards compatibility.

> diff --git a/drivers/net/ipa/ipa_data.h b/drivers/net/ipa/ipa_data.h
> index 2fd03f0799b2..f3bdc64cef05 100644
> --- a/drivers/net/ipa/ipa_data.h
> +++ b/drivers/net/ipa/ipa_data.h
> @@ -185,8 +185,13 @@ struct ipa_resource_data {
>  struct ipa_mem_data {
>  	u32 local_count;
>  	const struct ipa_mem *local;
> -	u32 imem_addr;
> -	u32 imem_size;
> +
> +	/* These values are now passed via DT, but to support
> +	 * older systems we must allow this to be specified here.
> +	 */
> +	u32 imem_addr; /* DEPRECATED */
> +	u32 imem_size; /* DEPRECATED */
> +
>  	u32 smem_size;
>  };
>
> diff --git a/drivers/net/ipa/ipa_mem.c b/drivers/net/ipa/ipa_mem.c
> index 835a3c9c1fd4..5d3f68bd02d9 100644
> --- a/drivers/net/ipa/ipa_mem.c
> +++ b/drivers/net/ipa/ipa_mem.c
> @@ -7,6 +7,7 @@
>  #include <linux/dma-mapping.h>
>  #include <linux/io.h>
>  #include <linux/iommu.h>
> +#include <linux/of_address.h>
>  #include <linux/platform_device.h>
>  #include <linux/types.h>
>

[ ... ]

> @@ -656,7 +659,24 @@ int ipa_mem_init(struct ipa *ipa, struct platform_device *pdev,
>  	ipa->mem_addr = res->start;
>  	ipa->mem_size = resource_size(res);
>
> -	ret = ipa_imem_init(ipa, mem_data->imem_addr, mem_data->imem_size);
> +	ipa_slice_np = of_parse_phandle(dev->of_node, "sram", 0);
> +	if (ipa_slice_np) {
> +		ret = of_address_to_resource(ipa_slice_np, 0, res);
> +		of_node_put(ipa_slice_np);
> +		if (ret)
> +			goto err_unmap;
> +
> +		imem_base = res->start;
> +		imem_size = resource_size(res);
                     ^^^^

Does this code corrupt the platform device's resource array? The variable
'res' was obtained from platform_get_resource_byname() earlier in this
function, which returns a pointer directly into pdev->resource[]:

drivers/base/platform.c:platform_get_resource_byname()
    return platform_get_resource(dev, type, num);
        => return &dev->resource[i];

Passing this pointer to of_address_to_resource() causes
__of_address_to_resource() to memset the entire structure to zero and then
overwrite all fields:

drivers/of/address.c:__of_address_to_resource()
    memset(r, 0, sizeof(struct resource));
    ...
    r->flags = ...
    r->name = ...
    r->start = ...
    r->end = ...

This permanently corrupts the platform device's "ipa-shared" resource entry.
While ipa->mem_addr and ipa->mem_size were saved before the corruption, the
platform device's resource array is shared kernel infrastructure.

After this corruption:
- /proc/iomem and sysfs will report incorrect resource information
- If the driver is unbound and rebound, platform_get_resource_byname(pdev,
  IORESOURCE_MEM, "ipa-shared") will fail because the resource's name field
  was overwritten with the sram DT node's full_name, causing probe to fail
  with -ENODEV

Would it be better to use a separate local variable for the
of_address_to_resource() call?

struct resource sram_res;
...
ret = of_address_to_resource(ipa_slice_np, 0, &sram_res);
...
imem_base = sram_res.start;
imem_size = resource_size(&sram_res);

> +	} else {
> +		/* Backwards compatibility for DTs lacking
> +		 * an explicit reference
> +		 */
> +		imem_base = mem_data->imem_addr;
> +		imem_size = mem_data->imem_size;
> +	}
> +
> +	ret = ipa_imem_init(ipa, imem_base, imem_size);
>  	if (ret)
>  		goto err_unmap;
-- 
pw-bot: cr