[PATCH] dmaengine: fsl_raid: fix 64-bit ring base address programming

[PATCH] dmaengine: fsl_raid: fix 64-bit ring base address programming

[Rosen Penev]

The driver claims a 40-bit DMA mask via dma_set_mask(40), but the
inbound/outbound ring base addresses were programmed by masking the
physical address with FSL_RE_ADDR_BIT_MASK (0xF) into the high register
and shifting it right by FSL_RE_ADDR_BIT_SHIFT (4) into the low register.

This truncates the upper address bits and, worse, places the lowest 4
bits of the address into the high register. For any ring allocated above
the 64 GB boundary the hardware reads/writes the wrong physical memory,
causing silent data corruption.

Program the registers correctly: the low register takes bits [31:0] and
the high register takes bits [39:32] of the 40-bit DMA address. Replace
the broken FSL_RE_ADDR_BIT_* macros with FSL_RE_ADDR_HIGH_MASK.

Fixes: ad80da658bbc ("dmaengine: Driver support for FSL RaidEngine device.")
Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/dma/fsl_raid.c | 14 +++++++++-----
 drivers/dma/fsl_raid.h |  3 +--
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c
index befb4bb69d54..7343833b3b34 100644
--- a/drivers/dma/fsl_raid.c
+++ b/drivers/dma/fsl_raid.c
@@ -715,15 +715,19 @@ static int fsl_re_chan_probe(struct platform_device *ofdev,
 		goto err_free_1;
 	}
 
-	/* Program the Inbound/Outbound ring base addresses and size */
+	/* Program the Inbound/Outbound ring base addresses and size.
+	 * The DMA rings are 64-bit addresses split into high/low registers.
+	 * The driver supports a 40-bit DMA mask, so the low register holds
+	 * bits [31:0] and the high register holds bits [39:32].
+	 */
 	out_be32(&chan->jrregs->inbring_base_h,
-		 chan->inb_phys_addr & FSL_RE_ADDR_BIT_MASK);
+		 upper_32_bits(chan->inb_phys_addr) & FSL_RE_ADDR_HIGH_MASK);
 	out_be32(&chan->jrregs->oubring_base_h,
-		 chan->oub_phys_addr & FSL_RE_ADDR_BIT_MASK);
+		 upper_32_bits(chan->oub_phys_addr) & FSL_RE_ADDR_HIGH_MASK);
 	out_be32(&chan->jrregs->inbring_base_l,
-		 chan->inb_phys_addr >> FSL_RE_ADDR_BIT_SHIFT);
+		 lower_32_bits(chan->inb_phys_addr));
 	out_be32(&chan->jrregs->oubring_base_l,
-		 chan->oub_phys_addr >> FSL_RE_ADDR_BIT_SHIFT);
+		 lower_32_bits(chan->oub_phys_addr));
 	out_be32(&chan->jrregs->inbring_size,
 		 FSL_RE_RING_SIZE << FSL_RE_RING_SIZE_SHIFT);
 	out_be32(&chan->jrregs->oubring_size,
diff --git a/drivers/dma/fsl_raid.h b/drivers/dma/fsl_raid.h
index adbfede330a7..748047996bbc 100644
--- a/drivers/dma/fsl_raid.h
+++ b/drivers/dma/fsl_raid.h
@@ -66,8 +66,7 @@
 #define FSL_RE_RING_SIZE		0x400
 #define FSL_RE_RING_SIZE_MASK		(FSL_RE_RING_SIZE - 1)
 #define FSL_RE_RING_SIZE_SHIFT		8
-#define FSL_RE_ADDR_BIT_SHIFT		4
-#define FSL_RE_ADDR_BIT_MASK		(BIT(FSL_RE_ADDR_BIT_SHIFT) - 1)
+#define FSL_RE_ADDR_HIGH_MASK		0xFF
 #define FSL_RE_ERROR			0x40000000
 #define FSL_RE_INTR			0x80000000
 #define FSL_RE_CLR_INTR			0x80000000
-- 
2.55.0

Re: [PATCH] dmaengine: fsl_raid: fix 64-bit ring base address programming

[Frank Li]

On Thu, Sep 10, 2026 at 01:17:17PM -0700, Rosen Penev wrote:
> The driver claims a 40-bit DMA mask via dma_set_mask(40), but the
> inbound/outbound ring base addresses were programmed by masking the
> physical address with FSL_RE_ADDR_BIT_MASK (0xF) into the high register
> and shifting it right by FSL_RE_ADDR_BIT_SHIFT (4) into the low register.

This IP is too old, which only use by power pc. I supposed you have not
hardware to test. Maybw 40-bit DMA mask is wrong, only support 36bits.

And hardware base_l hold 36:4 base_h hold:3:0,

I supposed this driver is tested when upstream. this change may block
function unless you or someone can run test at real hardware.

Frank

>
> This truncates the upper address bits and, worse, places the lowest 4
> bits of the address into the high register. For any ring allocated above
> the 64 GB boundary the hardware reads/writes the wrong physical memory,
> causing silent data corruption.
>
> Program the registers correctly: the low register takes bits [31:0] and
> the high register takes bits [39:32] of the 40-bit DMA address. Replace
> the broken FSL_RE_ADDR_BIT_* macros with FSL_RE_ADDR_HIGH_MASK.
>
> Fixes: ad80da658bbc ("dmaengine: Driver support for FSL RaidEngine device.")
> Assisted-by: opencode:hy3-free
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---
>  drivers/dma/fsl_raid.c | 14 +++++++++-----
>  drivers/dma/fsl_raid.h |  3 +--
>  2 files changed, 10 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c
> index befb4bb69d54..7343833b3b34 100644
> --- a/drivers/dma/fsl_raid.c
> +++ b/drivers/dma/fsl_raid.c
> @@ -715,15 +715,19 @@ static int fsl_re_chan_probe(struct platform_device *ofdev,
>  		goto err_free_1;
>  	}
>
> -	/* Program the Inbound/Outbound ring base addresses and size */
> +	/* Program the Inbound/Outbound ring base addresses and size.
> +	 * The DMA rings are 64-bit addresses split into high/low registers.
> +	 * The driver supports a 40-bit DMA mask, so the low register holds
> +	 * bits [31:0] and the high register holds bits [39:32].
> +	 */
>  	out_be32(&chan->jrregs->inbring_base_h,
> -		 chan->inb_phys_addr & FSL_RE_ADDR_BIT_MASK);
> +		 upper_32_bits(chan->inb_phys_addr) & FSL_RE_ADDR_HIGH_MASK);
>  	out_be32(&chan->jrregs->oubring_base_h,
> -		 chan->oub_phys_addr & FSL_RE_ADDR_BIT_MASK);
> +		 upper_32_bits(chan->oub_phys_addr) & FSL_RE_ADDR_HIGH_MASK);
>  	out_be32(&chan->jrregs->inbring_base_l,
> -		 chan->inb_phys_addr >> FSL_RE_ADDR_BIT_SHIFT);
> +		 lower_32_bits(chan->inb_phys_addr));
>  	out_be32(&chan->jrregs->oubring_base_l,
> -		 chan->oub_phys_addr >> FSL_RE_ADDR_BIT_SHIFT);
> +		 lower_32_bits(chan->oub_phys_addr));
>  	out_be32(&chan->jrregs->inbring_size,
>  		 FSL_RE_RING_SIZE << FSL_RE_RING_SIZE_SHIFT);
>  	out_be32(&chan->jrregs->oubring_size,
> diff --git a/drivers/dma/fsl_raid.h b/drivers/dma/fsl_raid.h
> index adbfede330a7..748047996bbc 100644
> --- a/drivers/dma/fsl_raid.h
> +++ b/drivers/dma/fsl_raid.h
> @@ -66,8 +66,7 @@
>  #define FSL_RE_RING_SIZE		0x400
>  #define FSL_RE_RING_SIZE_MASK		(FSL_RE_RING_SIZE - 1)
>  #define FSL_RE_RING_SIZE_SHIFT		8
> -#define FSL_RE_ADDR_BIT_SHIFT		4
> -#define FSL_RE_ADDR_BIT_MASK		(BIT(FSL_RE_ADDR_BIT_SHIFT) - 1)
> +#define FSL_RE_ADDR_HIGH_MASK		0xFF
>  #define FSL_RE_ERROR			0x40000000
>  #define FSL_RE_INTR			0x80000000
>  #define FSL_RE_CLR_INTR			0x80000000
> --
> 2.55.0
>