Re: [PATCH v2] pci: designware: Set DMA_BYPASS bit in outbound IATU CTRL2 register

[Bjorn Helgaas <helgaas@kernel.org>]

On Mon, Oct 19, 2026 at 04:55:15PM -0500, Bjorn Helgaas wrote:
> On Thu, Oct 15, 2026 at 11:10:49AM +0530, Manivannan Sadhasivam wrote:
> > On Wed, Oct 14, 2026 at 02:20:49PM -0500, Bjorn Helgaas wrote:
> > > On Tue, Sep 08, 2026 at 11:48:22AM +0530, Sumit Kumar wrote:
> > > > An outbound iATU region matches any local (AXI/application-side)
> > > > address that falls within its Base/Limit window and rewrites it to
> > > > the PCIe-side address programmed in that region's Target Address
> > > > Registers before the transaction goes out on the link. This matching
> > > > does not distinguish CPU-initiated transactions from ones issued by
> > > > the internal DMA engine (eDMA/HDMA).
> > > > 
> > > > Example: outbound region 0 is programmed with Base/Limit covering
> > > > local addresses 0x8000_0000-0x8000_0FFF and Target 0x1_0000_0000, for
> > > > CPU-initiated accesses. The DMA engine is later given a descriptor
> > > > whose destination is the host address 0x8000_0080, which happens to
> > > > fall inside region 0's Base/Limit range. The iATU matches the DMA
> > > > transaction against region 0 too and rewrites it to 0x1_0000_0080
> > > > instead of passing 0x8000_0080 through unchanged. The transaction
> > > > then lands on the wrong host address, causing data corruption or an
> > > > IOMMU fault when the rewritten address has no valid mapping.
> > > > 
> > > > Set the DMA_BYPASS bit (bit 27) in PCIE_ATU_REGION_CTRL2 when
> > > > programming outbound iATU regions so only CPU/AXI-initiated
> > > > transactions are matched against the region; DMA engine transactions
> > > > bypass the translation and go out on the PCIe link with their
> > > > original address.
> > > > 
> > > > Signed-off-by: Sumit Kumar <sumit.kumar@oss.qualcomm.com>
> > > 
> > > Thanks for the fix.  A data corruption is pretty disastrous.
> > > 
> > > Is there a Fixes: tag we can add here?
> > > 
> > > Probably also a stable tag?
> > 
> > Just to clarify, there is no reported data corruption due to kernel.
> > Our internal teams saw corruption in the bootloader with overlapped
> > mapping between iATU and eDMA and fixed it with this BYPASS flag. So
> > Sumit wanted to do the same thing in kenrel to avoid hitting such
> > scenarios. That's why there is no fixes or stable tag.
> 
> This doesn't sound very comforting to me.  Unless there's some reason
> similar corruption can't happen in the kernel, I think this deserves
> Fixes: and a stable tag.
> 
> The fact that nobody's reported it doesn't mean it's not happening or
> won't happen.

I guess I had already added a stable tag, but if we knew a Fixes
commit, that would still be helpful for stable kernels.