Re: [PATCH v2] pci: designware: Set DMA_BYPASS bit in outbound IATU CTRL2 register

[Bjorn Helgaas]

On Thu, Oct 15, 2026 at 11:10:49AM +0530, Manivannan Sadhasivam wrote:
> On Wed, Oct 14, 2026 at 02:20:49PM -0500, Bjorn Helgaas wrote:
> > On Tue, Sep 08, 2026 at 11:48:22AM +0530, Sumit Kumar wrote:
> > > An outbound iATU region matches any local (AXI/application-side)
> > > address that falls within its Base/Limit window and rewrites it to
> > > the PCIe-side address programmed in that region's Target Address
> > > Registers before the transaction goes out on the link. This matching
> > > does not distinguish CPU-initiated transactions from ones issued by
> > > the internal DMA engine (eDMA/HDMA).
> > > 
> > > Example: outbound region 0 is programmed with Base/Limit covering
> > > local addresses 0x8000_0000-0x8000_0FFF and Target 0x1_0000_0000, for
> > > CPU-initiated accesses. The DMA engine is later given a descriptor
> > > whose destination is the host address 0x8000_0080, which happens to
> > > fall inside region 0's Base/Limit range. The iATU matches the DMA
> > > transaction against region 0 too and rewrites it to 0x1_0000_0080
> > > instead of passing 0x8000_0080 through unchanged. The transaction
> > > then lands on the wrong host address, causing data corruption or an
> > > IOMMU fault when the rewritten address has no valid mapping.
> > > 
> > > Set the DMA_BYPASS bit (bit 27) in PCIE_ATU_REGION_CTRL2 when
> > > programming outbound iATU regions so only CPU/AXI-initiated
> > > transactions are matched against the region; DMA engine transactions
> > > bypass the translation and go out on the PCIe link with their
> > > original address.
> > > 
> > > Signed-off-by: Sumit Kumar <sumit.kumar@xxxxxxxxxxxxxxxx>
> > 
> > Thanks for the fix.  A data corruption is pretty disastrous.
> > 
> > Is there a Fixes: tag we can add here?
> > 
> > Probably also a stable tag?
> 
> Just to clarify, there is no reported data corruption due to kernel.
> Our internal teams saw corruption in the bootloader with overlapped
> mapping between iATU and eDMA and fixed it with this BYPASS flag. So
> Sumit wanted to do the same thing in kenrel to avoid hitting such
> scenarios. That's why there is no fixes or stable tag.

This doesn't sound very comforting to me.  Unless there's some reason
similar corruption can't happen in the kernel, I think this deserves
Fixes: and a stable tag.

The fact that nobody's reported it doesn't mean it's not happening or
won't happen.