linux.git/kernel/dma/coherent.c, branch v6.18.22

dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask

2025-04-22T15:44:09+00:00

When a reserved memory region described in the device tree is attached
to a device, it is expected that the device's limitations are correctly
included in that description.

However, if the device driver failed to implement DMA address masking
or addressing beyond the default 32 bits (on arm64), then bad things
could happen because the DMA address was truncated, such as playing
back audio with no actual audio coming out, or DMA overwriting random
blocks of kernel memory.

Check against the coherent DMA mask when the memory regions are attached
to the device. Give a warning when the memory region can not be covered
by the mask.

A warning instead of a hard error was chosen, because it is possible
that existing drivers could be working fine even if they forgot to
extend the coherent DMA mask.

Signed-off-by: Chen-Yu Tsai 
Signed-off-by: Marek Szyprowski 
Link: https://lore.kernel.org/r/20250421083930.374173-1-wenst@chromium.org

dma-mapping: save base/size instead of pointer to shared DMA pool

2024-11-14T09:45:09+00:00

On RZ/Five, which is non-coherent, and uses CONFIG_DMA_GLOBAL_POOL=y:

    Oops - store (or AMO) access fault [#1]
    CPU: 0 UID: 0 PID: 1 Comm: swapper Not tainted 6.12.0-rc1-00015-g8a6e02d0c00e #201
    Hardware name: Renesas SMARC EVK based on r9a07g043f01 (DT)
    epc : __memset+0x60/0x100
     ra : __dma_alloc_from_coherent+0x150/0x17a
    epc : ffffffff8062d2bc ra : ffffffff80053a94 sp : ffffffc60000ba20
     gp : ffffffff812e9938 tp : ffffffd601920000 t0 : ffffffc6000d0000
     t1 : 0000000000000000 t2 : ffffffffe9600000 s0 : ffffffc60000baa0
     s1 : ffffffc6000d0000 a0 : ffffffc6000d0000 a1 : 0000000000000000
     a2 : 0000000000001000 a3 : ffffffc6000d1000 a4 : 0000000000000000
     a5 : 0000000000000000 a6 : ffffffd601adacc0 a7 : ffffffd601a841a8
     s2 : ffffffd6018573c0 s3 : 0000000000001000 s4 : ffffffd6019541e0
     s5 : 0000000200000022 s6 : ffffffd6018f8410 s7 : ffffffd6018573e8
     s8 : 0000000000000001 s9 : 0000000000000001 s10: 0000000000000010
     s11: 0000000000000000 t3 : 0000000000000000 t4 : ffffffffdefe62d1
     t5 : 000000001cd6a3a9 t6 : ffffffd601b2aad6
    status: 0000000200000120 badaddr: ffffffc6000d0000 cause: 0000000000000007
    [] __memset+0x60/0x100
    [] dma_alloc_from_global_coherent+0x1c/0x28
    [] dma_direct_alloc+0x98/0x112
    [] dma_alloc_attrs+0x78/0x86
    [] rz_dmac_probe+0x3f6/0x50a
    [] platform_probe+0x4c/0x8a

If CONFIG_DMA_GLOBAL_POOL=y, the reserved_mem structure passed to
rmem_dma_setup() is saved for later use, by saving the passed pointer.
However, when dma_init_reserved_memory() is called later, the pointer
has become stale, causing a crash.

E.g. in the RZ/Five case, the referenced memory now contains the
reserved_mem structure for the "mmode_resv0@30000" node (with base
0x30000 and size 0x10000), instead of the correct "pma_resv0@58000000"
node (with base 0x58000000 and size 0x8000000).

Fix this by saving the needed reserved_mem structure's contents instead.

Fixes: 8a6e02d0c00e7b62 ("of: reserved_mem: Restructure how the reserved memory regions are processed")
Signed-off-by: Geert Uytterhoeven 
Reviewed-by: Oreoluwa Babatunde 
Tested-by: Lad Prabhakar 
Signed-off-by: Christoph Hellwig

dma-mapping: clear dev->dma_mem to NULL after freeing it

2023-12-15T11:32:45+00:00

Reproduced with below sequence:
dma_declare_coherent_memory()->dma_release_coherent_memory()
->dma_declare_coherent_memory()->"return -EBUSY" error

It will return -EBUSY from the dma_assign_coherent_memory()
in dma_declare_coherent_memory(), the reason is that dev->dma_mem
pointer has not been set to NULL after it's freed.

Fixes: cf65a0f6f6ff ("dma-mapping: move all DMA mapping code to kernel/dma")
Signed-off-by: Joakim Zhang 
Signed-off-by: Christoph Hellwig

dma-mapping: Add dma_release_coherent_memory to DMA API

2022-06-24T15:30:54+00:00

Add dma_release_coherent_memory to DMA API to allow dma
user call it to release dev->dma_mem when the device is
removed.

Signed-off-by: Mark-PK Tsai 
Acked-by: Christoph Hellwig 
Link: https://lore.kernel.org/r/20220422062436.14384-2-mark-pk.tsai@mediatek.com
Signed-off-by: Mathieu Poirier

dma-mapping: use 'bitmap_zalloc()' when applicable

2021-10-27T06:20:09+00:00

'dma_mem->bitmap' is a bitmap. So use 'bitmap_zalloc()' to simplify code,
improve the semantic and avoid some open-coded arithmetic in allocator
arguments.

Also change the corresponding 'kfree()' into 'bitmap_free()' to keep
consistency.

Signed-off-by: Christophe JAILLET 
Signed-off-by: Christoph Hellwig

dma-mapping: make the global coherent pool conditional

2021-08-19T07:02:39+00:00

Only build the code to support the global coherent pool if support for
it is enabled.

Signed-off-by: Christoph Hellwig 
Tested-by: Dillon Min

dma-mapping: add a dma_init_global_coherent helper

2021-08-18T14:24:11+00:00

Add a new helper to initialize the global coherent pool.  This both
cleans up the existing initialization which indirects through the
reserved_mem_ops that are normally only used for struct device, and
also allows using the global pool for non-devicetree architectures.

Signed-off-by: Christoph Hellwig 
Tested-by: Dillon Min

dma-mapping: simplify dma_init_coherent_memory

2021-08-18T14:24:10+00:00

Return the allocated dma_coherent_mem structure, set the
use_dma_pfn_offset and print the failure warning inside of
dma_init_coherent_memory instead of leaving that to the callers.

Signed-off-by: Christoph Hellwig 
Tested-by: Dillon Min

dma-mapping: allow using the global coherent pool for !ARM

2021-08-18T14:24:10+00:00

Switch an ifdef so that the global coherent pool is initialized for
any architecture that selects the DMA_GLOBAL_POOL symbol insted of
hardcoding ARM.

Signed-off-by: Christoph Hellwig 
Tested-by: Dillon Min

dma-mapping: remove a trailing space

2021-06-22T06:15:46+00:00

Signed-off-by: Zhen Lei 
Signed-off-by: Christoph Hellwig