Commit af0c3f05 authored by Jianpeng Chang's avatar Jianpeng Chang Committed by Marek Szyprowski
Browse files

dma-mapping: move dma_map_resource() sanity check into debug code 



dma_map_resource() uses pfn_valid() to ensure the range is not RAM.
However, pfn_valid() only checks for availability of the memory map for
a PFN but it does not ensure that the PFN is actually backed by RAM. On
ARM64 with SPARSEMEM (128MB section granularity), MMIO addresses that
share a section with RAM will falsely trigger the WARN_ON_ONCE and cause
dma_map_resource() to return DMA_MAPPING_ERROR.

This causes a WARNING on Raspberry Pi 4 during spi_bcm2835 probe because
the SPI FIFO register (0xfe204004) falls in the same sparsemem section
as the end of RAM (0xf8000000-0xfbffffff), both in section 31
(0xf8000000-0xffffffff).

Move the sanity check from dma_map_resource() into debug_dma_map_phys()
and replace the unreliable pfn_valid() with pfn_valid() &&
!PageReserved(), which correctly identifies actual usable RAM without
false positives for MMIO regions that happen to have struct pages.

Since dma_map_resource() is dma_map_phys(DMA_ATTR_MMIO), the check
applies equally to both APIs. Any non-reserved page represents kernel
memory to a sufficient degree that using DMA_ATTR_MMIO on it is almost
certainly wrong and risks breaking coherency on non-coherent platforms.
ZONE_DEVICE pages used for PCI P2P DMA (MEMORY_DEVICE_PCI_P2PDMA) have
PageReserved set, so they will not trigger a false positive.

The check no longer blocks the mapping and uses err_printk() to
integrate with dma-debug filtering.

Fixes: f7326196 ("dma-mapping: export new dma_*map_phys() interface")
Reviewed-by: default avatarRobin Murphy <robin.murphy@arm.com>
Signed-off-by: default avatarJianpeng Chang <jianpeng.chang.cn@windriver.com>
Reviewed-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Signed-off-by: default avatarMarek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20260513072209.1486986-1-jianpeng.chang.cn@windriver.com
parent 22d0213e

kernel/dma/debug.c

+8 −1
Original line number Diff line number Diff line
@@ -1251,7 +1251,14 @@ void debug_dma_map_phys(struct device *dev, phys_addr_t phys, size_t size, 
	entry->direction = direction;

	entry->map_err_type = MAP_ERR_NOT_CHECKED;



	if (!(attrs & DMA_ATTR_MMIO)) {

	if (attrs & DMA_ATTR_MMIO) {

		unsigned long pfn = PHYS_PFN(phys);



		if (pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))

			err_printk(dev, entry,

				   "dma_map_resource called for RAM address %pa\n",

				   &phys);

	} else {

		check_for_stack(dev, phys);



		if (!PhysHighMem(phys))

kernel/dma/mapping.c

+0 −4
Original line number Diff line number Diff line
@@ -365,10 +365,6 @@ EXPORT_SYMBOL(dma_unmap_sg_attrs); 
dma_addr_t dma_map_resource(struct device *dev, phys_addr_t phys_addr,

		size_t size, enum dma_data_direction dir, unsigned long attrs)

{

	if (IS_ENABLED(CONFIG_DMA_API_DEBUG) &&

	    WARN_ON_ONCE(pfn_valid(PHYS_PFN(phys_addr))))

		return DMA_MAPPING_ERROR;



	return dma_map_phys(dev, phys_addr, size, dir, attrs | DMA_ATTR_MMIO);

}

EXPORT_SYMBOL(dma_map_resource);