Re: REGRESSION in 6.0-rc7 caused by patch "ARM/dma-mapping: use dma-direct unconditionally"

From: "Russell King (Oracle)" <linux@armlinux.org.uk>
To: Christoph Hellwig <hch@lst.de>
Cc: "Marek Behún" <kabel@kernel.org>,
	"Robin Murphy" <robin.murphy@arm.com>,
	"Arnd Bergmann" <arnd@kernel.org>,
	"Andre Przywara" <andre.przywara@arm.com>,
	"Marc Zyngier" <maz@kernel.org>,
	"Linus Torvalds" <torvalds@linux-foundation.org>,
	"Andrew Lunn" <andrew@lunn.ch>,
	"Gregory Clement" <gregory.clement@bootlin.com>,
	"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
	iommu@lists.linux-foundation.org,
	linux-arm-kernel@lists.infradead.org
Subject: Re: REGRESSION in 6.0-rc7 caused by patch "ARM/dma-mapping: use dma-direct unconditionally"
Date: Mon, 3 Oct 2022 15:11:44 +0100	[thread overview]
Message-ID: <YzrtoNYtmEmftrjU@shell.armlinux.org.uk> (raw)
In-Reply-To: <20221003073037.GB2108@lst.de>

On Mon, Oct 03, 2022 at 09:30:37AM +0200, Christoph Hellwig wrote:
> On Fri, Sep 30, 2022 at 05:02:05PM +0200, Marek Behún wrote:
> > It seems that the null pointer dereference comes from the data variable
> > having zero value. We assign
> >   data = (u8 *)(uintptr_t)rx_desc->buf_cookie;
> 
> I never see any assignment to ->buf_cookie in the driver, what am
> I missing?

I think Marek's setup (like my setups) use the hardware buffer manager,
and it's hardware that fills in the "buf_cookie", which is supposed to
be the virtual address of the buffer.

Each buffer supplied to the hardware buffer manager is supposed to
contain the virtual address in the first 32-bit word in that buffer.

This is done by mvneta_bm_construct():

        /* In order to update buf_cookie field of RX descriptor properly,
         * BM hardware expects buf virtual address to be placed in the
         * first four bytes of mapped buffer.
         */
        *(u32 *)buf = (u32)buf;

immediately prior to dma_map_single(..., DMA_FROM_DEVICE) is called.

If I had to guess, I would suggest that this write is being lost via
cache invalidation, and given that the hardware BM both reads and
writes this buffer, DMA_FROM_DEVICE is not correct, it should be
DMA_BIDIRECTIONAL.

Changing that is probably going to need DMA_FROM_DEVICE also changed
elsewhere in the mvneta_bm and mvneta driver.

I'm not in a position where I could test that out. Marek?

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 40Mbps down 10Mbps up. Decent connectivity at last!

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel