* [PATCH v8 01/19] dmaengine: ti: k3-udma: Fix sporadic crash on AM62x
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
@ 2026-08-10 15:13 ` Sai Sree Kartheek Adivi
2026-08-10 15:36 ` sashiko-bot
2026-08-10 15:13 ` [PATCH v8 02/19] dmaengine: ti: k3-udma: move macros to header file Sai Sree Kartheek Adivi
` (17 subsequent siblings)
18 siblings, 1 reply; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:13 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
From: Vignesh Raghavendra <vigneshr@ti.com>
ring_init_data is declared on stack and thus can contain garbage which
can lead to k3_ringacc_dmarings use junk address for ringrt base leading
to below crash during ring pop
[ 1.998239] cadence-qspi fc40000.spi: couldn't determine phase-detect-selector
[ 2.532106] Unable to handle kernel paging request at virtual address ffff800081a84b98
[ 2.540051] Mem abort info:
[...]
[ 2.629987] Workqueue: events_unbound deferred_probe_work_func
[ 2.635832] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 2.642787] pc : k3_ringacc_ring_pop+0x48/0x94
[ 2.647234] lr : udma_pop_from_ring+0x7c/0xb4
[...]
[ 2.726250] Call trace:
[ 2.728691] k3_ringacc_ring_pop+0x48/0x94
[ 2.732786] udma_ring_irq_handler+0x34/0x218
[ 2.737141] __handle_irq_event_percpu+0x60/0x14c
[ 2.741846] handle_irq_event+0x4c/0xa8
Fix this by explicitly initializing the variable to 0.
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
---
drivers/dma/ti/k3-udma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index fb21e0df5ab7b..48f4db777d924 100644
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -5484,7 +5484,7 @@ static int udma_probe(struct platform_device *pdev)
if (ud->match_data->type == DMA_TYPE_UDMA) {
ud->ringacc = of_k3_ringacc_get_by_phandle(dev->of_node, "ti,ringacc");
} else {
- struct k3_ringacc_init_data ring_init_data;
+ struct k3_ringacc_init_data ring_init_data = { 0 };
ring_init_data.tisci = ud->tisci_rm.tisci;
ring_init_data.tisci_dev_id = ud->tisci_rm.tisci_dev_id;
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 01/19] dmaengine: ti: k3-udma: Fix sporadic crash on AM62x
2026-08-10 15:13 ` [PATCH v8 01/19] dmaengine: ti: k3-udma: Fix sporadic crash on AM62x Sai Sree Kartheek Adivi
@ 2026-08-10 15:36 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-08-10 15:36 UTC (permalink / raw)
To: Sai Sree Kartheek Adivi
Cc: Frank.Li, dmaengine, vkoul, conor+dt, devicetree, robh
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:
Pre-existing issues:
- [High] The driver restricts MSI controller retrieval to the 'msi-parent' DT binding variant by directly calling `of_msi_get_domain()`, causing failures on platforms using the 'msi-map' binding.
- [High] The patch claims to fix a sporadic crash by zero-initializing `ring_init_data`, but this is a placebo fix because all fields of the struct are already explicitly initialized. The true memory corruption bug remains unaddressed.
- [High] Incorrect use of `INIT_DELAYED_WORK_ONSTACK` for a dynamically allocated work structure causes debug object memory leaks and overwrite warnings.
- [High] DMA mappings created in `udma_setup_rx_flush` are permanently leaked on probe failure.
- [High] Background work `ud->purge_work` is not canceled on probe failure, risking Use-After-Free.
--
--- Patch [1]: [PATCH v8 01/19] dmaengine: ti: k3-udma: Fix sporadic crash on AM62x ---
commit b87c41f67fa8026f26760de8230ab1ebfd627cb1
Author: Vignesh Raghavendra <vigneshr@ti.com>
dmaengine: ti: k3-udma: Fix sporadic crash on AM62x
ring_init_data is declared on stack and thus can contain garbage which
can lead to k3_ringacc_dmarings use junk address for ringrt base leading
to below crash during ring pop
[Severity: High]
This is a pre-existing issue, but does this commit message accurately
describe the root cause of the crash?
Looking at the code, all fields of k3_ringacc_init_data (tisci,
tisci_dev_id, and num_rings) are unconditionally assigned before
k3_ringacc_dmarings_init() is called. Furthermore, k3_ringacc_dmarings_init()
does not read 'ringrt base' from this struct, but fetches it via
devm_platform_ioremap_resource_byname().
Could initializing this struct with { 0 } be acting as a placebo that masks
a true memory corruption or stack buffer overflow by altering the compiler's
stack layout?
[ ... ]
> diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
> index fb21e0df5ab7b..48f4db777d924 100644
> --- a/drivers/dma/ti/k3-udma.c
> +++ b/drivers/dma/ti/k3-udma.c
> @@ -5484,7 +5484,7 @@ static int udma_probe(struct platform_device *pdev)
> if (ud->match_data->type == DMA_TYPE_UDMA) {
> ud->ringacc = of_k3_ringacc_get_by_phandle(dev->of_node, "ti,ringacc");
> } else {
> - struct k3_ringacc_init_data ring_init_data;
> + struct k3_ringacc_init_data ring_init_data = { 0 };
>
> ring_init_data.tisci = ud->tisci_rm.tisci;
> ring_init_data.tisci_dev_id = ud->tisci_rm.tisci_dev_id;
[Severity: High]
This is a pre-existing issue, but are we leaving a true root cause unaddressed
here since the struct is completely initialized immediately after this line?
[Severity: High]
This is a pre-existing issue, but does this code properly handle platforms
using the 'msi-map' DT binding variant?
drivers/dma/ti/k3-udma.c:udma_probe() {
...
dev->msi.domain = of_msi_get_domain(dev, dev->of_node, DOMAIN_BUS_TI_SCI_INTA_MSI);
...
}
Calling of_msi_get_domain() directly only iterates 'msi-parent' phandles.
Could this cause MSI allocation failures on platforms that map device IDs
using 'msi-map'?
[Severity: High]
This is a pre-existing issue, but is it safe to use INIT_DELAYED_WORK_ONSTACK()
for a work structure that is part of a dynamically allocated object?
drivers/dma/ti/k3-udma.c:bcdma_alloc_chan_resources() {
...
INIT_DELAYED_WORK_ONSTACK(&uc->tx_drain.work, udma_check_tx_completion);
...
}
The INIT_DELAYED_WORK_ONSTACK() macro is intended for stack variables and
requires a matching destroy_delayed_work_on_stack(). Since uc is heap-allocated
and destroy_delayed_work_on_stack() is never called, could this lead to debug
object memory leaks and ODEBUG overwrite warnings?
This same pattern also appears in pktdma_alloc_chan_resources().
[Severity: High]
This is a pre-existing issue, but are the DMA mappings created in
udma_setup_rx_flush() properly unmapped on probe failure paths?
drivers/dma/ti/k3-udma.c:udma_setup_rx_flush() {
...
rx_flush->buffer_paddr = dma_map_single(dev, rx_flush->buffer_vaddr,
rx_flush->buffer_size,
DMA_TO_DEVICE);
...
}
If an error occurs later in udma_setup_rx_flush(), or if udma_probe()
subsequently fails and returns an error:
drivers/dma/ti/k3-udma.c:udma_probe() {
...
return ret;
}
These DMA mappings appear to permanently leak, as they are not managed by
devres and are not unmapped before returning.
[Severity: High]
This is a pre-existing issue, but is there a risk of a use-after-free if
the device is unregistered on probe failure?
drivers/dma/ti/k3-udma.c:udma_probe() {
...
dma_async_device_unregister(&ud->ddev);
...
}
If of_dma_controller_register() fails after dma_async_device_register(),
the DMA channels are briefly exposed. If a client requests a channel and
schedules ud->purge_work before the device is unregistered, could the
asynchronous work execute on the devres-managed ud structure after it has
been freed, since cancel_work_sync(&ud->purge_work) is not called?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260810151423.1948224-1-s-adivi@ti.com?part=1
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 02/19] dmaengine: ti: k3-udma: move macros to header file
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
2026-08-10 15:13 ` [PATCH v8 01/19] dmaengine: ti: k3-udma: Fix sporadic crash on AM62x Sai Sree Kartheek Adivi
@ 2026-08-10 15:13 ` Sai Sree Kartheek Adivi
2026-08-10 15:25 ` sashiko-bot
2026-08-10 15:13 ` [PATCH v8 03/19] dmaengine: ti: k3-udma: move structs and enums " Sai Sree Kartheek Adivi
` (16 subsequent siblings)
18 siblings, 1 reply; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:13 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
Move macros defined in k3-udma.c to k3-udma.h for better separation and
reuse.
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
drivers/dma/ti/k3-udma.c | 62 ---------------------------------------
drivers/dma/ti/k3-udma.h | 63 ++++++++++++++++++++++++++++++++++++++++
2 files changed, 63 insertions(+), 62 deletions(-)
diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index 48f4db777d924..a066862e2c699 100644
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -39,21 +39,6 @@ struct udma_static_tr {
u16 bstcnt; /* RPSTR1 */
};
-#define K3_UDMA_MAX_RFLOWS 1024
-#define K3_UDMA_DEFAULT_RING_SIZE 16
-
-/* How SRC/DST tag should be updated by UDMA in the descriptor's Word 3 */
-#define UDMA_RFLOW_SRCTAG_NONE 0
-#define UDMA_RFLOW_SRCTAG_CFG_TAG 1
-#define UDMA_RFLOW_SRCTAG_FLOW_ID 2
-#define UDMA_RFLOW_SRCTAG_SRC_TAG 4
-
-#define UDMA_RFLOW_DSTTAG_NONE 0
-#define UDMA_RFLOW_DSTTAG_CFG_TAG 1
-#define UDMA_RFLOW_DSTTAG_FLOW_ID 2
-#define UDMA_RFLOW_DSTTAG_DST_TAG_LO 4
-#define UDMA_RFLOW_DSTTAG_DST_TAG_HI 5
-
struct udma_chan;
enum k3_dma_type {
@@ -118,15 +103,6 @@ struct udma_oes_offsets {
u32 pktdma_rchan_flow;
};
-#define UDMA_FLAG_PDMA_ACC32 BIT(0)
-#define UDMA_FLAG_PDMA_BURST BIT(1)
-#define UDMA_FLAG_TDTYPE BIT(2)
-#define UDMA_FLAG_BURST_SIZE BIT(3)
-#define UDMA_FLAGS_J7_CLASS (UDMA_FLAG_PDMA_ACC32 | \
- UDMA_FLAG_PDMA_BURST | \
- UDMA_FLAG_TDTYPE | \
- UDMA_FLAG_BURST_SIZE)
-
struct udma_match_data {
enum k3_dma_type type;
u32 psil_base;
@@ -1837,38 +1813,6 @@ static int udma_alloc_rx_resources(struct udma_chan *uc)
return ret;
}
-#define TISCI_BCDMA_BCHAN_VALID_PARAMS ( \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_PAUSE_ON_ERR_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_EXTENDED_CH_TYPE_VALID)
-
-#define TISCI_BCDMA_TCHAN_VALID_PARAMS ( \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_PAUSE_ON_ERR_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_TX_SUPR_TDPKT_VALID)
-
-#define TISCI_BCDMA_RCHAN_VALID_PARAMS ( \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_PAUSE_ON_ERR_VALID)
-
-#define TISCI_UDMA_TCHAN_VALID_PARAMS ( \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_PAUSE_ON_ERR_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_TX_FILT_EINFO_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_TX_FILT_PSWORDS_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_CHAN_TYPE_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_TX_SUPR_TDPKT_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_FETCH_SIZE_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_CQ_QNUM_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_ATYPE_VALID)
-
-#define TISCI_UDMA_RCHAN_VALID_PARAMS ( \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_PAUSE_ON_ERR_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_FETCH_SIZE_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_CQ_QNUM_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_CHAN_TYPE_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_RX_IGNORE_SHORT_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_RX_IGNORE_LONG_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_RX_FLOWID_START_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_RX_FLOWID_CNT_VALID | \
- TI_SCI_MSG_VALUE_RM_UDMAP_CH_ATYPE_VALID)
-
static int udma_tisci_m2m_channel_config(struct udma_chan *uc)
{
struct udma_dev *ud = uc->ud;
@@ -5398,12 +5342,6 @@ static enum dmaengine_alignment udma_get_copy_align(struct udma_dev *ud)
}
}
-#define TI_UDMAC_BUSWIDTHS (BIT(DMA_SLAVE_BUSWIDTH_1_BYTE) | \
- BIT(DMA_SLAVE_BUSWIDTH_2_BYTES) | \
- BIT(DMA_SLAVE_BUSWIDTH_3_BYTES) | \
- BIT(DMA_SLAVE_BUSWIDTH_4_BYTES) | \
- BIT(DMA_SLAVE_BUSWIDTH_8_BYTES))
-
static int udma_probe(struct platform_device *pdev)
{
struct device_node *navss_node = pdev->dev.parent->of_node;
diff --git a/drivers/dma/ti/k3-udma.h b/drivers/dma/ti/k3-udma.h
index 9062a237cd167..750720cd06911 100644
--- a/drivers/dma/ti/k3-udma.h
+++ b/drivers/dma/ti/k3-udma.h
@@ -97,6 +97,69 @@
/* Address Space Select */
#define K3_ADDRESS_ASEL_SHIFT 48
+#define K3_UDMA_MAX_RFLOWS 1024
+#define K3_UDMA_DEFAULT_RING_SIZE 16
+
+/* How SRC/DST tag should be updated by UDMA in the descriptor's Word 3 */
+#define UDMA_RFLOW_SRCTAG_NONE 0
+#define UDMA_RFLOW_SRCTAG_CFG_TAG 1
+#define UDMA_RFLOW_SRCTAG_FLOW_ID 2
+#define UDMA_RFLOW_SRCTAG_SRC_TAG 4
+
+#define UDMA_RFLOW_DSTTAG_NONE 0
+#define UDMA_RFLOW_DSTTAG_CFG_TAG 1
+#define UDMA_RFLOW_DSTTAG_FLOW_ID 2
+#define UDMA_RFLOW_DSTTAG_DST_TAG_LO 4
+#define UDMA_RFLOW_DSTTAG_DST_TAG_HI 5
+
+#define UDMA_FLAG_PDMA_ACC32 BIT(0)
+#define UDMA_FLAG_PDMA_BURST BIT(1)
+#define UDMA_FLAG_TDTYPE BIT(2)
+#define UDMA_FLAG_BURST_SIZE BIT(3)
+#define UDMA_FLAGS_J7_CLASS (UDMA_FLAG_PDMA_ACC32 | \
+ UDMA_FLAG_PDMA_BURST | \
+ UDMA_FLAG_TDTYPE | \
+ UDMA_FLAG_BURST_SIZE)
+
+#define TI_UDMAC_BUSWIDTHS (BIT(DMA_SLAVE_BUSWIDTH_1_BYTE) | \
+ BIT(DMA_SLAVE_BUSWIDTH_2_BYTES) | \
+ BIT(DMA_SLAVE_BUSWIDTH_3_BYTES) | \
+ BIT(DMA_SLAVE_BUSWIDTH_4_BYTES) | \
+ BIT(DMA_SLAVE_BUSWIDTH_8_BYTES))
+
+/* TI_SCI Params */
+#define TISCI_BCDMA_BCHAN_VALID_PARAMS ( \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_PAUSE_ON_ERR_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_EXTENDED_CH_TYPE_VALID)
+
+#define TISCI_BCDMA_TCHAN_VALID_PARAMS ( \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_PAUSE_ON_ERR_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_TX_SUPR_TDPKT_VALID)
+
+#define TISCI_BCDMA_RCHAN_VALID_PARAMS ( \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_PAUSE_ON_ERR_VALID)
+
+#define TISCI_UDMA_TCHAN_VALID_PARAMS ( \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_PAUSE_ON_ERR_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_TX_FILT_EINFO_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_TX_FILT_PSWORDS_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_CHAN_TYPE_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_TX_SUPR_TDPKT_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_FETCH_SIZE_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_CQ_QNUM_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_ATYPE_VALID)
+
+#define TISCI_UDMA_RCHAN_VALID_PARAMS ( \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_PAUSE_ON_ERR_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_FETCH_SIZE_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_CQ_QNUM_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_CHAN_TYPE_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_RX_IGNORE_SHORT_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_RX_IGNORE_LONG_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_RX_FLOWID_START_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_RX_FLOWID_CNT_VALID | \
+ TI_SCI_MSG_VALUE_RM_UDMAP_CH_ATYPE_VALID)
+
struct udma_dev;
struct udma_tchan;
struct udma_rchan;
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 02/19] dmaengine: ti: k3-udma: move macros to header file
2026-08-10 15:13 ` [PATCH v8 02/19] dmaengine: ti: k3-udma: move macros to header file Sai Sree Kartheek Adivi
@ 2026-08-10 15:25 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-08-10 15:25 UTC (permalink / raw)
To: Sai Sree Kartheek Adivi
Cc: conor+dt, robh, Frank.Li, devicetree, vkoul, dmaengine
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] Failure to handle all MSI controller DT binding variants by directly calling `of_msi_get_domain`.
--
--- Patch [2]: [PATCH v8 02/19] dmaengine: ti: k3-udma: move macros to header file ---
commit 602a5738457ed780a012151dd52a59d2064763e4
Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>
dmaengine: ti: k3-udma: move macros to header file
Move macros defined in k3-udma.c to k3-udma.h for better separation and
reuse.
> diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
> index 48f4db777d924..a066862e2c699 100644
> --- a/drivers/dma/ti/k3-udma.c
> +++ b/drivers/dma/ti/k3-udma.c
[ ... ]
> @@ -5398,12 +5342,6 @@ static enum dmaengine_alignment udma_get_copy_align(struct udma_dev *ud)
> }
> }
>
> -#define TI_UDMAC_BUSWIDTHS (BIT(DMA_SLAVE_BUSWIDTH_1_BYTE) | \
> - BIT(DMA_SLAVE_BUSWIDTH_2_BYTES) | \
> - BIT(DMA_SLAVE_BUSWIDTH_3_BYTES) | \
> - BIT(DMA_SLAVE_BUSWIDTH_4_BYTES) | \
> - BIT(DMA_SLAVE_BUSWIDTH_8_BYTES))
> -
> static int udma_probe(struct platform_device *pdev)
> {
> struct device_node *navss_node = pdev->dev.parent->of_node;
[ ... ]
dev->msi.domain = of_msi_get_domain(dev, dev->of_node,
DOMAIN_BUS_TI_SCI_INTA_MSI);
[Severity: High]
This is a pre-existing issue, but does this explicitly fail to support
msi-map bindings?
By calling of_msi_get_domain() during device probe, the driver resolves
the MSI domain solely by iterating msi-parent phandles.
Will this cause MSI allocation failures and return -EPROBE_DEFER on platforms
that rely on msi-map bindings?
if (!dev->msi.domain) {
return -EPROBE_DEFER;
}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260810151423.1948224-1-s-adivi@ti.com?part=2
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 03/19] dmaengine: ti: k3-udma: move structs and enums to header file
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
2026-08-10 15:13 ` [PATCH v8 01/19] dmaengine: ti: k3-udma: Fix sporadic crash on AM62x Sai Sree Kartheek Adivi
2026-08-10 15:13 ` [PATCH v8 02/19] dmaengine: ti: k3-udma: move macros to header file Sai Sree Kartheek Adivi
@ 2026-08-10 15:13 ` Sai Sree Kartheek Adivi
2026-08-10 15:13 ` [PATCH v8 04/19] dmaengine: ti: k3-udma: move static inline helper functions " Sai Sree Kartheek Adivi
` (15 subsequent siblings)
18 siblings, 0 replies; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:13 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
Move struct and enum definitions in k3-udma.c to k3-udma.h header file
for better separation and reuse.
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
drivers/dma/ti/k3-udma.c | 259 +-------------------------------------
drivers/dma/ti/k3-udma.h | 265 +++++++++++++++++++++++++++++++++++++++
2 files changed, 266 insertions(+), 258 deletions(-)
diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index a066862e2c699..ce706033143ad 100644
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -24,8 +24,8 @@
#include <linux/workqueue.h>
#include <linux/completion.h>
#include <linux/soc/ti/k3-ringacc.h>
-#include <linux/soc/ti/ti_sci_protocol.h>
#include <linux/soc/ti/ti_sci_inta_msi.h>
+#include <linux/soc/ti/ti_sci_protocol.h>
#include <linux/dma/k3-event-router.h>
#include <linux/dma/ti-cppi5.h>
@@ -33,28 +33,6 @@
#include "k3-udma.h"
#include "k3-psil-priv.h"
-struct udma_static_tr {
- u8 elsize; /* RPSTR0 */
- u16 elcnt; /* RPSTR0 */
- u16 bstcnt; /* RPSTR1 */
-};
-
-struct udma_chan;
-
-enum k3_dma_type {
- DMA_TYPE_UDMA = 0,
- DMA_TYPE_BCDMA,
- DMA_TYPE_PKTDMA,
-};
-
-enum udma_mmr {
- MMR_GCFG = 0,
- MMR_BCHANRT,
- MMR_RCHANRT,
- MMR_TCHANRT,
- MMR_LAST,
-};
-
static const char * const mmr_names[] = {
[MMR_GCFG] = "gcfg",
[MMR_BCHANRT] = "bchanrt",
@@ -62,234 +40,6 @@ static const char * const mmr_names[] = {
[MMR_TCHANRT] = "tchanrt",
};
-struct udma_tchan {
- void __iomem *reg_rt;
-
- int id;
- struct k3_ring *t_ring; /* Transmit ring */
- struct k3_ring *tc_ring; /* Transmit Completion ring */
- int tflow_id; /* applicable only for PKTDMA */
-
-};
-
-#define udma_bchan udma_tchan
-
-struct udma_rflow {
- int id;
- struct k3_ring *fd_ring; /* Free Descriptor ring */
- struct k3_ring *r_ring; /* Receive ring */
-};
-
-struct udma_rchan {
- void __iomem *reg_rt;
-
- int id;
-};
-
-struct udma_oes_offsets {
- /* K3 UDMA Output Event Offset */
- u32 udma_rchan;
-
- /* BCDMA Output Event Offsets */
- u32 bcdma_bchan_data;
- u32 bcdma_bchan_ring;
- u32 bcdma_tchan_data;
- u32 bcdma_tchan_ring;
- u32 bcdma_rchan_data;
- u32 bcdma_rchan_ring;
-
- /* PKTDMA Output Event Offsets */
- u32 pktdma_tchan_flow;
- u32 pktdma_rchan_flow;
-};
-
-struct udma_match_data {
- enum k3_dma_type type;
- u32 psil_base;
- bool enable_memcpy_support;
- u32 flags;
- u32 statictr_z_mask;
- u8 burst_size[3];
- struct udma_soc_data *soc_data;
-};
-
-struct udma_soc_data {
- struct udma_oes_offsets oes;
- u32 bcdma_trigger_event_offset;
-};
-
-struct udma_hwdesc {
- size_t cppi5_desc_size;
- void *cppi5_desc_vaddr;
- dma_addr_t cppi5_desc_paddr;
-
- /* TR descriptor internal pointers */
- void *tr_req_base;
- struct cppi5_tr_resp_t *tr_resp_base;
-};
-
-struct udma_rx_flush {
- struct udma_hwdesc hwdescs[2];
-
- size_t buffer_size;
- void *buffer_vaddr;
- dma_addr_t buffer_paddr;
-};
-
-struct udma_tpl {
- u8 levels;
- u32 start_idx[3];
-};
-
-struct udma_dev {
- struct dma_device ddev;
- struct device *dev;
- void __iomem *mmrs[MMR_LAST];
- const struct udma_match_data *match_data;
- const struct udma_soc_data *soc_data;
-
- struct udma_tpl bchan_tpl;
- struct udma_tpl tchan_tpl;
- struct udma_tpl rchan_tpl;
-
- size_t desc_align; /* alignment to use for descriptors */
-
- struct udma_tisci_rm tisci_rm;
-
- struct k3_ringacc *ringacc;
-
- struct work_struct purge_work;
- struct list_head desc_to_purge;
- spinlock_t lock;
-
- struct udma_rx_flush rx_flush;
-
- int bchan_cnt;
- int tchan_cnt;
- int echan_cnt;
- int rchan_cnt;
- int rflow_cnt;
- int tflow_cnt;
- unsigned long *bchan_map;
- unsigned long *tchan_map;
- unsigned long *rchan_map;
- unsigned long *rflow_gp_map;
- unsigned long *rflow_gp_map_allocated;
- unsigned long *rflow_in_use;
- unsigned long *tflow_map;
-
- struct udma_bchan *bchans;
- struct udma_tchan *tchans;
- struct udma_rchan *rchans;
- struct udma_rflow *rflows;
-
- struct udma_chan *channels;
- u32 psil_base;
- u32 atype;
- u32 asel;
-};
-
-struct udma_desc {
- struct virt_dma_desc vd;
-
- bool terminated;
-
- enum dma_transfer_direction dir;
-
- struct udma_static_tr static_tr;
- u32 residue;
-
- unsigned int sglen;
- unsigned int desc_idx; /* Only used for cyclic in packet mode */
- unsigned int tr_idx;
-
- u32 metadata_size;
- void *metadata; /* pointer to provided metadata buffer (EPIP, PSdata) */
-
- unsigned int hwdesc_count;
- struct udma_hwdesc hwdesc[];
-};
-
-enum udma_chan_state {
- UDMA_CHAN_IS_IDLE = 0, /* not active, no teardown is in progress */
- UDMA_CHAN_IS_ACTIVE, /* Normal operation */
- UDMA_CHAN_IS_TERMINATING, /* channel is being terminated */
-};
-
-struct udma_tx_drain {
- struct delayed_work work;
- ktime_t tstamp;
- u32 residue;
-};
-
-struct udma_chan_config {
- bool pkt_mode; /* TR or packet */
- bool needs_epib; /* EPIB is needed for the communication or not */
- u32 psd_size; /* size of Protocol Specific Data */
- u32 metadata_size; /* (needs_epib ? 16:0) + psd_size */
- u32 hdesc_size; /* Size of a packet descriptor in packet mode */
- bool notdpkt; /* Suppress sending TDC packet */
- int remote_thread_id;
- u32 atype;
- u32 asel;
- u32 src_thread;
- u32 dst_thread;
- enum psil_endpoint_type ep_type;
- bool enable_acc32;
- bool enable_burst;
- enum udma_tp_level channel_tpl; /* Channel Throughput Level */
-
- u32 tr_trigger_type;
- unsigned long tx_flags;
-
- /* PKDMA mapped channel */
- int mapped_channel_id;
- /* PKTDMA default tflow or rflow for mapped channel */
- int default_flow_id;
-
- enum dma_transfer_direction dir;
-};
-
-struct udma_chan {
- struct virt_dma_chan vc;
- struct dma_slave_config cfg;
- struct udma_dev *ud;
- struct device *dma_dev;
- struct udma_desc *desc;
- struct udma_desc *terminated_desc;
- struct udma_static_tr static_tr;
- char *name;
-
- struct udma_bchan *bchan;
- struct udma_tchan *tchan;
- struct udma_rchan *rchan;
- struct udma_rflow *rflow;
-
- bool psil_paired;
-
- int irq_num_ring;
- int irq_num_udma;
-
- bool cyclic;
- bool paused;
-
- enum udma_chan_state state;
- struct completion teardown_completed;
-
- struct udma_tx_drain tx_drain;
-
- /* Channel configuration parameters */
- struct udma_chan_config config;
- /* Channel configuration parameters (backup) */
- struct udma_chan_config backup_config;
-
- /* dmapool for packet mode descriptors */
- bool use_dma_pool;
- struct dma_pool *hdesc_pool;
-
- u32 id;
-};
-
static inline struct udma_dev *to_udma_dev(struct dma_device *d)
{
return container_of(d, struct udma_dev, ddev);
@@ -4073,13 +3823,6 @@ static struct platform_driver udma_driver;
static struct platform_driver bcdma_driver;
static struct platform_driver pktdma_driver;
-struct udma_filter_param {
- int remote_thread_id;
- u32 atype;
- u32 asel;
- u32 tr_trigger_type;
-};
-
static bool udma_dma_filter_fn(struct dma_chan *chan, void *param)
{
struct udma_chan_config *ucc;
diff --git a/drivers/dma/ti/k3-udma.h b/drivers/dma/ti/k3-udma.h
index 750720cd06911..11d08adb0d69f 100644
--- a/drivers/dma/ti/k3-udma.h
+++ b/drivers/dma/ti/k3-udma.h
@@ -6,7 +6,16 @@
#ifndef K3_UDMA_H_
#define K3_UDMA_H_
+#include <linux/dmaengine.h>
#include <linux/soc/ti/ti_sci_protocol.h>
+#include <linux/dma/ti-cppi5.h>
+#include <linux/completion.h>
+#include <linux/workqueue.h>
+#include <linux/spinlock.h>
+#include <linux/ktime.h>
+
+#include "../virt-dma.h"
+#include "k3-psil-priv.h"
/* Global registers */
#define UDMA_REV_REG 0x0
@@ -164,6 +173,7 @@ struct udma_dev;
struct udma_tchan;
struct udma_rchan;
struct udma_rflow;
+struct udma_chan;
enum udma_rm_range {
RM_RANGE_BCHAN = 0,
@@ -186,6 +196,261 @@ struct udma_tisci_rm {
struct ti_sci_resource *rm_ranges[RM_RANGE_LAST];
};
+struct udma_static_tr {
+ u8 elsize; /* RPSTR0 */
+ u16 elcnt; /* RPSTR0 */
+ u16 bstcnt; /* RPSTR1 */
+};
+
+enum k3_dma_type {
+ DMA_TYPE_UDMA = 0,
+ DMA_TYPE_BCDMA,
+ DMA_TYPE_PKTDMA,
+};
+
+enum udma_mmr {
+ MMR_GCFG = 0,
+ MMR_BCHANRT,
+ MMR_RCHANRT,
+ MMR_TCHANRT,
+ MMR_LAST,
+};
+
+struct udma_filter_param {
+ int remote_thread_id;
+ u32 atype;
+ u32 asel;
+ u32 tr_trigger_type;
+};
+
+struct udma_tchan {
+ void __iomem *reg_rt;
+
+ int id;
+ struct k3_ring *t_ring; /* Transmit ring */
+ struct k3_ring *tc_ring; /* Transmit Completion ring */
+ int tflow_id; /* applicable only for PKTDMA */
+
+};
+
+#define udma_bchan udma_tchan
+
+struct udma_rflow {
+ int id;
+ struct k3_ring *fd_ring; /* Free Descriptor ring */
+ struct k3_ring *r_ring; /* Receive ring */
+};
+
+struct udma_rchan {
+ void __iomem *reg_rt;
+
+ int id;
+};
+
+struct udma_oes_offsets {
+ /* K3 UDMA Output Event Offset */
+ u32 udma_rchan;
+
+ /* BCDMA Output Event Offsets */
+ u32 bcdma_bchan_data;
+ u32 bcdma_bchan_ring;
+ u32 bcdma_tchan_data;
+ u32 bcdma_tchan_ring;
+ u32 bcdma_rchan_data;
+ u32 bcdma_rchan_ring;
+
+ /* PKTDMA Output Event Offsets */
+ u32 pktdma_tchan_flow;
+ u32 pktdma_rchan_flow;
+};
+
+struct udma_match_data {
+ enum k3_dma_type type;
+ u32 psil_base;
+ bool enable_memcpy_support;
+ u32 flags;
+ u32 statictr_z_mask;
+ u8 burst_size[3];
+ struct udma_soc_data *soc_data;
+};
+
+struct udma_soc_data {
+ struct udma_oes_offsets oes;
+ u32 bcdma_trigger_event_offset;
+};
+
+struct udma_hwdesc {
+ size_t cppi5_desc_size;
+ void *cppi5_desc_vaddr;
+ dma_addr_t cppi5_desc_paddr;
+
+ /* TR descriptor internal pointers */
+ void *tr_req_base;
+ struct cppi5_tr_resp_t *tr_resp_base;
+};
+
+struct udma_rx_flush {
+ struct udma_hwdesc hwdescs[2];
+
+ size_t buffer_size;
+ void *buffer_vaddr;
+ dma_addr_t buffer_paddr;
+};
+
+struct udma_tpl {
+ u8 levels;
+ u32 start_idx[3];
+};
+
+struct udma_dev {
+ struct dma_device ddev;
+ struct device *dev;
+ void __iomem *mmrs[MMR_LAST];
+ const struct udma_match_data *match_data;
+ const struct udma_soc_data *soc_data;
+
+ struct udma_tpl bchan_tpl;
+ struct udma_tpl tchan_tpl;
+ struct udma_tpl rchan_tpl;
+
+ size_t desc_align; /* alignment to use for descriptors */
+
+ struct udma_tisci_rm tisci_rm;
+
+ struct k3_ringacc *ringacc;
+
+ struct work_struct purge_work;
+ struct list_head desc_to_purge;
+ spinlock_t lock;
+
+ struct udma_rx_flush rx_flush;
+
+ int bchan_cnt;
+ int tchan_cnt;
+ int echan_cnt;
+ int rchan_cnt;
+ int rflow_cnt;
+ int tflow_cnt;
+ unsigned long *bchan_map;
+ unsigned long *tchan_map;
+ unsigned long *rchan_map;
+ unsigned long *rflow_gp_map;
+ unsigned long *rflow_gp_map_allocated;
+ unsigned long *rflow_in_use;
+ unsigned long *tflow_map;
+
+ struct udma_bchan *bchans;
+ struct udma_tchan *tchans;
+ struct udma_rchan *rchans;
+ struct udma_rflow *rflows;
+
+ struct udma_chan *channels;
+ u32 psil_base;
+ u32 atype;
+ u32 asel;
+};
+
+struct udma_desc {
+ struct virt_dma_desc vd;
+
+ bool terminated;
+
+ enum dma_transfer_direction dir;
+
+ struct udma_static_tr static_tr;
+ u32 residue;
+
+ unsigned int sglen;
+ unsigned int desc_idx; /* Only used for cyclic in packet mode */
+ unsigned int tr_idx;
+
+ u32 metadata_size;
+ void *metadata; /* pointer to provided metadata buffer (EPIP, PSdata) */
+
+ unsigned int hwdesc_count;
+ struct udma_hwdesc hwdesc[];
+};
+
+enum udma_chan_state {
+ UDMA_CHAN_IS_IDLE = 0, /* not active, no teardown is in progress */
+ UDMA_CHAN_IS_ACTIVE, /* Normal operation */
+ UDMA_CHAN_IS_TERMINATING, /* channel is being terminated */
+};
+
+struct udma_tx_drain {
+ struct delayed_work work;
+ ktime_t tstamp;
+ u32 residue;
+};
+
+struct udma_chan_config {
+ bool pkt_mode; /* TR or packet */
+ bool needs_epib; /* EPIB is needed for the communication or not */
+ u32 psd_size; /* size of Protocol Specific Data */
+ u32 metadata_size; /* (needs_epib ? 16:0) + psd_size */
+ u32 hdesc_size; /* Size of a packet descriptor in packet mode */
+ bool notdpkt; /* Suppress sending TDC packet */
+ int remote_thread_id;
+ u32 atype;
+ u32 asel;
+ u32 src_thread;
+ u32 dst_thread;
+ enum psil_endpoint_type ep_type;
+ bool enable_acc32;
+ bool enable_burst;
+ enum udma_tp_level channel_tpl; /* Channel Throughput Level */
+
+ u32 tr_trigger_type;
+ unsigned long tx_flags;
+
+ /* PKDMA mapped channel */
+ int mapped_channel_id;
+ /* PKTDMA default tflow or rflow for mapped channel */
+ int default_flow_id;
+
+ enum dma_transfer_direction dir;
+};
+
+struct udma_chan {
+ struct virt_dma_chan vc;
+ struct dma_slave_config cfg;
+ struct udma_dev *ud;
+ struct device *dma_dev;
+ struct udma_desc *desc;
+ struct udma_desc *terminated_desc;
+ struct udma_static_tr static_tr;
+ char *name;
+
+ struct udma_bchan *bchan;
+ struct udma_tchan *tchan;
+ struct udma_rchan *rchan;
+ struct udma_rflow *rflow;
+
+ bool psil_paired;
+
+ int irq_num_ring;
+ int irq_num_udma;
+
+ bool cyclic;
+ bool paused;
+
+ enum udma_chan_state state;
+ struct completion teardown_completed;
+
+ struct udma_tx_drain tx_drain;
+
+ /* Channel configuration parameters */
+ struct udma_chan_config config;
+ /* Channel configuration parameters (backup) */
+ struct udma_chan_config backup_config;
+
+ /* dmapool for packet mode descriptors */
+ bool use_dma_pool;
+ struct dma_pool *hdesc_pool;
+
+ u32 id;
+};
+
/* Direct access to UDMA low lever resources for the glue layer */
int xudma_navss_psil_pair(struct udma_dev *ud, u32 src_thread, u32 dst_thread);
int xudma_navss_psil_unpair(struct udma_dev *ud, u32 src_thread,
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v8 04/19] dmaengine: ti: k3-udma: move static inline helper functions to header file
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
` (2 preceding siblings ...)
2026-08-10 15:13 ` [PATCH v8 03/19] dmaengine: ti: k3-udma: move structs and enums " Sai Sree Kartheek Adivi
@ 2026-08-10 15:13 ` Sai Sree Kartheek Adivi
2026-08-10 15:13 ` [PATCH v8 05/19] dmaengine: ti: k3-udma: move descriptor management to k3-udma-common.c Sai Sree Kartheek Adivi
` (14 subsequent siblings)
18 siblings, 0 replies; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:13 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
Move static inline helper functions in k3-udma.c to k3-udma.h header
file for better separation and reuse.
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
drivers/dma/ti/k3-udma.c | 108 --------------------------------------
drivers/dma/ti/k3-udma.h | 109 +++++++++++++++++++++++++++++++++++++++
2 files changed, 109 insertions(+), 108 deletions(-)
diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index ce706033143ad..0eaa06b7ae988 100644
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -40,91 +40,6 @@ static const char * const mmr_names[] = {
[MMR_TCHANRT] = "tchanrt",
};
-static inline struct udma_dev *to_udma_dev(struct dma_device *d)
-{
- return container_of(d, struct udma_dev, ddev);
-}
-
-static inline struct udma_chan *to_udma_chan(struct dma_chan *c)
-{
- return container_of(c, struct udma_chan, vc.chan);
-}
-
-static inline struct udma_desc *to_udma_desc(struct dma_async_tx_descriptor *t)
-{
- return container_of(t, struct udma_desc, vd.tx);
-}
-
-/* Generic register access functions */
-static inline u32 udma_read(void __iomem *base, int reg)
-{
- return readl(base + reg);
-}
-
-static inline void udma_write(void __iomem *base, int reg, u32 val)
-{
- writel(val, base + reg);
-}
-
-static inline void udma_update_bits(void __iomem *base, int reg,
- u32 mask, u32 val)
-{
- u32 tmp, orig;
-
- orig = readl(base + reg);
- tmp = orig & ~mask;
- tmp |= (val & mask);
-
- if (tmp != orig)
- writel(tmp, base + reg);
-}
-
-/* TCHANRT */
-static inline u32 udma_tchanrt_read(struct udma_chan *uc, int reg)
-{
- if (!uc->tchan)
- return 0;
- return udma_read(uc->tchan->reg_rt, reg);
-}
-
-static inline void udma_tchanrt_write(struct udma_chan *uc, int reg, u32 val)
-{
- if (!uc->tchan)
- return;
- udma_write(uc->tchan->reg_rt, reg, val);
-}
-
-static inline void udma_tchanrt_update_bits(struct udma_chan *uc, int reg,
- u32 mask, u32 val)
-{
- if (!uc->tchan)
- return;
- udma_update_bits(uc->tchan->reg_rt, reg, mask, val);
-}
-
-/* RCHANRT */
-static inline u32 udma_rchanrt_read(struct udma_chan *uc, int reg)
-{
- if (!uc->rchan)
- return 0;
- return udma_read(uc->rchan->reg_rt, reg);
-}
-
-static inline void udma_rchanrt_write(struct udma_chan *uc, int reg, u32 val)
-{
- if (!uc->rchan)
- return;
- udma_write(uc->rchan->reg_rt, reg, val);
-}
-
-static inline void udma_rchanrt_update_bits(struct udma_chan *uc, int reg,
- u32 mask, u32 val)
-{
- if (!uc->rchan)
- return;
- udma_update_bits(uc->rchan->reg_rt, reg, mask, val);
-}
-
static int navss_psil_pair(struct udma_dev *ud, u32 src_thread, u32 dst_thread)
{
struct udma_tisci_rm *tisci_rm = &ud->tisci_rm;
@@ -216,17 +131,6 @@ static void udma_dump_chan_stdata(struct udma_chan *uc)
}
}
-static inline dma_addr_t udma_curr_cppi5_desc_paddr(struct udma_desc *d,
- int idx)
-{
- return d->hwdesc[idx].cppi5_desc_paddr;
-}
-
-static inline void *udma_curr_cppi5_desc_vaddr(struct udma_desc *d, int idx)
-{
- return d->hwdesc[idx].cppi5_desc_vaddr;
-}
-
static struct udma_desc *udma_udma_desc_from_paddr(struct udma_chan *uc,
dma_addr_t paddr)
{
@@ -369,11 +273,6 @@ static bool udma_is_chan_paused(struct udma_chan *uc)
return false;
}
-static inline dma_addr_t udma_get_rx_flush_hwdesc_paddr(struct udma_chan *uc)
-{
- return uc->ud->rx_flush.hwdescs[uc->config.pkt_mode].cppi5_desc_paddr;
-}
-
static int udma_push_to_ring(struct udma_chan *uc, int idx)
{
struct udma_desc *d = uc->desc;
@@ -775,13 +674,6 @@ static void udma_cyclic_packet_elapsed(struct udma_chan *uc)
d->desc_idx = (d->desc_idx + 1) % d->sglen;
}
-static inline void udma_fetch_epib(struct udma_chan *uc, struct udma_desc *d)
-{
- struct cppi5_host_desc_t *h_desc = d->hwdesc[0].cppi5_desc_vaddr;
-
- memcpy(d->metadata, h_desc->epib, d->metadata_size);
-}
-
static bool udma_is_desc_really_done(struct udma_chan *uc, struct udma_desc *d)
{
u32 peer_bcnt, bcnt;
diff --git a/drivers/dma/ti/k3-udma.h b/drivers/dma/ti/k3-udma.h
index 11d08adb0d69f..54e1757c3de38 100644
--- a/drivers/dma/ti/k3-udma.h
+++ b/drivers/dma/ti/k3-udma.h
@@ -451,6 +451,115 @@ struct udma_chan {
u32 id;
};
+/* K3 UDMA helper functions */
+static inline struct udma_dev *to_udma_dev(struct dma_device *d)
+{
+ return container_of(d, struct udma_dev, ddev);
+}
+
+static inline struct udma_chan *to_udma_chan(struct dma_chan *c)
+{
+ return container_of(c, struct udma_chan, vc.chan);
+}
+
+static inline struct udma_desc *to_udma_desc(struct dma_async_tx_descriptor *t)
+{
+ return container_of(t, struct udma_desc, vd.tx);
+}
+
+/* Generic register access functions */
+static inline u32 udma_read(void __iomem *base, int reg)
+{
+ return readl(base + reg);
+}
+
+static inline void udma_write(void __iomem *base, int reg, u32 val)
+{
+ writel(val, base + reg);
+}
+
+static inline void udma_update_bits(void __iomem *base, int reg,
+ u32 mask, u32 val)
+{
+ u32 tmp, orig;
+
+ orig = readl(base + reg);
+ tmp = orig & ~mask;
+ tmp |= (val & mask);
+
+ if (tmp != orig)
+ writel(tmp, base + reg);
+}
+
+/* TCHANRT */
+static inline u32 udma_tchanrt_read(struct udma_chan *uc, int reg)
+{
+ if (!uc->tchan)
+ return 0;
+ return udma_read(uc->tchan->reg_rt, reg);
+}
+
+static inline void udma_tchanrt_write(struct udma_chan *uc, int reg, u32 val)
+{
+ if (!uc->tchan)
+ return;
+ udma_write(uc->tchan->reg_rt, reg, val);
+}
+
+static inline void udma_tchanrt_update_bits(struct udma_chan *uc, int reg,
+ u32 mask, u32 val)
+{
+ if (!uc->tchan)
+ return;
+ udma_update_bits(uc->tchan->reg_rt, reg, mask, val);
+}
+
+/* RCHANRT */
+static inline u32 udma_rchanrt_read(struct udma_chan *uc, int reg)
+{
+ if (!uc->rchan)
+ return 0;
+ return udma_read(uc->rchan->reg_rt, reg);
+}
+
+static inline void udma_rchanrt_write(struct udma_chan *uc, int reg, u32 val)
+{
+ if (!uc->rchan)
+ return;
+ udma_write(uc->rchan->reg_rt, reg, val);
+}
+
+static inline void udma_rchanrt_update_bits(struct udma_chan *uc, int reg,
+ u32 mask, u32 val)
+{
+ if (!uc->rchan)
+ return;
+ udma_update_bits(uc->rchan->reg_rt, reg, mask, val);
+}
+
+static inline dma_addr_t udma_curr_cppi5_desc_paddr(struct udma_desc *d,
+ int idx)
+{
+ return d->hwdesc[idx].cppi5_desc_paddr;
+}
+
+static inline void *udma_curr_cppi5_desc_vaddr(struct udma_desc *d, int idx)
+{
+ return d->hwdesc[idx].cppi5_desc_vaddr;
+}
+
+static inline dma_addr_t udma_get_rx_flush_hwdesc_paddr(struct udma_chan *uc)
+{
+ return uc->ud->rx_flush.hwdescs[uc->config.pkt_mode].cppi5_desc_paddr;
+}
+
+static inline void udma_fetch_epib(struct udma_chan *uc, struct udma_desc *d)
+{
+ struct cppi5_host_desc_t *h_desc = d->hwdesc[0].cppi5_desc_vaddr;
+
+ memcpy(d->metadata, h_desc->epib, d->metadata_size);
+}
+
/* Direct access to UDMA low lever resources for the glue layer */
int xudma_navss_psil_pair(struct udma_dev *ud, u32 src_thread, u32 dst_thread);
int xudma_navss_psil_unpair(struct udma_dev *ud, u32 src_thread,
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v8 05/19] dmaengine: ti: k3-udma: move descriptor management to k3-udma-common.c
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
` (3 preceding siblings ...)
2026-08-10 15:13 ` [PATCH v8 04/19] dmaengine: ti: k3-udma: move static inline helper functions " Sai Sree Kartheek Adivi
@ 2026-08-10 15:13 ` Sai Sree Kartheek Adivi
2026-08-10 15:56 ` sashiko-bot
2026-08-10 15:14 ` [PATCH v8 06/19] dmaengine: ti: k3-udma: move ring management functions " Sai Sree Kartheek Adivi
` (13 subsequent siblings)
18 siblings, 1 reply; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:13 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
Refactor the K3 UDMA driver by moving all DMA descriptor handling
functions from k3-udma.c to a new common library, k3-udma-common.c.
This prepares the driver for supporting new K3 UDMA v2 variant
(used in AM62L) that can reuse the same descriptor handling logic.
To ensure this common code works correctly across all build
configurations (built-in vs modules), introduce a hidden Kconfig symbol:
CONFIG_TI_K3_UDMA_COMMON.
No functional changes intended.
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
drivers/dma/ti/Kconfig | 5 +
drivers/dma/ti/Makefile | 1 +
drivers/dma/ti/k3-udma-common.c | 1243 +++++++++++++++++++++++++++++++
drivers/dma/ti/k3-udma.c | 1218 ------------------------------
drivers/dma/ti/k3-udma.h | 54 ++
5 files changed, 1303 insertions(+), 1218 deletions(-)
create mode 100644 drivers/dma/ti/k3-udma-common.c
diff --git a/drivers/dma/ti/Kconfig b/drivers/dma/ti/Kconfig
index cbc30ab627832..712e456015459 100644
--- a/drivers/dma/ti/Kconfig
+++ b/drivers/dma/ti/Kconfig
@@ -42,12 +42,17 @@ config TI_K3_UDMA
select DMA_ENGINE
select DMA_VIRTUAL_CHANNELS
select SOC_TI
+ select TI_K3_UDMA_COMMON
select TI_K3_RINGACC
select TI_K3_PSIL
help
Enable support for the TI UDMA (Unified DMA) controller. This
DMA engine is used in AM65x and j721e.
+config TI_K3_UDMA_COMMON
+ tristate
+ default n
+
config TI_K3_UDMA_GLUE_LAYER
tristate "Texas Instruments UDMA Glue layer for non DMAengine users"
depends on ARCH_K3 || COMPILE_TEST
diff --git a/drivers/dma/ti/Makefile b/drivers/dma/ti/Makefile
index d376c117cecf6..3b91c02e55eaf 100644
--- a/drivers/dma/ti/Makefile
+++ b/drivers/dma/ti/Makefile
@@ -3,6 +3,7 @@ obj-$(CONFIG_TI_CPPI41) += cppi41.o
obj-$(CONFIG_TI_EDMA) += edma.o
obj-$(CONFIG_DMA_OMAP) += omap-dma.o
obj-$(CONFIG_TI_K3_UDMA) += k3-udma.o
+obj-$(CONFIG_TI_K3_UDMA_COMMON) += k3-udma-common.o
obj-$(CONFIG_TI_K3_UDMA_GLUE_LAYER) += k3-udma-glue.o
k3-psil-lib-objs := k3-psil.o \
k3-psil-am654.o \
diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
new file mode 100644
index 0000000000000..3130805a8ec40
--- /dev/null
+++ b/drivers/dma/ti/k3-udma-common.c
@@ -0,0 +1,1243 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2025 Texas Instruments Incorporated - http://www.ti.com
+ * Author: Peter Ujfalusi <peter.ujfalusi@ti.com>
+ */
+
+#include <linux/dmaengine.h>
+#include <linux/dma-mapping.h>
+#include <linux/dmapool.h>
+#include <linux/platform_device.h>
+#include <linux/soc/ti/k3-ringacc.h>
+
+#include "k3-udma.h"
+
+static const struct dma_descriptor_metadata_ops metadata_ops = {
+ .attach = udma_attach_metadata,
+ .get_ptr = udma_get_metadata_ptr,
+ .set_len = udma_set_metadata_len,
+};
+
+struct udma_desc *udma_udma_desc_from_paddr(struct udma_chan *uc,
+ dma_addr_t paddr)
+{
+ struct udma_desc *d = uc->terminated_desc;
+
+ if (d) {
+ dma_addr_t desc_paddr = udma_curr_cppi5_desc_paddr(d,
+ d->desc_idx);
+
+ if (desc_paddr != paddr)
+ d = NULL;
+ }
+
+ if (!d) {
+ d = uc->desc;
+ if (d) {
+ dma_addr_t desc_paddr = udma_curr_cppi5_desc_paddr(d,
+ d->desc_idx);
+
+ if (desc_paddr != paddr)
+ d = NULL;
+ }
+ }
+
+ return d;
+}
+EXPORT_SYMBOL_GPL(udma_udma_desc_from_paddr);
+
+void udma_free_hwdesc(struct udma_chan *uc, struct udma_desc *d)
+{
+ if (uc->use_dma_pool) {
+ int i;
+
+ for (i = 0; i < d->hwdesc_count; i++) {
+ if (!d->hwdesc[i].cppi5_desc_vaddr)
+ continue;
+
+ dma_pool_free(uc->hdesc_pool,
+ d->hwdesc[i].cppi5_desc_vaddr,
+ d->hwdesc[i].cppi5_desc_paddr);
+
+ d->hwdesc[i].cppi5_desc_vaddr = NULL;
+ }
+ } else if (d->hwdesc[0].cppi5_desc_vaddr) {
+ dma_free_coherent(uc->dma_dev, d->hwdesc[0].cppi5_desc_size,
+ d->hwdesc[0].cppi5_desc_vaddr,
+ d->hwdesc[0].cppi5_desc_paddr);
+
+ d->hwdesc[0].cppi5_desc_vaddr = NULL;
+ }
+}
+
+void udma_purge_desc_work(struct work_struct *work)
+{
+ struct udma_dev *ud = container_of(work, typeof(*ud), purge_work);
+ struct virt_dma_desc *vd, *_vd;
+ unsigned long flags;
+ LIST_HEAD(head);
+
+ spin_lock_irqsave(&ud->lock, flags);
+ list_splice_tail_init(&ud->desc_to_purge, &head);
+ spin_unlock_irqrestore(&ud->lock, flags);
+
+ list_for_each_entry_safe(vd, _vd, &head, node) {
+ struct udma_chan *uc = to_udma_chan(vd->tx.chan);
+ struct udma_desc *d = to_udma_desc(&vd->tx);
+
+ udma_free_hwdesc(uc, d);
+ list_del(&vd->node);
+ kfree(d);
+ }
+
+ /* If more to purge, schedule the work again */
+ if (!list_empty(&ud->desc_to_purge))
+ schedule_work(&ud->purge_work);
+}
+EXPORT_SYMBOL_GPL(udma_purge_desc_work);
+
+void udma_desc_free(struct virt_dma_desc *vd)
+{
+ struct udma_dev *ud = to_udma_dev(vd->tx.chan->device);
+ struct udma_chan *uc = to_udma_chan(vd->tx.chan);
+ struct udma_desc *d = to_udma_desc(&vd->tx);
+ unsigned long flags;
+
+ if (uc->terminated_desc == d)
+ uc->terminated_desc = NULL;
+
+ if (uc->use_dma_pool) {
+ udma_free_hwdesc(uc, d);
+ kfree(d);
+ return;
+ }
+
+ spin_lock_irqsave(&ud->lock, flags);
+ list_add_tail(&vd->node, &ud->desc_to_purge);
+ spin_unlock_irqrestore(&ud->lock, flags);
+
+ schedule_work(&ud->purge_work);
+}
+EXPORT_SYMBOL_GPL(udma_desc_free);
+
+bool udma_desc_is_rx_flush(struct udma_chan *uc, dma_addr_t addr)
+{
+ if (uc->config.dir != DMA_DEV_TO_MEM)
+ return false;
+
+ if (addr == udma_get_rx_flush_hwdesc_paddr(uc))
+ return true;
+
+ return false;
+}
+EXPORT_SYMBOL_GPL(udma_desc_is_rx_flush);
+
+bool udma_is_desc_really_done(struct udma_chan *uc, struct udma_desc *d)
+{
+ u32 peer_bcnt, bcnt;
+
+ /*
+ * Only TX towards PDMA is affected.
+ * If DMA_PREP_INTERRUPT is not set by consumer then skip the transfer
+ * completion calculation, consumer must ensure that there is no stale
+ * data in DMA fabric in this case.
+ */
+ if (uc->config.ep_type == PSIL_EP_NATIVE ||
+ uc->config.dir != DMA_MEM_TO_DEV || !(uc->config.tx_flags & DMA_PREP_INTERRUPT))
+ return true;
+
+ peer_bcnt = udma_tchanrt_read(uc, UDMA_CHAN_RT_PEER_BCNT_REG);
+ bcnt = udma_tchanrt_read(uc, UDMA_CHAN_RT_BCNT_REG);
+
+ /* Transfer is incomplete, store current residue and time stamp */
+ if (peer_bcnt < bcnt) {
+ uc->tx_drain.residue = bcnt - peer_bcnt;
+ uc->tx_drain.tstamp = ktime_get();
+ return false;
+ }
+
+ return true;
+}
+EXPORT_SYMBOL_GPL(udma_is_desc_really_done);
+
+struct udma_desc *udma_alloc_tr_desc(struct udma_chan *uc,
+ size_t tr_size, int tr_count,
+ enum dma_transfer_direction dir)
+{
+ struct udma_hwdesc *hwdesc;
+ struct cppi5_desc_hdr_t *tr_desc;
+ struct udma_desc *d;
+ u32 reload_count = 0;
+ u32 ring_id;
+
+ switch (tr_size) {
+ case 16:
+ case 32:
+ case 64:
+ case 128:
+ break;
+ default:
+ dev_err(uc->ud->dev, "Unsupported TR size of %zu\n", tr_size);
+ return NULL;
+ }
+
+ /* We have only one descriptor containing multiple TRs */
+ d = kzalloc(sizeof(*d) + sizeof(d->hwdesc[0]), GFP_NOWAIT);
+ if (!d)
+ return NULL;
+
+ d->sglen = tr_count;
+
+ d->hwdesc_count = 1;
+ hwdesc = &d->hwdesc[0];
+
+ /* Allocate memory for DMA ring descriptor */
+ if (uc->use_dma_pool) {
+ hwdesc->cppi5_desc_size = uc->config.hdesc_size;
+ hwdesc->cppi5_desc_vaddr = dma_pool_zalloc(uc->hdesc_pool,
+ GFP_NOWAIT,
+ &hwdesc->cppi5_desc_paddr);
+ } else {
+ hwdesc->cppi5_desc_size = cppi5_trdesc_calc_size(tr_size,
+ tr_count);
+ hwdesc->cppi5_desc_size = ALIGN(hwdesc->cppi5_desc_size,
+ uc->ud->desc_align);
+ hwdesc->cppi5_desc_vaddr = dma_alloc_coherent(uc->ud->dev,
+ hwdesc->cppi5_desc_size,
+ &hwdesc->cppi5_desc_paddr,
+ GFP_NOWAIT);
+ }
+
+ if (!hwdesc->cppi5_desc_vaddr) {
+ kfree(d);
+ return NULL;
+ }
+
+ /* Start of the TR req records */
+ hwdesc->tr_req_base = hwdesc->cppi5_desc_vaddr + tr_size;
+ /* Start address of the TR response array */
+ hwdesc->tr_resp_base = hwdesc->tr_req_base + tr_size * tr_count;
+
+ tr_desc = hwdesc->cppi5_desc_vaddr;
+
+ if (uc->cyclic)
+ reload_count = CPPI5_INFO0_TRDESC_RLDCNT_INFINITE;
+
+ if (dir == DMA_DEV_TO_MEM)
+ ring_id = k3_ringacc_get_ring_id(uc->rflow->r_ring);
+ else
+ ring_id = k3_ringacc_get_ring_id(uc->tchan->tc_ring);
+
+ cppi5_trdesc_init(tr_desc, tr_count, tr_size, 0, reload_count);
+ cppi5_desc_set_pktids(tr_desc, uc->id,
+ CPPI5_INFO1_DESC_FLOWID_DEFAULT);
+ cppi5_desc_set_retpolicy(tr_desc, 0, ring_id);
+
+ return d;
+}
+
+/**
+ * udma_get_tr_counters - calculate TR counters for a given length
+ * @len: Length of the transfer
+ * @align_to: Preferred alignment
+ * @tr0_cnt0: First TR icnt0
+ * @tr0_cnt1: First TR icnt1
+ * @tr1_cnt0: Second (if used) TR icnt0
+ *
+ * For len < SZ_64K only one TR is enough, tr1_cnt0 is not updated
+ * For len >= SZ_64K two TRs are used in a simple way:
+ * First TR: SZ_64K-alignment blocks (tr0_cnt0, tr0_cnt1)
+ * Second TR: the remaining length (tr1_cnt0)
+ *
+ * Returns the number of TRs the length needs (1 or 2)
+ * -EINVAL if the length can not be supported
+ */
+int udma_get_tr_counters(size_t len, unsigned long align_to,
+ u16 *tr0_cnt0, u16 *tr0_cnt1, u16 *tr1_cnt0)
+{
+ if (len < SZ_64K) {
+ *tr0_cnt0 = len;
+ *tr0_cnt1 = 1;
+
+ return 1;
+ }
+
+ if (align_to > 3)
+ align_to = 3;
+
+realign:
+ *tr0_cnt0 = SZ_64K - BIT(align_to);
+ if (len / *tr0_cnt0 >= SZ_64K) {
+ if (align_to) {
+ align_to--;
+ goto realign;
+ }
+ return -EINVAL;
+ }
+
+ *tr0_cnt1 = len / *tr0_cnt0;
+ *tr1_cnt0 = len % *tr0_cnt0;
+
+ return 2;
+}
+
+struct udma_desc *
+udma_prep_slave_sg_tr(struct udma_chan *uc, struct scatterlist *sgl,
+ unsigned int sglen, enum dma_transfer_direction dir,
+ unsigned long tx_flags, void *context)
+{
+ struct scatterlist *sgent;
+ struct udma_desc *d;
+ struct cppi5_tr_type1_t *tr_req = NULL;
+ u16 tr0_cnt0, tr0_cnt1, tr1_cnt0;
+ unsigned int i;
+ size_t tr_size;
+ int num_tr = 0;
+ int tr_idx = 0;
+ u64 asel;
+
+ /* estimate the number of TRs we will need */
+ for_each_sg(sgl, sgent, sglen, i) {
+ if (sg_dma_len(sgent) < SZ_64K)
+ num_tr++;
+ else
+ num_tr += 2;
+ }
+
+ /* Now allocate and setup the descriptor. */
+ tr_size = sizeof(struct cppi5_tr_type1_t);
+ d = udma_alloc_tr_desc(uc, tr_size, num_tr, dir);
+ if (!d)
+ return NULL;
+
+ d->sglen = sglen;
+
+ if (uc->ud->match_data->type == DMA_TYPE_UDMA)
+ asel = 0;
+ else
+ asel = (u64)uc->config.asel << K3_ADDRESS_ASEL_SHIFT;
+
+ tr_req = d->hwdesc[0].tr_req_base;
+ for_each_sg(sgl, sgent, sglen, i) {
+ dma_addr_t sg_addr = sg_dma_address(sgent);
+
+ num_tr = udma_get_tr_counters(sg_dma_len(sgent), __ffs(sg_addr),
+ &tr0_cnt0, &tr0_cnt1, &tr1_cnt0);
+ if (num_tr < 0) {
+ dev_err(uc->ud->dev, "size %u is not supported\n",
+ sg_dma_len(sgent));
+ udma_free_hwdesc(uc, d);
+ kfree(d);
+ return NULL;
+ }
+
+ cppi5_tr_init(&tr_req[tr_idx].flags, CPPI5_TR_TYPE1, false,
+ false, CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
+ cppi5_tr_csf_set(&tr_req[tr_idx].flags, CPPI5_TR_CSF_SUPR_EVT);
+
+ sg_addr |= asel;
+ tr_req[tr_idx].addr = sg_addr;
+ tr_req[tr_idx].icnt0 = tr0_cnt0;
+ tr_req[tr_idx].icnt1 = tr0_cnt1;
+ tr_req[tr_idx].dim1 = tr0_cnt0;
+ tr_idx++;
+
+ if (num_tr == 2) {
+ cppi5_tr_init(&tr_req[tr_idx].flags, CPPI5_TR_TYPE1,
+ false, false,
+ CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
+ cppi5_tr_csf_set(&tr_req[tr_idx].flags,
+ CPPI5_TR_CSF_SUPR_EVT);
+
+ tr_req[tr_idx].addr = sg_addr + tr0_cnt1 * tr0_cnt0;
+ tr_req[tr_idx].icnt0 = tr1_cnt0;
+ tr_req[tr_idx].icnt1 = 1;
+ tr_req[tr_idx].dim1 = tr1_cnt0;
+ tr_idx++;
+ }
+
+ d->residue += sg_dma_len(sgent);
+ }
+
+ cppi5_tr_csf_set(&tr_req[tr_idx - 1].flags,
+ CPPI5_TR_CSF_SUPR_EVT | CPPI5_TR_CSF_EOP);
+
+ return d;
+}
+
+struct udma_desc *
+udma_prep_slave_sg_triggered_tr(struct udma_chan *uc, struct scatterlist *sgl,
+ unsigned int sglen,
+ enum dma_transfer_direction dir,
+ unsigned long tx_flags, void *context)
+{
+ struct scatterlist *sgent;
+ struct cppi5_tr_type15_t *tr_req = NULL;
+ enum dma_slave_buswidth dev_width;
+ u32 csf = CPPI5_TR_CSF_SUPR_EVT;
+ u16 tr_cnt0, tr_cnt1;
+ dma_addr_t dev_addr;
+ struct udma_desc *d;
+ unsigned int i;
+ size_t tr_size, sg_len;
+ int num_tr = 0;
+ int tr_idx = 0;
+ u32 burst, trigger_size, port_window;
+ u64 asel;
+
+ if (dir == DMA_DEV_TO_MEM) {
+ dev_addr = uc->cfg.src_addr;
+ dev_width = uc->cfg.src_addr_width;
+ burst = uc->cfg.src_maxburst;
+ port_window = uc->cfg.src_port_window_size;
+ } else if (dir == DMA_MEM_TO_DEV) {
+ dev_addr = uc->cfg.dst_addr;
+ dev_width = uc->cfg.dst_addr_width;
+ burst = uc->cfg.dst_maxburst;
+ port_window = uc->cfg.dst_port_window_size;
+ } else {
+ dev_err(uc->ud->dev, "%s: bad direction?\n", __func__);
+ return NULL;
+ }
+
+ if (!burst)
+ burst = 1;
+
+ if (port_window) {
+ if (port_window != burst) {
+ dev_err(uc->ud->dev,
+ "The burst must be equal to port_window\n");
+ return NULL;
+ }
+
+ tr_cnt0 = dev_width * port_window;
+ tr_cnt1 = 1;
+ } else {
+ tr_cnt0 = dev_width;
+ tr_cnt1 = burst;
+ }
+ trigger_size = tr_cnt0 * tr_cnt1;
+
+ /* estimate the number of TRs we will need */
+ for_each_sg(sgl, sgent, sglen, i) {
+ sg_len = sg_dma_len(sgent);
+
+ if (sg_len % trigger_size) {
+ dev_err(uc->ud->dev,
+ "Not aligned SG entry (%zu for %u)\n", sg_len,
+ trigger_size);
+ return NULL;
+ }
+
+ if (sg_len / trigger_size < SZ_64K)
+ num_tr++;
+ else
+ num_tr += 2;
+ }
+
+ /* Now allocate and setup the descriptor. */
+ tr_size = sizeof(struct cppi5_tr_type15_t);
+ d = udma_alloc_tr_desc(uc, tr_size, num_tr, dir);
+ if (!d)
+ return NULL;
+
+ d->sglen = sglen;
+
+ if (uc->ud->match_data->type == DMA_TYPE_UDMA) {
+ asel = 0;
+ csf |= CPPI5_TR_CSF_EOL_ICNT0;
+ } else {
+ asel = (u64)uc->config.asel << K3_ADDRESS_ASEL_SHIFT;
+ dev_addr |= asel;
+ }
+
+ tr_req = d->hwdesc[0].tr_req_base;
+ for_each_sg(sgl, sgent, sglen, i) {
+ u16 tr0_cnt2, tr0_cnt3, tr1_cnt2;
+ dma_addr_t sg_addr = sg_dma_address(sgent);
+
+ sg_len = sg_dma_len(sgent);
+ num_tr = udma_get_tr_counters(sg_len / trigger_size, 0,
+ &tr0_cnt2, &tr0_cnt3, &tr1_cnt2);
+ if (num_tr < 0) {
+ dev_err(uc->ud->dev, "size %zu is not supported\n",
+ sg_len);
+ udma_free_hwdesc(uc, d);
+ kfree(d);
+ return NULL;
+ }
+
+ cppi5_tr_init(&tr_req[tr_idx].flags, CPPI5_TR_TYPE15, false,
+ true, CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
+ cppi5_tr_csf_set(&tr_req[tr_idx].flags, csf);
+ cppi5_tr_set_trigger(&tr_req[tr_idx].flags,
+ uc->config.tr_trigger_type,
+ CPPI5_TR_TRIGGER_TYPE_ICNT2_DEC, 0, 0);
+
+ sg_addr |= asel;
+ if (dir == DMA_DEV_TO_MEM) {
+ tr_req[tr_idx].addr = dev_addr;
+ tr_req[tr_idx].icnt0 = tr_cnt0;
+ tr_req[tr_idx].icnt1 = tr_cnt1;
+ tr_req[tr_idx].icnt2 = tr0_cnt2;
+ tr_req[tr_idx].icnt3 = tr0_cnt3;
+ tr_req[tr_idx].dim1 = (-1) * tr_cnt0;
+
+ tr_req[tr_idx].daddr = sg_addr;
+ tr_req[tr_idx].dicnt0 = tr_cnt0;
+ tr_req[tr_idx].dicnt1 = tr_cnt1;
+ tr_req[tr_idx].dicnt2 = tr0_cnt2;
+ tr_req[tr_idx].dicnt3 = tr0_cnt3;
+ tr_req[tr_idx].ddim1 = tr_cnt0;
+ tr_req[tr_idx].ddim2 = trigger_size;
+ tr_req[tr_idx].ddim3 = trigger_size * tr0_cnt2;
+ } else {
+ tr_req[tr_idx].addr = sg_addr;
+ tr_req[tr_idx].icnt0 = tr_cnt0;
+ tr_req[tr_idx].icnt1 = tr_cnt1;
+ tr_req[tr_idx].icnt2 = tr0_cnt2;
+ tr_req[tr_idx].icnt3 = tr0_cnt3;
+ tr_req[tr_idx].dim1 = tr_cnt0;
+ tr_req[tr_idx].dim2 = trigger_size;
+ tr_req[tr_idx].dim3 = trigger_size * tr0_cnt2;
+
+ tr_req[tr_idx].daddr = dev_addr;
+ tr_req[tr_idx].dicnt0 = tr_cnt0;
+ tr_req[tr_idx].dicnt1 = tr_cnt1;
+ tr_req[tr_idx].dicnt2 = tr0_cnt2;
+ tr_req[tr_idx].dicnt3 = tr0_cnt3;
+ tr_req[tr_idx].ddim1 = (-1) * tr_cnt0;
+ }
+
+ tr_idx++;
+
+ if (num_tr == 2) {
+ cppi5_tr_init(&tr_req[tr_idx].flags, CPPI5_TR_TYPE15,
+ false, true,
+ CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
+ cppi5_tr_csf_set(&tr_req[tr_idx].flags, csf);
+ cppi5_tr_set_trigger(&tr_req[tr_idx].flags,
+ uc->config.tr_trigger_type,
+ CPPI5_TR_TRIGGER_TYPE_ICNT2_DEC,
+ 0, 0);
+
+ sg_addr += trigger_size * tr0_cnt2 * tr0_cnt3;
+ if (dir == DMA_DEV_TO_MEM) {
+ tr_req[tr_idx].addr = dev_addr;
+ tr_req[tr_idx].icnt0 = tr_cnt0;
+ tr_req[tr_idx].icnt1 = tr_cnt1;
+ tr_req[tr_idx].icnt2 = tr1_cnt2;
+ tr_req[tr_idx].icnt3 = 1;
+ tr_req[tr_idx].dim1 = (-1) * tr_cnt0;
+
+ tr_req[tr_idx].daddr = sg_addr;
+ tr_req[tr_idx].dicnt0 = tr_cnt0;
+ tr_req[tr_idx].dicnt1 = tr_cnt1;
+ tr_req[tr_idx].dicnt2 = tr1_cnt2;
+ tr_req[tr_idx].dicnt3 = 1;
+ tr_req[tr_idx].ddim1 = tr_cnt0;
+ tr_req[tr_idx].ddim2 = trigger_size;
+ } else {
+ tr_req[tr_idx].addr = sg_addr;
+ tr_req[tr_idx].icnt0 = tr_cnt0;
+ tr_req[tr_idx].icnt1 = tr_cnt1;
+ tr_req[tr_idx].icnt2 = tr1_cnt2;
+ tr_req[tr_idx].icnt3 = 1;
+ tr_req[tr_idx].dim1 = tr_cnt0;
+ tr_req[tr_idx].dim2 = trigger_size;
+
+ tr_req[tr_idx].daddr = dev_addr;
+ tr_req[tr_idx].dicnt0 = tr_cnt0;
+ tr_req[tr_idx].dicnt1 = tr_cnt1;
+ tr_req[tr_idx].dicnt2 = tr1_cnt2;
+ tr_req[tr_idx].dicnt3 = 1;
+ tr_req[tr_idx].ddim1 = (-1) * tr_cnt0;
+ }
+ tr_idx++;
+ }
+
+ d->residue += sg_len;
+ }
+
+ cppi5_tr_csf_set(&tr_req[tr_idx - 1].flags, csf | CPPI5_TR_CSF_EOP);
+
+ return d;
+}
+
+int udma_configure_statictr(struct udma_chan *uc, struct udma_desc *d,
+ enum dma_slave_buswidth dev_width,
+ u16 elcnt)
+{
+ if (uc->config.ep_type != PSIL_EP_PDMA_XY)
+ return 0;
+
+ /* Bus width translates to the element size (ES) */
+ switch (dev_width) {
+ case DMA_SLAVE_BUSWIDTH_1_BYTE:
+ d->static_tr.elsize = 0;
+ break;
+ case DMA_SLAVE_BUSWIDTH_2_BYTES:
+ d->static_tr.elsize = 1;
+ break;
+ case DMA_SLAVE_BUSWIDTH_3_BYTES:
+ d->static_tr.elsize = 2;
+ break;
+ case DMA_SLAVE_BUSWIDTH_4_BYTES:
+ d->static_tr.elsize = 3;
+ break;
+ case DMA_SLAVE_BUSWIDTH_8_BYTES:
+ d->static_tr.elsize = 4;
+ break;
+ default: /* not reached */
+ return -EINVAL;
+ }
+
+ d->static_tr.elcnt = elcnt;
+
+ if (uc->config.pkt_mode || !uc->cyclic) {
+ /*
+ * PDMA must close the packet when the channel is in packet mode.
+ * For TR mode when the channel is not cyclic we also need PDMA
+ * to close the packet otherwise the transfer will stall because
+ * PDMA holds on the data it has received from the peripheral.
+ */
+ unsigned int div = dev_width * elcnt;
+
+ if (uc->cyclic)
+ d->static_tr.bstcnt = d->residue / d->sglen / div;
+ else
+ d->static_tr.bstcnt = d->residue / div;
+ } else if (uc->ud->match_data->type == DMA_TYPE_BCDMA &&
+ uc->config.dir == DMA_DEV_TO_MEM &&
+ uc->cyclic) {
+ /*
+ * For cyclic mode with BCDMA we have to set EOP in each TR to
+ * prevent short packet errors seen on channel teardown. So the
+ * PDMA must close the packet after every TR transfer by setting
+ * burst count equal to the number of bytes transferred.
+ */
+ struct cppi5_tr_type1_t *tr_req = d->hwdesc[0].tr_req_base;
+
+ d->static_tr.bstcnt =
+ (tr_req->icnt0 * tr_req->icnt1) / dev_width;
+ } else {
+ d->static_tr.bstcnt = 0;
+ }
+
+ if (uc->config.dir == DMA_DEV_TO_MEM &&
+ d->static_tr.bstcnt > uc->ud->match_data->statictr_z_mask)
+ return -EINVAL;
+
+ return 0;
+}
+
+struct udma_desc *
+udma_prep_slave_sg_pkt(struct udma_chan *uc, struct scatterlist *sgl,
+ unsigned int sglen, enum dma_transfer_direction dir,
+ unsigned long tx_flags, void *context)
+{
+ struct scatterlist *sgent;
+ struct cppi5_host_desc_t *h_desc = NULL;
+ struct udma_desc *d;
+ u32 ring_id;
+ unsigned int i;
+ u64 asel;
+
+ d = kzalloc(struct_size(d, hwdesc, sglen), GFP_NOWAIT);
+ if (!d)
+ return NULL;
+
+ d->sglen = sglen;
+ d->hwdesc_count = sglen;
+
+ if (dir == DMA_DEV_TO_MEM)
+ ring_id = k3_ringacc_get_ring_id(uc->rflow->r_ring);
+ else
+ ring_id = k3_ringacc_get_ring_id(uc->tchan->tc_ring);
+
+ if (uc->ud->match_data->type == DMA_TYPE_UDMA)
+ asel = 0;
+ else
+ asel = (u64)uc->config.asel << K3_ADDRESS_ASEL_SHIFT;
+
+ for_each_sg(sgl, sgent, sglen, i) {
+ struct udma_hwdesc *hwdesc = &d->hwdesc[i];
+ dma_addr_t sg_addr = sg_dma_address(sgent);
+ struct cppi5_host_desc_t *desc;
+ size_t sg_len = sg_dma_len(sgent);
+
+ hwdesc->cppi5_desc_vaddr = dma_pool_zalloc(uc->hdesc_pool,
+ GFP_NOWAIT,
+ &hwdesc->cppi5_desc_paddr);
+ if (!hwdesc->cppi5_desc_vaddr) {
+ dev_err(uc->ud->dev,
+ "descriptor%d allocation failed\n", i);
+
+ udma_free_hwdesc(uc, d);
+ kfree(d);
+ return NULL;
+ }
+
+ d->residue += sg_len;
+ hwdesc->cppi5_desc_size = uc->config.hdesc_size;
+ desc = hwdesc->cppi5_desc_vaddr;
+
+ if (i == 0) {
+ cppi5_hdesc_init(desc, 0, 0);
+ /* Flow and Packed ID */
+ cppi5_desc_set_pktids(&desc->hdr, uc->id,
+ CPPI5_INFO1_DESC_FLOWID_DEFAULT);
+ cppi5_desc_set_retpolicy(&desc->hdr, 0, ring_id);
+ } else {
+ cppi5_hdesc_reset_hbdesc(desc);
+ cppi5_desc_set_retpolicy(&desc->hdr, 0, 0xffff);
+ }
+
+ /* attach the sg buffer to the descriptor */
+ sg_addr |= asel;
+ cppi5_hdesc_attach_buf(desc, sg_addr, sg_len, sg_addr, sg_len);
+
+ /* Attach link as host buffer descriptor */
+ if (h_desc)
+ cppi5_hdesc_link_hbdesc(h_desc,
+ hwdesc->cppi5_desc_paddr | asel);
+
+ if (uc->ud->match_data->type == DMA_TYPE_PKTDMA ||
+ dir == DMA_MEM_TO_DEV)
+ h_desc = desc;
+ }
+
+ if (d->residue >= SZ_4M) {
+ dev_err(uc->ud->dev,
+ "%s: Transfer size %u is over the supported 4M range\n",
+ __func__, d->residue);
+ udma_free_hwdesc(uc, d);
+ kfree(d);
+ return NULL;
+ }
+
+ h_desc = d->hwdesc[0].cppi5_desc_vaddr;
+ cppi5_hdesc_set_pktlen(h_desc, d->residue);
+
+ return d;
+}
+
+int udma_attach_metadata(struct dma_async_tx_descriptor *desc,
+ void *data, size_t len)
+{
+ struct udma_desc *d = to_udma_desc(desc);
+ struct udma_chan *uc = to_udma_chan(desc->chan);
+ struct cppi5_host_desc_t *h_desc;
+ u32 psd_size = len;
+ u32 flags = 0;
+
+ if (!uc->config.pkt_mode || !uc->config.metadata_size)
+ return -EOPNOTSUPP;
+
+ if (!data || len > uc->config.metadata_size)
+ return -EINVAL;
+
+ if (uc->config.needs_epib && len < CPPI5_INFO0_HDESC_EPIB_SIZE)
+ return -EINVAL;
+
+ h_desc = d->hwdesc[0].cppi5_desc_vaddr;
+ if (d->dir == DMA_MEM_TO_DEV)
+ memcpy(h_desc->epib, data, len);
+
+ if (uc->config.needs_epib)
+ psd_size -= CPPI5_INFO0_HDESC_EPIB_SIZE;
+
+ d->metadata = data;
+ d->metadata_size = len;
+ if (uc->config.needs_epib)
+ flags |= CPPI5_INFO0_HDESC_EPIB_PRESENT;
+
+ cppi5_hdesc_update_flags(h_desc, flags);
+ cppi5_hdesc_update_psdata_size(h_desc, psd_size);
+
+ return 0;
+}
+
+void *udma_get_metadata_ptr(struct dma_async_tx_descriptor *desc,
+ size_t *payload_len, size_t *max_len)
+{
+ struct udma_desc *d = to_udma_desc(desc);
+ struct udma_chan *uc = to_udma_chan(desc->chan);
+ struct cppi5_host_desc_t *h_desc;
+
+ if (!uc->config.pkt_mode || !uc->config.metadata_size)
+ return ERR_PTR(-EOPNOTSUPP);
+
+ h_desc = d->hwdesc[0].cppi5_desc_vaddr;
+
+ *max_len = uc->config.metadata_size;
+
+ *payload_len = cppi5_hdesc_epib_present(&h_desc->hdr) ?
+ CPPI5_INFO0_HDESC_EPIB_SIZE : 0;
+ *payload_len += cppi5_hdesc_get_psdata_size(h_desc);
+
+ return h_desc->epib;
+}
+
+int udma_set_metadata_len(struct dma_async_tx_descriptor *desc,
+ size_t payload_len)
+{
+ struct udma_desc *d = to_udma_desc(desc);
+ struct udma_chan *uc = to_udma_chan(desc->chan);
+ struct cppi5_host_desc_t *h_desc;
+ u32 psd_size = payload_len;
+ u32 flags = 0;
+
+ if (!uc->config.pkt_mode || !uc->config.metadata_size)
+ return -EOPNOTSUPP;
+
+ if (payload_len > uc->config.metadata_size)
+ return -EINVAL;
+
+ if (uc->config.needs_epib && payload_len < CPPI5_INFO0_HDESC_EPIB_SIZE)
+ return -EINVAL;
+
+ h_desc = d->hwdesc[0].cppi5_desc_vaddr;
+
+ if (uc->config.needs_epib) {
+ psd_size -= CPPI5_INFO0_HDESC_EPIB_SIZE;
+ flags |= CPPI5_INFO0_HDESC_EPIB_PRESENT;
+ }
+
+ cppi5_hdesc_update_flags(h_desc, flags);
+ cppi5_hdesc_update_psdata_size(h_desc, psd_size);
+
+ return 0;
+}
+
+struct dma_async_tx_descriptor *
+udma_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
+ unsigned int sglen, enum dma_transfer_direction dir,
+ unsigned long tx_flags, void *context)
+{
+ struct udma_chan *uc = to_udma_chan(chan);
+ enum dma_slave_buswidth dev_width;
+ struct udma_desc *d;
+ u32 burst;
+
+ if (dir != uc->config.dir &&
+ (uc->config.dir == DMA_MEM_TO_MEM && !uc->config.tr_trigger_type)) {
+ dev_err(chan->device->dev,
+ "%s: chan%d is for %s, not supporting %s\n",
+ __func__, uc->id,
+ dmaengine_get_direction_text(uc->config.dir),
+ dmaengine_get_direction_text(dir));
+ return NULL;
+ }
+
+ if (dir == DMA_DEV_TO_MEM) {
+ dev_width = uc->cfg.src_addr_width;
+ burst = uc->cfg.src_maxburst;
+ } else if (dir == DMA_MEM_TO_DEV) {
+ dev_width = uc->cfg.dst_addr_width;
+ burst = uc->cfg.dst_maxburst;
+ } else {
+ dev_err(chan->device->dev, "%s: bad direction?\n", __func__);
+ return NULL;
+ }
+
+ if (!burst)
+ burst = 1;
+
+ uc->config.tx_flags = tx_flags;
+
+ if (uc->config.pkt_mode)
+ d = udma_prep_slave_sg_pkt(uc, sgl, sglen, dir, tx_flags,
+ context);
+ else if (is_slave_direction(uc->config.dir))
+ d = udma_prep_slave_sg_tr(uc, sgl, sglen, dir, tx_flags,
+ context);
+ else
+ d = udma_prep_slave_sg_triggered_tr(uc, sgl, sglen, dir,
+ tx_flags, context);
+
+ if (!d)
+ return NULL;
+
+ d->dir = dir;
+ d->desc_idx = 0;
+ d->tr_idx = 0;
+
+ /* static TR for remote PDMA */
+ if (udma_configure_statictr(uc, d, dev_width, burst)) {
+ dev_err(uc->ud->dev,
+ "%s: StaticTR Z is limited to maximum %u (%u)\n",
+ __func__, uc->ud->match_data->statictr_z_mask,
+ d->static_tr.bstcnt);
+
+ udma_free_hwdesc(uc, d);
+ kfree(d);
+ return NULL;
+ }
+
+ if (uc->config.metadata_size)
+ d->vd.tx.metadata_ops = &metadata_ops;
+
+ return vchan_tx_prep(&uc->vc, &d->vd, tx_flags);
+}
+EXPORT_SYMBOL_GPL(udma_prep_slave_sg);
+
+struct udma_desc *
+udma_prep_dma_cyclic_tr(struct udma_chan *uc, dma_addr_t buf_addr,
+ size_t buf_len, size_t period_len,
+ enum dma_transfer_direction dir, unsigned long flags)
+{
+ struct udma_desc *d;
+ size_t tr_size, period_addr;
+ struct cppi5_tr_type1_t *tr_req;
+ unsigned int periods = buf_len / period_len;
+ u16 tr0_cnt0, tr0_cnt1, tr1_cnt0;
+ unsigned int i;
+ int num_tr;
+ u32 period_csf = 0;
+
+ num_tr = udma_get_tr_counters(period_len, __ffs(buf_addr), &tr0_cnt0,
+ &tr0_cnt1, &tr1_cnt0);
+ if (num_tr < 0) {
+ dev_err(uc->ud->dev, "size %zu is not supported\n",
+ period_len);
+ return NULL;
+ }
+
+ /* Now allocate and setup the descriptor. */
+ tr_size = sizeof(struct cppi5_tr_type1_t);
+ d = udma_alloc_tr_desc(uc, tr_size, periods * num_tr, dir);
+ if (!d)
+ return NULL;
+
+ tr_req = d->hwdesc[0].tr_req_base;
+ if (uc->ud->match_data->type == DMA_TYPE_UDMA)
+ period_addr = buf_addr;
+ else
+ period_addr = buf_addr |
+ ((u64)uc->config.asel << K3_ADDRESS_ASEL_SHIFT);
+
+ /*
+ * For BCDMA <-> PDMA transfers, the EOP flag needs to be set on the
+ * last TR of a descriptor, to mark the packet as complete.
+ * This is required for getting the teardown completion message in case
+ * of TX, and to avoid short-packet error in case of RX.
+ *
+ * As we are in cyclic mode, we do not know which period might be the
+ * last one, so set the flag for each period.
+ */
+ if (uc->config.ep_type == PSIL_EP_PDMA_XY &&
+ uc->ud->match_data->type == DMA_TYPE_BCDMA) {
+ period_csf = CPPI5_TR_CSF_EOP;
+ }
+
+ for (i = 0; i < periods; i++) {
+ int tr_idx = i * num_tr;
+
+ cppi5_tr_init(&tr_req[tr_idx].flags, CPPI5_TR_TYPE1, false,
+ false, CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
+
+ tr_req[tr_idx].addr = period_addr;
+ tr_req[tr_idx].icnt0 = tr0_cnt0;
+ tr_req[tr_idx].icnt1 = tr0_cnt1;
+ tr_req[tr_idx].dim1 = tr0_cnt0;
+
+ if (num_tr == 2) {
+ cppi5_tr_csf_set(&tr_req[tr_idx].flags,
+ CPPI5_TR_CSF_SUPR_EVT);
+ tr_idx++;
+
+ cppi5_tr_init(&tr_req[tr_idx].flags, CPPI5_TR_TYPE1,
+ false, false,
+ CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
+
+ tr_req[tr_idx].addr = period_addr + tr0_cnt1 * tr0_cnt0;
+ tr_req[tr_idx].icnt0 = tr1_cnt0;
+ tr_req[tr_idx].icnt1 = 1;
+ tr_req[tr_idx].dim1 = tr1_cnt0;
+ }
+
+ if (!(flags & DMA_PREP_INTERRUPT))
+ period_csf |= CPPI5_TR_CSF_SUPR_EVT;
+
+ if (period_csf)
+ cppi5_tr_csf_set(&tr_req[tr_idx].flags, period_csf);
+
+ period_addr += period_len;
+ }
+
+ return d;
+}
+
+struct udma_desc *
+udma_prep_dma_cyclic_pkt(struct udma_chan *uc, dma_addr_t buf_addr,
+ size_t buf_len, size_t period_len,
+ enum dma_transfer_direction dir, unsigned long flags)
+{
+ struct udma_desc *d;
+ u32 ring_id;
+ int i;
+ int periods = buf_len / period_len;
+
+ if (periods > (K3_UDMA_DEFAULT_RING_SIZE - 1))
+ return NULL;
+
+ if (period_len >= SZ_4M)
+ return NULL;
+
+ d = kzalloc(struct_size(d, hwdesc, periods), GFP_NOWAIT);
+ if (!d)
+ return NULL;
+
+ d->hwdesc_count = periods;
+
+ /* TODO: re-check this... */
+ if (dir == DMA_DEV_TO_MEM)
+ ring_id = k3_ringacc_get_ring_id(uc->rflow->r_ring);
+ else
+ ring_id = k3_ringacc_get_ring_id(uc->tchan->tc_ring);
+
+ if (uc->ud->match_data->type != DMA_TYPE_UDMA)
+ buf_addr |= (u64)uc->config.asel << K3_ADDRESS_ASEL_SHIFT;
+
+ for (i = 0; i < periods; i++) {
+ struct udma_hwdesc *hwdesc = &d->hwdesc[i];
+ dma_addr_t period_addr = buf_addr + (period_len * i);
+ struct cppi5_host_desc_t *h_desc;
+
+ hwdesc->cppi5_desc_vaddr = dma_pool_zalloc(uc->hdesc_pool,
+ GFP_NOWAIT,
+ &hwdesc->cppi5_desc_paddr);
+ if (!hwdesc->cppi5_desc_vaddr) {
+ dev_err(uc->ud->dev,
+ "descriptor%d allocation failed\n", i);
+
+ udma_free_hwdesc(uc, d);
+ kfree(d);
+ return NULL;
+ }
+
+ hwdesc->cppi5_desc_size = uc->config.hdesc_size;
+ h_desc = hwdesc->cppi5_desc_vaddr;
+
+ cppi5_hdesc_init(h_desc, 0, 0);
+ cppi5_hdesc_set_pktlen(h_desc, period_len);
+
+ /* Flow and Packed ID */
+ cppi5_desc_set_pktids(&h_desc->hdr, uc->id,
+ CPPI5_INFO1_DESC_FLOWID_DEFAULT);
+ cppi5_desc_set_retpolicy(&h_desc->hdr, 0, ring_id);
+
+ /* attach each period to a new descriptor */
+ cppi5_hdesc_attach_buf(h_desc,
+ period_addr, period_len,
+ period_addr, period_len);
+ }
+
+ return d;
+}
+
+struct dma_async_tx_descriptor *
+udma_prep_dma_cyclic(struct dma_chan *chan, dma_addr_t buf_addr, size_t buf_len,
+ size_t period_len, enum dma_transfer_direction dir,
+ unsigned long flags)
+{
+ struct udma_chan *uc = to_udma_chan(chan);
+ enum dma_slave_buswidth dev_width;
+ struct udma_desc *d;
+ u32 burst;
+
+ if (dir != uc->config.dir) {
+ dev_err(chan->device->dev,
+ "%s: chan%d is for %s, not supporting %s\n",
+ __func__, uc->id,
+ dmaengine_get_direction_text(uc->config.dir),
+ dmaengine_get_direction_text(dir));
+ return NULL;
+ }
+
+ uc->cyclic = true;
+
+ if (dir == DMA_DEV_TO_MEM) {
+ dev_width = uc->cfg.src_addr_width;
+ burst = uc->cfg.src_maxburst;
+ } else if (dir == DMA_MEM_TO_DEV) {
+ dev_width = uc->cfg.dst_addr_width;
+ burst = uc->cfg.dst_maxburst;
+ } else {
+ dev_err(uc->ud->dev, "%s: bad direction?\n", __func__);
+ return NULL;
+ }
+
+ if (!burst)
+ burst = 1;
+
+ if (uc->config.pkt_mode)
+ d = udma_prep_dma_cyclic_pkt(uc, buf_addr, buf_len, period_len,
+ dir, flags);
+ else
+ d = udma_prep_dma_cyclic_tr(uc, buf_addr, buf_len, period_len,
+ dir, flags);
+
+ if (!d)
+ return NULL;
+
+ d->sglen = buf_len / period_len;
+
+ d->dir = dir;
+ d->residue = buf_len;
+
+ /* static TR for remote PDMA */
+ if (udma_configure_statictr(uc, d, dev_width, burst)) {
+ dev_err(uc->ud->dev,
+ "%s: StaticTR Z is limited to maximum %u (%u)\n",
+ __func__, uc->ud->match_data->statictr_z_mask,
+ d->static_tr.bstcnt);
+
+ udma_free_hwdesc(uc, d);
+ kfree(d);
+ return NULL;
+ }
+
+ if (uc->config.metadata_size)
+ d->vd.tx.metadata_ops = &metadata_ops;
+
+ return vchan_tx_prep(&uc->vc, &d->vd, flags);
+}
+EXPORT_SYMBOL_GPL(udma_prep_dma_cyclic);
+
+struct dma_async_tx_descriptor *
+udma_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src,
+ size_t len, unsigned long tx_flags)
+{
+ struct udma_chan *uc = to_udma_chan(chan);
+ struct udma_desc *d;
+ struct cppi5_tr_type15_t *tr_req;
+ int num_tr;
+ size_t tr_size = sizeof(struct cppi5_tr_type15_t);
+ u16 tr0_cnt0, tr0_cnt1, tr1_cnt0;
+ u32 csf = CPPI5_TR_CSF_SUPR_EVT;
+
+ if (uc->config.dir != DMA_MEM_TO_MEM) {
+ dev_err(chan->device->dev,
+ "%s: chan%d is for %s, not supporting %s\n",
+ __func__, uc->id,
+ dmaengine_get_direction_text(uc->config.dir),
+ dmaengine_get_direction_text(DMA_MEM_TO_MEM));
+ return NULL;
+ }
+
+ num_tr = udma_get_tr_counters(len, __ffs(src | dest), &tr0_cnt0,
+ &tr0_cnt1, &tr1_cnt0);
+ if (num_tr < 0) {
+ dev_err(uc->ud->dev, "size %zu is not supported\n",
+ len);
+ return NULL;
+ }
+
+ d = udma_alloc_tr_desc(uc, tr_size, num_tr, DMA_MEM_TO_MEM);
+ if (!d)
+ return NULL;
+
+ d->dir = DMA_MEM_TO_MEM;
+ d->desc_idx = 0;
+ d->tr_idx = 0;
+ d->residue = len;
+
+ if (uc->ud->match_data->type != DMA_TYPE_UDMA) {
+ src |= (u64)uc->ud->asel << K3_ADDRESS_ASEL_SHIFT;
+ dest |= (u64)uc->ud->asel << K3_ADDRESS_ASEL_SHIFT;
+ } else {
+ csf |= CPPI5_TR_CSF_EOL_ICNT0;
+ }
+
+ tr_req = d->hwdesc[0].tr_req_base;
+
+ cppi5_tr_init(&tr_req[0].flags, CPPI5_TR_TYPE15, false, true,
+ CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
+ cppi5_tr_csf_set(&tr_req[0].flags, csf);
+
+ tr_req[0].addr = src;
+ tr_req[0].icnt0 = tr0_cnt0;
+ tr_req[0].icnt1 = tr0_cnt1;
+ tr_req[0].icnt2 = 1;
+ tr_req[0].icnt3 = 1;
+ tr_req[0].dim1 = tr0_cnt0;
+
+ tr_req[0].daddr = dest;
+ tr_req[0].dicnt0 = tr0_cnt0;
+ tr_req[0].dicnt1 = tr0_cnt1;
+ tr_req[0].dicnt2 = 1;
+ tr_req[0].dicnt3 = 1;
+ tr_req[0].ddim1 = tr0_cnt0;
+
+ if (num_tr == 2) {
+ cppi5_tr_init(&tr_req[1].flags, CPPI5_TR_TYPE15, false, true,
+ CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
+ cppi5_tr_csf_set(&tr_req[1].flags, csf);
+
+ tr_req[1].addr = src + tr0_cnt1 * tr0_cnt0;
+ tr_req[1].icnt0 = tr1_cnt0;
+ tr_req[1].icnt1 = 1;
+ tr_req[1].icnt2 = 1;
+ tr_req[1].icnt3 = 1;
+
+ tr_req[1].daddr = dest + tr0_cnt1 * tr0_cnt0;
+ tr_req[1].dicnt0 = tr1_cnt0;
+ tr_req[1].dicnt1 = 1;
+ tr_req[1].dicnt2 = 1;
+ tr_req[1].dicnt3 = 1;
+ }
+
+ cppi5_tr_csf_set(&tr_req[num_tr - 1].flags, csf | CPPI5_TR_CSF_EOP);
+
+ if (uc->config.metadata_size)
+ d->vd.tx.metadata_ops = &metadata_ops;
+
+ return vchan_tx_prep(&uc->vc, &d->vd, tx_flags);
+}
+EXPORT_SYMBOL_GPL(udma_prep_dma_memcpy);
+
+void udma_desc_pre_callback(struct virt_dma_chan *vc,
+ struct virt_dma_desc *vd,
+ struct dmaengine_result *result)
+{
+ struct udma_chan *uc = to_udma_chan(&vc->chan);
+ struct udma_desc *d;
+ u8 status;
+
+ if (!vd)
+ return;
+
+ d = to_udma_desc(&vd->tx);
+
+ if (d->metadata_size)
+ udma_fetch_epib(uc, d);
+
+ if (result) {
+ void *desc_vaddr = udma_curr_cppi5_desc_vaddr(d, d->desc_idx);
+
+ if (cppi5_desc_get_type(desc_vaddr) ==
+ CPPI5_INFO0_DESC_TYPE_VAL_HOST) {
+ /* Provide residue information for the client */
+ result->residue = d->residue -
+ cppi5_hdesc_get_pktlen(desc_vaddr);
+ if (result->residue)
+ result->result = DMA_TRANS_ABORTED;
+ else
+ result->result = DMA_TRANS_NOERROR;
+ } else {
+ result->residue = 0;
+ /* Propagate TR Response errors to the client */
+ status = d->hwdesc[0].tr_resp_base->status;
+ if (status)
+ result->result = DMA_TRANS_ABORTED;
+ else
+ result->result = DMA_TRANS_NOERROR;
+ }
+ }
+}
+EXPORT_SYMBOL_GPL(udma_desc_pre_callback);
+
+MODULE_DESCRIPTION("Texas Instruments K3 UDMA Common Library");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index 0eaa06b7ae988..ae8b8ebd5dddd 100644
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -131,105 +131,6 @@ static void udma_dump_chan_stdata(struct udma_chan *uc)
}
}
-static struct udma_desc *udma_udma_desc_from_paddr(struct udma_chan *uc,
- dma_addr_t paddr)
-{
- struct udma_desc *d = uc->terminated_desc;
-
- if (d) {
- dma_addr_t desc_paddr = udma_curr_cppi5_desc_paddr(d,
- d->desc_idx);
-
- if (desc_paddr != paddr)
- d = NULL;
- }
-
- if (!d) {
- d = uc->desc;
- if (d) {
- dma_addr_t desc_paddr = udma_curr_cppi5_desc_paddr(d,
- d->desc_idx);
-
- if (desc_paddr != paddr)
- d = NULL;
- }
- }
-
- return d;
-}
-
-static void udma_free_hwdesc(struct udma_chan *uc, struct udma_desc *d)
-{
- if (uc->use_dma_pool) {
- int i;
-
- for (i = 0; i < d->hwdesc_count; i++) {
- if (!d->hwdesc[i].cppi5_desc_vaddr)
- continue;
-
- dma_pool_free(uc->hdesc_pool,
- d->hwdesc[i].cppi5_desc_vaddr,
- d->hwdesc[i].cppi5_desc_paddr);
-
- d->hwdesc[i].cppi5_desc_vaddr = NULL;
- }
- } else if (d->hwdesc[0].cppi5_desc_vaddr) {
- dma_free_coherent(uc->dma_dev, d->hwdesc[0].cppi5_desc_size,
- d->hwdesc[0].cppi5_desc_vaddr,
- d->hwdesc[0].cppi5_desc_paddr);
-
- d->hwdesc[0].cppi5_desc_vaddr = NULL;
- }
-}
-
-static void udma_purge_desc_work(struct work_struct *work)
-{
- struct udma_dev *ud = container_of(work, typeof(*ud), purge_work);
- struct virt_dma_desc *vd, *_vd;
- unsigned long flags;
- LIST_HEAD(head);
-
- spin_lock_irqsave(&ud->lock, flags);
- list_splice_tail_init(&ud->desc_to_purge, &head);
- spin_unlock_irqrestore(&ud->lock, flags);
-
- list_for_each_entry_safe(vd, _vd, &head, node) {
- struct udma_chan *uc = to_udma_chan(vd->tx.chan);
- struct udma_desc *d = to_udma_desc(&vd->tx);
-
- udma_free_hwdesc(uc, d);
- list_del(&vd->node);
- kfree(d);
- }
-
- /* If more to purge, schedule the work again */
- if (!list_empty(&ud->desc_to_purge))
- schedule_work(&ud->purge_work);
-}
-
-static void udma_desc_free(struct virt_dma_desc *vd)
-{
- struct udma_dev *ud = to_udma_dev(vd->tx.chan->device);
- struct udma_chan *uc = to_udma_chan(vd->tx.chan);
- struct udma_desc *d = to_udma_desc(&vd->tx);
- unsigned long flags;
-
- if (uc->terminated_desc == d)
- uc->terminated_desc = NULL;
-
- if (uc->use_dma_pool) {
- udma_free_hwdesc(uc, d);
- kfree(d);
- return;
- }
-
- spin_lock_irqsave(&ud->lock, flags);
- list_add_tail(&vd->node, &ud->desc_to_purge);
- spin_unlock_irqrestore(&ud->lock, flags);
-
- schedule_work(&ud->purge_work);
-}
-
static bool udma_is_chan_running(struct udma_chan *uc)
{
u32 trt_ctl = 0;
@@ -303,17 +204,6 @@ static int udma_push_to_ring(struct udma_chan *uc, int idx)
return k3_ringacc_ring_push(ring, &paddr);
}
-static bool udma_desc_is_rx_flush(struct udma_chan *uc, dma_addr_t addr)
-{
- if (uc->config.dir != DMA_DEV_TO_MEM)
- return false;
-
- if (addr == udma_get_rx_flush_hwdesc_paddr(uc))
- return true;
-
- return false;
-}
-
static int udma_pop_from_ring(struct udma_chan *uc, dma_addr_t *addr)
{
struct k3_ring *ring = NULL;
@@ -674,33 +564,6 @@ static void udma_cyclic_packet_elapsed(struct udma_chan *uc)
d->desc_idx = (d->desc_idx + 1) % d->sglen;
}
-static bool udma_is_desc_really_done(struct udma_chan *uc, struct udma_desc *d)
-{
- u32 peer_bcnt, bcnt;
-
- /*
- * Only TX towards PDMA is affected.
- * If DMA_PREP_INTERRUPT is not set by consumer then skip the transfer
- * completion calculation, consumer must ensure that there is no stale
- * data in DMA fabric in this case.
- */
- if (uc->config.ep_type == PSIL_EP_NATIVE ||
- uc->config.dir != DMA_MEM_TO_DEV || !(uc->config.tx_flags & DMA_PREP_INTERRUPT))
- return true;
-
- peer_bcnt = udma_tchanrt_read(uc, UDMA_CHAN_RT_PEER_BCNT_REG);
- bcnt = udma_tchanrt_read(uc, UDMA_CHAN_RT_BCNT_REG);
-
- /* Transfer is incomplete, store current residue and time stamp */
- if (peer_bcnt < bcnt) {
- uc->tx_drain.residue = bcnt - peer_bcnt;
- uc->tx_drain.tstamp = ktime_get();
- return false;
- }
-
- return true;
-}
-
static void udma_check_tx_completion(struct work_struct *work)
{
struct udma_chan *uc = container_of(work, typeof(*uc),
@@ -2344,1047 +2207,6 @@ static int udma_slave_config(struct dma_chan *chan,
return 0;
}
-static struct udma_desc *udma_alloc_tr_desc(struct udma_chan *uc,
- size_t tr_size, int tr_count,
- enum dma_transfer_direction dir)
-{
- struct udma_hwdesc *hwdesc;
- struct cppi5_desc_hdr_t *tr_desc;
- struct udma_desc *d;
- u32 reload_count = 0;
- u32 ring_id;
-
- switch (tr_size) {
- case 16:
- case 32:
- case 64:
- case 128:
- break;
- default:
- dev_err(uc->ud->dev, "Unsupported TR size of %zu\n", tr_size);
- return NULL;
- }
-
- /* We have only one descriptor containing multiple TRs */
- d = kzalloc(sizeof(*d) + sizeof(d->hwdesc[0]), GFP_NOWAIT);
- if (!d)
- return NULL;
-
- d->sglen = tr_count;
-
- d->hwdesc_count = 1;
- hwdesc = &d->hwdesc[0];
-
- /* Allocate memory for DMA ring descriptor */
- if (uc->use_dma_pool) {
- hwdesc->cppi5_desc_size = uc->config.hdesc_size;
- hwdesc->cppi5_desc_vaddr = dma_pool_zalloc(uc->hdesc_pool,
- GFP_NOWAIT,
- &hwdesc->cppi5_desc_paddr);
- } else {
- hwdesc->cppi5_desc_size = cppi5_trdesc_calc_size(tr_size,
- tr_count);
- hwdesc->cppi5_desc_size = ALIGN(hwdesc->cppi5_desc_size,
- uc->ud->desc_align);
- hwdesc->cppi5_desc_vaddr = dma_alloc_coherent(uc->ud->dev,
- hwdesc->cppi5_desc_size,
- &hwdesc->cppi5_desc_paddr,
- GFP_NOWAIT);
- }
-
- if (!hwdesc->cppi5_desc_vaddr) {
- kfree(d);
- return NULL;
- }
-
- /* Start of the TR req records */
- hwdesc->tr_req_base = hwdesc->cppi5_desc_vaddr + tr_size;
- /* Start address of the TR response array */
- hwdesc->tr_resp_base = hwdesc->tr_req_base + tr_size * tr_count;
-
- tr_desc = hwdesc->cppi5_desc_vaddr;
-
- if (uc->cyclic)
- reload_count = CPPI5_INFO0_TRDESC_RLDCNT_INFINITE;
-
- if (dir == DMA_DEV_TO_MEM)
- ring_id = k3_ringacc_get_ring_id(uc->rflow->r_ring);
- else
- ring_id = k3_ringacc_get_ring_id(uc->tchan->tc_ring);
-
- cppi5_trdesc_init(tr_desc, tr_count, tr_size, 0, reload_count);
- cppi5_desc_set_pktids(tr_desc, uc->id,
- CPPI5_INFO1_DESC_FLOWID_DEFAULT);
- cppi5_desc_set_retpolicy(tr_desc, 0, ring_id);
-
- return d;
-}
-
-/**
- * udma_get_tr_counters - calculate TR counters for a given length
- * @len: Length of the trasnfer
- * @align_to: Preferred alignment
- * @tr0_cnt0: First TR icnt0
- * @tr0_cnt1: First TR icnt1
- * @tr1_cnt0: Second (if used) TR icnt0
- *
- * For len < SZ_64K only one TR is enough, tr1_cnt0 is not updated
- * For len >= SZ_64K two TRs are used in a simple way:
- * First TR: SZ_64K-alignment blocks (tr0_cnt0, tr0_cnt1)
- * Second TR: the remaining length (tr1_cnt0)
- *
- * Returns the number of TRs the length needs (1 or 2)
- * -EINVAL if the length can not be supported
- */
-static int udma_get_tr_counters(size_t len, unsigned long align_to,
- u16 *tr0_cnt0, u16 *tr0_cnt1, u16 *tr1_cnt0)
-{
- if (len < SZ_64K) {
- *tr0_cnt0 = len;
- *tr0_cnt1 = 1;
-
- return 1;
- }
-
- if (align_to > 3)
- align_to = 3;
-
-realign:
- *tr0_cnt0 = SZ_64K - BIT(align_to);
- if (len / *tr0_cnt0 >= SZ_64K) {
- if (align_to) {
- align_to--;
- goto realign;
- }
- return -EINVAL;
- }
-
- *tr0_cnt1 = len / *tr0_cnt0;
- *tr1_cnt0 = len % *tr0_cnt0;
-
- return 2;
-}
-
-static struct udma_desc *
-udma_prep_slave_sg_tr(struct udma_chan *uc, struct scatterlist *sgl,
- unsigned int sglen, enum dma_transfer_direction dir,
- unsigned long tx_flags, void *context)
-{
- struct scatterlist *sgent;
- struct udma_desc *d;
- struct cppi5_tr_type1_t *tr_req = NULL;
- u16 tr0_cnt0, tr0_cnt1, tr1_cnt0;
- unsigned int i;
- size_t tr_size;
- int num_tr = 0;
- int tr_idx = 0;
- u64 asel;
-
- /* estimate the number of TRs we will need */
- for_each_sg(sgl, sgent, sglen, i) {
- if (sg_dma_len(sgent) < SZ_64K)
- num_tr++;
- else
- num_tr += 2;
- }
-
- /* Now allocate and setup the descriptor. */
- tr_size = sizeof(struct cppi5_tr_type1_t);
- d = udma_alloc_tr_desc(uc, tr_size, num_tr, dir);
- if (!d)
- return NULL;
-
- d->sglen = sglen;
-
- if (uc->ud->match_data->type == DMA_TYPE_UDMA)
- asel = 0;
- else
- asel = (u64)uc->config.asel << K3_ADDRESS_ASEL_SHIFT;
-
- tr_req = d->hwdesc[0].tr_req_base;
- for_each_sg(sgl, sgent, sglen, i) {
- dma_addr_t sg_addr = sg_dma_address(sgent);
-
- num_tr = udma_get_tr_counters(sg_dma_len(sgent), __ffs(sg_addr),
- &tr0_cnt0, &tr0_cnt1, &tr1_cnt0);
- if (num_tr < 0) {
- dev_err(uc->ud->dev, "size %u is not supported\n",
- sg_dma_len(sgent));
- udma_free_hwdesc(uc, d);
- kfree(d);
- return NULL;
- }
-
- cppi5_tr_init(&tr_req[tr_idx].flags, CPPI5_TR_TYPE1, false,
- false, CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
- cppi5_tr_csf_set(&tr_req[tr_idx].flags, CPPI5_TR_CSF_SUPR_EVT);
-
- sg_addr |= asel;
- tr_req[tr_idx].addr = sg_addr;
- tr_req[tr_idx].icnt0 = tr0_cnt0;
- tr_req[tr_idx].icnt1 = tr0_cnt1;
- tr_req[tr_idx].dim1 = tr0_cnt0;
- tr_idx++;
-
- if (num_tr == 2) {
- cppi5_tr_init(&tr_req[tr_idx].flags, CPPI5_TR_TYPE1,
- false, false,
- CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
- cppi5_tr_csf_set(&tr_req[tr_idx].flags,
- CPPI5_TR_CSF_SUPR_EVT);
-
- tr_req[tr_idx].addr = sg_addr + tr0_cnt1 * tr0_cnt0;
- tr_req[tr_idx].icnt0 = tr1_cnt0;
- tr_req[tr_idx].icnt1 = 1;
- tr_req[tr_idx].dim1 = tr1_cnt0;
- tr_idx++;
- }
-
- d->residue += sg_dma_len(sgent);
- }
-
- cppi5_tr_csf_set(&tr_req[tr_idx - 1].flags,
- CPPI5_TR_CSF_SUPR_EVT | CPPI5_TR_CSF_EOP);
-
- return d;
-}
-
-static struct udma_desc *
-udma_prep_slave_sg_triggered_tr(struct udma_chan *uc, struct scatterlist *sgl,
- unsigned int sglen,
- enum dma_transfer_direction dir,
- unsigned long tx_flags, void *context)
-{
- struct scatterlist *sgent;
- struct cppi5_tr_type15_t *tr_req = NULL;
- enum dma_slave_buswidth dev_width;
- u32 csf = CPPI5_TR_CSF_SUPR_EVT;
- u16 tr_cnt0, tr_cnt1;
- dma_addr_t dev_addr;
- struct udma_desc *d;
- unsigned int i;
- size_t tr_size, sg_len;
- int num_tr = 0;
- int tr_idx = 0;
- u32 burst, trigger_size, port_window;
- u64 asel;
-
- if (dir == DMA_DEV_TO_MEM) {
- dev_addr = uc->cfg.src_addr;
- dev_width = uc->cfg.src_addr_width;
- burst = uc->cfg.src_maxburst;
- port_window = uc->cfg.src_port_window_size;
- } else if (dir == DMA_MEM_TO_DEV) {
- dev_addr = uc->cfg.dst_addr;
- dev_width = uc->cfg.dst_addr_width;
- burst = uc->cfg.dst_maxburst;
- port_window = uc->cfg.dst_port_window_size;
- } else {
- dev_err(uc->ud->dev, "%s: bad direction?\n", __func__);
- return NULL;
- }
-
- if (!burst)
- burst = 1;
-
- if (port_window) {
- if (port_window != burst) {
- dev_err(uc->ud->dev,
- "The burst must be equal to port_window\n");
- return NULL;
- }
-
- tr_cnt0 = dev_width * port_window;
- tr_cnt1 = 1;
- } else {
- tr_cnt0 = dev_width;
- tr_cnt1 = burst;
- }
- trigger_size = tr_cnt0 * tr_cnt1;
-
- /* estimate the number of TRs we will need */
- for_each_sg(sgl, sgent, sglen, i) {
- sg_len = sg_dma_len(sgent);
-
- if (sg_len % trigger_size) {
- dev_err(uc->ud->dev,
- "Not aligned SG entry (%zu for %u)\n", sg_len,
- trigger_size);
- return NULL;
- }
-
- if (sg_len / trigger_size < SZ_64K)
- num_tr++;
- else
- num_tr += 2;
- }
-
- /* Now allocate and setup the descriptor. */
- tr_size = sizeof(struct cppi5_tr_type15_t);
- d = udma_alloc_tr_desc(uc, tr_size, num_tr, dir);
- if (!d)
- return NULL;
-
- d->sglen = sglen;
-
- if (uc->ud->match_data->type == DMA_TYPE_UDMA) {
- asel = 0;
- csf |= CPPI5_TR_CSF_EOL_ICNT0;
- } else {
- asel = (u64)uc->config.asel << K3_ADDRESS_ASEL_SHIFT;
- dev_addr |= asel;
- }
-
- tr_req = d->hwdesc[0].tr_req_base;
- for_each_sg(sgl, sgent, sglen, i) {
- u16 tr0_cnt2, tr0_cnt3, tr1_cnt2;
- dma_addr_t sg_addr = sg_dma_address(sgent);
-
- sg_len = sg_dma_len(sgent);
- num_tr = udma_get_tr_counters(sg_len / trigger_size, 0,
- &tr0_cnt2, &tr0_cnt3, &tr1_cnt2);
- if (num_tr < 0) {
- dev_err(uc->ud->dev, "size %zu is not supported\n",
- sg_len);
- udma_free_hwdesc(uc, d);
- kfree(d);
- return NULL;
- }
-
- cppi5_tr_init(&tr_req[tr_idx].flags, CPPI5_TR_TYPE15, false,
- true, CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
- cppi5_tr_csf_set(&tr_req[tr_idx].flags, csf);
- cppi5_tr_set_trigger(&tr_req[tr_idx].flags,
- uc->config.tr_trigger_type,
- CPPI5_TR_TRIGGER_TYPE_ICNT2_DEC, 0, 0);
-
- sg_addr |= asel;
- if (dir == DMA_DEV_TO_MEM) {
- tr_req[tr_idx].addr = dev_addr;
- tr_req[tr_idx].icnt0 = tr_cnt0;
- tr_req[tr_idx].icnt1 = tr_cnt1;
- tr_req[tr_idx].icnt2 = tr0_cnt2;
- tr_req[tr_idx].icnt3 = tr0_cnt3;
- tr_req[tr_idx].dim1 = (-1) * tr_cnt0;
-
- tr_req[tr_idx].daddr = sg_addr;
- tr_req[tr_idx].dicnt0 = tr_cnt0;
- tr_req[tr_idx].dicnt1 = tr_cnt1;
- tr_req[tr_idx].dicnt2 = tr0_cnt2;
- tr_req[tr_idx].dicnt3 = tr0_cnt3;
- tr_req[tr_idx].ddim1 = tr_cnt0;
- tr_req[tr_idx].ddim2 = trigger_size;
- tr_req[tr_idx].ddim3 = trigger_size * tr0_cnt2;
- } else {
- tr_req[tr_idx].addr = sg_addr;
- tr_req[tr_idx].icnt0 = tr_cnt0;
- tr_req[tr_idx].icnt1 = tr_cnt1;
- tr_req[tr_idx].icnt2 = tr0_cnt2;
- tr_req[tr_idx].icnt3 = tr0_cnt3;
- tr_req[tr_idx].dim1 = tr_cnt0;
- tr_req[tr_idx].dim2 = trigger_size;
- tr_req[tr_idx].dim3 = trigger_size * tr0_cnt2;
-
- tr_req[tr_idx].daddr = dev_addr;
- tr_req[tr_idx].dicnt0 = tr_cnt0;
- tr_req[tr_idx].dicnt1 = tr_cnt1;
- tr_req[tr_idx].dicnt2 = tr0_cnt2;
- tr_req[tr_idx].dicnt3 = tr0_cnt3;
- tr_req[tr_idx].ddim1 = (-1) * tr_cnt0;
- }
-
- tr_idx++;
-
- if (num_tr == 2) {
- cppi5_tr_init(&tr_req[tr_idx].flags, CPPI5_TR_TYPE15,
- false, true,
- CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
- cppi5_tr_csf_set(&tr_req[tr_idx].flags, csf);
- cppi5_tr_set_trigger(&tr_req[tr_idx].flags,
- uc->config.tr_trigger_type,
- CPPI5_TR_TRIGGER_TYPE_ICNT2_DEC,
- 0, 0);
-
- sg_addr += trigger_size * tr0_cnt2 * tr0_cnt3;
- if (dir == DMA_DEV_TO_MEM) {
- tr_req[tr_idx].addr = dev_addr;
- tr_req[tr_idx].icnt0 = tr_cnt0;
- tr_req[tr_idx].icnt1 = tr_cnt1;
- tr_req[tr_idx].icnt2 = tr1_cnt2;
- tr_req[tr_idx].icnt3 = 1;
- tr_req[tr_idx].dim1 = (-1) * tr_cnt0;
-
- tr_req[tr_idx].daddr = sg_addr;
- tr_req[tr_idx].dicnt0 = tr_cnt0;
- tr_req[tr_idx].dicnt1 = tr_cnt1;
- tr_req[tr_idx].dicnt2 = tr1_cnt2;
- tr_req[tr_idx].dicnt3 = 1;
- tr_req[tr_idx].ddim1 = tr_cnt0;
- tr_req[tr_idx].ddim2 = trigger_size;
- } else {
- tr_req[tr_idx].addr = sg_addr;
- tr_req[tr_idx].icnt0 = tr_cnt0;
- tr_req[tr_idx].icnt1 = tr_cnt1;
- tr_req[tr_idx].icnt2 = tr1_cnt2;
- tr_req[tr_idx].icnt3 = 1;
- tr_req[tr_idx].dim1 = tr_cnt0;
- tr_req[tr_idx].dim2 = trigger_size;
-
- tr_req[tr_idx].daddr = dev_addr;
- tr_req[tr_idx].dicnt0 = tr_cnt0;
- tr_req[tr_idx].dicnt1 = tr_cnt1;
- tr_req[tr_idx].dicnt2 = tr1_cnt2;
- tr_req[tr_idx].dicnt3 = 1;
- tr_req[tr_idx].ddim1 = (-1) * tr_cnt0;
- }
- tr_idx++;
- }
-
- d->residue += sg_len;
- }
-
- cppi5_tr_csf_set(&tr_req[tr_idx - 1].flags, csf | CPPI5_TR_CSF_EOP);
-
- return d;
-}
-
-static int udma_configure_statictr(struct udma_chan *uc, struct udma_desc *d,
- enum dma_slave_buswidth dev_width,
- u16 elcnt)
-{
- if (uc->config.ep_type != PSIL_EP_PDMA_XY)
- return 0;
-
- /* Bus width translates to the element size (ES) */
- switch (dev_width) {
- case DMA_SLAVE_BUSWIDTH_1_BYTE:
- d->static_tr.elsize = 0;
- break;
- case DMA_SLAVE_BUSWIDTH_2_BYTES:
- d->static_tr.elsize = 1;
- break;
- case DMA_SLAVE_BUSWIDTH_3_BYTES:
- d->static_tr.elsize = 2;
- break;
- case DMA_SLAVE_BUSWIDTH_4_BYTES:
- d->static_tr.elsize = 3;
- break;
- case DMA_SLAVE_BUSWIDTH_8_BYTES:
- d->static_tr.elsize = 4;
- break;
- default: /* not reached */
- return -EINVAL;
- }
-
- d->static_tr.elcnt = elcnt;
-
- if (uc->config.pkt_mode || !uc->cyclic) {
- /*
- * PDMA must close the packet when the channel is in packet mode.
- * For TR mode when the channel is not cyclic we also need PDMA
- * to close the packet otherwise the transfer will stall because
- * PDMA holds on the data it has received from the peripheral.
- */
- unsigned int div = dev_width * elcnt;
-
- if (uc->cyclic)
- d->static_tr.bstcnt = d->residue / d->sglen / div;
- else
- d->static_tr.bstcnt = d->residue / div;
- } else if (uc->ud->match_data->type == DMA_TYPE_BCDMA &&
- uc->config.dir == DMA_DEV_TO_MEM &&
- uc->cyclic) {
- /*
- * For cyclic mode with BCDMA we have to set EOP in each TR to
- * prevent short packet errors seen on channel teardown. So the
- * PDMA must close the packet after every TR transfer by setting
- * burst count equal to the number of bytes transferred.
- */
- struct cppi5_tr_type1_t *tr_req = d->hwdesc[0].tr_req_base;
-
- d->static_tr.bstcnt =
- (tr_req->icnt0 * tr_req->icnt1) / dev_width;
- } else {
- d->static_tr.bstcnt = 0;
- }
-
- if (uc->config.dir == DMA_DEV_TO_MEM &&
- d->static_tr.bstcnt > uc->ud->match_data->statictr_z_mask)
- return -EINVAL;
-
- return 0;
-}
-
-static struct udma_desc *
-udma_prep_slave_sg_pkt(struct udma_chan *uc, struct scatterlist *sgl,
- unsigned int sglen, enum dma_transfer_direction dir,
- unsigned long tx_flags, void *context)
-{
- struct scatterlist *sgent;
- struct cppi5_host_desc_t *h_desc = NULL;
- struct udma_desc *d;
- u32 ring_id;
- unsigned int i;
- u64 asel;
-
- d = kzalloc_flex(*d, hwdesc, sglen, GFP_NOWAIT);
- if (!d)
- return NULL;
-
- d->sglen = sglen;
- d->hwdesc_count = sglen;
-
- if (dir == DMA_DEV_TO_MEM)
- ring_id = k3_ringacc_get_ring_id(uc->rflow->r_ring);
- else
- ring_id = k3_ringacc_get_ring_id(uc->tchan->tc_ring);
-
- if (uc->ud->match_data->type == DMA_TYPE_UDMA)
- asel = 0;
- else
- asel = (u64)uc->config.asel << K3_ADDRESS_ASEL_SHIFT;
-
- for_each_sg(sgl, sgent, sglen, i) {
- struct udma_hwdesc *hwdesc = &d->hwdesc[i];
- dma_addr_t sg_addr = sg_dma_address(sgent);
- struct cppi5_host_desc_t *desc;
- size_t sg_len = sg_dma_len(sgent);
-
- hwdesc->cppi5_desc_vaddr = dma_pool_zalloc(uc->hdesc_pool,
- GFP_NOWAIT,
- &hwdesc->cppi5_desc_paddr);
- if (!hwdesc->cppi5_desc_vaddr) {
- dev_err(uc->ud->dev,
- "descriptor%d allocation failed\n", i);
-
- udma_free_hwdesc(uc, d);
- kfree(d);
- return NULL;
- }
-
- d->residue += sg_len;
- hwdesc->cppi5_desc_size = uc->config.hdesc_size;
- desc = hwdesc->cppi5_desc_vaddr;
-
- if (i == 0) {
- cppi5_hdesc_init(desc, 0, 0);
- /* Flow and Packed ID */
- cppi5_desc_set_pktids(&desc->hdr, uc->id,
- CPPI5_INFO1_DESC_FLOWID_DEFAULT);
- cppi5_desc_set_retpolicy(&desc->hdr, 0, ring_id);
- } else {
- cppi5_hdesc_reset_hbdesc(desc);
- cppi5_desc_set_retpolicy(&desc->hdr, 0, 0xffff);
- }
-
- /* attach the sg buffer to the descriptor */
- sg_addr |= asel;
- cppi5_hdesc_attach_buf(desc, sg_addr, sg_len, sg_addr, sg_len);
-
- /* Attach link as host buffer descriptor */
- if (h_desc)
- cppi5_hdesc_link_hbdesc(h_desc,
- hwdesc->cppi5_desc_paddr | asel);
-
- if (uc->ud->match_data->type == DMA_TYPE_PKTDMA ||
- dir == DMA_MEM_TO_DEV)
- h_desc = desc;
- }
-
- if (d->residue >= SZ_4M) {
- dev_err(uc->ud->dev,
- "%s: Transfer size %u is over the supported 4M range\n",
- __func__, d->residue);
- udma_free_hwdesc(uc, d);
- kfree(d);
- return NULL;
- }
-
- h_desc = d->hwdesc[0].cppi5_desc_vaddr;
- cppi5_hdesc_set_pktlen(h_desc, d->residue);
-
- return d;
-}
-
-static int udma_attach_metadata(struct dma_async_tx_descriptor *desc,
- void *data, size_t len)
-{
- struct udma_desc *d = to_udma_desc(desc);
- struct udma_chan *uc = to_udma_chan(desc->chan);
- struct cppi5_host_desc_t *h_desc;
- u32 psd_size = len;
- u32 flags = 0;
-
- if (!uc->config.pkt_mode || !uc->config.metadata_size)
- return -ENOTSUPP;
-
- if (!data || len > uc->config.metadata_size)
- return -EINVAL;
-
- if (uc->config.needs_epib && len < CPPI5_INFO0_HDESC_EPIB_SIZE)
- return -EINVAL;
-
- h_desc = d->hwdesc[0].cppi5_desc_vaddr;
- if (d->dir == DMA_MEM_TO_DEV)
- memcpy(h_desc->epib, data, len);
-
- if (uc->config.needs_epib)
- psd_size -= CPPI5_INFO0_HDESC_EPIB_SIZE;
-
- d->metadata = data;
- d->metadata_size = len;
- if (uc->config.needs_epib)
- flags |= CPPI5_INFO0_HDESC_EPIB_PRESENT;
-
- cppi5_hdesc_update_flags(h_desc, flags);
- cppi5_hdesc_update_psdata_size(h_desc, psd_size);
-
- return 0;
-}
-
-static void *udma_get_metadata_ptr(struct dma_async_tx_descriptor *desc,
- size_t *payload_len, size_t *max_len)
-{
- struct udma_desc *d = to_udma_desc(desc);
- struct udma_chan *uc = to_udma_chan(desc->chan);
- struct cppi5_host_desc_t *h_desc;
-
- if (!uc->config.pkt_mode || !uc->config.metadata_size)
- return ERR_PTR(-ENOTSUPP);
-
- h_desc = d->hwdesc[0].cppi5_desc_vaddr;
-
- *max_len = uc->config.metadata_size;
-
- *payload_len = cppi5_hdesc_epib_present(&h_desc->hdr) ?
- CPPI5_INFO0_HDESC_EPIB_SIZE : 0;
- *payload_len += cppi5_hdesc_get_psdata_size(h_desc);
-
- return h_desc->epib;
-}
-
-static int udma_set_metadata_len(struct dma_async_tx_descriptor *desc,
- size_t payload_len)
-{
- struct udma_desc *d = to_udma_desc(desc);
- struct udma_chan *uc = to_udma_chan(desc->chan);
- struct cppi5_host_desc_t *h_desc;
- u32 psd_size = payload_len;
- u32 flags = 0;
-
- if (!uc->config.pkt_mode || !uc->config.metadata_size)
- return -ENOTSUPP;
-
- if (payload_len > uc->config.metadata_size)
- return -EINVAL;
-
- if (uc->config.needs_epib && payload_len < CPPI5_INFO0_HDESC_EPIB_SIZE)
- return -EINVAL;
-
- h_desc = d->hwdesc[0].cppi5_desc_vaddr;
-
- if (uc->config.needs_epib) {
- psd_size -= CPPI5_INFO0_HDESC_EPIB_SIZE;
- flags |= CPPI5_INFO0_HDESC_EPIB_PRESENT;
- }
-
- cppi5_hdesc_update_flags(h_desc, flags);
- cppi5_hdesc_update_psdata_size(h_desc, psd_size);
-
- return 0;
-}
-
-static const struct dma_descriptor_metadata_ops metadata_ops = {
- .attach = udma_attach_metadata,
- .get_ptr = udma_get_metadata_ptr,
- .set_len = udma_set_metadata_len,
-};
-
-static struct dma_async_tx_descriptor *
-udma_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
- unsigned int sglen, enum dma_transfer_direction dir,
- unsigned long tx_flags, void *context)
-{
- struct udma_chan *uc = to_udma_chan(chan);
- enum dma_slave_buswidth dev_width;
- struct udma_desc *d;
- u32 burst;
-
- if (dir != uc->config.dir &&
- (uc->config.dir == DMA_MEM_TO_MEM && !uc->config.tr_trigger_type)) {
- dev_err(chan->device->dev,
- "%s: chan%d is for %s, not supporting %s\n",
- __func__, uc->id,
- dmaengine_get_direction_text(uc->config.dir),
- dmaengine_get_direction_text(dir));
- return NULL;
- }
-
- if (dir == DMA_DEV_TO_MEM) {
- dev_width = uc->cfg.src_addr_width;
- burst = uc->cfg.src_maxburst;
- } else if (dir == DMA_MEM_TO_DEV) {
- dev_width = uc->cfg.dst_addr_width;
- burst = uc->cfg.dst_maxburst;
- } else {
- dev_err(chan->device->dev, "%s: bad direction?\n", __func__);
- return NULL;
- }
-
- if (!burst)
- burst = 1;
-
- uc->config.tx_flags = tx_flags;
-
- if (uc->config.pkt_mode)
- d = udma_prep_slave_sg_pkt(uc, sgl, sglen, dir, tx_flags,
- context);
- else if (is_slave_direction(uc->config.dir))
- d = udma_prep_slave_sg_tr(uc, sgl, sglen, dir, tx_flags,
- context);
- else
- d = udma_prep_slave_sg_triggered_tr(uc, sgl, sglen, dir,
- tx_flags, context);
-
- if (!d)
- return NULL;
-
- d->dir = dir;
- d->desc_idx = 0;
- d->tr_idx = 0;
-
- /* static TR for remote PDMA */
- if (udma_configure_statictr(uc, d, dev_width, burst)) {
- dev_err(uc->ud->dev,
- "%s: StaticTR Z is limited to maximum %u (%u)\n",
- __func__, uc->ud->match_data->statictr_z_mask,
- d->static_tr.bstcnt);
-
- udma_free_hwdesc(uc, d);
- kfree(d);
- return NULL;
- }
-
- if (uc->config.metadata_size)
- d->vd.tx.metadata_ops = &metadata_ops;
-
- return vchan_tx_prep(&uc->vc, &d->vd, tx_flags);
-}
-
-static struct udma_desc *
-udma_prep_dma_cyclic_tr(struct udma_chan *uc, dma_addr_t buf_addr,
- size_t buf_len, size_t period_len,
- enum dma_transfer_direction dir, unsigned long flags)
-{
- struct udma_desc *d;
- size_t tr_size, period_addr;
- struct cppi5_tr_type1_t *tr_req;
- unsigned int periods = buf_len / period_len;
- u16 tr0_cnt0, tr0_cnt1, tr1_cnt0;
- unsigned int i;
- int num_tr;
- u32 period_csf = 0;
-
- num_tr = udma_get_tr_counters(period_len, __ffs(buf_addr), &tr0_cnt0,
- &tr0_cnt1, &tr1_cnt0);
- if (num_tr < 0) {
- dev_err(uc->ud->dev, "size %zu is not supported\n",
- period_len);
- return NULL;
- }
-
- /* Now allocate and setup the descriptor. */
- tr_size = sizeof(struct cppi5_tr_type1_t);
- d = udma_alloc_tr_desc(uc, tr_size, periods * num_tr, dir);
- if (!d)
- return NULL;
-
- tr_req = d->hwdesc[0].tr_req_base;
- if (uc->ud->match_data->type == DMA_TYPE_UDMA)
- period_addr = buf_addr;
- else
- period_addr = buf_addr |
- ((u64)uc->config.asel << K3_ADDRESS_ASEL_SHIFT);
-
- /*
- * For BCDMA <-> PDMA transfers, the EOP flag needs to be set on the
- * last TR of a descriptor, to mark the packet as complete.
- * This is required for getting the teardown completion message in case
- * of TX, and to avoid short-packet error in case of RX.
- *
- * As we are in cyclic mode, we do not know which period might be the
- * last one, so set the flag for each period.
- */
- if (uc->config.ep_type == PSIL_EP_PDMA_XY &&
- uc->ud->match_data->type == DMA_TYPE_BCDMA) {
- period_csf = CPPI5_TR_CSF_EOP;
- }
-
- for (i = 0; i < periods; i++) {
- int tr_idx = i * num_tr;
-
- cppi5_tr_init(&tr_req[tr_idx].flags, CPPI5_TR_TYPE1, false,
- false, CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
-
- tr_req[tr_idx].addr = period_addr;
- tr_req[tr_idx].icnt0 = tr0_cnt0;
- tr_req[tr_idx].icnt1 = tr0_cnt1;
- tr_req[tr_idx].dim1 = tr0_cnt0;
-
- if (num_tr == 2) {
- cppi5_tr_csf_set(&tr_req[tr_idx].flags,
- CPPI5_TR_CSF_SUPR_EVT);
- tr_idx++;
-
- cppi5_tr_init(&tr_req[tr_idx].flags, CPPI5_TR_TYPE1,
- false, false,
- CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
-
- tr_req[tr_idx].addr = period_addr + tr0_cnt1 * tr0_cnt0;
- tr_req[tr_idx].icnt0 = tr1_cnt0;
- tr_req[tr_idx].icnt1 = 1;
- tr_req[tr_idx].dim1 = tr1_cnt0;
- }
-
- if (!(flags & DMA_PREP_INTERRUPT))
- period_csf |= CPPI5_TR_CSF_SUPR_EVT;
-
- if (period_csf)
- cppi5_tr_csf_set(&tr_req[tr_idx].flags, period_csf);
-
- period_addr += period_len;
- }
-
- return d;
-}
-
-static struct udma_desc *
-udma_prep_dma_cyclic_pkt(struct udma_chan *uc, dma_addr_t buf_addr,
- size_t buf_len, size_t period_len,
- enum dma_transfer_direction dir, unsigned long flags)
-{
- struct udma_desc *d;
- u32 ring_id;
- int i;
- int periods = buf_len / period_len;
-
- if (periods > (K3_UDMA_DEFAULT_RING_SIZE - 1))
- return NULL;
-
- if (period_len >= SZ_4M)
- return NULL;
-
- d = kzalloc_flex(*d, hwdesc, periods, GFP_NOWAIT);
- if (!d)
- return NULL;
-
- d->hwdesc_count = periods;
-
- /* TODO: re-check this... */
- if (dir == DMA_DEV_TO_MEM)
- ring_id = k3_ringacc_get_ring_id(uc->rflow->r_ring);
- else
- ring_id = k3_ringacc_get_ring_id(uc->tchan->tc_ring);
-
- if (uc->ud->match_data->type != DMA_TYPE_UDMA)
- buf_addr |= (u64)uc->config.asel << K3_ADDRESS_ASEL_SHIFT;
-
- for (i = 0; i < periods; i++) {
- struct udma_hwdesc *hwdesc = &d->hwdesc[i];
- dma_addr_t period_addr = buf_addr + (period_len * i);
- struct cppi5_host_desc_t *h_desc;
-
- hwdesc->cppi5_desc_vaddr = dma_pool_zalloc(uc->hdesc_pool,
- GFP_NOWAIT,
- &hwdesc->cppi5_desc_paddr);
- if (!hwdesc->cppi5_desc_vaddr) {
- dev_err(uc->ud->dev,
- "descriptor%d allocation failed\n", i);
-
- udma_free_hwdesc(uc, d);
- kfree(d);
- return NULL;
- }
-
- hwdesc->cppi5_desc_size = uc->config.hdesc_size;
- h_desc = hwdesc->cppi5_desc_vaddr;
-
- cppi5_hdesc_init(h_desc, 0, 0);
- cppi5_hdesc_set_pktlen(h_desc, period_len);
-
- /* Flow and Packed ID */
- cppi5_desc_set_pktids(&h_desc->hdr, uc->id,
- CPPI5_INFO1_DESC_FLOWID_DEFAULT);
- cppi5_desc_set_retpolicy(&h_desc->hdr, 0, ring_id);
-
- /* attach each period to a new descriptor */
- cppi5_hdesc_attach_buf(h_desc,
- period_addr, period_len,
- period_addr, period_len);
- }
-
- return d;
-}
-
-static struct dma_async_tx_descriptor *
-udma_prep_dma_cyclic(struct dma_chan *chan, dma_addr_t buf_addr, size_t buf_len,
- size_t period_len, enum dma_transfer_direction dir,
- unsigned long flags)
-{
- struct udma_chan *uc = to_udma_chan(chan);
- enum dma_slave_buswidth dev_width;
- struct udma_desc *d;
- u32 burst;
-
- if (dir != uc->config.dir) {
- dev_err(chan->device->dev,
- "%s: chan%d is for %s, not supporting %s\n",
- __func__, uc->id,
- dmaengine_get_direction_text(uc->config.dir),
- dmaengine_get_direction_text(dir));
- return NULL;
- }
-
- uc->cyclic = true;
-
- if (dir == DMA_DEV_TO_MEM) {
- dev_width = uc->cfg.src_addr_width;
- burst = uc->cfg.src_maxburst;
- } else if (dir == DMA_MEM_TO_DEV) {
- dev_width = uc->cfg.dst_addr_width;
- burst = uc->cfg.dst_maxburst;
- } else {
- dev_err(uc->ud->dev, "%s: bad direction?\n", __func__);
- return NULL;
- }
-
- if (!burst)
- burst = 1;
-
- if (uc->config.pkt_mode)
- d = udma_prep_dma_cyclic_pkt(uc, buf_addr, buf_len, period_len,
- dir, flags);
- else
- d = udma_prep_dma_cyclic_tr(uc, buf_addr, buf_len, period_len,
- dir, flags);
-
- if (!d)
- return NULL;
-
- d->sglen = buf_len / period_len;
-
- d->dir = dir;
- d->residue = buf_len;
-
- /* static TR for remote PDMA */
- if (udma_configure_statictr(uc, d, dev_width, burst)) {
- dev_err(uc->ud->dev,
- "%s: StaticTR Z is limited to maximum %u (%u)\n",
- __func__, uc->ud->match_data->statictr_z_mask,
- d->static_tr.bstcnt);
-
- udma_free_hwdesc(uc, d);
- kfree(d);
- return NULL;
- }
-
- if (uc->config.metadata_size)
- d->vd.tx.metadata_ops = &metadata_ops;
-
- return vchan_tx_prep(&uc->vc, &d->vd, flags);
-}
-
-static struct dma_async_tx_descriptor *
-udma_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src,
- size_t len, unsigned long tx_flags)
-{
- struct udma_chan *uc = to_udma_chan(chan);
- struct udma_desc *d;
- struct cppi5_tr_type15_t *tr_req;
- int num_tr;
- size_t tr_size = sizeof(struct cppi5_tr_type15_t);
- u16 tr0_cnt0, tr0_cnt1, tr1_cnt0;
- u32 csf = CPPI5_TR_CSF_SUPR_EVT;
-
- if (uc->config.dir != DMA_MEM_TO_MEM) {
- dev_err(chan->device->dev,
- "%s: chan%d is for %s, not supporting %s\n",
- __func__, uc->id,
- dmaengine_get_direction_text(uc->config.dir),
- dmaengine_get_direction_text(DMA_MEM_TO_MEM));
- return NULL;
- }
-
- num_tr = udma_get_tr_counters(len, __ffs(src | dest), &tr0_cnt0,
- &tr0_cnt1, &tr1_cnt0);
- if (num_tr < 0) {
- dev_err(uc->ud->dev, "size %zu is not supported\n",
- len);
- return NULL;
- }
-
- d = udma_alloc_tr_desc(uc, tr_size, num_tr, DMA_MEM_TO_MEM);
- if (!d)
- return NULL;
-
- d->dir = DMA_MEM_TO_MEM;
- d->desc_idx = 0;
- d->tr_idx = 0;
- d->residue = len;
-
- if (uc->ud->match_data->type != DMA_TYPE_UDMA) {
- src |= (u64)uc->ud->asel << K3_ADDRESS_ASEL_SHIFT;
- dest |= (u64)uc->ud->asel << K3_ADDRESS_ASEL_SHIFT;
- } else {
- csf |= CPPI5_TR_CSF_EOL_ICNT0;
- }
-
- tr_req = d->hwdesc[0].tr_req_base;
-
- cppi5_tr_init(&tr_req[0].flags, CPPI5_TR_TYPE15, false, true,
- CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
- cppi5_tr_csf_set(&tr_req[0].flags, csf);
-
- tr_req[0].addr = src;
- tr_req[0].icnt0 = tr0_cnt0;
- tr_req[0].icnt1 = tr0_cnt1;
- tr_req[0].icnt2 = 1;
- tr_req[0].icnt3 = 1;
- tr_req[0].dim1 = tr0_cnt0;
-
- tr_req[0].daddr = dest;
- tr_req[0].dicnt0 = tr0_cnt0;
- tr_req[0].dicnt1 = tr0_cnt1;
- tr_req[0].dicnt2 = 1;
- tr_req[0].dicnt3 = 1;
- tr_req[0].ddim1 = tr0_cnt0;
-
- if (num_tr == 2) {
- cppi5_tr_init(&tr_req[1].flags, CPPI5_TR_TYPE15, false, true,
- CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
- cppi5_tr_csf_set(&tr_req[1].flags, csf);
-
- tr_req[1].addr = src + tr0_cnt1 * tr0_cnt0;
- tr_req[1].icnt0 = tr1_cnt0;
- tr_req[1].icnt1 = 1;
- tr_req[1].icnt2 = 1;
- tr_req[1].icnt3 = 1;
-
- tr_req[1].daddr = dest + tr0_cnt1 * tr0_cnt0;
- tr_req[1].dicnt0 = tr1_cnt0;
- tr_req[1].dicnt1 = 1;
- tr_req[1].dicnt2 = 1;
- tr_req[1].dicnt3 = 1;
- }
-
- cppi5_tr_csf_set(&tr_req[num_tr - 1].flags, csf | CPPI5_TR_CSF_EOP);
-
- if (uc->config.metadata_size)
- d->vd.tx.metadata_ops = &metadata_ops;
-
- return vchan_tx_prep(&uc->vc, &d->vd, tx_flags);
-}
-
static void udma_issue_pending(struct dma_chan *chan)
{
struct udma_chan *uc = to_udma_chan(chan);
@@ -3587,46 +2409,6 @@ static void udma_synchronize(struct dma_chan *chan)
udma_reset_rings(uc);
}
-static void udma_desc_pre_callback(struct virt_dma_chan *vc,
- struct virt_dma_desc *vd,
- struct dmaengine_result *result)
-{
- struct udma_chan *uc = to_udma_chan(&vc->chan);
- struct udma_desc *d;
- u8 status;
-
- if (!vd)
- return;
-
- d = to_udma_desc(&vd->tx);
-
- if (d->metadata_size)
- udma_fetch_epib(uc, d);
-
- if (result) {
- void *desc_vaddr = udma_curr_cppi5_desc_vaddr(d, d->desc_idx);
-
- if (cppi5_desc_get_type(desc_vaddr) ==
- CPPI5_INFO0_DESC_TYPE_VAL_HOST) {
- /* Provide residue information for the client */
- result->residue = d->residue -
- cppi5_hdesc_get_pktlen(desc_vaddr);
- if (result->residue)
- result->result = DMA_TRANS_ABORTED;
- else
- result->result = DMA_TRANS_NOERROR;
- } else {
- result->residue = 0;
- /* Propagate TR Response errors to the client */
- status = d->hwdesc[0].tr_resp_base->status;
- if (status)
- result->result = DMA_TRANS_ABORTED;
- else
- result->result = DMA_TRANS_NOERROR;
- }
- }
-}
-
/*
* This tasklet handles the completion of a DMA descriptor by
* calling its callback and freeing it.
diff --git a/drivers/dma/ti/k3-udma.h b/drivers/dma/ti/k3-udma.h
index 54e1757c3de38..62c15b0cc9ae7 100644
--- a/drivers/dma/ti/k3-udma.h
+++ b/drivers/dma/ti/k3-udma.h
@@ -560,6 +560,60 @@ static inline void udma_fetch_epib(struct udma_chan *uc, struct udma_desc *d)
memcpy(d->metadata, h_desc->epib, d->metadata_size);
}
+/* Common functions */
+struct udma_desc *udma_udma_desc_from_paddr(struct udma_chan *uc,
+ dma_addr_t paddr);
+void udma_free_hwdesc(struct udma_chan *uc, struct udma_desc *d);
+void udma_purge_desc_work(struct work_struct *work);
+void udma_desc_free(struct virt_dma_desc *vd);
+bool udma_desc_is_rx_flush(struct udma_chan *uc, dma_addr_t addr);
+bool udma_is_desc_really_done(struct udma_chan *uc, struct udma_desc *d);
+struct udma_desc *udma_alloc_tr_desc(struct udma_chan *uc,
+ size_t tr_size, int tr_count,
+ enum dma_transfer_direction dir);
+int udma_get_tr_counters(size_t len, unsigned long align_to,
+ u16 *tr0_cnt0, u16 *tr0_cnt1, u16 *tr1_cnt0);
+struct udma_desc *udma_prep_slave_sg_tr(struct udma_chan *uc,
+ struct scatterlist *sgl, unsigned int sglen,
+ enum dma_transfer_direction dir,
+ unsigned long tx_flags, void *context);
+struct udma_desc *udma_prep_slave_sg_triggered_tr(struct udma_chan *uc,
+ struct scatterlist *sgl, unsigned int sglen,
+ enum dma_transfer_direction dir,
+ unsigned long tx_flags, void *context);
+int udma_configure_statictr(struct udma_chan *uc, struct udma_desc *d,
+ enum dma_slave_buswidth dev_width, u16 elcnt);
+struct udma_desc *udma_prep_slave_sg_pkt(struct udma_chan *uc,
+ struct scatterlist *sgl, unsigned int sglen,
+ enum dma_transfer_direction dir,
+ unsigned long tx_flags, void *context);
+int udma_attach_metadata(struct dma_async_tx_descriptor *desc,
+ void *data, size_t len);
+void *udma_get_metadata_ptr(struct dma_async_tx_descriptor *desc,
+ size_t *payload_len, size_t *max_len);
+int udma_set_metadata_len(struct dma_async_tx_descriptor *desc,
+ size_t payload_len);
+struct dma_async_tx_descriptor *udma_prep_slave_sg(struct dma_chan *chan,
+ struct scatterlist *sgl, unsigned int sglen,
+ enum dma_transfer_direction dir,
+ unsigned long tx_flags, void *context);
+struct udma_desc *udma_prep_dma_cyclic_tr(struct udma_chan *uc,
+ dma_addr_t buf_addr, size_t buf_len, size_t period_len,
+ enum dma_transfer_direction dir, unsigned long flags);
+struct udma_desc *udma_prep_dma_cyclic_pkt(struct udma_chan *uc,
+ dma_addr_t buf_addr, size_t buf_len, size_t period_len,
+ enum dma_transfer_direction dir, unsigned long flags);
+struct dma_async_tx_descriptor *udma_prep_dma_cyclic(struct dma_chan *chan, dma_addr_t buf_addr,
+ size_t buf_len, size_t period_len,
+ enum dma_transfer_direction dir,
+ unsigned long flags);
+struct dma_async_tx_descriptor *udma_prep_dma_memcpy(struct dma_chan *chan,
+ dma_addr_t dest, dma_addr_t src,
+ size_t len, unsigned long tx_flags);
+void udma_desc_pre_callback(struct virt_dma_chan *vc,
+ struct virt_dma_desc *vd,
+ struct dmaengine_result *result);
+
/* Direct access to UDMA low lever resources for the glue layer */
int xudma_navss_psil_pair(struct udma_dev *ud, u32 src_thread, u32 dst_thread);
int xudma_navss_psil_unpair(struct udma_dev *ud, u32 src_thread,
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 05/19] dmaengine: ti: k3-udma: move descriptor management to k3-udma-common.c
2026-08-10 15:13 ` [PATCH v8 05/19] dmaengine: ti: k3-udma: move descriptor management to k3-udma-common.c Sai Sree Kartheek Adivi
@ 2026-08-10 15:56 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-08-10 15:56 UTC (permalink / raw)
To: Sai Sree Kartheek Adivi
Cc: Frank.Li, dmaengine, devicetree, vkoul, robh, conor+dt
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:
Pre-existing issues:
- [Critical] Swapped arguments to `cppi5_trdesc_calc_size` causes heap buffer under-allocation.
- [High] Missing `.remove` callback in platform driver leads to UAF on module unload.
- [High] Global channel state overwritten without locks during descriptor preparation.
- [High] Race condition between teardown IRQ and `udma_free_chan_resources` causes Double Free.
- [High] Zero-length scatterlist (`sglen == 0`) causes out-of-bounds array access and wild pointer dereference.
--
--- Patch [5]: [PATCH v8 05/19] dmaengine: ti: k3-udma: move descriptor management to k3-udma-common.c ---
commit 2f5a11e37f11d6bdbc83b58ccea07da9ab136d47
Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>
dmaengine: ti: k3-udma: move descriptor management to k3-udma-common.c
Refactor the K3 UDMA driver by moving all DMA descriptor handling
functions from k3-udma.c to a new common library, k3-udma-common.c.
This prepares the driver for supporting new K3 UDMA v2 variant.
No functional changes intended.
> diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
> new file mode 100644
> index 0000000000000..3130805a8ec40
> --- /dev/null
> +++ b/drivers/dma/ti/k3-udma-common.c
[ ... ]
> + if (uc->use_dma_pool) {
> + hwdesc->cppi5_desc_size = uc->config.hdesc_size;
> + hwdesc->cppi5_desc_vaddr = dma_pool_zalloc(uc->hdesc_pool,
> + GFP_NOWAIT,
> + &hwdesc->cppi5_desc_paddr);
> + } else {
> + hwdesc->cppi5_desc_size = cppi5_trdesc_calc_size(tr_size,
> + tr_count);
[Severity: Critical]
This is a pre-existing issue, but are the arguments to
cppi5_trdesc_calc_size() swapped here?
The function signature expects the count first and then the size, but it
is called with tr_size as the first argument.
When processing a scatterlist with a large number of segments where the
count exceeds the size, could this result in an under-allocation and
a subsequent heap buffer overflow?
[ ... ]
> + d->residue += sg_dma_len(sgent);
> + }
> +
> + cppi5_tr_csf_set(&tr_req[tr_idx - 1].flags,
> + CPPI5_TR_CSF_SUPR_EVT | CPPI5_TR_CSF_EOP);
[Severity: High]
This isn't a bug introduced by this patch, but what happens if a consumer
submits a zero-length scatterlist?
If sglen is 0, the tr_idx variable remains 0. Does this result in a
write to tr_req[-1], causing an out-of-bounds access and corrupting
the descriptor header?
[ ... ]
> + if (d->residue >= SZ_4M) {
> + dev_err(uc->ud->dev,
> + "%s: Transfer size %u is over the supported 4M range\n",
> + __func__, d->residue);
> + udma_free_hwdesc(uc, d);
> + kfree(d);
> + return NULL;
> + }
> +
> + h_desc = d->hwdesc[0].cppi5_desc_vaddr;
> + cppi5_hdesc_set_pktlen(h_desc, d->residue);
[Severity: High]
This is a pre-existing issue, but similar to the above, if a consumer
provides a zero-length scatterlist, the flexible array hwdesc is
allocated with zero elements.
Since the code unconditionally accesses the first element of the flexible
array to retrieve h_desc, could this lead to an out-of-bounds pointer
dereference and memory corruption?
[ ... ]
> + if (!burst)
> + burst = 1;
> +
> + uc->config.tx_flags = tx_flags;
[Severity: High]
This isn't a bug introduced by this patch, but it looks like the global
channel state is being modified without holding the vc.lock.
If a consumer prepares multiple descriptors concurrently with different
flags, could the last prepared descriptor overwrite the channel state?
When udma_is_desc_really_done() checks the flags later, this might cause
it to skip the stall check and falsely complete the transfer while data
remains in the DMA fabric.
[ ... ]
> + if (dir != uc->config.dir) {
> + dev_err(chan->device->dev,
> + "%s: chan%d is for %s, not supporting %s\n",
> + __func__, uc->id,
> + dmaengine_get_direction_text(uc->config.dir),
> + dmaengine_get_direction_text(dir));
> + return NULL;
> + }
> +
> + uc->cyclic = true;
[Severity: High]
This is a pre-existing issue, but similar to the tx_flags modification,
this global channel state is being updated without holding any lock.
Can this lead to the same race conditions and data corruption if
concurrently modified?
I also noticed a few other pre-existing issues in the surrounding
driver code that might be worth looking into while refactoring.
[Severity: High]
In drivers/dma/ti/k3-udma.c, there appears to be a race condition between
udma_free_chan_resources() and the teardown IRQ handler:
udma_free_chan_resources() {
...
udma_terminate_all(chan);
if (uc->terminated_desc) {
udma_reset_chan(uc, false);
udma_reset_rings(uc);
}
}
The udma_reset_rings() function checks for uc->terminated_desc and frees
it without holding the lock.
If udma_terminate_all() triggers a hardware teardown completion message,
and the IRQ handler concurrently takes the lock and frees the descriptor,
do both threads end up freeing the same terminated_desc, leading to a
double free?
[Severity: High]
Also in drivers/dma/ti/k3-udma.c, the platform_driver definition lacks
a remove callback:
static struct platform_driver udma_driver = {
.driver = {
.name = "ti-k3-udma",
.of_match_table = udma_of_match,
.suppress_bind_attrs = true,
},
.probe = udma_probe,
};
Because this is a tristate module, if the driver is unloaded via rmmod,
the registrations from udma_probe() are not symmetrically torn down.
Since devres will free the memory while the DMA engine subsystem retains
pointers to it, could this cause a use-after-free upon the next DMA access?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260810151423.1948224-1-s-adivi@ti.com?part=5
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 06/19] dmaengine: ti: k3-udma: move ring management functions to k3-udma-common.c
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
` (4 preceding siblings ...)
2026-08-10 15:13 ` [PATCH v8 05/19] dmaengine: ti: k3-udma: move descriptor management to k3-udma-common.c Sai Sree Kartheek Adivi
@ 2026-08-10 15:14 ` Sai Sree Kartheek Adivi
2026-08-10 15:52 ` sashiko-bot
2026-08-10 15:14 ` [PATCH v8 07/19] dmaengine: ti: k3-udma: Add variant-specific function pointers to udma_dev Sai Sree Kartheek Adivi
` (12 subsequent siblings)
18 siblings, 1 reply; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:14 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
Relocate the ring management functions such as push, pop, and reset
from k3-udma.c to k3-udma-common.c file. These operations are
common across multiple K3 UDMA variants and will be reused by
future implementations like K3 UDMA v2.
No functional changes intended.
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
drivers/dma/ti/k3-udma-common.c | 103 ++++++++++++++++++++++++++++++++
drivers/dma/ti/k3-udma.c | 100 -------------------------------
drivers/dma/ti/k3-udma.h | 4 ++
3 files changed, 107 insertions(+), 100 deletions(-)
diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
index 3130805a8ec40..3ec5cc932280c 100644
--- a/drivers/dma/ti/k3-udma-common.c
+++ b/drivers/dma/ti/k3-udma-common.c
@@ -1239,5 +1239,108 @@ void udma_desc_pre_callback(struct virt_dma_chan *vc,
}
EXPORT_SYMBOL_GPL(udma_desc_pre_callback);
+int udma_push_to_ring(struct udma_chan *uc, int idx)
+{
+ struct udma_desc *d = uc->desc;
+ struct k3_ring *ring = NULL;
+ dma_addr_t paddr;
+
+ switch (uc->config.dir) {
+ case DMA_DEV_TO_MEM:
+ ring = uc->rflow->fd_ring;
+ break;
+ case DMA_MEM_TO_DEV:
+ case DMA_MEM_TO_MEM:
+ ring = uc->tchan->t_ring;
+ break;
+ default:
+ return -EINVAL;
+ }
+
+ /* RX flush packet: idx == -1 is only passed in case of DEV_TO_MEM */
+ if (idx == -1) {
+ paddr = udma_get_rx_flush_hwdesc_paddr(uc);
+ } else {
+ paddr = udma_curr_cppi5_desc_paddr(d, idx);
+
+ wmb(); /* Ensure that writes are not moved over this point */
+ }
+
+ return k3_ringacc_ring_push(ring, &paddr);
+}
+EXPORT_SYMBOL_GPL(udma_push_to_ring);
+
+int udma_pop_from_ring(struct udma_chan *uc, dma_addr_t *addr)
+{
+ struct k3_ring *ring = NULL;
+ int ret;
+
+ switch (uc->config.dir) {
+ case DMA_DEV_TO_MEM:
+ ring = uc->rflow->r_ring;
+ break;
+ case DMA_MEM_TO_DEV:
+ case DMA_MEM_TO_MEM:
+ ring = uc->tchan->tc_ring;
+ break;
+ default:
+ return -ENOENT;
+ }
+
+ ret = k3_ringacc_ring_pop(ring, addr);
+ if (ret)
+ return ret;
+
+ rmb(); /* Ensure that reads are not moved before this point */
+
+ /* Teardown completion */
+ if (cppi5_desc_is_tdcm(*addr))
+ return 0;
+
+ /* Check for flush descriptor */
+ if (udma_desc_is_rx_flush(uc, *addr))
+ return -ENOENT;
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(udma_pop_from_ring);
+
+void udma_reset_rings(struct udma_chan *uc)
+{
+ struct k3_ring *ring1 = NULL;
+ struct k3_ring *ring2 = NULL;
+
+ switch (uc->config.dir) {
+ case DMA_DEV_TO_MEM:
+ if (uc->rchan) {
+ ring1 = uc->rflow->fd_ring;
+ ring2 = uc->rflow->r_ring;
+ }
+ break;
+ case DMA_MEM_TO_DEV:
+ case DMA_MEM_TO_MEM:
+ if (uc->tchan) {
+ ring1 = uc->tchan->t_ring;
+ ring2 = uc->tchan->tc_ring;
+ }
+ break;
+ default:
+ break;
+ }
+
+ if (ring1)
+ k3_ringacc_ring_reset_dma(ring1,
+ k3_ringacc_ring_get_occ(ring1));
+ if (ring2)
+ k3_ringacc_ring_reset(ring2);
+
+ /* make sure we are not leaking memory by stalled descriptor */
+ if (uc->terminated_desc) {
+ udma_desc_free(&uc->terminated_desc->vd);
+ uc->terminated_desc = NULL;
+ }
+}
+EXPORT_SYMBOL_GPL(udma_reset_rings);
+
MODULE_DESCRIPTION("Texas Instruments K3 UDMA Common Library");
MODULE_LICENSE("GPL v2");
diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index ae8b8ebd5dddd..40ba114ac81dd 100644
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -174,106 +174,6 @@ static bool udma_is_chan_paused(struct udma_chan *uc)
return false;
}
-static int udma_push_to_ring(struct udma_chan *uc, int idx)
-{
- struct udma_desc *d = uc->desc;
- struct k3_ring *ring = NULL;
- dma_addr_t paddr;
-
- switch (uc->config.dir) {
- case DMA_DEV_TO_MEM:
- ring = uc->rflow->fd_ring;
- break;
- case DMA_MEM_TO_DEV:
- case DMA_MEM_TO_MEM:
- ring = uc->tchan->t_ring;
- break;
- default:
- return -EINVAL;
- }
-
- /* RX flush packet: idx == -1 is only passed in case of DEV_TO_MEM */
- if (idx == -1) {
- paddr = udma_get_rx_flush_hwdesc_paddr(uc);
- } else {
- paddr = udma_curr_cppi5_desc_paddr(d, idx);
-
- wmb(); /* Ensure that writes are not moved over this point */
- }
-
- return k3_ringacc_ring_push(ring, &paddr);
-}
-
-static int udma_pop_from_ring(struct udma_chan *uc, dma_addr_t *addr)
-{
- struct k3_ring *ring = NULL;
- int ret;
-
- switch (uc->config.dir) {
- case DMA_DEV_TO_MEM:
- ring = uc->rflow->r_ring;
- break;
- case DMA_MEM_TO_DEV:
- case DMA_MEM_TO_MEM:
- ring = uc->tchan->tc_ring;
- break;
- default:
- return -ENOENT;
- }
-
- ret = k3_ringacc_ring_pop(ring, addr);
- if (ret)
- return ret;
-
- rmb(); /* Ensure that reads are not moved before this point */
-
- /* Teardown completion */
- if (cppi5_desc_is_tdcm(*addr))
- return 0;
-
- /* Check for flush descriptor */
- if (udma_desc_is_rx_flush(uc, *addr))
- return -ENOENT;
-
- return 0;
-}
-
-static void udma_reset_rings(struct udma_chan *uc)
-{
- struct k3_ring *ring1 = NULL;
- struct k3_ring *ring2 = NULL;
-
- switch (uc->config.dir) {
- case DMA_DEV_TO_MEM:
- if (uc->rchan) {
- ring1 = uc->rflow->fd_ring;
- ring2 = uc->rflow->r_ring;
- }
- break;
- case DMA_MEM_TO_DEV:
- case DMA_MEM_TO_MEM:
- if (uc->tchan) {
- ring1 = uc->tchan->t_ring;
- ring2 = uc->tchan->tc_ring;
- }
- break;
- default:
- break;
- }
-
- if (ring1)
- k3_ringacc_ring_reset_dma(ring1,
- k3_ringacc_ring_get_occ(ring1));
- if (ring2)
- k3_ringacc_ring_reset(ring2);
-
- /* make sure we are not leaking memory by stalled descriptor */
- if (uc->terminated_desc) {
- udma_desc_free(&uc->terminated_desc->vd);
- uc->terminated_desc = NULL;
- }
-}
-
static void udma_decrement_byte_counters(struct udma_chan *uc, u32 val)
{
if (uc->desc->dir == DMA_DEV_TO_MEM) {
diff --git a/drivers/dma/ti/k3-udma.h b/drivers/dma/ti/k3-udma.h
index 62c15b0cc9ae7..767b73021390d 100644
--- a/drivers/dma/ti/k3-udma.h
+++ b/drivers/dma/ti/k3-udma.h
@@ -614,6 +614,10 @@ void udma_desc_pre_callback(struct virt_dma_chan *vc,
struct virt_dma_desc *vd,
struct dmaengine_result *result);
+int udma_push_to_ring(struct udma_chan *uc, int idx);
+int udma_pop_from_ring(struct udma_chan *uc, dma_addr_t *addr);
+void udma_reset_rings(struct udma_chan *uc);
+
/* Direct access to UDMA low lever resources for the glue layer */
int xudma_navss_psil_pair(struct udma_dev *ud, u32 src_thread, u32 dst_thread);
int xudma_navss_psil_unpair(struct udma_dev *ud, u32 src_thread,
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 06/19] dmaengine: ti: k3-udma: move ring management functions to k3-udma-common.c
2026-08-10 15:14 ` [PATCH v8 06/19] dmaengine: ti: k3-udma: move ring management functions " Sai Sree Kartheek Adivi
@ 2026-08-10 15:52 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-08-10 15:52 UTC (permalink / raw)
To: Sai Sree Kartheek Adivi
Cc: robh, Frank.Li, conor+dt, devicetree, vkoul, dmaengine
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] Lockless check and free of `uc->terminated_desc` in `udma_reset_rings` races with the ring IRQ handler, leading to a double free and memory corruption.
--
--- Patch [6]: [PATCH v8 06/19] dmaengine: ti: k3-udma: move ring management functions to k3-udma-common.c ---
commit 0d8096a9286d7cd074f83a1328af2729690e353f
Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>
dmaengine: ti: k3-udma: move ring management functions to k3-udma-common.c
Relocate the ring management functions such as push, pop, and reset
from k3-udma.c to k3-udma-common.c file. These operations are
common across multiple K3 UDMA variants and will be reused by
future implementations like K3 UDMA v2. No functional changes intended.
> diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
> index 3130805a8ec40..3ec5cc932280c 100644
> --- a/drivers/dma/ti/k3-udma-common.c
> +++ b/drivers/dma/ti/k3-udma-common.c
[ ... ]
> @@ -1239,5 +1239,108 @@ void udma_desc_pre_callback(struct virt_dma_chan *vc,
[ ... ]
> +void udma_reset_rings(struct udma_chan *uc)
> +{
> + struct k3_ring *ring1 = NULL;
> + struct k3_ring *ring2 = NULL;
> +
> + switch (uc->config.dir) {
> + case DMA_DEV_TO_MEM:
> + if (uc->rchan) {
> + ring1 = uc->rflow->fd_ring;
> + ring2 = uc->rflow->r_ring;
> + }
> + break;
> + case DMA_MEM_TO_DEV:
> + case DMA_MEM_TO_MEM:
> + if (uc->tchan) {
> + ring1 = uc->tchan->t_ring;
> + ring2 = uc->tchan->tc_ring;
> + }
> + break;
> + default:
> + break;
> + }
> +
> + if (ring1)
> + k3_ringacc_ring_reset_dma(ring1,
> + k3_ringacc_ring_get_occ(ring1));
> + if (ring2)
> + k3_ringacc_ring_reset(ring2);
> +
> + /* make sure we are not leaking memory by stalled descriptor */
> + if (uc->terminated_desc) {
> + udma_desc_free(&uc->terminated_desc->vd);
> + uc->terminated_desc = NULL;
> + }
> +}
[Severity: High]
This isn't a bug introduced by this patch, but does this lockless check and
free of uc->terminated_desc race with the ring irq handler?
When tearing down a channel, udma_free_chan_resources() calls
udma_terminate_all(), which initiates hardware teardown and drops uc->vc.lock.
When teardown finishes, a hardware interrupt can fire on another cpu:
drivers/dma/ti/k3-udma.c:udma_ring_irq_handler() {
...
complete_all(&uc->teardown_completed);
if (uc->terminated_desc) {
udma_desc_free(&uc->terminated_desc->vd);
uc->terminated_desc = NULL;
}
}
Meanwhile, the first cpu can concurrently proceed to call udma_reset_rings()
locklessly:
drivers/dma/ti/k3-udma.c:udma_free_chan_resources() {
udma_terminate_all(chan);
if (uc->terminated_desc) {
udma_reset_chan(uc, false);
udma_reset_rings(uc);
}
}
Since udma_reset_rings() also evaluates and frees uc->terminated_desc without
holding a lock, can both threads evaluate it as true and trigger a double
free before either sets the pointer to NULL?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260810151423.1948224-1-s-adivi@ti.com?part=6
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 07/19] dmaengine: ti: k3-udma: Add variant-specific function pointers to udma_dev
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
` (5 preceding siblings ...)
2026-08-10 15:14 ` [PATCH v8 06/19] dmaengine: ti: k3-udma: move ring management functions " Sai Sree Kartheek Adivi
@ 2026-08-10 15:14 ` Sai Sree Kartheek Adivi
2026-08-10 16:06 ` sashiko-bot
2026-08-10 15:14 ` [PATCH v8 08/19] dmaengine: ti: k3-udma: move udma utility functions to k3-udma-common.c Sai Sree Kartheek Adivi
` (11 subsequent siblings)
18 siblings, 1 reply; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:14 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
Introduce function pointers in the udma_dev structure to allow
variant-specific implementations for certain operations.
This prepares the driver for supporting multiple K3 UDMA variants,
such as UDMA v2, with minimal code duplication.
No functional changes intended in this commit.
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
drivers/dma/ti/k3-udma-private.c | 10 ++++-
drivers/dma/ti/k3-udma.c | 66 ++++++++++++++++++--------------
drivers/dma/ti/k3-udma.h | 12 ++++++
3 files changed, 57 insertions(+), 31 deletions(-)
diff --git a/drivers/dma/ti/k3-udma-private.c b/drivers/dma/ti/k3-udma-private.c
index 624360423ef17..44c097fff5ee6 100644
--- a/drivers/dma/ti/k3-udma-private.c
+++ b/drivers/dma/ti/k3-udma-private.c
@@ -8,13 +8,19 @@
int xudma_navss_psil_pair(struct udma_dev *ud, u32 src_thread, u32 dst_thread)
{
- return navss_psil_pair(ud, src_thread, dst_thread);
+ if (ud->psil_pair)
+ return ud->psil_pair(ud, src_thread, dst_thread);
+
+ return 0;
}
EXPORT_SYMBOL(xudma_navss_psil_pair);
int xudma_navss_psil_unpair(struct udma_dev *ud, u32 src_thread, u32 dst_thread)
{
- return navss_psil_unpair(ud, src_thread, dst_thread);
+ if (ud->psil_unpair)
+ return ud->psil_unpair(ud, src_thread, dst_thread);
+
+ return 0;
}
EXPORT_SYMBOL(xudma_navss_psil_unpair);
diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index 40ba114ac81dd..c44a12157e65f 100644
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -40,7 +40,7 @@ static const char * const mmr_names[] = {
[MMR_TCHANRT] = "tchanrt",
};
-static int navss_psil_pair(struct udma_dev *ud, u32 src_thread, u32 dst_thread)
+int navss_psil_pair(struct udma_dev *ud, u32 src_thread, u32 dst_thread)
{
struct udma_tisci_rm *tisci_rm = &ud->tisci_rm;
@@ -50,8 +50,8 @@ static int navss_psil_pair(struct udma_dev *ud, u32 src_thread, u32 dst_thread)
src_thread, dst_thread);
}
-static int navss_psil_unpair(struct udma_dev *ud, u32 src_thread,
- u32 dst_thread)
+int navss_psil_unpair(struct udma_dev *ud, u32 src_thread,
+ u32 dst_thread)
{
struct udma_tisci_rm *tisci_rm = &ud->tisci_rm;
@@ -329,7 +329,7 @@ static int udma_start(struct udma_chan *uc)
}
/* Make sure that we clear the teardown bit, if it is set */
- udma_reset_chan(uc, false);
+ uc->ud->reset_chan(uc, false);
/* Push descriptors before we start the channel */
udma_start_desc(uc);
@@ -521,8 +521,8 @@ static void udma_check_tx_completion(struct work_struct *work)
if (uc->desc) {
struct udma_desc *d = uc->desc;
- udma_decrement_byte_counters(uc, d->residue);
- udma_start(uc);
+ uc->ud->decrement_byte_counters(uc, d->residue);
+ uc->ud->start(uc);
vchan_cookie_complete(&d->vd);
break;
}
@@ -554,7 +554,7 @@ static irqreturn_t udma_ring_irq_handler(int irq, void *data)
}
if (!uc->desc)
- udma_start(uc);
+ uc->ud->start(uc);
goto out;
}
@@ -576,8 +576,8 @@ static irqreturn_t udma_ring_irq_handler(int irq, void *data)
vchan_cyclic_callback(&d->vd);
} else {
if (udma_is_desc_really_done(uc, d)) {
- udma_decrement_byte_counters(uc, d->residue);
- udma_start(uc);
+ uc->ud->decrement_byte_counters(uc, d->residue);
+ uc->ud->start(uc);
vchan_cookie_complete(&d->vd);
} else {
schedule_delayed_work(&uc->tx_drain.work,
@@ -612,8 +612,8 @@ static irqreturn_t udma_udma_irq_handler(int irq, void *data)
vchan_cyclic_callback(&d->vd);
} else {
/* TODO: figure out the real amount of data */
- udma_decrement_byte_counters(uc, d->residue);
- udma_start(uc);
+ uc->ud->decrement_byte_counters(uc, d->residue);
+ uc->ud->start(uc);
vchan_cookie_complete(&d->vd);
}
}
@@ -1654,7 +1654,7 @@ static int udma_alloc_chan_resources(struct dma_chan *chan)
if (udma_is_chan_running(uc)) {
dev_warn(ud->dev, "chan%d: is running!\n", uc->id);
- udma_reset_chan(uc, false);
+ ud->reset_chan(uc, false);
if (udma_is_chan_running(uc)) {
dev_err(ud->dev, "chan%d: won't stop!\n", uc->id);
ret = -EBUSY;
@@ -1663,7 +1663,7 @@ static int udma_alloc_chan_resources(struct dma_chan *chan)
}
/* PSI-L pairing */
- ret = navss_psil_pair(ud, uc->config.src_thread, uc->config.dst_thread);
+ ret = ud->psil_pair(ud, uc->config.src_thread, uc->config.dst_thread);
if (ret) {
dev_err(ud->dev, "PSI-L pairing failed: 0x%04x -> 0x%04x\n",
uc->config.src_thread, uc->config.dst_thread);
@@ -1718,7 +1718,7 @@ static int udma_alloc_chan_resources(struct dma_chan *chan)
uc->irq_num_ring = 0;
uc->irq_num_udma = 0;
err_psi_free:
- navss_psil_unpair(ud, uc->config.src_thread, uc->config.dst_thread);
+ ud->psil_unpair(ud, uc->config.src_thread, uc->config.dst_thread);
uc->psil_paired = false;
err_res_free:
udma_free_tx_resources(uc);
@@ -1821,7 +1821,7 @@ static int bcdma_alloc_chan_resources(struct dma_chan *chan)
if (udma_is_chan_running(uc)) {
dev_warn(ud->dev, "chan%d: is running!\n", uc->id);
- udma_reset_chan(uc, false);
+ ud->reset_chan(uc, false);
if (udma_is_chan_running(uc)) {
dev_err(ud->dev, "chan%d: won't stop!\n", uc->id);
ret = -EBUSY;
@@ -1849,8 +1849,8 @@ static int bcdma_alloc_chan_resources(struct dma_chan *chan)
uc->use_dma_pool = true;
} else if (uc->config.dir != DMA_MEM_TO_MEM) {
/* PSI-L pairing */
- ret = navss_psil_pair(ud, uc->config.src_thread,
- uc->config.dst_thread);
+ ret = ud->psil_pair(ud, uc->config.src_thread,
+ uc->config.dst_thread);
if (ret) {
dev_err(ud->dev,
"PSI-L pairing failed: 0x%04x -> 0x%04x\n",
@@ -1910,8 +1910,8 @@ static int bcdma_alloc_chan_resources(struct dma_chan *chan)
uc->irq_num_udma = 0;
err_psi_free:
if (uc->psil_paired)
- navss_psil_unpair(ud, uc->config.src_thread,
- uc->config.dst_thread);
+ ud->psil_unpair(ud, uc->config.src_thread,
+ uc->config.dst_thread);
uc->psil_paired = false;
err_res_free:
bcdma_free_bchan_resources(uc);
@@ -2014,7 +2014,7 @@ static int pktdma_alloc_chan_resources(struct dma_chan *chan)
if (udma_is_chan_running(uc)) {
dev_warn(ud->dev, "chan%d: is running!\n", uc->id);
- udma_reset_chan(uc, false);
+ ud->reset_chan(uc, false);
if (udma_is_chan_running(uc)) {
dev_err(ud->dev, "chan%d: won't stop!\n", uc->id);
ret = -EBUSY;
@@ -2037,7 +2037,7 @@ static int pktdma_alloc_chan_resources(struct dma_chan *chan)
uc->use_dma_pool = true;
/* PSI-L pairing */
- ret = navss_psil_pair(ud, uc->config.src_thread, uc->config.dst_thread);
+ ret = ud->psil_pair(ud, uc->config.src_thread, uc->config.dst_thread);
if (ret) {
dev_err(ud->dev, "PSI-L pairing failed: 0x%04x -> 0x%04x\n",
uc->config.src_thread, uc->config.dst_thread);
@@ -2083,7 +2083,7 @@ static int pktdma_alloc_chan_resources(struct dma_chan *chan)
err_irq_free:
uc->irq_num_ring = 0;
err_psi_free:
- navss_psil_unpair(ud, uc->config.src_thread, uc->config.dst_thread);
+ ud->psil_unpair(ud, uc->config.src_thread, uc->config.dst_thread);
uc->psil_paired = false;
err_res_free:
udma_free_tx_resources(uc);
@@ -2123,7 +2123,7 @@ static void udma_issue_pending(struct dma_chan *chan)
*/
if (!(uc->state == UDMA_CHAN_IS_TERMINATING &&
udma_is_chan_running(uc)))
- udma_start(uc);
+ uc->ud->start(uc);
}
spin_unlock_irqrestore(&uc->vc.lock, flags);
@@ -2265,7 +2265,7 @@ static int udma_terminate_all(struct dma_chan *chan)
spin_lock_irqsave(&uc->vc.lock, flags);
if (udma_is_chan_running(uc))
- udma_stop(uc);
+ uc->ud->stop(uc);
if (uc->desc) {
uc->terminated_desc = uc->desc;
@@ -2297,11 +2297,11 @@ static void udma_synchronize(struct dma_chan *chan)
dev_warn(uc->ud->dev, "chan%d teardown timeout!\n",
uc->id);
udma_dump_chan_stdata(uc);
- udma_reset_chan(uc, true);
+ uc->ud->reset_chan(uc, true);
}
}
- udma_reset_chan(uc, false);
+ uc->ud->reset_chan(uc, false);
if (udma_is_chan_running(uc))
dev_warn(uc->ud->dev, "chan%d refused to stop!\n", uc->id);
@@ -2355,7 +2355,7 @@ static void udma_free_chan_resources(struct dma_chan *chan)
udma_terminate_all(chan);
if (uc->terminated_desc) {
- udma_reset_chan(uc, false);
+ ud->reset_chan(uc, false);
udma_reset_rings(uc);
}
@@ -2374,8 +2374,8 @@ static void udma_free_chan_resources(struct dma_chan *chan)
/* Release PSI-L pairing */
if (uc->psil_paired) {
- navss_psil_unpair(ud, uc->config.src_thread,
- uc->config.dst_thread);
+ ud->psil_unpair(ud, uc->config.src_thread,
+ uc->config.dst_thread);
uc->psil_paired = false;
}
@@ -3694,6 +3694,14 @@ static int udma_probe(struct platform_device *pdev)
ud->soc_data = soc->data;
}
+ // Setup function pointers
+ ud->start = udma_start;
+ ud->stop = udma_stop;
+ ud->reset_chan = udma_reset_chan;
+ ud->decrement_byte_counters = udma_decrement_byte_counters;
+ ud->psil_pair = navss_psil_pair;
+ ud->psil_unpair = navss_psil_unpair;
+
ret = udma_get_mmrs(pdev, ud);
if (ret)
return ret;
diff --git a/drivers/dma/ti/k3-udma.h b/drivers/dma/ti/k3-udma.h
index 767b73021390d..16de0b218d8ad 100644
--- a/drivers/dma/ti/k3-udma.h
+++ b/drivers/dma/ti/k3-udma.h
@@ -348,6 +348,15 @@ struct udma_dev {
u32 psil_base;
u32 atype;
u32 asel;
+
+ int (*start)(struct udma_chan *uc);
+ int (*stop)(struct udma_chan *uc);
+ int (*reset_chan)(struct udma_chan *uc, bool hard);
+ void (*decrement_byte_counters)(struct udma_chan *uc, u32 val);
+ int (*psil_pair)(struct udma_dev *ud, u32 src_thread,
+ u32 dst_thread);
+ int (*psil_unpair)(struct udma_dev *ud, u32 src_thread,
+ u32 dst_thread);
};
struct udma_desc {
@@ -618,6 +627,9 @@ int udma_push_to_ring(struct udma_chan *uc, int idx);
int udma_pop_from_ring(struct udma_chan *uc, dma_addr_t *addr);
void udma_reset_rings(struct udma_chan *uc);
+int navss_psil_pair(struct udma_dev *ud, u32 src_thread, u32 dst_thread);
+int navss_psil_unpair(struct udma_dev *ud, u32 src_thread, u32 dst_thread);
+
/* Direct access to UDMA low lever resources for the glue layer */
int xudma_navss_psil_pair(struct udma_dev *ud, u32 src_thread, u32 dst_thread);
int xudma_navss_psil_unpair(struct udma_dev *ud, u32 src_thread,
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 07/19] dmaengine: ti: k3-udma: Add variant-specific function pointers to udma_dev
2026-08-10 15:14 ` [PATCH v8 07/19] dmaengine: ti: k3-udma: Add variant-specific function pointers to udma_dev Sai Sree Kartheek Adivi
@ 2026-08-10 16:06 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-08-10 16:06 UTC (permalink / raw)
To: Sai Sree Kartheek Adivi
Cc: dmaengine, conor+dt, robh, devicetree, Frank.Li, vkoul
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
New issues:
- [Medium] Unconditional invocation of optional psil_pair and psil_unpair function pointers leads to potential NULL pointer dereferences.
Pre-existing issues:
- [High] Debug objects leak due to misuse of INIT_DELAYED_WORK_ONSTACK for heap-allocated work items.
- [High] Unconditional destruction of hdesc_pool in the error path of pktdma_alloc_chan_resources causes a double-free.
--
--- Patch [7]: [PATCH v8 07/19] dmaengine: ti: k3-udma: Add variant-specific function pointers to udma_dev ---
commit e169d39794002b63060719c1aeef8f8eb77d45c6
Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>
dmaengine: ti: k3-udma: Add variant-specific function pointers to udma_dev
Introduce function pointers in the udma_dev structure to allow
variant-specific implementations for certain operations.
This prepares the driver for supporting multiple K3 UDMA variants,
such as UDMA v2, with minimal code duplication.
> diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
> index 40ba114ac81dd..c44a12157e65f 100644
> --- a/drivers/dma/ti/k3-udma.c
> +++ b/drivers/dma/ti/k3-udma.c
[ ... ]
> @@ -1663,7 +1663,7 @@ static int udma_alloc_chan_resources(struct dma_chan *chan)
> }
>
> /* PSI-L pairing */
> - ret = navss_psil_pair(ud, uc->config.src_thread, uc->config.dst_thread);
> + ret = ud->psil_pair(ud, uc->config.src_thread, uc->config.dst_thread);
[Severity: Medium]
Will this crash if a future variant does not support PSI-L pairing?
The wrapper function xudma_navss_psil_pair() checks if ud->psil_pair is set
before calling it, but this direct call does not. If a future variant leaves
this pointer unassigned, couldn't this result in a NULL pointer dereference?
[ ... ]
> @@ -1849,8 +1849,8 @@ static int bcdma_alloc_chan_resources(struct dma_chan *chan)
> uc->use_dma_pool = true;
> } else if (uc->config.dir != DMA_MEM_TO_MEM) {
> /* PSI-L pairing */
> - ret = navss_psil_pair(ud, uc->config.src_thread,
> - uc->config.dst_thread);
> + ret = ud->psil_pair(ud, uc->config.src_thread,
> + uc->config.dst_thread);
[Severity: High]
This isn't a bug introduced by this patch, but I noticed a pre-existing issue
in bcdma_alloc_chan_resources() and pktdma_alloc_chan_resources(). It looks
like the work item is initialized as a stack object but it's embedded within
the heap-allocated struct udma_chan:
INIT_DELAYED_WORK_ONSTACK(&uc->tx_drain.work,
udma_check_tx_completion);
Since destroy_delayed_work_on_stack() is never called when the channel is
freed, wouldn't every allocation/free cycle leak a debug object, eventually
leading to ODEBUG OOM warnings?
[ ... ]
> @@ -2083,7 +2083,7 @@ static int pktdma_alloc_chan_resources(struct dma_chan *chan)
> err_irq_free:
> uc->irq_num_ring = 0;
> err_psi_free:
> - navss_psil_unpair(ud, uc->config.src_thread, uc->config.dst_thread);
> + ud->psil_unpair(ud, uc->config.src_thread, uc->config.dst_thread);
> uc->psil_paired = false;
> err_res_free:
> udma_free_tx_resources(uc);
[Severity: High]
This is a pre-existing issue, but the error path in
pktdma_alloc_chan_resources() unconditionally destroys the dma pool:
err_res_free:
udma_free_tx_resources(uc);
udma_free_rx_resources(uc);
udma_reset_uchan(uc);
dma_pool_destroy(uc->hdesc_pool);
If a channel is freed (leaving uc->hdesc_pool as a dangling pointer), and
later re-requested but fails early in the allocation process, wouldn't this
jump to err_res_free and cause a double-free of the pool?
Unlike other paths, there's no check for uc->use_dma_pool here.
[ ... ]
> @@ -2374,8 +2374,8 @@ static void udma_free_chan_resources(struct dma_chan *chan)
>
> /* Release PSI-L pairing */
> if (uc->psil_paired) {
> - navss_psil_unpair(ud, uc->config.src_thread,
> - uc->config.dst_thread);
> + ud->psil_unpair(ud, uc->config.src_thread,
> + uc->config.dst_thread);
[Severity: Medium]
As mentioned earlier, does this need a check for ud->psil_unpair being
non-NULL to avoid a potential panic if a future variant lacks PSI-L pairing
support?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260810151423.1948224-1-s-adivi@ti.com?part=7
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 08/19] dmaengine: ti: k3-udma: move udma utility functions to k3-udma-common.c
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
` (6 preceding siblings ...)
2026-08-10 15:14 ` [PATCH v8 07/19] dmaengine: ti: k3-udma: Add variant-specific function pointers to udma_dev Sai Sree Kartheek Adivi
@ 2026-08-10 15:14 ` Sai Sree Kartheek Adivi
2026-08-10 16:09 ` sashiko-bot
2026-08-10 15:14 ` [PATCH v8 09/19] dmaengine: ti: k3-udma: move resource management " Sai Sree Kartheek Adivi
` (10 subsequent siblings)
18 siblings, 1 reply; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:14 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
Relocate udma utility functions from k3-udma.c to k3-udma-common.c file.
The implementation of these functions is largely shared between K3 UDMA
and K3 UDMA v2. This refactor improves code reuse and maintainability
across multiple variants.
No functional changes intended.
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
drivers/dma/ti/k3-udma-common.c | 549 ++++++++++++++++++++++++++++++++
drivers/dma/ti/k3-udma.c | 531 ------------------------------
drivers/dma/ti/k3-udma.h | 28 ++
3 files changed, 577 insertions(+), 531 deletions(-)
diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
index 3ec5cc932280c..892b88a220f18 100644
--- a/drivers/dma/ti/k3-udma-common.c
+++ b/drivers/dma/ti/k3-udma-common.c
@@ -4,6 +4,7 @@
* Author: Peter Ujfalusi <peter.ujfalusi@ti.com>
*/
+#include <linux/delay.h>
#include <linux/dmaengine.h>
#include <linux/dma-mapping.h>
#include <linux/dmapool.h>
@@ -46,6 +47,28 @@ struct udma_desc *udma_udma_desc_from_paddr(struct udma_chan *uc,
}
EXPORT_SYMBOL_GPL(udma_udma_desc_from_paddr);
+void udma_start_desc(struct udma_chan *uc)
+{
+ struct udma_chan_config *ucc = &uc->config;
+
+ if (uc->ud->match_data->type == DMA_TYPE_UDMA && ucc->pkt_mode &&
+ (uc->cyclic || ucc->dir == DMA_DEV_TO_MEM)) {
+ int i;
+
+ /*
+ * UDMA only: Push all descriptors to ring for packet mode
+ * cyclic or RX
+ * PKTDMA supports pre-linked descriptor and cyclic is not
+ * supported
+ */
+ for (i = 0; i < uc->desc->sglen; i++)
+ udma_push_to_ring(uc, i);
+ } else {
+ udma_push_to_ring(uc, 0);
+ }
+}
+EXPORT_SYMBOL_GPL(udma_start_desc);
+
void udma_free_hwdesc(struct udma_chan *uc, struct udma_desc *d)
{
if (uc->use_dma_pool) {
@@ -1342,5 +1365,531 @@ void udma_reset_rings(struct udma_chan *uc)
}
EXPORT_SYMBOL_GPL(udma_reset_rings);
+u8 udma_get_chan_tpl_index(struct udma_tpl *tpl_map, int chan_id)
+{
+ int i;
+
+ for (i = 0; i < tpl_map->levels; i++) {
+ if (chan_id >= tpl_map->start_idx[i])
+ return i;
+ }
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(udma_get_chan_tpl_index);
+
+void k3_configure_chan_coherency(struct dma_chan *chan, u32 asel)
+{
+ struct device *chan_dev = &chan->dev->device;
+
+ if (asel == 0) {
+ /* No special handling for the channel */
+ chan->dev->chan_dma_dev = false;
+
+ dev_clear_dma_coherent(chan_dev);
+ chan_dev->dma_parms = NULL;
+ } else if (asel == 14 || asel == 15) {
+ chan->dev->chan_dma_dev = true;
+
+ dev_set_dma_coherent(chan_dev);
+ dma_coerce_mask_and_coherent(chan_dev, DMA_BIT_MASK(48));
+ chan_dev->dma_parms = chan_dev->parent->dma_parms;
+ } else {
+ dev_warn(chan->device->dev, "Invalid ASEL value: %u\n", asel);
+
+ dev_clear_dma_coherent(chan_dev);
+ chan_dev->dma_parms = NULL;
+ }
+}
+EXPORT_SYMBOL_GPL(k3_configure_chan_coherency);
+
+void udma_reset_uchan(struct udma_chan *uc)
+{
+ memset(&uc->config, 0, sizeof(uc->config));
+ uc->config.remote_thread_id = -1;
+ uc->config.mapped_channel_id = -1;
+ uc->config.default_flow_id = -1;
+ uc->state = UDMA_CHAN_IS_IDLE;
+}
+EXPORT_SYMBOL_GPL(udma_reset_uchan);
+
+void udma_dump_chan_stdata(struct udma_chan *uc)
+{
+ struct device *dev = uc->ud->dev;
+ u32 offset;
+ int i;
+
+ if (uc->config.dir == DMA_MEM_TO_DEV || uc->config.dir == DMA_MEM_TO_MEM) {
+ dev_dbg(dev, "TCHAN State data:\n");
+ for (i = 0; i < 32; i++) {
+ offset = UDMA_CHAN_RT_STDATA_REG + i * 4;
+ dev_dbg(dev, "TRT_STDATA[%02d]: 0x%08x\n", i,
+ udma_tchanrt_read(uc, offset));
+ }
+ }
+
+ if (uc->config.dir == DMA_DEV_TO_MEM || uc->config.dir == DMA_MEM_TO_MEM) {
+ dev_dbg(dev, "RCHAN State data:\n");
+ for (i = 0; i < 32; i++) {
+ offset = UDMA_CHAN_RT_STDATA_REG + i * 4;
+ dev_dbg(dev, "RRT_STDATA[%02d]: 0x%08x\n", i,
+ udma_rchanrt_read(uc, offset));
+ }
+ }
+}
+
+bool udma_is_chan_running(struct udma_chan *uc)
+{
+ u32 trt_ctl = 0;
+ u32 rrt_ctl = 0;
+
+ if (uc->tchan)
+ trt_ctl = udma_tchanrt_read(uc, UDMA_CHAN_RT_CTL_REG);
+ if (uc->rchan)
+ rrt_ctl = udma_rchanrt_read(uc, UDMA_CHAN_RT_CTL_REG);
+
+ if (trt_ctl & UDMA_CHAN_RT_CTL_EN || rrt_ctl & UDMA_CHAN_RT_CTL_EN)
+ return true;
+
+ return false;
+}
+EXPORT_SYMBOL_GPL(udma_is_chan_running);
+
+bool udma_chan_needs_reconfiguration(struct udma_chan *uc)
+{
+ /* Only PDMAs have staticTR */
+ if (uc->config.ep_type == PSIL_EP_NATIVE)
+ return false;
+
+ /* Check if the staticTR configuration has changed for TX */
+ if (memcmp(&uc->static_tr, &uc->desc->static_tr, sizeof(uc->static_tr)))
+ return true;
+
+ return false;
+}
+EXPORT_SYMBOL_GPL(udma_chan_needs_reconfiguration);
+
+void udma_cyclic_packet_elapsed(struct udma_chan *uc)
+{
+ struct udma_desc *d = uc->desc;
+ struct cppi5_host_desc_t *h_desc;
+
+ h_desc = d->hwdesc[d->desc_idx].cppi5_desc_vaddr;
+ cppi5_hdesc_reset_to_original(h_desc);
+ udma_push_to_ring(uc, d->desc_idx);
+ d->desc_idx = (d->desc_idx + 1) % d->sglen;
+}
+EXPORT_SYMBOL_GPL(udma_cyclic_packet_elapsed);
+
+void udma_check_tx_completion(struct work_struct *work)
+{
+ struct udma_chan *uc = container_of(work, typeof(*uc),
+ tx_drain.work.work);
+ bool desc_done = true;
+ u32 residue_diff;
+ ktime_t time_diff;
+ unsigned long delay;
+ unsigned long flags;
+
+ while (1) {
+ spin_lock_irqsave(&uc->vc.lock, flags);
+
+ if (uc->desc) {
+ /* Get previous residue and time stamp */
+ residue_diff = uc->tx_drain.residue;
+ time_diff = uc->tx_drain.tstamp;
+ /*
+ * Get current residue and time stamp or see if
+ * transfer is complete
+ */
+ desc_done = udma_is_desc_really_done(uc, uc->desc);
+ }
+
+ if (!desc_done) {
+ /*
+ * Find the time delta and residue delta w.r.t
+ * previous poll
+ */
+ time_diff = ktime_sub(uc->tx_drain.tstamp,
+ time_diff) + 1;
+ residue_diff -= uc->tx_drain.residue;
+ if (residue_diff) {
+ /*
+ * Try to guess when we should check
+ * next time by calculating rate at
+ * which data is being drained at the
+ * peer device
+ */
+ delay = (time_diff / residue_diff) *
+ uc->tx_drain.residue;
+ } else {
+ /* No progress, check again in 1 second */
+ schedule_delayed_work(&uc->tx_drain.work, HZ);
+ break;
+ }
+
+ spin_unlock_irqrestore(&uc->vc.lock, flags);
+
+ usleep_range(ktime_to_us(delay),
+ ktime_to_us(delay) + 10);
+ continue;
+ }
+
+ if (uc->desc) {
+ struct udma_desc *d = uc->desc;
+
+ uc->ud->decrement_byte_counters(uc, d->residue);
+ uc->ud->start(uc);
+ vchan_cookie_complete(&d->vd);
+ break;
+ }
+
+ break;
+ }
+
+ spin_unlock_irqrestore(&uc->vc.lock, flags);
+}
+EXPORT_SYMBOL_GPL(udma_check_tx_completion);
+
+int udma_slave_config(struct dma_chan *chan,
+ struct dma_slave_config *cfg)
+{
+ struct udma_chan *uc = to_udma_chan(chan);
+
+ memcpy(&uc->cfg, cfg, sizeof(uc->cfg));
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(udma_slave_config);
+
+void udma_issue_pending(struct dma_chan *chan)
+{
+ struct udma_chan *uc = to_udma_chan(chan);
+ unsigned long flags;
+
+ spin_lock_irqsave(&uc->vc.lock, flags);
+
+ /* If we have something pending and no active descriptor, then */
+ if (vchan_issue_pending(&uc->vc) && !uc->desc) {
+ /*
+ * start a descriptor if the channel is NOT [marked as
+ * terminating _and_ it is still running (teardown has not
+ * completed yet)].
+ */
+ if (!(uc->state == UDMA_CHAN_IS_TERMINATING &&
+ udma_is_chan_running(uc)))
+ uc->ud->start(uc);
+ }
+
+ spin_unlock_irqrestore(&uc->vc.lock, flags);
+}
+EXPORT_SYMBOL_GPL(udma_issue_pending);
+
+int udma_terminate_all(struct dma_chan *chan)
+{
+ struct udma_chan *uc = to_udma_chan(chan);
+ unsigned long flags;
+ LIST_HEAD(head);
+
+ spin_lock_irqsave(&uc->vc.lock, flags);
+
+ if (udma_is_chan_running(uc))
+ uc->ud->stop(uc);
+
+ if (uc->desc) {
+ uc->terminated_desc = uc->desc;
+ uc->desc = NULL;
+ uc->terminated_desc->terminated = true;
+ cancel_delayed_work(&uc->tx_drain.work);
+ }
+
+ uc->paused = false;
+
+ vchan_get_all_descriptors(&uc->vc, &head);
+ spin_unlock_irqrestore(&uc->vc.lock, flags);
+ vchan_dma_desc_free_list(&uc->vc, &head);
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(udma_terminate_all);
+
+void udma_synchronize(struct dma_chan *chan)
+{
+ struct udma_chan *uc = to_udma_chan(chan);
+ unsigned long timeout = msecs_to_jiffies(1000);
+
+ vchan_synchronize(&uc->vc);
+
+ if (uc->state == UDMA_CHAN_IS_TERMINATING) {
+ timeout = wait_for_completion_timeout(&uc->teardown_completed,
+ timeout);
+ if (!timeout) {
+ dev_warn(uc->ud->dev, "chan%d teardown timeout!\n",
+ uc->id);
+ udma_dump_chan_stdata(uc);
+ uc->ud->reset_chan(uc, true);
+ }
+ }
+
+ uc->ud->reset_chan(uc, false);
+ if (udma_is_chan_running(uc))
+ dev_warn(uc->ud->dev, "chan%d refused to stop!\n", uc->id);
+
+ cancel_delayed_work_sync(&uc->tx_drain.work);
+ udma_reset_rings(uc);
+}
+EXPORT_SYMBOL_GPL(udma_synchronize);
+
+/*
+ * This tasklet handles the completion of a DMA descriptor by
+ * calling its callback and freeing it.
+ */
+void udma_vchan_complete(struct tasklet_struct *t)
+{
+ struct virt_dma_chan *vc = from_tasklet(vc, t, task);
+ struct virt_dma_desc *vd, *_vd;
+ struct dmaengine_desc_callback cb;
+ LIST_HEAD(head);
+
+ spin_lock_irq(&vc->lock);
+ list_splice_tail_init(&vc->desc_completed, &head);
+ vd = vc->cyclic;
+ if (vd) {
+ vc->cyclic = NULL;
+ dmaengine_desc_get_callback(&vd->tx, &cb);
+ } else {
+ memset(&cb, 0, sizeof(cb));
+ }
+ spin_unlock_irq(&vc->lock);
+
+ udma_desc_pre_callback(vc, vd, NULL);
+ dmaengine_desc_callback_invoke(&cb, NULL);
+
+ list_for_each_entry_safe(vd, _vd, &head, node) {
+ struct dmaengine_result result;
+
+ dmaengine_desc_get_callback(&vd->tx, &cb);
+
+ list_del(&vd->node);
+
+ udma_desc_pre_callback(vc, vd, &result);
+ dmaengine_desc_callback_invoke(&cb, &result);
+
+ vchan_vdesc_fini(vd);
+ }
+}
+EXPORT_SYMBOL_GPL(udma_vchan_complete);
+
+void udma_mark_resource_ranges(struct udma_dev *ud, unsigned long *map,
+ struct ti_sci_resource_desc *rm_desc,
+ char *name)
+{
+ bitmap_clear(map, rm_desc->start, rm_desc->num);
+ bitmap_clear(map, rm_desc->start_sec, rm_desc->num_sec);
+ dev_dbg(ud->dev, "ti_sci resource range for %s: %d:%d | %d:%d\n", name,
+ rm_desc->start, rm_desc->num, rm_desc->start_sec,
+ rm_desc->num_sec);
+}
+EXPORT_SYMBOL_GPL(udma_mark_resource_ranges);
+
+int udma_setup_rx_flush(struct udma_dev *ud)
+{
+ struct udma_rx_flush *rx_flush = &ud->rx_flush;
+ struct cppi5_desc_hdr_t *tr_desc;
+ struct cppi5_tr_type1_t *tr_req;
+ struct cppi5_host_desc_t *desc;
+ struct device *dev = ud->dev;
+ struct udma_hwdesc *hwdesc;
+ size_t tr_size;
+
+ /* Allocate 1K buffer for discarded data on RX channel teardown */
+ rx_flush->buffer_size = SZ_1K;
+ rx_flush->buffer_vaddr = devm_kzalloc(dev, rx_flush->buffer_size,
+ GFP_KERNEL);
+ if (!rx_flush->buffer_vaddr)
+ return -ENOMEM;
+
+ rx_flush->buffer_paddr = dma_map_single(dev, rx_flush->buffer_vaddr,
+ rx_flush->buffer_size,
+ DMA_TO_DEVICE);
+ if (dma_mapping_error(dev, rx_flush->buffer_paddr))
+ return -ENOMEM;
+
+ /* Set up descriptor to be used for TR mode */
+ hwdesc = &rx_flush->hwdescs[0];
+ tr_size = sizeof(struct cppi5_tr_type1_t);
+ hwdesc->cppi5_desc_size = cppi5_trdesc_calc_size(tr_size, 1);
+ hwdesc->cppi5_desc_size = ALIGN(hwdesc->cppi5_desc_size,
+ ud->desc_align);
+
+ hwdesc->cppi5_desc_vaddr = devm_kzalloc(dev, hwdesc->cppi5_desc_size,
+ GFP_KERNEL);
+ if (!hwdesc->cppi5_desc_vaddr)
+ return -ENOMEM;
+
+ hwdesc->cppi5_desc_paddr = dma_map_single(dev, hwdesc->cppi5_desc_vaddr,
+ hwdesc->cppi5_desc_size,
+ DMA_TO_DEVICE);
+ if (dma_mapping_error(dev, hwdesc->cppi5_desc_paddr))
+ return -ENOMEM;
+
+ /* Start of the TR req records */
+ hwdesc->tr_req_base = hwdesc->cppi5_desc_vaddr + tr_size;
+ /* Start address of the TR response array */
+ hwdesc->tr_resp_base = hwdesc->tr_req_base + tr_size;
+
+ tr_desc = hwdesc->cppi5_desc_vaddr;
+ cppi5_trdesc_init(tr_desc, 1, tr_size, 0, 0);
+ cppi5_desc_set_pktids(tr_desc, 0, CPPI5_INFO1_DESC_FLOWID_DEFAULT);
+ cppi5_desc_set_retpolicy(tr_desc, 0, 0);
+
+ tr_req = hwdesc->tr_req_base;
+ cppi5_tr_init(&tr_req->flags, CPPI5_TR_TYPE1, false, false,
+ CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
+ cppi5_tr_csf_set(&tr_req->flags, CPPI5_TR_CSF_SUPR_EVT);
+
+ tr_req->addr = rx_flush->buffer_paddr;
+ tr_req->icnt0 = rx_flush->buffer_size;
+ tr_req->icnt1 = 1;
+
+ dma_sync_single_for_device(dev, hwdesc->cppi5_desc_paddr,
+ hwdesc->cppi5_desc_size, DMA_TO_DEVICE);
+
+ /* Set up descriptor to be used for packet mode */
+ hwdesc = &rx_flush->hwdescs[1];
+ hwdesc->cppi5_desc_size = ALIGN(sizeof(struct cppi5_host_desc_t) +
+ CPPI5_INFO0_HDESC_EPIB_SIZE +
+ CPPI5_INFO0_HDESC_PSDATA_MAX_SIZE,
+ ud->desc_align);
+
+ hwdesc->cppi5_desc_vaddr = devm_kzalloc(dev, hwdesc->cppi5_desc_size,
+ GFP_KERNEL);
+ if (!hwdesc->cppi5_desc_vaddr)
+ return -ENOMEM;
+
+ hwdesc->cppi5_desc_paddr = dma_map_single(dev, hwdesc->cppi5_desc_vaddr,
+ hwdesc->cppi5_desc_size,
+ DMA_TO_DEVICE);
+ if (dma_mapping_error(dev, hwdesc->cppi5_desc_paddr))
+ return -ENOMEM;
+
+ desc = hwdesc->cppi5_desc_vaddr;
+ cppi5_hdesc_init(desc, 0, 0);
+ cppi5_desc_set_pktids(&desc->hdr, 0, CPPI5_INFO1_DESC_FLOWID_DEFAULT);
+ cppi5_desc_set_retpolicy(&desc->hdr, 0, 0);
+
+ cppi5_hdesc_attach_buf(desc,
+ rx_flush->buffer_paddr, rx_flush->buffer_size,
+ rx_flush->buffer_paddr, rx_flush->buffer_size);
+
+ dma_sync_single_for_device(dev, hwdesc->cppi5_desc_paddr,
+ hwdesc->cppi5_desc_size, DMA_TO_DEVICE);
+ return 0;
+}
+EXPORT_SYMBOL_GPL(udma_setup_rx_flush);
+
+#ifdef CONFIG_DEBUG_FS
+void udma_dbg_summary_show_chan(struct seq_file *s,
+ struct dma_chan *chan)
+{
+ struct udma_chan *uc = to_udma_chan(chan);
+ struct udma_chan_config *ucc = &uc->config;
+
+ seq_printf(s, " %-13s| %s", dma_chan_name(chan),
+ chan->dbg_client_name ?: "in-use");
+ if (ucc->tr_trigger_type)
+ seq_puts(s, " (triggered, ");
+ else
+ seq_printf(s, " (%s, ",
+ dmaengine_get_direction_text(uc->config.dir));
+
+ switch (uc->config.dir) {
+ case DMA_MEM_TO_MEM:
+ if (uc->ud->match_data->type == DMA_TYPE_BCDMA) {
+ seq_printf(s, "bchan%d)\n", uc->bchan->id);
+ return;
+ }
+
+ seq_printf(s, "chan%d pair [0x%04x -> 0x%04x], ", uc->tchan->id,
+ ucc->src_thread, ucc->dst_thread);
+ break;
+ case DMA_DEV_TO_MEM:
+ seq_printf(s, "rchan%d [0x%04x -> 0x%04x], ", uc->rchan->id,
+ ucc->src_thread, ucc->dst_thread);
+ if (uc->ud->match_data->type == DMA_TYPE_PKTDMA)
+ seq_printf(s, "rflow%d, ", uc->rflow->id);
+ break;
+ case DMA_MEM_TO_DEV:
+ seq_printf(s, "tchan%d [0x%04x -> 0x%04x], ", uc->tchan->id,
+ ucc->src_thread, ucc->dst_thread);
+ if (uc->ud->match_data->type == DMA_TYPE_PKTDMA)
+ seq_printf(s, "tflow%d, ", uc->tchan->tflow_id);
+ break;
+ default:
+ seq_puts(s, ")\n");
+ return;
+ }
+
+ if (ucc->ep_type == PSIL_EP_NATIVE) {
+ seq_puts(s, "PSI-L Native");
+ if (ucc->metadata_size) {
+ seq_printf(s, "[%s", ucc->needs_epib ? " EPIB" : "");
+ if (ucc->psd_size)
+ seq_printf(s, " PSDsize:%u", ucc->psd_size);
+ seq_puts(s, " ]");
+ }
+ } else {
+ seq_puts(s, "PDMA");
+ if (ucc->enable_acc32 || ucc->enable_burst)
+ seq_printf(s, "[%s%s ]",
+ ucc->enable_acc32 ? " ACC32" : "",
+ ucc->enable_burst ? " BURST" : "");
+ }
+
+ seq_printf(s, ", %s)\n", ucc->pkt_mode ? "Packet mode" : "TR mode");
+}
+
+void udma_dbg_summary_show(struct seq_file *s,
+ struct dma_device *dma_dev)
+{
+ struct dma_chan *chan;
+
+ list_for_each_entry(chan, &dma_dev->channels, device_node) {
+ if (chan->client_count)
+ udma_dbg_summary_show_chan(s, chan);
+ }
+}
+EXPORT_SYMBOL_GPL(udma_dbg_summary_show);
+#endif /* CONFIG_DEBUG_FS */
+
+enum dmaengine_alignment udma_get_copy_align(struct udma_dev *ud)
+{
+ const struct udma_match_data *match_data = ud->match_data;
+ u8 tpl;
+
+ if (!match_data->enable_memcpy_support)
+ return DMAENGINE_ALIGN_8_BYTES;
+
+ /* Get the highest TPL level the device supports for memcpy */
+ if (ud->bchan_cnt)
+ tpl = udma_get_chan_tpl_index(&ud->bchan_tpl, 0);
+ else if (ud->tchan_cnt)
+ tpl = udma_get_chan_tpl_index(&ud->tchan_tpl, 0);
+ else
+ return DMAENGINE_ALIGN_8_BYTES;
+
+ switch (match_data->burst_size[tpl]) {
+ case TI_SCI_RM_UDMAP_CHAN_BURST_SIZE_256_BYTES:
+ return DMAENGINE_ALIGN_256_BYTES;
+ case TI_SCI_RM_UDMAP_CHAN_BURST_SIZE_128_BYTES:
+ return DMAENGINE_ALIGN_128_BYTES;
+ case TI_SCI_RM_UDMAP_CHAN_BURST_SIZE_64_BYTES:
+ fallthrough;
+ default:
+ return DMAENGINE_ALIGN_64_BYTES;
+ }
+}
+EXPORT_SYMBOL_GPL(udma_get_copy_align);
+
MODULE_DESCRIPTION("Texas Instruments K3 UDMA Common Library");
MODULE_LICENSE("GPL v2");
diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index c44a12157e65f..cd73bf03e9cc6 100644
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -61,92 +61,6 @@ int navss_psil_unpair(struct udma_dev *ud, u32 src_thread,
src_thread, dst_thread);
}
-static void k3_configure_chan_coherency(struct dma_chan *chan, u32 asel)
-{
- struct device *chan_dev = &chan->dev->device;
-
- if (asel == 0) {
- /* No special handling for the channel */
- chan->dev->chan_dma_dev = false;
-
- dev_clear_dma_coherent(chan_dev);
- chan_dev->dma_parms = NULL;
- } else if (asel == 14 || asel == 15) {
- chan->dev->chan_dma_dev = true;
-
- dev_set_dma_coherent(chan_dev);
- dma_coerce_mask_and_coherent(chan_dev, DMA_BIT_MASK(48));
- chan_dev->dma_parms = chan_dev->parent->dma_parms;
- } else {
- dev_warn(chan->device->dev, "Invalid ASEL value: %u\n", asel);
-
- dev_clear_dma_coherent(chan_dev);
- chan_dev->dma_parms = NULL;
- }
-}
-
-static u8 udma_get_chan_tpl_index(struct udma_tpl *tpl_map, int chan_id)
-{
- int i;
-
- for (i = 0; i < tpl_map->levels; i++) {
- if (chan_id >= tpl_map->start_idx[i])
- return i;
- }
-
- return 0;
-}
-
-static void udma_reset_uchan(struct udma_chan *uc)
-{
- memset(&uc->config, 0, sizeof(uc->config));
- uc->config.remote_thread_id = -1;
- uc->config.mapped_channel_id = -1;
- uc->config.default_flow_id = -1;
- uc->state = UDMA_CHAN_IS_IDLE;
-}
-
-static void udma_dump_chan_stdata(struct udma_chan *uc)
-{
- struct device *dev = uc->ud->dev;
- u32 offset;
- int i;
-
- if (uc->config.dir == DMA_MEM_TO_DEV || uc->config.dir == DMA_MEM_TO_MEM) {
- dev_dbg(dev, "TCHAN State data:\n");
- for (i = 0; i < 32; i++) {
- offset = UDMA_CHAN_RT_STDATA_REG + i * 4;
- dev_dbg(dev, "TRT_STDATA[%02d]: 0x%08x\n", i,
- udma_tchanrt_read(uc, offset));
- }
- }
-
- if (uc->config.dir == DMA_DEV_TO_MEM || uc->config.dir == DMA_MEM_TO_MEM) {
- dev_dbg(dev, "RCHAN State data:\n");
- for (i = 0; i < 32; i++) {
- offset = UDMA_CHAN_RT_STDATA_REG + i * 4;
- dev_dbg(dev, "RRT_STDATA[%02d]: 0x%08x\n", i,
- udma_rchanrt_read(uc, offset));
- }
- }
-}
-
-static bool udma_is_chan_running(struct udma_chan *uc)
-{
- u32 trt_ctl = 0;
- u32 rrt_ctl = 0;
-
- if (uc->tchan)
- trt_ctl = udma_tchanrt_read(uc, UDMA_CHAN_RT_CTL_REG);
- if (uc->rchan)
- rrt_ctl = udma_rchanrt_read(uc, UDMA_CHAN_RT_CTL_REG);
-
- if (trt_ctl & UDMA_CHAN_RT_CTL_EN || rrt_ctl & UDMA_CHAN_RT_CTL_EN)
- return true;
-
- return false;
-}
-
static bool udma_is_chan_paused(struct udma_chan *uc)
{
u32 val, pause_mask;
@@ -275,40 +189,6 @@ static int udma_reset_chan(struct udma_chan *uc, bool hard)
return 0;
}
-static void udma_start_desc(struct udma_chan *uc)
-{
- struct udma_chan_config *ucc = &uc->config;
-
- if (uc->ud->match_data->type == DMA_TYPE_UDMA && ucc->pkt_mode &&
- (uc->cyclic || ucc->dir == DMA_DEV_TO_MEM)) {
- int i;
-
- /*
- * UDMA only: Push all descriptors to ring for packet mode
- * cyclic or RX
- * PKTDMA supports pre-linked descriptor and cyclic is not
- * supported
- */
- for (i = 0; i < uc->desc->sglen; i++)
- udma_push_to_ring(uc, i);
- } else {
- udma_push_to_ring(uc, 0);
- }
-}
-
-static bool udma_chan_needs_reconfiguration(struct udma_chan *uc)
-{
- /* Only PDMAs have staticTR */
- if (uc->config.ep_type == PSIL_EP_NATIVE)
- return false;
-
- /* Check if the staticTR configuration has changed for TX */
- if (memcmp(&uc->static_tr, &uc->desc->static_tr, sizeof(uc->static_tr)))
- return true;
-
- return false;
-}
-
static int udma_start(struct udma_chan *uc)
{
struct virt_dma_desc *vd = vchan_next_desc(&uc->vc);
@@ -453,86 +333,6 @@ static int udma_stop(struct udma_chan *uc)
return 0;
}
-static void udma_cyclic_packet_elapsed(struct udma_chan *uc)
-{
- struct udma_desc *d = uc->desc;
- struct cppi5_host_desc_t *h_desc;
-
- h_desc = d->hwdesc[d->desc_idx].cppi5_desc_vaddr;
- cppi5_hdesc_reset_to_original(h_desc);
- udma_push_to_ring(uc, d->desc_idx);
- d->desc_idx = (d->desc_idx + 1) % d->sglen;
-}
-
-static void udma_check_tx_completion(struct work_struct *work)
-{
- struct udma_chan *uc = container_of(work, typeof(*uc),
- tx_drain.work.work);
- bool desc_done = true;
- u32 residue_diff;
- ktime_t time_diff;
- unsigned long delay;
- unsigned long flags;
-
- while (1) {
- spin_lock_irqsave(&uc->vc.lock, flags);
-
- if (uc->desc) {
- /* Get previous residue and time stamp */
- residue_diff = uc->tx_drain.residue;
- time_diff = uc->tx_drain.tstamp;
- /*
- * Get current residue and time stamp or see if
- * transfer is complete
- */
- desc_done = udma_is_desc_really_done(uc, uc->desc);
- }
-
- if (!desc_done) {
- /*
- * Find the time delta and residue delta w.r.t
- * previous poll
- */
- time_diff = ktime_sub(uc->tx_drain.tstamp,
- time_diff) + 1;
- residue_diff -= uc->tx_drain.residue;
- if (residue_diff) {
- /*
- * Try to guess when we should check
- * next time by calculating rate at
- * which data is being drained at the
- * peer device
- */
- delay = (time_diff / residue_diff) *
- uc->tx_drain.residue;
- } else {
- /* No progress, check again in 1 second */
- schedule_delayed_work(&uc->tx_drain.work, HZ);
- break;
- }
-
- spin_unlock_irqrestore(&uc->vc.lock, flags);
-
- usleep_range(ktime_to_us(delay),
- ktime_to_us(delay) + 10);
- continue;
- }
-
- if (uc->desc) {
- struct udma_desc *d = uc->desc;
-
- uc->ud->decrement_byte_counters(uc, d->residue);
- uc->ud->start(uc);
- vchan_cookie_complete(&d->vd);
- break;
- }
-
- break;
- }
-
- spin_unlock_irqrestore(&uc->vc.lock, flags);
-}
-
static irqreturn_t udma_ring_irq_handler(int irq, void *data)
{
struct udma_chan *uc = data;
@@ -2097,38 +1897,6 @@ static int pktdma_alloc_chan_resources(struct dma_chan *chan)
return ret;
}
-static int udma_slave_config(struct dma_chan *chan,
- struct dma_slave_config *cfg)
-{
- struct udma_chan *uc = to_udma_chan(chan);
-
- memcpy(&uc->cfg, cfg, sizeof(uc->cfg));
-
- return 0;
-}
-
-static void udma_issue_pending(struct dma_chan *chan)
-{
- struct udma_chan *uc = to_udma_chan(chan);
- unsigned long flags;
-
- spin_lock_irqsave(&uc->vc.lock, flags);
-
- /* If we have something pending and no active descriptor, then */
- if (vchan_issue_pending(&uc->vc) && !uc->desc) {
- /*
- * start a descriptor if the channel is NOT [marked as
- * terminating _and_ it is still running (teardown has not
- * completed yet)].
- */
- if (!(uc->state == UDMA_CHAN_IS_TERMINATING &&
- udma_is_chan_running(uc)))
- uc->ud->start(uc);
- }
-
- spin_unlock_irqrestore(&uc->vc.lock, flags);
-}
-
static enum dma_status udma_tx_status(struct dma_chan *chan,
dma_cookie_t cookie,
struct dma_tx_state *txstate)
@@ -2256,98 +2024,6 @@ static int udma_resume(struct dma_chan *chan)
return 0;
}
-static int udma_terminate_all(struct dma_chan *chan)
-{
- struct udma_chan *uc = to_udma_chan(chan);
- unsigned long flags;
- LIST_HEAD(head);
-
- spin_lock_irqsave(&uc->vc.lock, flags);
-
- if (udma_is_chan_running(uc))
- uc->ud->stop(uc);
-
- if (uc->desc) {
- uc->terminated_desc = uc->desc;
- uc->desc = NULL;
- uc->terminated_desc->terminated = true;
- cancel_delayed_work(&uc->tx_drain.work);
- }
-
- uc->paused = false;
-
- vchan_get_all_descriptors(&uc->vc, &head);
- spin_unlock_irqrestore(&uc->vc.lock, flags);
- vchan_dma_desc_free_list(&uc->vc, &head);
-
- return 0;
-}
-
-static void udma_synchronize(struct dma_chan *chan)
-{
- struct udma_chan *uc = to_udma_chan(chan);
- unsigned long timeout = msecs_to_jiffies(1000);
-
- vchan_synchronize(&uc->vc);
-
- if (uc->state == UDMA_CHAN_IS_TERMINATING) {
- timeout = wait_for_completion_timeout(&uc->teardown_completed,
- timeout);
- if (!timeout) {
- dev_warn(uc->ud->dev, "chan%d teardown timeout!\n",
- uc->id);
- udma_dump_chan_stdata(uc);
- uc->ud->reset_chan(uc, true);
- }
- }
-
- uc->ud->reset_chan(uc, false);
- if (udma_is_chan_running(uc))
- dev_warn(uc->ud->dev, "chan%d refused to stop!\n", uc->id);
-
- cancel_delayed_work_sync(&uc->tx_drain.work);
- udma_reset_rings(uc);
-}
-
-/*
- * This tasklet handles the completion of a DMA descriptor by
- * calling its callback and freeing it.
- */
-static void udma_vchan_complete(struct tasklet_struct *t)
-{
- struct virt_dma_chan *vc = from_tasklet(vc, t, task);
- struct virt_dma_desc *vd, *_vd;
- struct dmaengine_desc_callback cb;
- LIST_HEAD(head);
-
- spin_lock_irq(&vc->lock);
- list_splice_tail_init(&vc->desc_completed, &head);
- vd = vc->cyclic;
- if (vd) {
- vc->cyclic = NULL;
- dmaengine_desc_get_callback(&vd->tx, &cb);
- } else {
- memset(&cb, 0, sizeof(cb));
- }
- spin_unlock_irq(&vc->lock);
-
- udma_desc_pre_callback(vc, vd, NULL);
- dmaengine_desc_callback_invoke(&cb, NULL);
-
- list_for_each_entry_safe(vd, _vd, &head, node) {
- struct dmaengine_result result;
-
- dmaengine_desc_get_callback(&vd->tx, &cb);
-
- list_del(&vd->node);
-
- udma_desc_pre_callback(vc, vd, &result);
- dmaengine_desc_callback_invoke(&cb, &result);
-
- vchan_vdesc_fini(vd);
- }
-}
-
static void udma_free_chan_resources(struct dma_chan *chan)
{
struct udma_chan *uc = to_udma_chan(chan);
@@ -2822,17 +2498,6 @@ static int udma_get_mmrs(struct platform_device *pdev, struct udma_dev *ud)
return 0;
}
-static void udma_mark_resource_ranges(struct udma_dev *ud, unsigned long *map,
- struct ti_sci_resource_desc *rm_desc,
- char *name)
-{
- bitmap_clear(map, rm_desc->start, rm_desc->num);
- bitmap_clear(map, rm_desc->start_sec, rm_desc->num_sec);
- dev_dbg(ud->dev, "ti_sci resource range for %s: %d:%d | %d:%d\n", name,
- rm_desc->start, rm_desc->num, rm_desc->start_sec,
- rm_desc->num_sec);
-}
-
static const char * const range_names[] = {
[RM_RANGE_BCHAN] = "ti,sci-rm-range-bchan",
[RM_RANGE_TCHAN] = "ti,sci-rm-range-tchan",
@@ -3463,202 +3128,6 @@ static int setup_resources(struct udma_dev *ud)
return ch_count;
}
-static int udma_setup_rx_flush(struct udma_dev *ud)
-{
- struct udma_rx_flush *rx_flush = &ud->rx_flush;
- struct cppi5_desc_hdr_t *tr_desc;
- struct cppi5_tr_type1_t *tr_req;
- struct cppi5_host_desc_t *desc;
- struct device *dev = ud->dev;
- struct udma_hwdesc *hwdesc;
- size_t tr_size;
-
- /* Allocate 1K buffer for discarded data on RX channel teardown */
- rx_flush->buffer_size = SZ_1K;
- rx_flush->buffer_vaddr = devm_kzalloc(dev, rx_flush->buffer_size,
- GFP_KERNEL);
- if (!rx_flush->buffer_vaddr)
- return -ENOMEM;
-
- rx_flush->buffer_paddr = dma_map_single(dev, rx_flush->buffer_vaddr,
- rx_flush->buffer_size,
- DMA_TO_DEVICE);
- if (dma_mapping_error(dev, rx_flush->buffer_paddr))
- return -ENOMEM;
-
- /* Set up descriptor to be used for TR mode */
- hwdesc = &rx_flush->hwdescs[0];
- tr_size = sizeof(struct cppi5_tr_type1_t);
- hwdesc->cppi5_desc_size = cppi5_trdesc_calc_size(tr_size, 1);
- hwdesc->cppi5_desc_size = ALIGN(hwdesc->cppi5_desc_size,
- ud->desc_align);
-
- hwdesc->cppi5_desc_vaddr = devm_kzalloc(dev, hwdesc->cppi5_desc_size,
- GFP_KERNEL);
- if (!hwdesc->cppi5_desc_vaddr)
- return -ENOMEM;
-
- hwdesc->cppi5_desc_paddr = dma_map_single(dev, hwdesc->cppi5_desc_vaddr,
- hwdesc->cppi5_desc_size,
- DMA_TO_DEVICE);
- if (dma_mapping_error(dev, hwdesc->cppi5_desc_paddr))
- return -ENOMEM;
-
- /* Start of the TR req records */
- hwdesc->tr_req_base = hwdesc->cppi5_desc_vaddr + tr_size;
- /* Start address of the TR response array */
- hwdesc->tr_resp_base = hwdesc->tr_req_base + tr_size;
-
- tr_desc = hwdesc->cppi5_desc_vaddr;
- cppi5_trdesc_init(tr_desc, 1, tr_size, 0, 0);
- cppi5_desc_set_pktids(tr_desc, 0, CPPI5_INFO1_DESC_FLOWID_DEFAULT);
- cppi5_desc_set_retpolicy(tr_desc, 0, 0);
-
- tr_req = hwdesc->tr_req_base;
- cppi5_tr_init(&tr_req->flags, CPPI5_TR_TYPE1, false, false,
- CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
- cppi5_tr_csf_set(&tr_req->flags, CPPI5_TR_CSF_SUPR_EVT);
-
- tr_req->addr = rx_flush->buffer_paddr;
- tr_req->icnt0 = rx_flush->buffer_size;
- tr_req->icnt1 = 1;
-
- dma_sync_single_for_device(dev, hwdesc->cppi5_desc_paddr,
- hwdesc->cppi5_desc_size, DMA_TO_DEVICE);
-
- /* Set up descriptor to be used for packet mode */
- hwdesc = &rx_flush->hwdescs[1];
- hwdesc->cppi5_desc_size = ALIGN(sizeof(struct cppi5_host_desc_t) +
- CPPI5_INFO0_HDESC_EPIB_SIZE +
- CPPI5_INFO0_HDESC_PSDATA_MAX_SIZE,
- ud->desc_align);
-
- hwdesc->cppi5_desc_vaddr = devm_kzalloc(dev, hwdesc->cppi5_desc_size,
- GFP_KERNEL);
- if (!hwdesc->cppi5_desc_vaddr)
- return -ENOMEM;
-
- hwdesc->cppi5_desc_paddr = dma_map_single(dev, hwdesc->cppi5_desc_vaddr,
- hwdesc->cppi5_desc_size,
- DMA_TO_DEVICE);
- if (dma_mapping_error(dev, hwdesc->cppi5_desc_paddr))
- return -ENOMEM;
-
- desc = hwdesc->cppi5_desc_vaddr;
- cppi5_hdesc_init(desc, 0, 0);
- cppi5_desc_set_pktids(&desc->hdr, 0, CPPI5_INFO1_DESC_FLOWID_DEFAULT);
- cppi5_desc_set_retpolicy(&desc->hdr, 0, 0);
-
- cppi5_hdesc_attach_buf(desc,
- rx_flush->buffer_paddr, rx_flush->buffer_size,
- rx_flush->buffer_paddr, rx_flush->buffer_size);
-
- dma_sync_single_for_device(dev, hwdesc->cppi5_desc_paddr,
- hwdesc->cppi5_desc_size, DMA_TO_DEVICE);
- return 0;
-}
-
-#ifdef CONFIG_DEBUG_FS
-static void udma_dbg_summary_show_chan(struct seq_file *s,
- struct dma_chan *chan)
-{
- struct udma_chan *uc = to_udma_chan(chan);
- struct udma_chan_config *ucc = &uc->config;
-
- seq_printf(s, " %-13s| %s", dma_chan_name(chan),
- chan->dbg_client_name ?: "in-use");
- if (ucc->tr_trigger_type)
- seq_puts(s, " (triggered, ");
- else
- seq_printf(s, " (%s, ",
- dmaengine_get_direction_text(uc->config.dir));
-
- switch (uc->config.dir) {
- case DMA_MEM_TO_MEM:
- if (uc->ud->match_data->type == DMA_TYPE_BCDMA) {
- seq_printf(s, "bchan%d)\n", uc->bchan->id);
- return;
- }
-
- seq_printf(s, "chan%d pair [0x%04x -> 0x%04x], ", uc->tchan->id,
- ucc->src_thread, ucc->dst_thread);
- break;
- case DMA_DEV_TO_MEM:
- seq_printf(s, "rchan%d [0x%04x -> 0x%04x], ", uc->rchan->id,
- ucc->src_thread, ucc->dst_thread);
- if (uc->ud->match_data->type == DMA_TYPE_PKTDMA)
- seq_printf(s, "rflow%d, ", uc->rflow->id);
- break;
- case DMA_MEM_TO_DEV:
- seq_printf(s, "tchan%d [0x%04x -> 0x%04x], ", uc->tchan->id,
- ucc->src_thread, ucc->dst_thread);
- if (uc->ud->match_data->type == DMA_TYPE_PKTDMA)
- seq_printf(s, "tflow%d, ", uc->tchan->tflow_id);
- break;
- default:
- seq_printf(s, ")\n");
- return;
- }
-
- if (ucc->ep_type == PSIL_EP_NATIVE) {
- seq_printf(s, "PSI-L Native");
- if (ucc->metadata_size) {
- seq_printf(s, "[%s", ucc->needs_epib ? " EPIB" : "");
- if (ucc->psd_size)
- seq_printf(s, " PSDsize:%u", ucc->psd_size);
- seq_printf(s, " ]");
- }
- } else {
- seq_printf(s, "PDMA");
- if (ucc->enable_acc32 || ucc->enable_burst)
- seq_printf(s, "[%s%s ]",
- ucc->enable_acc32 ? " ACC32" : "",
- ucc->enable_burst ? " BURST" : "");
- }
-
- seq_printf(s, ", %s)\n", ucc->pkt_mode ? "Packet mode" : "TR mode");
-}
-
-static void udma_dbg_summary_show(struct seq_file *s,
- struct dma_device *dma_dev)
-{
- struct dma_chan *chan;
-
- list_for_each_entry(chan, &dma_dev->channels, device_node) {
- if (chan->client_count)
- udma_dbg_summary_show_chan(s, chan);
- }
-}
-#endif /* CONFIG_DEBUG_FS */
-
-static enum dmaengine_alignment udma_get_copy_align(struct udma_dev *ud)
-{
- const struct udma_match_data *match_data = ud->match_data;
- u8 tpl;
-
- if (!match_data->enable_memcpy_support)
- return DMAENGINE_ALIGN_8_BYTES;
-
- /* Get the highest TPL level the device supports for memcpy */
- if (ud->bchan_cnt)
- tpl = udma_get_chan_tpl_index(&ud->bchan_tpl, 0);
- else if (ud->tchan_cnt)
- tpl = udma_get_chan_tpl_index(&ud->tchan_tpl, 0);
- else
- return DMAENGINE_ALIGN_8_BYTES;
-
- switch (match_data->burst_size[tpl]) {
- case TI_SCI_RM_UDMAP_CHAN_BURST_SIZE_256_BYTES:
- return DMAENGINE_ALIGN_256_BYTES;
- case TI_SCI_RM_UDMAP_CHAN_BURST_SIZE_128_BYTES:
- return DMAENGINE_ALIGN_128_BYTES;
- case TI_SCI_RM_UDMAP_CHAN_BURST_SIZE_64_BYTES:
- fallthrough;
- default:
- return DMAENGINE_ALIGN_64_BYTES;
- }
-}
-
static int udma_probe(struct platform_device *pdev)
{
struct device_node *navss_node = pdev->dev.parent->of_node;
diff --git a/drivers/dma/ti/k3-udma.h b/drivers/dma/ti/k3-udma.h
index 16de0b218d8ad..4878d13d84ed0 100644
--- a/drivers/dma/ti/k3-udma.h
+++ b/drivers/dma/ti/k3-udma.h
@@ -629,6 +629,34 @@ void udma_reset_rings(struct udma_chan *uc);
int navss_psil_pair(struct udma_dev *ud, u32 src_thread, u32 dst_thread);
int navss_psil_unpair(struct udma_dev *ud, u32 src_thread, u32 dst_thread);
+void udma_start_desc(struct udma_chan *uc);
+u8 udma_get_chan_tpl_index(struct udma_tpl *tpl_map, int chan_id);
+void k3_configure_chan_coherency(struct dma_chan *chan, u32 asel);
+void udma_reset_uchan(struct udma_chan *uc);
+void udma_dump_chan_stdata(struct udma_chan *uc);
+bool udma_is_chan_running(struct udma_chan *uc);
+
+bool udma_chan_needs_reconfiguration(struct udma_chan *uc);
+void udma_cyclic_packet_elapsed(struct udma_chan *uc);
+void udma_check_tx_completion(struct work_struct *work);
+int udma_slave_config(struct dma_chan *chan,
+ struct dma_slave_config *cfg);
+void udma_issue_pending(struct dma_chan *chan);
+int udma_terminate_all(struct dma_chan *chan);
+void udma_synchronize(struct dma_chan *chan);
+void udma_vchan_complete(struct tasklet_struct *t);
+void udma_mark_resource_ranges(struct udma_dev *ud, unsigned long *map,
+ struct ti_sci_resource_desc *rm_desc,
+ char *name);
+int udma_setup_rx_flush(struct udma_dev *ud);
+enum dmaengine_alignment udma_get_copy_align(struct udma_dev *ud);
+
+#ifdef CONFIG_DEBUG_FS
+void udma_dbg_summary_show_chan(struct seq_file *s,
+ struct dma_chan *chan);
+void udma_dbg_summary_show(struct seq_file *s,
+ struct dma_device *dma_dev);
+#endif /* CONFIG_DEBUG_FS */
/* Direct access to UDMA low lever resources for the glue layer */
int xudma_navss_psil_pair(struct udma_dev *ud, u32 src_thread, u32 dst_thread);
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 08/19] dmaengine: ti: k3-udma: move udma utility functions to k3-udma-common.c
2026-08-10 15:14 ` [PATCH v8 08/19] dmaengine: ti: k3-udma: move udma utility functions to k3-udma-common.c Sai Sree Kartheek Adivi
@ 2026-08-10 16:09 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-08-10 16:09 UTC (permalink / raw)
To: Sai Sree Kartheek Adivi
Cc: vkoul, Frank.Li, dmaengine, conor+dt, devicetree, robh
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
Pre-existing issues:
- [High] Infinite loop in `udma_check_tx_completion` when channel is terminated concurrently.
- [High] DMA mappings are permanently leaked in `udma_setup_rx_flush` on error paths and during normal teardown.
- [High] RX flush buffer is mapped with `DMA_TO_DEVICE` instead of `DMA_FROM_DEVICE`, causing IOMMU faults.
- [High] Double free of `uc->terminated_desc` due to a TOCTOU race condition between `udma_ring_irq_handler` and `udma_reset_rings`.
--
--- Patch [8]: [PATCH v8 08/19] dmaengine: ti: k3-udma: move udma utility functions to k3-udma-common.c ---
commit 1751c5be6aa08d5072c4cebf22d4b8c37ab58711
Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>
Date: Mon Aug 10 15:14:02 2026 +0000
dmaengine: ti: k3-udma: move udma utility functions to k3-udma-common.c
Relocate udma utility functions from k3-udma.c to k3-udma-common.c file.
The implementation of these functions is largely shared between K3 UDMA
and K3 UDMA v2. This refactor improves code reuse and maintainability
across multiple variants.
No functional changes intended.
> diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
> index 3ec5cc932280c..892b88a220f18 100644
> --- a/drivers/dma/ti/k3-udma-common.c
> +++ b/drivers/dma/ti/k3-udma-common.c
[ ... ]
> @@ -1342,5 +1365,531 @@ void udma_reset_rings(struct udma_chan *uc)
> +void udma_check_tx_completion(struct work_struct *work)
> +{
> + struct udma_chan *uc = container_of(work, typeof(*uc),
> + tx_drain.work.work);
> + bool desc_done = true;
> + u32 residue_diff;
> + ktime_t time_diff;
> + unsigned long delay;
> + unsigned long flags;
> +
> + while (1) {
> + spin_lock_irqsave(&uc->vc.lock, flags);
> +
> + if (uc->desc) {
> + /* Get previous residue and time stamp */
> + residue_diff = uc->tx_drain.residue;
> + time_diff = uc->tx_drain.tstamp;
> + /*
> + * Get current residue and time stamp or see if
> + * transfer is complete
> + */
> + desc_done = udma_is_desc_really_done(uc, uc->desc);
> + }
> +
> + if (!desc_done) {
> + /*
> + * Find the time delta and residue delta w.r.t
> + * previous poll
> + */
> + time_diff = ktime_sub(uc->tx_drain.tstamp,
> + time_diff) + 1;
> + residue_diff -= uc->tx_drain.residue;
> + if (residue_diff) {
> + /*
> + * Try to guess when we should check
> + * next time by calculating rate at
> + * which data is being drained at the
> + * peer device
> + */
> + delay = (time_diff / residue_diff) *
> + uc->tx_drain.residue;
> + } else {
> + /* No progress, check again in 1 second */
> + schedule_delayed_work(&uc->tx_drain.work, HZ);
> + break;
> + }
> +
> + spin_unlock_irqrestore(&uc->vc.lock, flags);
> +
> + usleep_range(ktime_to_us(delay),
> + ktime_to_us(delay) + 10);
> + continue;
[Severity: High]
This is a pre-existing issue, but can this worker thread spin indefinitely
if the channel is terminated concurrently?
If udma_terminate_all() executes while this worker is sleeping, it sets
uc->desc = NULL. When the worker wakes up and reacquires the lock, it
skips the if (uc->desc) block, leaving the local variable desc_done as
false.
It then enters the if (!desc_done) block, repeatedly subtracting the
now-stale uc->tx_drain.residue from the local residue_diff. Because the
state is never refreshed, does the loop repeat endlessly until an eventual
integer underflow allows it to break millions of iterations later?
> + }
> +
> + if (uc->desc) {
> + struct udma_desc *d = uc->desc;
> +
> + uc->ud->decrement_byte_counters(uc, d->residue);
> + uc->ud->start(uc);
> + vchan_cookie_complete(&d->vd);
> + break;
> + }
> +
> + break;
> + }
> +
> + spin_unlock_irqrestore(&uc->vc.lock, flags);
> +}
[ ... ]
> +void udma_synchronize(struct dma_chan *chan)
> +{
> + struct udma_chan *uc = to_udma_chan(chan);
> + unsigned long timeout = msecs_to_jiffies(1000);
> +
> + vchan_synchronize(&uc->vc);
> +
> + if (uc->state == UDMA_CHAN_IS_TERMINATING) {
> + timeout = wait_for_completion_timeout(&uc->teardown_completed,
> + timeout);
> + if (!timeout) {
> + dev_warn(uc->ud->dev, "chan%d teardown timeout!\n",
> + uc->id);
> + udma_dump_chan_stdata(uc);
> + uc->ud->reset_chan(uc, true);
> + }
> + }
> +
> + uc->ud->reset_chan(uc, false);
> + if (udma_is_chan_running(uc))
> + dev_warn(uc->ud->dev, "chan%d refused to stop!\n", uc->id);
> +
> + cancel_delayed_work_sync(&uc->tx_drain.work);
> + udma_reset_rings(uc);
[Severity: High]
This isn't a bug introduced by this patch, but is there a TOCTOU race
condition between udma_synchronize() calling udma_reset_rings() and the
udma_ring_irq_handler()?
In udma_ring_irq_handler(), when a teardown completion message is processed,
complete_all(&uc->teardown_completed) is called before uc->terminated_desc
is freed and cleared:
if (cppi5_desc_is_tdcm(paddr)) {
complete_all(&uc->teardown_completed);
if (uc->terminated_desc) {
udma_desc_free(&uc->terminated_desc->vd);
uc->terminated_desc = NULL;
}
Calling complete_all() immediately wakes up the thread waiting here in
udma_synchronize(). The woken thread then executes udma_reset_rings() which
performs an unlocked check of uc->terminated_desc.
In an SMP system, could the woken thread observe uc->terminated_desc as
non-NULL before the IRQ handler on the original CPU sets it to NULL, causing
both threads to concurrently attempt a double-free?
> +}
[ ... ]
> +int udma_setup_rx_flush(struct udma_dev *ud)
> +{
> + struct udma_rx_flush *rx_flush = &ud->rx_flush;
> + struct cppi5_desc_hdr_t *tr_desc;
> + struct cppi5_tr_type1_t *tr_req;
> + struct cppi5_host_desc_t *desc;
> + struct device *dev = ud->dev;
> + struct udma_hwdesc *hwdesc;
> + size_t tr_size;
> +
> + /* Allocate 1K buffer for discarded data on RX channel teardown */
> + rx_flush->buffer_size = SZ_1K;
> + rx_flush->buffer_vaddr = devm_kzalloc(dev, rx_flush->buffer_size,
> + GFP_KERNEL);
> + if (!rx_flush->buffer_vaddr)
> + return -ENOMEM;
> +
> + rx_flush->buffer_paddr = dma_map_single(dev, rx_flush->buffer_vaddr,
> + rx_flush->buffer_size,
> + DMA_TO_DEVICE);
[Severity: High]
This is a pre-existing issue, but is DMA_TO_DEVICE the correct direction
for this mapping?
This buffer seems to act as a memory sink for discarded incoming data
when tearing down a DEV_TO_MEM channel. Because the DMA engine writes data
to this buffer, the IOMMU must grant write access to the device. However,
mapping it with DMA_TO_DEVICE configures the IOMMU to allow only device reads.
Will a strict IOMMU trap the write and trigger a fault?
> + if (dma_mapping_error(dev, rx_flush->buffer_paddr))
> + return -ENOMEM;
> +
> + /* Set up descriptor to be used for TR mode */
> + hwdesc = &rx_flush->hwdescs[0];
> + tr_size = sizeof(struct cppi5_tr_type1_t);
> + hwdesc->cppi5_desc_size = cppi5_trdesc_calc_size(tr_size, 1);
> + hwdesc->cppi5_desc_size = ALIGN(hwdesc->cppi5_desc_size,
> + ud->desc_align);
> +
> + hwdesc->cppi5_desc_vaddr = devm_kzalloc(dev, hwdesc->cppi5_desc_size,
> + GFP_KERNEL);
> + if (!hwdesc->cppi5_desc_vaddr)
> + return -ENOMEM;
[Severity: High]
This isn't a bug introduced by this patch, but does this error path permanently
leak the DMA mapping (IOVA space)?
If the allocation for hwdesc->cppi5_desc_vaddr fails, the function returns
-ENOMEM without calling dma_unmap_single() for rx_flush->buffer_paddr.
While devres frees the memory, IOVA space mapped via dma_map_single() must
be explicitly unmapped.
Additionally, is there a corresponding dma_unmap_single() invoked during
normal driver teardown?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260810151423.1948224-1-s-adivi@ti.com?part=8
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 09/19] dmaengine: ti: k3-udma: move resource management functions to k3-udma-common.c
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
` (7 preceding siblings ...)
2026-08-10 15:14 ` [PATCH v8 08/19] dmaengine: ti: k3-udma: move udma utility functions to k3-udma-common.c Sai Sree Kartheek Adivi
@ 2026-08-10 15:14 ` Sai Sree Kartheek Adivi
2026-08-10 16:26 ` sashiko-bot
2026-08-10 15:14 ` [PATCH v8 10/19] dmaengine: ti: k3-udma: refactor resource setup functions Sai Sree Kartheek Adivi
` (9 subsequent siblings)
18 siblings, 1 reply; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:14 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
Move functions responsible for allocation and release of udma
resources such as channels, rings and flows from k3-udma.c
to the common k3-udma-common.c file.
The implementation of these functions is largely shared between K3 UDMA
and K3 UDMA v2. This refactor improves code reuse and maintainability
across multiple variants.
No functional changes intended.
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
drivers/dma/ti/k3-udma-common.c | 442 ++++++++++++++++++++++++++++++++
drivers/dma/ti/k3-udma.c | 423 ------------------------------
drivers/dma/ti/k3-udma.h | 21 ++
3 files changed, 463 insertions(+), 423 deletions(-)
diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
index 892b88a220f18..d93017a26bf1a 100644
--- a/drivers/dma/ti/k3-udma-common.c
+++ b/drivers/dma/ti/k3-udma-common.c
@@ -1891,5 +1891,447 @@ enum dmaengine_alignment udma_get_copy_align(struct udma_dev *ud)
}
EXPORT_SYMBOL_GPL(udma_get_copy_align);
+/**
+ * __udma_alloc_gp_rflow_range - alloc range of GP RX flows
+ * @ud: UDMA device
+ * @from: Start the search from this flow id number
+ * @cnt: Number of consecutive flow ids to allocate
+ *
+ * Allocate range of RX flow ids for future use, those flows can be requested
+ * only using explicit flow id number. if @from is set to -1 it will try to find
+ * first free range. if @from is positive value it will force allocation only
+ * of the specified range of flows.
+ *
+ * Returns -ENOMEM if can't find free range.
+ * -EEXIST if requested range is busy.
+ * -EINVAL if wrong input values passed.
+ * Returns flow id on success.
+ */
+int __udma_alloc_gp_rflow_range(struct udma_dev *ud, int from, int cnt)
+{
+ int start, tmp_from;
+ DECLARE_BITMAP(tmp, K3_UDMA_MAX_RFLOWS);
+
+ tmp_from = from;
+ if (tmp_from < 0)
+ tmp_from = ud->rchan_cnt;
+ /* default flows can't be allocated and accessible only by id */
+ if (tmp_from < ud->rchan_cnt)
+ return -EINVAL;
+
+ if (tmp_from + cnt > ud->rflow_cnt)
+ return -EINVAL;
+
+ bitmap_or(tmp, ud->rflow_gp_map, ud->rflow_gp_map_allocated,
+ ud->rflow_cnt);
+
+ start = bitmap_find_next_zero_area(tmp,
+ ud->rflow_cnt,
+ tmp_from, cnt, 0);
+ if (start >= ud->rflow_cnt)
+ return -ENOMEM;
+
+ if (from >= 0 && start != from)
+ return -EEXIST;
+
+ bitmap_set(ud->rflow_gp_map_allocated, start, cnt);
+ return start;
+}
+EXPORT_SYMBOL_GPL(__udma_alloc_gp_rflow_range);
+
+int __udma_free_gp_rflow_range(struct udma_dev *ud, int from, int cnt)
+{
+ if (from < ud->rchan_cnt)
+ return -EINVAL;
+ if (from + cnt > ud->rflow_cnt)
+ return -EINVAL;
+
+ bitmap_clear(ud->rflow_gp_map_allocated, from, cnt);
+ return 0;
+}
+EXPORT_SYMBOL_GPL(__udma_free_gp_rflow_range);
+
+struct udma_rflow *__udma_get_rflow(struct udma_dev *ud, int id)
+{
+ /*
+ * Attempt to request rflow by ID can be made for any rflow
+ * if not in use with assumption that caller knows what's doing.
+ * TI-SCI FW will perform additional permission check ant way, it's
+ * safe
+ */
+
+ if (id < 0 || id >= ud->rflow_cnt)
+ return ERR_PTR(-ENOENT);
+
+ if (test_bit(id, ud->rflow_in_use))
+ return ERR_PTR(-ENOENT);
+
+ if (ud->rflow_gp_map) {
+ /* GP rflow has to be allocated first */
+ if (!test_bit(id, ud->rflow_gp_map) &&
+ !test_bit(id, ud->rflow_gp_map_allocated))
+ return ERR_PTR(-EINVAL);
+ }
+
+ dev_dbg(ud->dev, "get rflow%d\n", id);
+ set_bit(id, ud->rflow_in_use);
+ return &ud->rflows[id];
+}
+EXPORT_SYMBOL_GPL(__udma_get_rflow);
+
+void __udma_put_rflow(struct udma_dev *ud, struct udma_rflow *rflow)
+{
+ if (!test_bit(rflow->id, ud->rflow_in_use)) {
+ dev_err(ud->dev, "attempt to put unused rflow%d\n", rflow->id);
+ return;
+ }
+
+ dev_dbg(ud->dev, "put rflow%d\n", rflow->id);
+ clear_bit(rflow->id, ud->rflow_in_use);
+}
+EXPORT_SYMBOL_GPL(__udma_put_rflow);
+
+#define UDMA_RESERVE_RESOURCE(res) \
+struct udma_##res *__udma_reserve_##res(struct udma_dev *ud, \
+ enum udma_tp_level tpl, \
+ int id) \
+{ \
+ if (id >= 0) { \
+ if (test_bit(id, ud->res##_map)) { \
+ dev_err(ud->dev, "res##%d is in use\n", id); \
+ return ERR_PTR(-ENOENT); \
+ } \
+ } else { \
+ int start; \
+ \
+ if (tpl >= ud->res##_tpl.levels) \
+ tpl = ud->res##_tpl.levels - 1; \
+ \
+ start = ud->res##_tpl.start_idx[tpl]; \
+ \
+ id = find_next_zero_bit(ud->res##_map, ud->res##_cnt, \
+ start); \
+ if (id == ud->res##_cnt) { \
+ return ERR_PTR(-ENOENT); \
+ } \
+ } \
+ \
+ set_bit(id, ud->res##_map); \
+ return &ud->res##s[id]; \
+}
+
+UDMA_RESERVE_RESOURCE(bchan);
+EXPORT_SYMBOL_GPL(__udma_reserve_bchan);
+UDMA_RESERVE_RESOURCE(tchan);
+EXPORT_SYMBOL_GPL(__udma_reserve_tchan);
+UDMA_RESERVE_RESOURCE(rchan);
+EXPORT_SYMBOL_GPL(__udma_reserve_rchan);
+
+int udma_get_tchan(struct udma_chan *uc)
+{
+ struct udma_dev *ud = uc->ud;
+ int ret;
+
+ if (uc->tchan) {
+ dev_dbg(ud->dev, "chan%d: already have tchan%d allocated\n",
+ uc->id, uc->tchan->id);
+ return 0;
+ }
+
+ /*
+ * mapped_channel_id is -1 for UDMA, BCDMA and PKTDMA unmapped channels.
+ * For PKTDMA mapped channels it is configured to a channel which must
+ * be used to service the peripheral.
+ */
+ uc->tchan = __udma_reserve_tchan(ud, uc->config.channel_tpl,
+ uc->config.mapped_channel_id);
+ if (IS_ERR(uc->tchan)) {
+ ret = PTR_ERR(uc->tchan);
+ uc->tchan = NULL;
+ return ret;
+ }
+
+ if (ud->tflow_cnt) {
+ int tflow_id;
+
+ /* Only PKTDMA have support for tx flows */
+ if (uc->config.default_flow_id >= 0)
+ tflow_id = uc->config.default_flow_id;
+ else
+ tflow_id = uc->tchan->id;
+
+ if (test_bit(tflow_id, ud->tflow_map)) {
+ dev_err(ud->dev, "tflow%d is in use\n", tflow_id);
+ clear_bit(uc->tchan->id, ud->tchan_map);
+ uc->tchan = NULL;
+ return -ENOENT;
+ }
+
+ uc->tchan->tflow_id = tflow_id;
+ set_bit(tflow_id, ud->tflow_map);
+ } else {
+ uc->tchan->tflow_id = -1;
+ }
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(udma_get_tchan);
+
+int udma_get_rchan(struct udma_chan *uc)
+{
+ struct udma_dev *ud = uc->ud;
+ int ret;
+
+ if (uc->rchan) {
+ dev_dbg(ud->dev, "chan%d: already have rchan%d allocated\n",
+ uc->id, uc->rchan->id);
+ return 0;
+ }
+
+ /*
+ * mapped_channel_id is -1 for UDMA, BCDMA and PKTDMA unmapped channels.
+ * For PKTDMA mapped channels it is configured to a channel which must
+ * be used to service the peripheral.
+ */
+ uc->rchan = __udma_reserve_rchan(ud, uc->config.channel_tpl,
+ uc->config.mapped_channel_id);
+ if (IS_ERR(uc->rchan)) {
+ ret = PTR_ERR(uc->rchan);
+ uc->rchan = NULL;
+ return ret;
+ }
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(udma_get_rchan);
+
+int udma_get_chan_pair(struct udma_chan *uc)
+{
+ struct udma_dev *ud = uc->ud;
+ int chan_id, end;
+
+ if ((uc->tchan && uc->rchan) && uc->tchan->id == uc->rchan->id) {
+ dev_info(ud->dev, "chan%d: already have %d pair allocated\n",
+ uc->id, uc->tchan->id);
+ return 0;
+ }
+
+ if (uc->tchan) {
+ dev_err(ud->dev, "chan%d: already have tchan%d allocated\n",
+ uc->id, uc->tchan->id);
+ return -EBUSY;
+ } else if (uc->rchan) {
+ dev_err(ud->dev, "chan%d: already have rchan%d allocated\n",
+ uc->id, uc->rchan->id);
+ return -EBUSY;
+ }
+
+ /* Can be optimized, but let's have it like this for now */
+ end = min(ud->tchan_cnt, ud->rchan_cnt);
+ /*
+ * Try to use the highest TPL channel pair for MEM_TO_MEM channels
+ * Note: in UDMAP the channel TPL is symmetric between tchan and rchan
+ */
+ chan_id = ud->tchan_tpl.start_idx[ud->tchan_tpl.levels - 1];
+ for (; chan_id < end; chan_id++) {
+ if (!test_bit(chan_id, ud->tchan_map) &&
+ !test_bit(chan_id, ud->rchan_map))
+ break;
+ }
+
+ if (chan_id == end)
+ return -ENOENT;
+
+ set_bit(chan_id, ud->tchan_map);
+ set_bit(chan_id, ud->rchan_map);
+ uc->tchan = &ud->tchans[chan_id];
+ uc->rchan = &ud->rchans[chan_id];
+
+ /* UDMA does not use tx flows */
+ uc->tchan->tflow_id = -1;
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(udma_get_chan_pair);
+
+int udma_get_rflow(struct udma_chan *uc, int flow_id)
+{
+ struct udma_dev *ud = uc->ud;
+ int ret;
+
+ if (!uc->rchan) {
+ dev_err(ud->dev, "chan%d: does not have rchan??\n", uc->id);
+ return -EINVAL;
+ }
+
+ if (uc->rflow) {
+ dev_dbg(ud->dev, "chan%d: already have rflow%d allocated\n",
+ uc->id, uc->rflow->id);
+ return 0;
+ }
+
+ uc->rflow = __udma_get_rflow(ud, flow_id);
+ if (IS_ERR(uc->rflow)) {
+ ret = PTR_ERR(uc->rflow);
+ uc->rflow = NULL;
+ return ret;
+ }
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(udma_get_rflow);
+
+void udma_put_rchan(struct udma_chan *uc)
+{
+ struct udma_dev *ud = uc->ud;
+
+ if (uc->rchan) {
+ dev_dbg(ud->dev, "chan%d: put rchan%d\n", uc->id,
+ uc->rchan->id);
+ clear_bit(uc->rchan->id, ud->rchan_map);
+ uc->rchan = NULL;
+ }
+}
+EXPORT_SYMBOL_GPL(udma_put_rchan);
+
+void udma_put_tchan(struct udma_chan *uc)
+{
+ struct udma_dev *ud = uc->ud;
+
+ if (uc->tchan) {
+ dev_dbg(ud->dev, "chan%d: put tchan%d\n", uc->id,
+ uc->tchan->id);
+ clear_bit(uc->tchan->id, ud->tchan_map);
+
+ if (uc->tchan->tflow_id >= 0)
+ clear_bit(uc->tchan->tflow_id, ud->tflow_map);
+
+ uc->tchan = NULL;
+ }
+}
+EXPORT_SYMBOL_GPL(udma_put_tchan);
+
+void udma_put_rflow(struct udma_chan *uc)
+{
+ struct udma_dev *ud = uc->ud;
+
+ if (uc->rflow) {
+ dev_dbg(ud->dev, "chan%d: put rflow%d\n", uc->id,
+ uc->rflow->id);
+ __udma_put_rflow(ud, uc->rflow);
+ uc->rflow = NULL;
+ }
+}
+EXPORT_SYMBOL_GPL(udma_put_rflow);
+
+void udma_free_tx_resources(struct udma_chan *uc)
+{
+ if (!uc->tchan)
+ return;
+
+ k3_ringacc_ring_free(uc->tchan->t_ring);
+ k3_ringacc_ring_free(uc->tchan->tc_ring);
+ uc->tchan->t_ring = NULL;
+ uc->tchan->tc_ring = NULL;
+
+ udma_put_tchan(uc);
+}
+EXPORT_SYMBOL_GPL(udma_free_tx_resources);
+
+void udma_free_rx_resources(struct udma_chan *uc)
+{
+ if (!uc->rchan)
+ return;
+
+ if (uc->rflow) {
+ struct udma_rflow *rflow = uc->rflow;
+
+ k3_ringacc_ring_free(rflow->fd_ring);
+ k3_ringacc_ring_free(rflow->r_ring);
+ rflow->fd_ring = NULL;
+ rflow->r_ring = NULL;
+
+ udma_put_rflow(uc);
+ }
+
+ udma_put_rchan(uc);
+}
+EXPORT_SYMBOL_GPL(udma_free_rx_resources);
+
+void udma_free_chan_resources(struct dma_chan *chan)
+{
+ struct udma_chan *uc = to_udma_chan(chan);
+ struct udma_dev *ud = to_udma_dev(chan->device);
+
+ udma_terminate_all(chan);
+ if (uc->terminated_desc) {
+ ud->reset_chan(uc, false);
+ udma_reset_rings(uc);
+ }
+
+ cancel_delayed_work_sync(&uc->tx_drain.work);
+
+ if (uc->irq_num_ring > 0) {
+ free_irq(uc->irq_num_ring, uc);
+
+ uc->irq_num_ring = 0;
+ }
+ if (uc->irq_num_udma > 0) {
+ free_irq(uc->irq_num_udma, uc);
+
+ uc->irq_num_udma = 0;
+ }
+
+ /* Release PSI-L pairing */
+ if (uc->psil_paired && ud->psil_unpair) {
+ ud->psil_unpair(ud, uc->config.src_thread,
+ uc->config.dst_thread);
+ uc->psil_paired = false;
+ }
+
+ vchan_free_chan_resources(&uc->vc);
+ tasklet_kill(&uc->vc.task);
+
+ bcdma_free_bchan_resources(uc);
+ udma_free_tx_resources(uc);
+ udma_free_rx_resources(uc);
+ udma_reset_uchan(uc);
+
+ if (uc->use_dma_pool) {
+ dma_pool_destroy(uc->hdesc_pool);
+ uc->use_dma_pool = false;
+ }
+}
+EXPORT_SYMBOL_GPL(udma_free_chan_resources);
+
+void bcdma_put_bchan(struct udma_chan *uc)
+{
+ struct udma_dev *ud = uc->ud;
+
+ if (uc->bchan) {
+ dev_dbg(ud->dev, "chan%d: put bchan%d\n", uc->id,
+ uc->bchan->id);
+ clear_bit(uc->bchan->id, ud->bchan_map);
+ uc->bchan = NULL;
+ uc->tchan = NULL;
+ }
+}
+EXPORT_SYMBOL_GPL(bcdma_put_bchan);
+
+void bcdma_free_bchan_resources(struct udma_chan *uc)
+{
+ if (!uc->bchan)
+ return;
+
+ k3_ringacc_ring_free(uc->bchan->tc_ring);
+ k3_ringacc_ring_free(uc->bchan->t_ring);
+ uc->bchan->tc_ring = NULL;
+ uc->bchan->t_ring = NULL;
+ k3_configure_chan_coherency(&uc->vc.chan, 0);
+
+ bcdma_put_bchan(uc);
+}
+EXPORT_SYMBOL_GPL(bcdma_free_bchan_resources);
+
MODULE_DESCRIPTION("Texas Instruments K3 UDMA Common Library");
MODULE_LICENSE("GPL v2");
diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index cd73bf03e9cc6..21978f17e327f 100644
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -423,135 +423,6 @@ static irqreturn_t udma_udma_irq_handler(int irq, void *data)
return IRQ_HANDLED;
}
-/**
- * __udma_alloc_gp_rflow_range - alloc range of GP RX flows
- * @ud: UDMA device
- * @from: Start the search from this flow id number
- * @cnt: Number of consecutive flow ids to allocate
- *
- * Allocate range of RX flow ids for future use, those flows can be requested
- * only using explicit flow id number. if @from is set to -1 it will try to find
- * first free range. if @from is positive value it will force allocation only
- * of the specified range of flows.
- *
- * Returns -ENOMEM if can't find free range.
- * -EEXIST if requested range is busy.
- * -EINVAL if wrong input values passed.
- * Returns flow id on success.
- */
-static int __udma_alloc_gp_rflow_range(struct udma_dev *ud, int from, int cnt)
-{
- int start, tmp_from;
- DECLARE_BITMAP(tmp, K3_UDMA_MAX_RFLOWS);
-
- tmp_from = from;
- if (tmp_from < 0)
- tmp_from = ud->rchan_cnt;
- /* default flows can't be allocated and accessible only by id */
- if (tmp_from < ud->rchan_cnt)
- return -EINVAL;
-
- if (tmp_from + cnt > ud->rflow_cnt)
- return -EINVAL;
-
- bitmap_or(tmp, ud->rflow_gp_map, ud->rflow_gp_map_allocated,
- ud->rflow_cnt);
-
- start = bitmap_find_next_zero_area(tmp,
- ud->rflow_cnt,
- tmp_from, cnt, 0);
- if (start >= ud->rflow_cnt)
- return -ENOMEM;
-
- if (from >= 0 && start != from)
- return -EEXIST;
-
- bitmap_set(ud->rflow_gp_map_allocated, start, cnt);
- return start;
-}
-
-static int __udma_free_gp_rflow_range(struct udma_dev *ud, int from, int cnt)
-{
- if (from < ud->rchan_cnt)
- return -EINVAL;
- if (from + cnt > ud->rflow_cnt)
- return -EINVAL;
-
- bitmap_clear(ud->rflow_gp_map_allocated, from, cnt);
- return 0;
-}
-
-static struct udma_rflow *__udma_get_rflow(struct udma_dev *ud, int id)
-{
- /*
- * Attempt to request rflow by ID can be made for any rflow
- * if not in use with assumption that caller knows what's doing.
- * TI-SCI FW will perform additional permission check ant way, it's
- * safe
- */
-
- if (id < 0 || id >= ud->rflow_cnt)
- return ERR_PTR(-ENOENT);
-
- if (test_bit(id, ud->rflow_in_use))
- return ERR_PTR(-ENOENT);
-
- if (ud->rflow_gp_map) {
- /* GP rflow has to be allocated first */
- if (!test_bit(id, ud->rflow_gp_map) &&
- !test_bit(id, ud->rflow_gp_map_allocated))
- return ERR_PTR(-EINVAL);
- }
-
- dev_dbg(ud->dev, "get rflow%d\n", id);
- set_bit(id, ud->rflow_in_use);
- return &ud->rflows[id];
-}
-
-static void __udma_put_rflow(struct udma_dev *ud, struct udma_rflow *rflow)
-{
- if (!test_bit(rflow->id, ud->rflow_in_use)) {
- dev_err(ud->dev, "attempt to put unused rflow%d\n", rflow->id);
- return;
- }
-
- dev_dbg(ud->dev, "put rflow%d\n", rflow->id);
- clear_bit(rflow->id, ud->rflow_in_use);
-}
-
-#define UDMA_RESERVE_RESOURCE(res) \
-static struct udma_##res *__udma_reserve_##res(struct udma_dev *ud, \
- enum udma_tp_level tpl, \
- int id) \
-{ \
- if (id >= 0) { \
- if (test_bit(id, ud->res##_map)) { \
- dev_err(ud->dev, "res##%d is in use\n", id); \
- return ERR_PTR(-ENOENT); \
- } \
- } else { \
- int start; \
- \
- if (tpl >= ud->res##_tpl.levels) \
- tpl = ud->res##_tpl.levels - 1; \
- \
- start = ud->res##_tpl.start_idx[tpl]; \
- \
- id = find_next_zero_bit(ud->res##_map, ud->res##_cnt, \
- start); \
- if (id == ud->res##_cnt) { \
- return ERR_PTR(-ENOENT); \
- } \
- } \
- \
- set_bit(id, ud->res##_map); \
- return &ud->res##s[id]; \
-}
-
-UDMA_RESERVE_RESOURCE(bchan);
-UDMA_RESERVE_RESOURCE(tchan);
-UDMA_RESERVE_RESOURCE(rchan);
-
static int bcdma_get_bchan(struct udma_chan *uc)
{
struct udma_dev *ud = uc->ud;
@@ -585,223 +456,6 @@ static int bcdma_get_bchan(struct udma_chan *uc)
return 0;
}
-static int udma_get_tchan(struct udma_chan *uc)
-{
- struct udma_dev *ud = uc->ud;
- int ret;
-
- if (uc->tchan) {
- dev_dbg(ud->dev, "chan%d: already have tchan%d allocated\n",
- uc->id, uc->tchan->id);
- return 0;
- }
-
- /*
- * mapped_channel_id is -1 for UDMA, BCDMA and PKTDMA unmapped channels.
- * For PKTDMA mapped channels it is configured to a channel which must
- * be used to service the peripheral.
- */
- uc->tchan = __udma_reserve_tchan(ud, uc->config.channel_tpl,
- uc->config.mapped_channel_id);
- if (IS_ERR(uc->tchan)) {
- ret = PTR_ERR(uc->tchan);
- uc->tchan = NULL;
- return ret;
- }
-
- if (ud->tflow_cnt) {
- int tflow_id;
-
- /* Only PKTDMA have support for tx flows */
- if (uc->config.default_flow_id >= 0)
- tflow_id = uc->config.default_flow_id;
- else
- tflow_id = uc->tchan->id;
-
- if (test_bit(tflow_id, ud->tflow_map)) {
- dev_err(ud->dev, "tflow%d is in use\n", tflow_id);
- clear_bit(uc->tchan->id, ud->tchan_map);
- uc->tchan = NULL;
- return -ENOENT;
- }
-
- uc->tchan->tflow_id = tflow_id;
- set_bit(tflow_id, ud->tflow_map);
- } else {
- uc->tchan->tflow_id = -1;
- }
-
- return 0;
-}
-
-static int udma_get_rchan(struct udma_chan *uc)
-{
- struct udma_dev *ud = uc->ud;
- int ret;
-
- if (uc->rchan) {
- dev_dbg(ud->dev, "chan%d: already have rchan%d allocated\n",
- uc->id, uc->rchan->id);
- return 0;
- }
-
- /*
- * mapped_channel_id is -1 for UDMA, BCDMA and PKTDMA unmapped channels.
- * For PKTDMA mapped channels it is configured to a channel which must
- * be used to service the peripheral.
- */
- uc->rchan = __udma_reserve_rchan(ud, uc->config.channel_tpl,
- uc->config.mapped_channel_id);
- if (IS_ERR(uc->rchan)) {
- ret = PTR_ERR(uc->rchan);
- uc->rchan = NULL;
- return ret;
- }
-
- return 0;
-}
-
-static int udma_get_chan_pair(struct udma_chan *uc)
-{
- struct udma_dev *ud = uc->ud;
- int chan_id, end;
-
- if ((uc->tchan && uc->rchan) && uc->tchan->id == uc->rchan->id) {
- dev_info(ud->dev, "chan%d: already have %d pair allocated\n",
- uc->id, uc->tchan->id);
- return 0;
- }
-
- if (uc->tchan) {
- dev_err(ud->dev, "chan%d: already have tchan%d allocated\n",
- uc->id, uc->tchan->id);
- return -EBUSY;
- } else if (uc->rchan) {
- dev_err(ud->dev, "chan%d: already have rchan%d allocated\n",
- uc->id, uc->rchan->id);
- return -EBUSY;
- }
-
- /* Can be optimized, but let's have it like this for now */
- end = min(ud->tchan_cnt, ud->rchan_cnt);
- /*
- * Try to use the highest TPL channel pair for MEM_TO_MEM channels
- * Note: in UDMAP the channel TPL is symmetric between tchan and rchan
- */
- chan_id = ud->tchan_tpl.start_idx[ud->tchan_tpl.levels - 1];
- for (; chan_id < end; chan_id++) {
- if (!test_bit(chan_id, ud->tchan_map) &&
- !test_bit(chan_id, ud->rchan_map))
- break;
- }
-
- if (chan_id == end)
- return -ENOENT;
-
- set_bit(chan_id, ud->tchan_map);
- set_bit(chan_id, ud->rchan_map);
- uc->tchan = &ud->tchans[chan_id];
- uc->rchan = &ud->rchans[chan_id];
-
- /* UDMA does not use tx flows */
- uc->tchan->tflow_id = -1;
-
- return 0;
-}
-
-static int udma_get_rflow(struct udma_chan *uc, int flow_id)
-{
- struct udma_dev *ud = uc->ud;
- int ret;
-
- if (!uc->rchan) {
- dev_err(ud->dev, "chan%d: does not have rchan??\n", uc->id);
- return -EINVAL;
- }
-
- if (uc->rflow) {
- dev_dbg(ud->dev, "chan%d: already have rflow%d allocated\n",
- uc->id, uc->rflow->id);
- return 0;
- }
-
- uc->rflow = __udma_get_rflow(ud, flow_id);
- if (IS_ERR(uc->rflow)) {
- ret = PTR_ERR(uc->rflow);
- uc->rflow = NULL;
- return ret;
- }
-
- return 0;
-}
-
-static void bcdma_put_bchan(struct udma_chan *uc)
-{
- struct udma_dev *ud = uc->ud;
-
- if (uc->bchan) {
- dev_dbg(ud->dev, "chan%d: put bchan%d\n", uc->id,
- uc->bchan->id);
- clear_bit(uc->bchan->id, ud->bchan_map);
- uc->bchan = NULL;
- uc->tchan = NULL;
- }
-}
-
-static void udma_put_rchan(struct udma_chan *uc)
-{
- struct udma_dev *ud = uc->ud;
-
- if (uc->rchan) {
- dev_dbg(ud->dev, "chan%d: put rchan%d\n", uc->id,
- uc->rchan->id);
- clear_bit(uc->rchan->id, ud->rchan_map);
- uc->rchan = NULL;
- }
-}
-
-static void udma_put_tchan(struct udma_chan *uc)
-{
- struct udma_dev *ud = uc->ud;
-
- if (uc->tchan) {
- dev_dbg(ud->dev, "chan%d: put tchan%d\n", uc->id,
- uc->tchan->id);
- clear_bit(uc->tchan->id, ud->tchan_map);
-
- if (uc->tchan->tflow_id >= 0)
- clear_bit(uc->tchan->tflow_id, ud->tflow_map);
-
- uc->tchan = NULL;
- }
-}
-
-static void udma_put_rflow(struct udma_chan *uc)
-{
- struct udma_dev *ud = uc->ud;
-
- if (uc->rflow) {
- dev_dbg(ud->dev, "chan%d: put rflow%d\n", uc->id,
- uc->rflow->id);
- __udma_put_rflow(ud, uc->rflow);
- uc->rflow = NULL;
- }
-}
-
-static void bcdma_free_bchan_resources(struct udma_chan *uc)
-{
- if (!uc->bchan)
- return;
-
- k3_ringacc_ring_free(uc->bchan->tc_ring);
- k3_ringacc_ring_free(uc->bchan->t_ring);
- uc->bchan->tc_ring = NULL;
- uc->bchan->t_ring = NULL;
- k3_configure_chan_coherency(&uc->vc.chan, 0);
-
- bcdma_put_bchan(uc);
-}
-
static int bcdma_alloc_bchan_resources(struct udma_chan *uc)
{
struct k3_ring_cfg ring_cfg;
@@ -847,19 +501,6 @@ static int bcdma_alloc_bchan_resources(struct udma_chan *uc)
return ret;
}
-static void udma_free_tx_resources(struct udma_chan *uc)
-{
- if (!uc->tchan)
- return;
-
- k3_ringacc_ring_free(uc->tchan->t_ring);
- k3_ringacc_ring_free(uc->tchan->tc_ring);
- uc->tchan->t_ring = NULL;
- uc->tchan->tc_ring = NULL;
-
- udma_put_tchan(uc);
-}
-
static int udma_alloc_tx_resources(struct udma_chan *uc)
{
struct k3_ring_cfg ring_cfg;
@@ -917,25 +558,6 @@ static int udma_alloc_tx_resources(struct udma_chan *uc)
return ret;
}
-static void udma_free_rx_resources(struct udma_chan *uc)
-{
- if (!uc->rchan)
- return;
-
- if (uc->rflow) {
- struct udma_rflow *rflow = uc->rflow;
-
- k3_ringacc_ring_free(rflow->fd_ring);
- k3_ringacc_ring_free(rflow->r_ring);
- rflow->fd_ring = NULL;
- rflow->r_ring = NULL;
-
- udma_put_rflow(uc);
- }
-
- udma_put_rchan(uc);
-}
-
static int udma_alloc_rx_resources(struct udma_chan *uc)
{
struct udma_dev *ud = uc->ud;
@@ -2024,51 +1646,6 @@ static int udma_resume(struct dma_chan *chan)
return 0;
}
-static void udma_free_chan_resources(struct dma_chan *chan)
-{
- struct udma_chan *uc = to_udma_chan(chan);
- struct udma_dev *ud = to_udma_dev(chan->device);
-
- udma_terminate_all(chan);
- if (uc->terminated_desc) {
- ud->reset_chan(uc, false);
- udma_reset_rings(uc);
- }
-
- cancel_delayed_work_sync(&uc->tx_drain.work);
-
- if (uc->irq_num_ring > 0) {
- free_irq(uc->irq_num_ring, uc);
-
- uc->irq_num_ring = 0;
- }
- if (uc->irq_num_udma > 0) {
- free_irq(uc->irq_num_udma, uc);
-
- uc->irq_num_udma = 0;
- }
-
- /* Release PSI-L pairing */
- if (uc->psil_paired) {
- ud->psil_unpair(ud, uc->config.src_thread,
- uc->config.dst_thread);
- uc->psil_paired = false;
- }
-
- vchan_free_chan_resources(&uc->vc);
- tasklet_kill(&uc->vc.task);
-
- bcdma_free_bchan_resources(uc);
- udma_free_tx_resources(uc);
- udma_free_rx_resources(uc);
- udma_reset_uchan(uc);
-
- if (uc->use_dma_pool) {
- dma_pool_destroy(uc->hdesc_pool);
- uc->use_dma_pool = false;
- }
-}
-
static struct platform_driver udma_driver;
static struct platform_driver bcdma_driver;
static struct platform_driver pktdma_driver;
diff --git a/drivers/dma/ti/k3-udma.h b/drivers/dma/ti/k3-udma.h
index 4878d13d84ed0..329df7eb156b2 100644
--- a/drivers/dma/ti/k3-udma.h
+++ b/drivers/dma/ti/k3-udma.h
@@ -658,6 +658,27 @@ void udma_dbg_summary_show(struct seq_file *s,
struct dma_device *dma_dev);
#endif /* CONFIG_DEBUG_FS */
+int __udma_alloc_gp_rflow_range(struct udma_dev *ud, int from, int cnt);
+int __udma_free_gp_rflow_range(struct udma_dev *ud, int from, int cnt);
+struct udma_rflow *__udma_get_rflow(struct udma_dev *ud, int id);
+void __udma_put_rflow(struct udma_dev *ud, struct udma_rflow *rflow);
+int udma_get_tchan(struct udma_chan *uc);
+int udma_get_rchan(struct udma_chan *uc);
+int udma_get_chan_pair(struct udma_chan *uc);
+int udma_get_rflow(struct udma_chan *uc, int flow_id);
+void udma_put_rchan(struct udma_chan *uc);
+void udma_put_tchan(struct udma_chan *uc);
+void udma_put_rflow(struct udma_chan *uc);
+void udma_free_tx_resources(struct udma_chan *uc);
+void udma_free_rx_resources(struct udma_chan *uc);
+void udma_free_chan_resources(struct dma_chan *chan);
+void bcdma_put_bchan(struct udma_chan *uc);
+void bcdma_free_bchan_resources(struct udma_chan *uc);
+
+struct udma_bchan *__udma_reserve_bchan(struct udma_dev *ud, enum udma_tp_level tpl, int id);
+struct udma_tchan *__udma_reserve_tchan(struct udma_dev *ud, enum udma_tp_level tpl, int id);
+struct udma_rchan *__udma_reserve_rchan(struct udma_dev *ud, enum udma_tp_level tpl, int id);
+
/* Direct access to UDMA low lever resources for the glue layer */
int xudma_navss_psil_pair(struct udma_dev *ud, u32 src_thread, u32 dst_thread);
int xudma_navss_psil_unpair(struct udma_dev *ud, u32 src_thread,
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 09/19] dmaengine: ti: k3-udma: move resource management functions to k3-udma-common.c
2026-08-10 15:14 ` [PATCH v8 09/19] dmaengine: ti: k3-udma: move resource management " Sai Sree Kartheek Adivi
@ 2026-08-10 16:26 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-08-10 16:26 UTC (permalink / raw)
To: Sai Sree Kartheek Adivi
Cc: robh, conor+dt, Frank.Li, vkoul, dmaengine, devicetree
Thank you for your contribution! Sashiko AI review found 6 potential issue(s) to consider:
New issues:
- [High] The refactored `udma_free_chan_resources` introduces a state leak by conditionally clearing `uc->psil_paired`, which can lead to a NULL pointer dereference during subsequent error handling.
Pre-existing issues:
- [High] An integer overflow in `__udma_free_gp_rflow_range` bypasses bounds checks and allows writing zeroes over a huge area of memory.
- [High] `udma_get_chan_pair()` can perform an out-of-bounds array and bitmap access if `tchan_tpl.start_idx` is greater than the calculated `end` boundary.
- [High] The delayed work `udma_check_tx_completion` does not handle `uc->desc` becoming NULL during its execution, which can lead to an infinite loop (deadlock) or a Use-After-Free.
- [High] The `UDMA_RESERVE_RESOURCE` macro does not bounds-check the requested `id` against `ud->res##_cnt` before performing bitmap operations, leading to out-of-bounds memory accesses.
- [High] Lack of bounds checking on `tflow_id` in `udma_get_tchan` leads to out-of-bounds bitmap accesses.
--
--- Patch [9]: [PATCH v8 09/19] dmaengine: ti: k3-udma: move resource management functions to k3-udma-common.c ---
commit 5154d89b8961f97e1c19dede29d91f31da71af6d
Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>
Subject: dmaengine: ti: k3-udma: move resource management functions to k3-udma-common.c
Move functions responsible for allocation and release of udma resources such
as channels, rings and flows from k3-udma.c to the common k3-udma-common.c
file. The implementation of these functions is largely shared between K3 UDMA
and K3 UDMA v2. This refactor improves code reuse and maintainability across
multiple variants.
> diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
> index 892b88a220f18..d93017a26bf1a 100644
> --- a/drivers/dma/ti/k3-udma-common.c
> +++ b/drivers/dma/ti/k3-udma-common.c
[ ... ]
> +int __udma_free_gp_rflow_range(struct udma_dev *ud, int from, int cnt)
> +{
> + if (from < ud->rchan_cnt)
> + return -EINVAL;
> + if (from + cnt > ud->rflow_cnt)
> + return -EINVAL;
[Severity: High]
This is a pre-existing issue, but can the signed integer addition overflow
here, bypassing the bounds check?
If a large positive value is passed for cnt (such as INT_MAX), the signed
addition from + cnt could wrap around to a negative integer. This would
bypass the validation check entirely.
The function subsequently calls bitmap_clear(ud->rflow_gp_map_allocated,
from, cnt). Because bitmap_clear() expects an unsigned int for the number
of bits, the negative cnt would convert to a massive unsigned integer,
which could zero out large amounts of adjacent kernel memory.
[ ... ]
> +#define UDMA_RESERVE_RESOURCE(res) \
> +struct udma_##res *__udma_reserve_##res(struct udma_dev *ud, \
> + enum udma_tp_level tpl, \
> + int id) \
> +{ \
> + if (id >= 0) { \
> + if (test_bit(id, ud->res##_map)) { \
[Severity: High]
This is a pre-existing issue, but does this macro need a bounds check
against ud->res##_cnt before checking the bitmap?
When id >= 0 is provided (for instance, from a mapped_channel_id populated
via the Device Tree), the macro directly evaluates test_bit(id,
ud->res##_map).
If a misconfigured or abnormally large ID is supplied, it appears this would
cause an out-of-bounds read and write on the resource bitmaps.
[ ... ]
> +int udma_get_tchan(struct udma_chan *uc)
> +{
[ ... ]
> + if (ud->tflow_cnt) {
> + int tflow_id;
> +
> + /* Only PKTDMA have support for tx flows */
> + if (uc->config.default_flow_id >= 0)
> + tflow_id = uc->config.default_flow_id;
> + else
> + tflow_id = uc->tchan->id;
> +
> + if (test_bit(tflow_id, ud->tflow_map)) {
[Severity: High]
This is a pre-existing issue, but could an unvalidated tflow_id cause an
out-of-bounds memory access on the tflow_map bitmap?
In udma_get_tchan(), tflow_id takes the value of
uc->config.default_flow_id, which comes from client configuration. The
function directly proceeds to call test_bit(tflow_id, ud->tflow_map)
without verifying that tflow_id is less than ud->tflow_cnt.
[ ... ]
> +int udma_get_chan_pair(struct udma_chan *uc)
> +{
[ ... ]
> + /*
> + * Try to use the highest TPL channel pair for MEM_TO_MEM channels
> + * Note: in UDMAP the channel TPL is symmetric between tchan and rchan
> + */
> + chan_id = ud->tchan_tpl.start_idx[ud->tchan_tpl.levels - 1];
> + for (; chan_id < end; chan_id++) {
> + if (!test_bit(chan_id, ud->tchan_map) &&
> + !test_bit(chan_id, ud->rchan_map))
> + break;
> + }
> +
> + if (chan_id == end)
> + return -ENOENT;
> +
> + set_bit(chan_id, ud->tchan_map);
> + set_bit(chan_id, ud->rchan_map);
[Severity: High]
This is a pre-existing issue, but will this exact-match check fail to
prevent out-of-bounds accesses if the starting index is greater than end?
The function calculates end = min(ud->tchan_cnt, ud->rchan_cnt) and sets
the initial chan_id. If the start index already exceeds end, the for loop
condition is immediately false and does not execute.
Because chan_id is greater than end, the check if (chan_id == end) fails to
catch it. The code then proceeds to call set_bit() with the out-of-bounds
chan_id. Would using chan_id >= end be safer here?
[ ... ]
> +void udma_free_chan_resources(struct dma_chan *chan)
> +{
> + struct udma_chan *uc = to_udma_chan(chan);
> + struct udma_dev *ud = to_udma_dev(chan->device);
> +
> + udma_terminate_all(chan);
> + if (uc->terminated_desc) {
> + ud->reset_chan(uc, false);
> + udma_reset_rings(uc);
> + }
> +
> + cancel_delayed_work_sync(&uc->tx_drain.work);
[Severity: High]
This is a pre-existing issue, but can the delayed work
udma_check_tx_completion() indefinitely sleep or re-arm if uc->desc becomes
NULL during termination?
If udma_terminate_all() is called concurrently, it sets uc->desc = NULL and
calls cancel_delayed_work(). If the work is already running and sleeping in
usleep_range(), the cancellation fails.
When the work wakes up and re-acquires the lock, it might see uc->desc as
NULL:
udma_check_tx_completion()
if (uc->desc) {
residue_diff = uc->tx_drain.residue;
...
}
if (!desc_done) {
...
}
If it skips the block, desc_done remains false. It then subtracts the old
residue from residue_diff. If residue_diff hits 0, it calls
schedule_delayed_work() to re-arm the timer on a channel that is being
freed, causing a use-after-free. If it doesn't hit 0, it sleeps again
infinitely because residue is never updated, which deadlocks
cancel_delayed_work_sync() here in the teardown path.
[ ... ]
> + if (uc->irq_num_udma > 0) {
> + free_irq(uc->irq_num_udma, uc);
> +
> + uc->irq_num_udma = 0;
> + }
> +
> + /* Release PSI-L pairing */
> + if (uc->psil_paired && ud->psil_unpair) {
> + ud->psil_unpair(ud, uc->config.src_thread,
> + uc->config.dst_thread);
> + uc->psil_paired = false;
> + }
[Severity: High]
Does this new structure leak the psil_paired state if ud->psil_unpair is
NULL?
By placing the uc->psil_paired = false assignment inside the conditional
block that checks ud->psil_unpair, the flag is never cleared if the
function pointer is missing.
Subsequently, udma_reset_uchan(uc) zeroes out the config but leaves
uc->psil_paired intact. If the channel is later reallocated and an error
occurs during allocation, the error handling path err_psi_free in
bcdma_alloc_chan_resources() checks if (uc->psil_paired) and
unconditionally dereferences ud->psil_unpair. Since it is NULL, this could
cause a kernel panic.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260810151423.1948224-1-s-adivi@ti.com?part=9
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 10/19] dmaengine: ti: k3-udma: refactor resource setup functions
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
` (8 preceding siblings ...)
2026-08-10 15:14 ` [PATCH v8 09/19] dmaengine: ti: k3-udma: move resource management " Sai Sree Kartheek Adivi
@ 2026-08-10 15:14 ` Sai Sree Kartheek Adivi
2026-08-10 15:14 ` [PATCH v8 11/19] dmaengine: ti: k3-udma: move inclusion of k3-udma-private.c to k3-udma-common.c Sai Sree Kartheek Adivi
` (8 subsequent siblings)
18 siblings, 0 replies; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:14 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
The implementation of setup_resources, bcdma_setup_resources and
pktdma_setup_resources is largely shared between all K3 UDMA variants
with the only major difference being SCI resources setup. So,
- Move the functions to k3-udma-common.c.
- Split SCI resource setup for bcdma and pktdma into separate functions
in variant specific driver (k3-udma.c).
- Add function pointers for setup_sci_resources in udma_dev and call
them as part of the actual resource setup implementations in
k3-udma-common.c to retain the existing functionality.
- Also since setup_resources call udma_setup_resources which is not
required for all K3 UDMA variants, Add a function pointer in udma_dev
and use that to call udma_setup_resources.
- Rename setup_resources to k3_udma_setup_resources to avoid polluting
global kernel namespace with generic symbol.
This refactor improves code reuse and maintainability across multiple
variants.
No functional changes intended.
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
drivers/dma/ti/k3-udma-common.c | 200 ++++++++++++++++++++++++++++++++
drivers/dma/ti/k3-udma.c | 184 ++---------------------------
drivers/dma/ti/k3-udma.h | 6 +
3 files changed, 213 insertions(+), 177 deletions(-)
diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
index d93017a26bf1a..b9d3cac5eb9d0 100644
--- a/drivers/dma/ti/k3-udma-common.c
+++ b/drivers/dma/ti/k3-udma-common.c
@@ -8,7 +8,9 @@
#include <linux/dmaengine.h>
#include <linux/dma-mapping.h>
#include <linux/dmapool.h>
+#include <linux/of.h>
#include <linux/platform_device.h>
+#include <linux/soc/ti/ti_sci_inta_msi.h>
#include <linux/soc/ti/k3-ringacc.h>
#include "k3-udma.h"
@@ -2333,5 +2335,203 @@ void bcdma_free_bchan_resources(struct udma_chan *uc)
}
EXPORT_SYMBOL_GPL(bcdma_free_bchan_resources);
+static int bcdma_setup_resources(struct udma_dev *ud)
+{
+ int ret;
+ struct device *dev = ud->dev;
+ u32 cap;
+
+ /* Set up the throughput level start indexes */
+ cap = udma_read(ud->mmrs[MMR_GCFG], 0x2c);
+ if (BCDMA_CAP3_UBCHAN_CNT(cap)) {
+ ud->bchan_tpl.levels = 3;
+ ud->bchan_tpl.start_idx[1] = BCDMA_CAP3_UBCHAN_CNT(cap);
+ ud->bchan_tpl.start_idx[0] = BCDMA_CAP3_HBCHAN_CNT(cap);
+ } else if (BCDMA_CAP3_HBCHAN_CNT(cap)) {
+ ud->bchan_tpl.levels = 2;
+ ud->bchan_tpl.start_idx[0] = BCDMA_CAP3_HBCHAN_CNT(cap);
+ } else {
+ ud->bchan_tpl.levels = 1;
+ }
+
+ cap = udma_read(ud->mmrs[MMR_GCFG], 0x30);
+ if (BCDMA_CAP4_URCHAN_CNT(cap)) {
+ ud->rchan_tpl.levels = 3;
+ ud->rchan_tpl.start_idx[1] = BCDMA_CAP4_URCHAN_CNT(cap);
+ ud->rchan_tpl.start_idx[0] = BCDMA_CAP4_HRCHAN_CNT(cap);
+ } else if (BCDMA_CAP4_HRCHAN_CNT(cap)) {
+ ud->rchan_tpl.levels = 2;
+ ud->rchan_tpl.start_idx[0] = BCDMA_CAP4_HRCHAN_CNT(cap);
+ } else {
+ ud->rchan_tpl.levels = 1;
+ }
+
+ if (BCDMA_CAP4_UTCHAN_CNT(cap)) {
+ ud->tchan_tpl.levels = 3;
+ ud->tchan_tpl.start_idx[1] = BCDMA_CAP4_UTCHAN_CNT(cap);
+ ud->tchan_tpl.start_idx[0] = BCDMA_CAP4_HTCHAN_CNT(cap);
+ } else if (BCDMA_CAP4_HTCHAN_CNT(cap)) {
+ ud->tchan_tpl.levels = 2;
+ ud->tchan_tpl.start_idx[0] = BCDMA_CAP4_HTCHAN_CNT(cap);
+ } else {
+ ud->tchan_tpl.levels = 1;
+ }
+
+ ud->bchan_map = devm_bitmap_zalloc(dev, ud->bchan_cnt, GFP_KERNEL);
+ ud->bchans = devm_kcalloc(dev, ud->bchan_cnt, sizeof(*ud->bchans),
+ GFP_KERNEL);
+ ud->tchan_map = devm_bitmap_zalloc(dev, ud->tchan_cnt, GFP_KERNEL);
+ ud->tchans = devm_kcalloc(dev, ud->tchan_cnt, sizeof(*ud->tchans),
+ GFP_KERNEL);
+ ud->rchan_map = devm_bitmap_zalloc(dev, ud->rchan_cnt, GFP_KERNEL);
+ ud->rchans = devm_kcalloc(dev, ud->rchan_cnt, sizeof(*ud->rchans),
+ GFP_KERNEL);
+ /* BCDMA do not really have flows, but the driver expect it */
+ ud->rflow_in_use = devm_kcalloc(dev, BITS_TO_LONGS(ud->rchan_cnt),
+ sizeof(unsigned long),
+ GFP_KERNEL);
+ ud->rflows = devm_kcalloc(dev, ud->rchan_cnt, sizeof(*ud->rflows),
+ GFP_KERNEL);
+
+ if (!ud->bchan_map || !ud->tchan_map || !ud->rchan_map ||
+ !ud->rflow_in_use || !ud->bchans || !ud->tchans || !ud->rchans ||
+ !ud->rflows)
+ return -ENOMEM;
+
+ if (ud->bcdma_setup_sci_resources) {
+ ret = ud->bcdma_setup_sci_resources(ud);
+ if (ret)
+ return ret;
+ }
+
+ return 0;
+}
+
+static int pktdma_setup_resources(struct udma_dev *ud)
+{
+ int ret;
+ struct device *dev = ud->dev;
+ u32 cap3;
+
+ /* Set up the throughput level start indexes */
+ cap3 = udma_read(ud->mmrs[MMR_GCFG], 0x2c);
+ if (UDMA_CAP3_UCHAN_CNT(cap3)) {
+ ud->tchan_tpl.levels = 3;
+ ud->tchan_tpl.start_idx[1] = UDMA_CAP3_UCHAN_CNT(cap3);
+ ud->tchan_tpl.start_idx[0] = UDMA_CAP3_HCHAN_CNT(cap3);
+ } else if (UDMA_CAP3_HCHAN_CNT(cap3)) {
+ ud->tchan_tpl.levels = 2;
+ ud->tchan_tpl.start_idx[0] = UDMA_CAP3_HCHAN_CNT(cap3);
+ } else {
+ ud->tchan_tpl.levels = 1;
+ }
+
+ ud->rchan_tpl.levels = ud->tchan_tpl.levels;
+ ud->rchan_tpl.start_idx[0] = ud->tchan_tpl.start_idx[0];
+ ud->rchan_tpl.start_idx[1] = ud->tchan_tpl.start_idx[1];
+
+ ud->tchan_map = devm_bitmap_zalloc(dev, ud->tchan_cnt, GFP_KERNEL);
+ ud->tchans = devm_kcalloc(dev, ud->tchan_cnt, sizeof(*ud->tchans),
+ GFP_KERNEL);
+ ud->rchan_map = devm_bitmap_zalloc(dev, ud->rchan_cnt, GFP_KERNEL);
+ ud->rchans = devm_kcalloc(dev, ud->rchan_cnt, sizeof(*ud->rchans),
+ GFP_KERNEL);
+ ud->rflow_in_use = devm_kcalloc(dev, BITS_TO_LONGS(ud->rflow_cnt),
+ sizeof(unsigned long),
+ GFP_KERNEL);
+ ud->rflows = devm_kcalloc(dev, ud->rflow_cnt, sizeof(*ud->rflows),
+ GFP_KERNEL);
+ ud->tflow_map = devm_bitmap_zalloc(dev, ud->tflow_cnt, GFP_KERNEL);
+
+ if (!ud->tchan_map || !ud->rchan_map || !ud->tflow_map || !ud->tchans ||
+ !ud->rchans || !ud->rflows || !ud->rflow_in_use)
+ return -ENOMEM;
+
+ if (ud->pktdma_setup_sci_resources) {
+ ret = ud->pktdma_setup_sci_resources(ud);
+ if (ret)
+ return ret;
+ }
+
+ return 0;
+}
+
+int k3_udma_setup_resources(struct udma_dev *ud)
+{
+ struct device *dev = ud->dev;
+ int ch_count, ret;
+
+ switch (ud->match_data->type) {
+ case DMA_TYPE_UDMA:
+ if (!ud->udma_setup_resources)
+ return -EINVAL;
+ ret = ud->udma_setup_resources(ud);
+ break;
+ case DMA_TYPE_BCDMA:
+ ret = bcdma_setup_resources(ud);
+ break;
+ case DMA_TYPE_PKTDMA:
+ ret = pktdma_setup_resources(ud);
+ break;
+ default:
+ return -EINVAL;
+ }
+
+ if (ret)
+ return ret;
+
+ ch_count = ud->bchan_cnt + ud->tchan_cnt + ud->rchan_cnt;
+ if (ud->bchan_cnt)
+ ch_count -= bitmap_weight(ud->bchan_map, ud->bchan_cnt);
+ ch_count -= bitmap_weight(ud->tchan_map, ud->tchan_cnt);
+ ch_count -= bitmap_weight(ud->rchan_map, ud->rchan_cnt);
+ if (!ch_count)
+ return -ENODEV;
+
+ ud->channels = devm_kcalloc(dev, ch_count, sizeof(*ud->channels),
+ GFP_KERNEL);
+ if (!ud->channels)
+ return -ENOMEM;
+
+ switch (ud->match_data->type) {
+ case DMA_TYPE_UDMA:
+ dev_info(dev,
+ "Channels: %d (tchan: %u, rchan: %u, gp-rflow: %u)\n",
+ ch_count,
+ ud->tchan_cnt - bitmap_weight(ud->tchan_map,
+ ud->tchan_cnt),
+ ud->rchan_cnt - bitmap_weight(ud->rchan_map,
+ ud->rchan_cnt),
+ ud->rflow_cnt - bitmap_weight(ud->rflow_gp_map,
+ ud->rflow_cnt));
+ break;
+ case DMA_TYPE_BCDMA:
+ dev_info(dev,
+ "Channels: %d (bchan: %u, tchan: %u, rchan: %u)\n",
+ ch_count,
+ ud->bchan_cnt - bitmap_weight(ud->bchan_map,
+ ud->bchan_cnt),
+ ud->tchan_cnt - bitmap_weight(ud->tchan_map,
+ ud->tchan_cnt),
+ ud->rchan_cnt - bitmap_weight(ud->rchan_map,
+ ud->rchan_cnt));
+ break;
+ case DMA_TYPE_PKTDMA:
+ dev_info(dev,
+ "Channels: %d (tchan: %u, rchan: %u)\n",
+ ch_count,
+ ud->tchan_cnt - bitmap_weight(ud->tchan_map,
+ ud->tchan_cnt),
+ ud->rchan_cnt - bitmap_weight(ud->rchan_map,
+ ud->rchan_cnt));
+ break;
+ default:
+ break;
+ }
+
+ return ch_count;
+}
+EXPORT_SYMBOL_GPL(k3_udma_setup_resources);
+
MODULE_DESCRIPTION("Texas Instruments K3 UDMA Common Library");
MODULE_LICENSE("GPL v2");
diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index 21978f17e327f..9a261747c8709 100644
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -2083,7 +2083,7 @@ static const char * const range_names[] = {
[RM_RANGE_TFLOW] = "ti,sci-rm-range-tflow",
};
-static int udma_setup_resources(struct udma_dev *ud)
+int udma_setup_resources(struct udma_dev *ud)
{
int ret, i, j;
struct device *dev = ud->dev;
@@ -2245,74 +2245,13 @@ static int udma_setup_resources(struct udma_dev *ud)
return 0;
}
-static int bcdma_setup_resources(struct udma_dev *ud)
+static int bcdma_setup_sci_resources(struct udma_dev *ud)
{
int ret, i, j;
struct device *dev = ud->dev;
struct ti_sci_resource *rm_res, irq_res;
struct udma_tisci_rm *tisci_rm = &ud->tisci_rm;
const struct udma_oes_offsets *oes = &ud->soc_data->oes;
- u32 cap;
-
- /* Set up the throughput level start indexes */
- cap = udma_read(ud->mmrs[MMR_GCFG], 0x2c);
- if (BCDMA_CAP3_UBCHAN_CNT(cap)) {
- ud->bchan_tpl.levels = 3;
- ud->bchan_tpl.start_idx[1] = BCDMA_CAP3_UBCHAN_CNT(cap);
- ud->bchan_tpl.start_idx[0] = BCDMA_CAP3_HBCHAN_CNT(cap);
- } else if (BCDMA_CAP3_HBCHAN_CNT(cap)) {
- ud->bchan_tpl.levels = 2;
- ud->bchan_tpl.start_idx[0] = BCDMA_CAP3_HBCHAN_CNT(cap);
- } else {
- ud->bchan_tpl.levels = 1;
- }
-
- cap = udma_read(ud->mmrs[MMR_GCFG], 0x30);
- if (BCDMA_CAP4_URCHAN_CNT(cap)) {
- ud->rchan_tpl.levels = 3;
- ud->rchan_tpl.start_idx[1] = BCDMA_CAP4_URCHAN_CNT(cap);
- ud->rchan_tpl.start_idx[0] = BCDMA_CAP4_HRCHAN_CNT(cap);
- } else if (BCDMA_CAP4_HRCHAN_CNT(cap)) {
- ud->rchan_tpl.levels = 2;
- ud->rchan_tpl.start_idx[0] = BCDMA_CAP4_HRCHAN_CNT(cap);
- } else {
- ud->rchan_tpl.levels = 1;
- }
-
- if (BCDMA_CAP4_UTCHAN_CNT(cap)) {
- ud->tchan_tpl.levels = 3;
- ud->tchan_tpl.start_idx[1] = BCDMA_CAP4_UTCHAN_CNT(cap);
- ud->tchan_tpl.start_idx[0] = BCDMA_CAP4_HTCHAN_CNT(cap);
- } else if (BCDMA_CAP4_HTCHAN_CNT(cap)) {
- ud->tchan_tpl.levels = 2;
- ud->tchan_tpl.start_idx[0] = BCDMA_CAP4_HTCHAN_CNT(cap);
- } else {
- ud->tchan_tpl.levels = 1;
- }
-
- ud->bchan_map = devm_kmalloc_array(dev, BITS_TO_LONGS(ud->bchan_cnt),
- sizeof(unsigned long), GFP_KERNEL);
- ud->bchans = devm_kcalloc(dev, ud->bchan_cnt, sizeof(*ud->bchans),
- GFP_KERNEL);
- ud->tchan_map = devm_kmalloc_array(dev, BITS_TO_LONGS(ud->tchan_cnt),
- sizeof(unsigned long), GFP_KERNEL);
- ud->tchans = devm_kcalloc(dev, ud->tchan_cnt, sizeof(*ud->tchans),
- GFP_KERNEL);
- ud->rchan_map = devm_kmalloc_array(dev, BITS_TO_LONGS(ud->rchan_cnt),
- sizeof(unsigned long), GFP_KERNEL);
- ud->rchans = devm_kcalloc(dev, ud->rchan_cnt, sizeof(*ud->rchans),
- GFP_KERNEL);
- /* BCDMA do not really have flows, but the driver expect it */
- ud->rflow_in_use = devm_kcalloc(dev, BITS_TO_LONGS(ud->rchan_cnt),
- sizeof(unsigned long),
- GFP_KERNEL);
- ud->rflows = devm_kcalloc(dev, ud->rchan_cnt, sizeof(*ud->rflows),
- GFP_KERNEL);
-
- if (!ud->bchan_map || !ud->tchan_map || !ud->rchan_map ||
- !ud->rflow_in_use || !ud->bchans || !ud->tchans || !ud->rchans ||
- !ud->rflows)
- return -ENOMEM;
/* Get resource ranges from tisci */
for (i = 0; i < RM_RANGE_LAST; i++) {
@@ -2476,51 +2415,13 @@ static int bcdma_setup_resources(struct udma_dev *ud)
return 0;
}
-static int pktdma_setup_resources(struct udma_dev *ud)
+static int pktdma_setup_sci_resources(struct udma_dev *ud)
{
int ret, i, j;
struct device *dev = ud->dev;
struct ti_sci_resource *rm_res, irq_res;
struct udma_tisci_rm *tisci_rm = &ud->tisci_rm;
const struct udma_oes_offsets *oes = &ud->soc_data->oes;
- u32 cap3;
-
- /* Set up the throughput level start indexes */
- cap3 = udma_read(ud->mmrs[MMR_GCFG], 0x2c);
- if (UDMA_CAP3_UCHAN_CNT(cap3)) {
- ud->tchan_tpl.levels = 3;
- ud->tchan_tpl.start_idx[1] = UDMA_CAP3_UCHAN_CNT(cap3);
- ud->tchan_tpl.start_idx[0] = UDMA_CAP3_HCHAN_CNT(cap3);
- } else if (UDMA_CAP3_HCHAN_CNT(cap3)) {
- ud->tchan_tpl.levels = 2;
- ud->tchan_tpl.start_idx[0] = UDMA_CAP3_HCHAN_CNT(cap3);
- } else {
- ud->tchan_tpl.levels = 1;
- }
-
- ud->rchan_tpl.levels = ud->tchan_tpl.levels;
- ud->rchan_tpl.start_idx[0] = ud->tchan_tpl.start_idx[0];
- ud->rchan_tpl.start_idx[1] = ud->tchan_tpl.start_idx[1];
-
- ud->tchan_map = devm_kmalloc_array(dev, BITS_TO_LONGS(ud->tchan_cnt),
- sizeof(unsigned long), GFP_KERNEL);
- ud->tchans = devm_kcalloc(dev, ud->tchan_cnt, sizeof(*ud->tchans),
- GFP_KERNEL);
- ud->rchan_map = devm_kmalloc_array(dev, BITS_TO_LONGS(ud->rchan_cnt),
- sizeof(unsigned long), GFP_KERNEL);
- ud->rchans = devm_kcalloc(dev, ud->rchan_cnt, sizeof(*ud->rchans),
- GFP_KERNEL);
- ud->rflow_in_use = devm_kcalloc(dev, BITS_TO_LONGS(ud->rflow_cnt),
- sizeof(unsigned long),
- GFP_KERNEL);
- ud->rflows = devm_kcalloc(dev, ud->rflow_cnt, sizeof(*ud->rflows),
- GFP_KERNEL);
- ud->tflow_map = devm_kmalloc_array(dev, BITS_TO_LONGS(ud->tflow_cnt),
- sizeof(unsigned long), GFP_KERNEL);
-
- if (!ud->tchan_map || !ud->rchan_map || !ud->tflow_map || !ud->tchans ||
- !ud->rchans || !ud->rflows || !ud->rflow_in_use)
- return -ENOMEM;
/* Get resource ranges from tisci */
for (i = 0; i < RM_RANGE_LAST; i++) {
@@ -2631,80 +2532,6 @@ static int pktdma_setup_resources(struct udma_dev *ud)
return 0;
}
-static int setup_resources(struct udma_dev *ud)
-{
- struct device *dev = ud->dev;
- int ch_count, ret;
-
- switch (ud->match_data->type) {
- case DMA_TYPE_UDMA:
- ret = udma_setup_resources(ud);
- break;
- case DMA_TYPE_BCDMA:
- ret = bcdma_setup_resources(ud);
- break;
- case DMA_TYPE_PKTDMA:
- ret = pktdma_setup_resources(ud);
- break;
- default:
- return -EINVAL;
- }
-
- if (ret)
- return ret;
-
- ch_count = ud->bchan_cnt + ud->tchan_cnt + ud->rchan_cnt;
- if (ud->bchan_cnt)
- ch_count -= bitmap_weight(ud->bchan_map, ud->bchan_cnt);
- ch_count -= bitmap_weight(ud->tchan_map, ud->tchan_cnt);
- ch_count -= bitmap_weight(ud->rchan_map, ud->rchan_cnt);
- if (!ch_count)
- return -ENODEV;
-
- ud->channels = devm_kcalloc(dev, ch_count, sizeof(*ud->channels),
- GFP_KERNEL);
- if (!ud->channels)
- return -ENOMEM;
-
- switch (ud->match_data->type) {
- case DMA_TYPE_UDMA:
- dev_info(dev,
- "Channels: %d (tchan: %u, rchan: %u, gp-rflow: %u)\n",
- ch_count,
- ud->tchan_cnt - bitmap_weight(ud->tchan_map,
- ud->tchan_cnt),
- ud->rchan_cnt - bitmap_weight(ud->rchan_map,
- ud->rchan_cnt),
- ud->rflow_cnt - bitmap_weight(ud->rflow_gp_map,
- ud->rflow_cnt));
- break;
- case DMA_TYPE_BCDMA:
- dev_info(dev,
- "Channels: %d (bchan: %u, tchan: %u, rchan: %u)\n",
- ch_count,
- ud->bchan_cnt - bitmap_weight(ud->bchan_map,
- ud->bchan_cnt),
- ud->tchan_cnt - bitmap_weight(ud->tchan_map,
- ud->tchan_cnt),
- ud->rchan_cnt - bitmap_weight(ud->rchan_map,
- ud->rchan_cnt));
- break;
- case DMA_TYPE_PKTDMA:
- dev_info(dev,
- "Channels: %d (tchan: %u, rchan: %u)\n",
- ch_count,
- ud->tchan_cnt - bitmap_weight(ud->tchan_map,
- ud->tchan_cnt),
- ud->rchan_cnt - bitmap_weight(ud->rchan_map,
- ud->rchan_cnt));
- break;
- default:
- break;
- }
-
- return ch_count;
-}
-
static int udma_probe(struct platform_device *pdev)
{
struct device_node *navss_node = pdev->dev.parent->of_node;
@@ -2747,6 +2574,9 @@ static int udma_probe(struct platform_device *pdev)
ud->decrement_byte_counters = udma_decrement_byte_counters;
ud->psil_pair = navss_psil_pair;
ud->psil_unpair = navss_psil_unpair;
+ ud->udma_setup_resources = udma_setup_resources;
+ ud->bcdma_setup_sci_resources = bcdma_setup_sci_resources;
+ ud->pktdma_setup_sci_resources = pktdma_setup_sci_resources;
ret = udma_get_mmrs(pdev, ud);
if (ret)
@@ -2876,7 +2706,7 @@ static int udma_probe(struct platform_device *pdev)
INIT_LIST_HEAD(&ud->ddev.channels);
INIT_LIST_HEAD(&ud->desc_to_purge);
- ch_count = setup_resources(ud);
+ ch_count = k3_udma_setup_resources(ud);
if (ch_count <= 0)
return ch_count;
diff --git a/drivers/dma/ti/k3-udma.h b/drivers/dma/ti/k3-udma.h
index 329df7eb156b2..d64b670d42490 100644
--- a/drivers/dma/ti/k3-udma.h
+++ b/drivers/dma/ti/k3-udma.h
@@ -357,6 +357,9 @@ struct udma_dev {
u32 dst_thread);
int (*psil_unpair)(struct udma_dev *ud, u32 src_thread,
u32 dst_thread);
+ int (*udma_setup_resources)(struct udma_dev *ud);
+ int (*bcdma_setup_sci_resources)(struct udma_dev *ud);
+ int (*pktdma_setup_sci_resources)(struct udma_dev *ud);
};
struct udma_desc {
@@ -679,6 +682,9 @@ struct udma_bchan *__udma_reserve_bchan(struct udma_dev *ud, enum udma_tp_level
struct udma_tchan *__udma_reserve_tchan(struct udma_dev *ud, enum udma_tp_level tpl, int id);
struct udma_rchan *__udma_reserve_rchan(struct udma_dev *ud, enum udma_tp_level tpl, int id);
+int udma_setup_resources(struct udma_dev *ud);
+int k3_udma_setup_resources(struct udma_dev *ud);
+
/* Direct access to UDMA low lever resources for the glue layer */
int xudma_navss_psil_pair(struct udma_dev *ud, u32 src_thread, u32 dst_thread);
int xudma_navss_psil_unpair(struct udma_dev *ud, u32 src_thread,
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v8 11/19] dmaengine: ti: k3-udma: move inclusion of k3-udma-private.c to k3-udma-common.c
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
` (9 preceding siblings ...)
2026-08-10 15:14 ` [PATCH v8 10/19] dmaengine: ti: k3-udma: refactor resource setup functions Sai Sree Kartheek Adivi
@ 2026-08-10 15:14 ` Sai Sree Kartheek Adivi
2026-08-10 16:27 ` sashiko-bot
2026-08-10 15:14 ` [PATCH v8 12/19] drivers: soc: ti: k3-ringacc: handle absence of tisci Sai Sree Kartheek Adivi
` (7 subsequent siblings)
18 siblings, 1 reply; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:14 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
Relocate the #include directive for k3-udma-private.c to
k3-udma-common.c so that the code can be shared between other UDMA
variants (like k3-udma-v2). This change improves modularity and prepares
for variant-specific implementations.
No functional changes intended.
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
drivers/dma/ti/k3-udma-common.c | 3 +++
drivers/dma/ti/k3-udma.c | 2 --
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
index b9d3cac5eb9d0..01b66e9f026b4 100644
--- a/drivers/dma/ti/k3-udma-common.c
+++ b/drivers/dma/ti/k3-udma-common.c
@@ -2535,3 +2535,6 @@ EXPORT_SYMBOL_GPL(k3_udma_setup_resources);
MODULE_DESCRIPTION("Texas Instruments K3 UDMA Common Library");
MODULE_LICENSE("GPL v2");
+
+/* Private interfaces to UDMA */
+#include "k3-udma-private.c"
diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index 9a261747c8709..ddedd51ab26d9 100644
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -2857,5 +2857,3 @@ module_platform_driver(udma_driver);
MODULE_DESCRIPTION("Texas Instruments UDMA support");
MODULE_LICENSE("GPL v2");
-/* Private interfaces to UDMA */
-#include "k3-udma-private.c"
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 11/19] dmaengine: ti: k3-udma: move inclusion of k3-udma-private.c to k3-udma-common.c
2026-08-10 15:14 ` [PATCH v8 11/19] dmaengine: ti: k3-udma: move inclusion of k3-udma-private.c to k3-udma-common.c Sai Sree Kartheek Adivi
@ 2026-08-10 16:27 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-08-10 16:27 UTC (permalink / raw)
To: Sai Sree Kartheek Adivi
Cc: robh, vkoul, devicetree, Frank.Li, dmaengine, conor+dt
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
New issues:
- [High] Moving `xudma_*` exports to `k3-udma-common.c` severs the module dependency between the glue layer and the `k3-udma` driver, allowing trivial module unload and subsequent use-after-free.
Pre-existing issues:
- [High] `of_xudma_dev_get` returns a pointer to devres-managed memory without establishing a device link, allowing use-after-free via sysfs unbind.
--
--- Patch [11]: [PATCH v8 11/19] dmaengine: ti: k3-udma: move inclusion of k3-udma-private.c to k3-udma-common.c ---
commit d7f9cc34a06f8d7304b5d1021da68dd8f487667c
Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>
dmaengine: ti: k3-udma: move inclusion of k3-udma-private.c to k3-udma-common.c
This commit relocates the inclusion of k3-udma-private.c from k3-udma.c to
k3-udma-common.c to allow sharing the code with other udma variants.
> diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
> index b9d3cac5eb9d0..01b66e9f026b4 100644
> --- a/drivers/dma/ti/k3-udma-common.c
> +++ b/drivers/dma/ti/k3-udma-common.c
[ ... ]
> @@ -2535,3 +2535,6 @@ EXPORT_SYMBOL_GPL(k3_udma_setup_resources);
>
> MODULE_DESCRIPTION("Texas Instruments K3 UDMA Common Library");
> MODULE_LICENSE("GPL v2");
> +
> +/* Private interfaces to UDMA */
> +#include "k3-udma-private.c"
[Severity: High]
Does moving this include introduce a regression by shifting the xudma_*
exports from the k3-udma module to the k3-udma-common module?
The k3-udma-glue.ko module bypasses the standard dma engine framework and
relies on these xudma_* functions. Previously, these functions were exported
by the k3-udma.ko driver, establishing a module dependency that prevented
k3-udma.ko from being unloaded while active.
By moving the exports to k3-udma-common.ko, k3-udma-glue.ko no longer holds
a reference to k3-udma.ko. If an administrator runs rmmod k3-udma, could it
successfully unbind the driver and free the devm-allocated struct udma_dev,
causing a use-after-free in the networking drivers on their next operation?
[Severity: High]
This is a pre-existing issue in k3-udma-private.c, but looking at how
of_xudma_dev_get() is implemented:
drivers/dma/ti/k3-udma-private.c:of_xudma_dev_get() {
...
ud = platform_get_drvdata(pdev);
put_device(&pdev->dev);
if (!ud) {
...
}
Since of_xudma_dev_get() drops the device reference before returning the
pointer to the devres-managed struct udma_dev, and does not establish a
supplier-consumer relationship via device_link_add(), can this lead to a
use-after-free if a privileged user unbinds the driver via sysfs?
The driver core would be unaware of the glue layer's dependency, allowing the
unbind to succeed and free udma_dev while consumers hold a dangling pointer.
> diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
> index 9a261747c8709..ddedd51ab26d9 100644
> --- a/drivers/dma/ti/k3-udma.c
> +++ b/drivers/dma/ti/k3-udma.c
[ ... ]
> @@ -2857,5 +2857,3 @@ module_platform_driver(udma_driver);
> MODULE_DESCRIPTION("Texas Instruments UDMA support");
> MODULE_LICENSE("GPL v2");
>
> -/* Private interfaces to UDMA */
> -#include "k3-udma-private.c"
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260810151423.1948224-1-s-adivi@ti.com?part=11
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 12/19] drivers: soc: ti: k3-ringacc: handle absence of tisci
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
` (10 preceding siblings ...)
2026-08-10 15:14 ` [PATCH v8 11/19] dmaengine: ti: k3-udma: move inclusion of k3-udma-private.c to k3-udma-common.c Sai Sree Kartheek Adivi
@ 2026-08-10 15:14 ` Sai Sree Kartheek Adivi
2026-08-10 16:38 ` sashiko-bot
2026-08-10 15:14 ` [PATCH v8 13/19] dt-bindings: dma: ti: Add K3 BCDMA V2 Sai Sree Kartheek Adivi
` (6 subsequent siblings)
18 siblings, 1 reply; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:14 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
Handle absence of tisci with direct register writes. This will support
platforms that do not have tisci firmware like AM62L.
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
drivers/soc/ti/k3-ringacc.c | 191 ++++++++++++++++++++++++++----
include/linux/soc/ti/k3-ringacc.h | 17 +++
2 files changed, 185 insertions(+), 23 deletions(-)
diff --git a/drivers/soc/ti/k3-ringacc.c b/drivers/soc/ti/k3-ringacc.c
index 5966db4327b13..2a93e389fb8e0 100644
--- a/drivers/soc/ti/k3-ringacc.c
+++ b/drivers/soc/ti/k3-ringacc.c
@@ -46,6 +46,53 @@ struct k3_ring_rt_regs {
u32 hwindx;
};
+#define K3_RINGACC_RT_CFG_REGS_OFS 0x40
+#define K3_DMARING_CFG_ADDR_HI_MASK GENMASK(3, 0)
+#define K3_DMARING_CFG_ASEL_SHIFT 16
+#define K3_DMARING_CFG_SIZE_MASK GENMASK(15, 0)
+
+/**
+ * struct k3_ring_cfg_regs - The RA Configuration Registers region
+ *
+ * @ba_lo: Ring Base Address Low Register
+ * @ba_hi: Ring Base Address High Register
+ * @size: Ring Size Register
+ */
+struct k3_ring_cfg_regs {
+ u32 ba_lo;
+ u32 ba_hi;
+ u32 size;
+};
+
+#define K3_RINGACC_RT_INT_REGS_OFS 0x140
+#define K3_RINGACC_RT_INT_ENABLE_SET_COMPLETE BIT(0)
+#define K3_RINGACC_RT_INT_ENABLE_SET_TR BIT(2)
+
+/**
+ * struct k3_ring_intr_regs {
+ *
+ * @enable_set: Ring Interrupt Enable Register
+ * @resv_1: Reserved
+ * @clr: Ring Interrupt Clear Register
+ * @resv_2: Reserved
+ * @status_set: Ring Interrupt Status Set Register
+ * @resv_3: Reserved
+ * @status: Ring Interrupt Status Register
+ * @resv_4: Reserved
+ * @status_masked: Ring Interrupt Status Masked Register
+ */
+struct k3_ring_intr_regs {
+ u32 enable_set;
+ u32 resv_1;
+ u32 clr;
+ u32 resv_2;
+ u32 status_set;
+ u32 resv_3;
+ u32 status;
+ u32 resv_4;
+ u32 status_masked;
+};
+
#define K3_RINGACC_RT_REGS_STEP 0x1000
#define K3_DMARING_RT_REGS_STEP 0x2000
#define K3_DMARING_RT_REGS_REVERSE_OFS 0x1000
@@ -139,6 +186,8 @@ struct k3_ring_state {
* struct k3_ring - RA Ring descriptor
*
* @rt: Ring control/status registers
+ * @cfg: Ring config registers
+ * @intr: Ring interrupt registers
* @fifos: Ring queues registers
* @proxy: Ring Proxy Datapath registers
* @ring_mem_dma: Ring buffer dma address
@@ -158,6 +207,8 @@ struct k3_ring_state {
*/
struct k3_ring {
struct k3_ring_rt_regs __iomem *rt;
+ struct k3_ring_cfg_regs __iomem *cfg;
+ struct k3_ring_intr_regs __iomem *intr;
struct k3_ring_fifo_regs __iomem *fifos;
struct k3_ringacc_proxy_target_regs __iomem *proxy;
dma_addr_t ring_mem_dma;
@@ -467,15 +518,31 @@ static void k3_ringacc_ring_reset_sci(struct k3_ring *ring)
struct k3_ringacc *ringacc = ring->parent;
int ret;
- ring_cfg.nav_id = ringacc->tisci_dev_id;
- ring_cfg.index = ring->ring_id;
- ring_cfg.valid_params = TI_SCI_MSG_VALUE_RM_RING_COUNT_VALID;
- ring_cfg.count = ring->size;
+ if (!ringacc->tisci) {
+ u32 reg;
- ret = ringacc->tisci_ring_ops->set_cfg(ringacc->tisci, &ring_cfg);
- if (ret)
- dev_err(ringacc->dev, "TISCI reset ring fail (%d) ring_idx %d\n",
- ret, ring->ring_id);
+ if (!ring->cfg)
+ return;
+
+ reg = readl(&ring->cfg->size);
+ reg &= ~K3_DMARING_CFG_SIZE_MASK;
+ writel(reg, &ring->cfg->size);
+
+ /* Ensure the register clear operation completes before writing new value */
+ reg = readl(&ring->cfg->size);
+ reg |= ring->size;
+ writel(reg, &ring->cfg->size);
+ } else {
+ ring_cfg.nav_id = ringacc->tisci_dev_id;
+ ring_cfg.index = ring->ring_id;
+ ring_cfg.valid_params = TI_SCI_MSG_VALUE_RM_RING_COUNT_VALID;
+ ring_cfg.count = ring->size;
+
+ ret = ringacc->tisci_ring_ops->set_cfg(ringacc->tisci, &ring_cfg);
+ if (ret)
+ dev_err(ringacc->dev, "TISCI reset ring fail (%d) ring_idx %d\n",
+ ret, ring->ring_id);
+ }
}
void k3_ringacc_ring_reset(struct k3_ring *ring)
@@ -501,10 +568,25 @@ static void k3_ringacc_ring_reconfig_qmode_sci(struct k3_ring *ring,
ring_cfg.valid_params = TI_SCI_MSG_VALUE_RM_RING_MODE_VALID;
ring_cfg.mode = mode;
- ret = ringacc->tisci_ring_ops->set_cfg(ringacc->tisci, &ring_cfg);
- if (ret)
- dev_err(ringacc->dev, "TISCI reconf qmode fail (%d) ring_idx %d\n",
- ret, ring->ring_id);
+ if (!ringacc->tisci) {
+ u32 reg;
+
+ writel(ring_cfg.addr_lo, &ring->cfg->ba_lo);
+ writel((ring_cfg.addr_hi & K3_DMARING_CFG_ADDR_HI_MASK) +
+ (ring_cfg.asel << K3_DMARING_CFG_ASEL_SHIFT),
+ &ring->cfg->ba_hi);
+
+ reg = readl(&ring->cfg->size);
+ reg &= ~K3_DMARING_CFG_SIZE_MASK;
+ reg |= ring_cfg.count & K3_DMARING_CFG_SIZE_MASK;
+
+ writel(reg, &ring->cfg->size);
+ } else {
+ ret = ringacc->tisci_ring_ops->set_cfg(ringacc->tisci, &ring_cfg);
+ if (ret)
+ dev_err(ringacc->dev, "TISCI reconf qmode fail (%d) ring_idx %d\n",
+ ret, ring->ring_id);
+ }
}
void k3_ringacc_ring_reset_dma(struct k3_ring *ring, u32 occ)
@@ -576,10 +658,25 @@ static void k3_ringacc_ring_free_sci(struct k3_ring *ring)
ring_cfg.index = ring->ring_id;
ring_cfg.valid_params = TI_SCI_MSG_VALUE_RM_ALL_NO_ORDER;
- ret = ringacc->tisci_ring_ops->set_cfg(ringacc->tisci, &ring_cfg);
- if (ret)
- dev_err(ringacc->dev, "TISCI ring free fail (%d) ring_idx %d\n",
- ret, ring->ring_id);
+ if (!ringacc->tisci) {
+ u32 reg;
+
+ writel(ring_cfg.addr_lo, &ring->cfg->ba_lo);
+ writel((ring_cfg.addr_hi & K3_DMARING_CFG_ADDR_HI_MASK) +
+ (ring_cfg.asel << K3_DMARING_CFG_ASEL_SHIFT),
+ &ring->cfg->ba_hi);
+
+ reg = readl(&ring->cfg->size);
+ reg &= ~K3_DMARING_CFG_SIZE_MASK;
+ reg |= ring_cfg.count & K3_DMARING_CFG_SIZE_MASK;
+
+ writel(reg, &ring->cfg->size);
+ } else {
+ ret = ringacc->tisci_ring_ops->set_cfg(ringacc->tisci, &ring_cfg);
+ if (ret)
+ dev_err(ringacc->dev, "TISCI ring free fail (%d) ring_idx %d\n",
+ ret, ring->ring_id);
+ }
}
int k3_ringacc_ring_free(struct k3_ring *ring)
@@ -670,15 +767,37 @@ int k3_ringacc_get_ring_irq_num(struct k3_ring *ring)
}
EXPORT_SYMBOL_GPL(k3_ringacc_get_ring_irq_num);
+u32 k3_ringacc_ring_get_irq_status(struct k3_ring *ring)
+{
+ struct k3_ringacc *ringacc = ring->parent;
+ struct k3_ring *ring2 = &ringacc->rings[ring->ring_id];
+
+ if (!ring2->intr)
+ return 0;
+
+ return readl(&ring2->intr->status);
+}
+EXPORT_SYMBOL_GPL(k3_ringacc_ring_get_irq_status);
+
+void k3_ringacc_ring_clear_irq(struct k3_ring *ring)
+{
+ struct k3_ringacc *ringacc = ring->parent;
+ struct k3_ring *ring2 = &ringacc->rings[ring->ring_id];
+
+ if (!ring2->intr)
+ return;
+
+ u32 status = readl(&ring2->intr->status);
+ writel(status, &ring2->intr->status);
+}
+EXPORT_SYMBOL_GPL(k3_ringacc_ring_clear_irq);
+
static int k3_ringacc_ring_cfg_sci(struct k3_ring *ring)
{
struct ti_sci_msg_rm_ring_cfg ring_cfg = { 0 };
struct k3_ringacc *ringacc = ring->parent;
int ret;
- if (!ringacc->tisci)
- return -EINVAL;
-
ring_cfg.nav_id = ringacc->tisci_dev_id;
ring_cfg.index = ring->ring_id;
ring_cfg.valid_params = TI_SCI_MSG_VALUE_RM_ALL_NO_ORDER;
@@ -689,6 +808,24 @@ static int k3_ringacc_ring_cfg_sci(struct k3_ring *ring)
ring_cfg.size = ring->elm_size;
ring_cfg.asel = ring->asel;
+ if (!ringacc->tisci) {
+ u32 reg;
+
+ writel(ring_cfg.addr_lo, &ring->cfg->ba_lo);
+ writel((ring_cfg.addr_hi & K3_DMARING_CFG_ADDR_HI_MASK) +
+ (ring_cfg.asel << K3_DMARING_CFG_ASEL_SHIFT),
+ &ring->cfg->ba_hi);
+
+ reg = readl(&ring->cfg->size);
+ reg &= ~K3_DMARING_CFG_SIZE_MASK;
+ reg |= ring_cfg.count & K3_DMARING_CFG_SIZE_MASK;
+
+ writel(reg, &ring->cfg->size);
+ writel(K3_RINGACC_RT_INT_ENABLE_SET_COMPLETE | K3_RINGACC_RT_INT_ENABLE_SET_TR,
+ &ring->intr->enable_set);
+ return 0;
+ }
+
ret = ringacc->tisci_ring_ops->set_cfg(ringacc->tisci, &ring_cfg);
if (ret)
dev_err(ringacc->dev, "TISCI config ring fail (%d) ring_idx %d\n",
@@ -1481,9 +1618,12 @@ struct k3_ringacc *k3_ringacc_dmarings_init(struct platform_device *pdev,
mutex_init(&ringacc->req_lock);
- base_rt = devm_platform_ioremap_resource_byname(pdev, "ringrt");
- if (IS_ERR(base_rt))
- return ERR_CAST(base_rt);
+ base_rt = data->base_rt;
+ if (!base_rt) {
+ base_rt = devm_platform_ioremap_resource_byname(pdev, "ringrt");
+ if (IS_ERR(base_rt))
+ return ERR_CAST(base_rt);
+ }
ringacc->rings = devm_kzalloc(dev,
sizeof(*ringacc->rings) *
@@ -1499,6 +1639,10 @@ struct k3_ringacc *k3_ringacc_dmarings_init(struct platform_device *pdev,
struct k3_ring *ring = &ringacc->rings[i];
ring->rt = base_rt + K3_DMARING_RT_REGS_STEP * i;
+ ring->cfg = base_rt + K3_RINGACC_RT_CFG_REGS_OFS +
+ K3_DMARING_RT_REGS_STEP * i;
+ ring->intr = base_rt + K3_RINGACC_RT_INT_REGS_OFS +
+ K3_DMARING_RT_REGS_STEP * i;
ring->parent = ringacc;
ring->ring_id = i;
ring->proxy_id = K3_RINGACC_PROXY_NOT_USED;
@@ -1512,7 +1656,8 @@ struct k3_ringacc *k3_ringacc_dmarings_init(struct platform_device *pdev,
ring->flags = K3_RING_FLAG_REVERSE;
}
- ringacc->tisci_ring_ops = &ringacc->tisci->ops.rm_ring_ops;
+ if (ringacc->tisci)
+ ringacc->tisci_ring_ops = &ringacc->tisci->ops.rm_ring_ops;
dev_info(dev, "Number of rings: %u\n", ringacc->num_rings);
diff --git a/include/linux/soc/ti/k3-ringacc.h b/include/linux/soc/ti/k3-ringacc.h
index 39b022b925986..9f2d141c988bd 100644
--- a/include/linux/soc/ti/k3-ringacc.h
+++ b/include/linux/soc/ti/k3-ringacc.h
@@ -158,6 +158,22 @@ u32 k3_ringacc_get_ring_id(struct k3_ring *ring);
*/
int k3_ringacc_get_ring_irq_num(struct k3_ring *ring);
+/**
+ * k3_ringacc_ring_get_irq_status - Get the irq status for the ring
+ * @ring: pointer on ring
+ *
+ * Returns the interrupt status
+ */
+u32 k3_ringacc_ring_get_irq_status(struct k3_ring *ring);
+
+/**
+ * k3_ringacc_ring_clear_irq - Clear all interrupts
+ * @ring: pointer on ring
+ *
+ * Clears all the interrupts on the ring
+ */
+void k3_ringacc_ring_clear_irq(struct k3_ring *ring);
+
/**
* k3_ringacc_ring_cfg - ring configure
* @ring: pointer on ring
@@ -262,6 +278,7 @@ struct k3_ringacc_init_data {
const struct ti_sci_handle *tisci;
u32 tisci_dev_id;
u32 num_rings;
+ void __iomem *base_rt;
};
struct k3_ringacc *k3_ringacc_dmarings_init(struct platform_device *pdev,
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 12/19] drivers: soc: ti: k3-ringacc: handle absence of tisci
2026-08-10 15:14 ` [PATCH v8 12/19] drivers: soc: ti: k3-ringacc: handle absence of tisci Sai Sree Kartheek Adivi
@ 2026-08-10 16:38 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-08-10 16:38 UTC (permalink / raw)
To: Sai Sree Kartheek Adivi
Cc: robh, conor+dt, Frank.Li, dmaengine, devicetree, vkoul
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The direct register fallback in `k3_ringacc_ring_reconfig_qmode_sci` uses zero-initialized fields to destructively clear the ring's base address and size.
--
--- Patch [12]: [PATCH v8 12/19] drivers: soc: ti: k3-ringacc: handle absence of tisci ---
commit 19dd5943c68e7ce05e29d608e96d6376a6ce8fed
Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>
drivers: soc: ti: k3-ringacc: handle absence of tisci
This commit adds direct register writes to handle platforms like AM62L that
do not have tisci firmware. It modifies the reset, free, configuration,
and reconfiguration paths to write directly to ring configuration registers
when tisci is absent.
> diff --git a/drivers/soc/ti/k3-ringacc.c b/drivers/soc/ti/k3-ringacc.c
> --- a/drivers/soc/ti/k3-ringacc.c
> +++ b/drivers/soc/ti/k3-ringacc.c
[ ... ]
> @@ -501,10 +568,25 @@ static void k3_ringacc_ring_reconfig_qmode_sci(struct k3_ring *ring,
> ring_cfg.valid_params = TI_SCI_MSG_VALUE_RM_RING_MODE_VALID;
> ring_cfg.mode = mode;
>
> - ret = ringacc->tisci_ring_ops->set_cfg(ringacc->tisci, &ring_cfg);
> - if (ret)
> - dev_err(ringacc->dev, "TISCI reconf qmode fail (%d) ring_idx %d\n",
> - ret, ring->ring_id);
> + if (!ringacc->tisci) {
> + u32 reg;
> +
> + writel(ring_cfg.addr_lo, &ring->cfg->ba_lo);
> + writel((ring_cfg.addr_hi & K3_DMARING_CFG_ADDR_HI_MASK) +
> + (ring_cfg.asel << K3_DMARING_CFG_ASEL_SHIFT),
> + &ring->cfg->ba_hi);
> +
> + reg = readl(&ring->cfg->size);
> + reg &= ~K3_DMARING_CFG_SIZE_MASK;
> + reg |= ring_cfg.count & K3_DMARING_CFG_SIZE_MASK;
> +
> + writel(reg, &ring->cfg->size);
[Severity: Medium]
Does this code accidentally clear the ring's base address and size instead of
just reconfiguring the mode?
Because ring_cfg is zero-initialized at the start of the function:
struct ti_sci_msg_rm_ring_cfg ring_cfg = { 0 };
The addr_lo, addr_hi, asel, and count fields are never populated in
k3_ringacc_ring_reconfig_qmode_sci() before being used here. Will this write
zeros to ba_lo, ba_hi, and size, corrupting the live memory mapping?
Even if this path is currently unreachable because platforms like AM62L do not
enable the dma_ring_reset_quirk, this might still cause hardware misconfiguration
if the quirk is used on future platforms without TISCI.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260810151423.1948224-1-s-adivi@ti.com?part=12
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 13/19] dt-bindings: dma: ti: Add K3 BCDMA V2
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
` (11 preceding siblings ...)
2026-08-10 15:14 ` [PATCH v8 12/19] drivers: soc: ti: k3-ringacc: handle absence of tisci Sai Sree Kartheek Adivi
@ 2026-08-10 15:14 ` Sai Sree Kartheek Adivi
2026-08-11 6:32 ` Krzysztof Kozlowski
2026-08-10 15:14 ` [PATCH v8 14/19] dt-bindings: dma: ti: Add K3 PKTDMA V2 Sai Sree Kartheek Adivi
` (5 subsequent siblings)
18 siblings, 1 reply; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:14 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
New binding document for Texas Instruments K3 Block Copy DMA (BCDMA) V2.
BCDMA V2 is introduced as part of AM62L.
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
.../bindings/dma/ti/ti,am62l-dmss-bcdma.yaml | 211 ++++++++++++++++++
1 file changed, 211 insertions(+)
create mode 100644 Documentation/devicetree/bindings/dma/ti/ti,am62l-dmss-bcdma.yaml
diff --git a/Documentation/devicetree/bindings/dma/ti/ti,am62l-dmss-bcdma.yaml b/Documentation/devicetree/bindings/dma/ti/ti,am62l-dmss-bcdma.yaml
new file mode 100644
index 0000000000000..76184485ebcba
--- /dev/null
+++ b/Documentation/devicetree/bindings/dma/ti/ti,am62l-dmss-bcdma.yaml
@@ -0,0 +1,211 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+# Copyright (C) 2026 Texas Instruments Incorporated
+# Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/dma/ti/ti,am62l-dmss-bcdma.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Texas Instruments K3 DMSS BCDMA V2
+
+maintainers:
+ - Sai Sree Kartheek Adivi <s-adivi@ti.com>
+
+description:
+ The BCDMA V2 is intended to perform similar functions as the TR
+ mode channels of K3 UDMA-P.
+ BCDMA V2 includes block copy channels and Split channels.
+
+ Block copy channels mainly used for memory to memory transfers, but with
+ optional triggers a block copy channel can service peripherals by accessing
+ directly to memory mapped registers or area.
+
+ Split channels can be used to service PSI-L based peripherals.
+ The peripherals can be PSI-L native or legacy, non PSI-L native peripherals
+ with PDMAs. PDMA is tasked to act as a bridge between the PSI-L fabric and the
+ legacy peripheral.
+
+allOf:
+ - $ref: /schemas/dma/dma-controller.yaml#
+
+properties:
+ compatible:
+ const: ti,am62l-dmss-bcdma
+
+ reg:
+ items:
+ - description: BCDMA Control & Status Registers region
+ - description: Block Copy Channel Realtime Registers region
+ - description: Channel Realtime Registers region
+ - description: Ring Realtime Registers region
+
+ reg-names:
+ items:
+ - const: gcfg
+ - const: bchanrt
+ - const: chanrt
+ - const: ringrt
+
+ "#dma-cells":
+ const: 4
+ description: |
+ cell 1: Trigger type for the channel
+ 0 - disable / no trigger
+ 1 - internal channel event
+ 2 - external signal
+ 3 - timer manager event
+
+ cell 2: parameter for the trigger:
+ if cell 1 is 0 (disable / no trigger):
+ Unused, ignored
+ if cell 1 is 1 (internal channel event):
+ channel number whose TR event should trigger the current channel.
+ if cell 1 is 2 or 3 (external signal or timer manager event):
+ index of global interfaces that come into the DMA.
+
+ Please refer to the device documentation for global interface indexes.
+
+ cell 3: Channel ID for the peripheral
+ This is the mapped_channel_id assigned to the peripheral in the PSI-L
+ endpoint map. For XYMF peripherals (SPI, CRC32) each chip-select/FIFO
+ has a distinct channel ID; use the channel ID for the specific
+ direction and chip-select being requested. Use 0 for triggered
+ block-copy channels (cell 1 != 0).
+
+ Please refer to the device documentation for the channel map.
+
+ cell 4: ASEL value for the channel
+
+ interrupts:
+ maxItems: 75
+ description:
+ Interrupts for DMA channels.
+
+ interrupt-names:
+ minItems: 75
+ maxItems: 75
+ items:
+ pattern: "^chan([0-9]|1[0-3]|1[6-9]|2[0-9]|3[0-9]|4[0-7]|4[89]|5[0-3]|6[4-8]|8[01]|12[89]|13[0-9]|14[0-3])$"
+ description:
+ The name of the interrupt corresponding to the DMA channel.
+
+required:
+ - compatible
+ - reg
+ - reg-names
+ - "#dma-cells"
+ - interrupts
+ - interrupt-names
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ #include <dt-bindings/interrupt-controller/arm-gic.h>
+ #include <dt-bindings/interrupt-controller/irq.h>
+
+ dma-controller@485c4000 {
+ compatible = "ti,am62l-dmss-bcdma";
+ reg = <0x485c4000 0x4000>,
+ <0x48880000 0x10000>,
+ <0x48800000 0x80000>,
+ <0x47000000 0x200000>;
+ reg-names = "gcfg", "bchanrt", "chanrt", "ringrt";
+
+ #dma-cells = <4>;
+
+ interrupts = <GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 361 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 364 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 365 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 368 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 369 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 372 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 373 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 376 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 377 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 324 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 325 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 324 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 325 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 324 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 325 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 324 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 325 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 328 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 328 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 328 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 328 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 332 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 332 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 332 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 332 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 384 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 385 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 386 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 387 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 388 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 389 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 50 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 482 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 482 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 548 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 548 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 516 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 517 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 518 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 519 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 520 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 521 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 522 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 523 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 524 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 525 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 526 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 527 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 528 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 529 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 530 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 531 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "chan0", "chan1", "chan2", "chan3", "chan4",
+ "chan5", "chan6", "chan7", "chan8", "chan9",
+ "chan10", "chan11", "chan12", "chan13",
+ "chan16", "chan17", "chan18", "chan19",
+ "chan20", "chan21", "chan22", "chan23",
+ "chan24", "chan25", "chan26", "chan27",
+ "chan28", "chan29", "chan30", "chan31",
+ "chan32", "chan33", "chan34", "chan35",
+ "chan36", "chan37", "chan38", "chan39",
+ "chan40", "chan41", "chan42", "chan43",
+ "chan44", "chan45", "chan46", "chan47",
+ "chan48", "chan49", "chan50", "chan51",
+ "chan52", "chan53", "chan64", "chan65",
+ "chan66", "chan80", "chan81", "chan67",
+ "chan68", "chan128", "chan129", "chan130",
+ "chan131", "chan132", "chan133", "chan134",
+ "chan135", "chan136", "chan137", "chan138",
+ "chan139", "chan140", "chan141", "chan142",
+ "chan143";
+ };
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 13/19] dt-bindings: dma: ti: Add K3 BCDMA V2
2026-08-10 15:14 ` [PATCH v8 13/19] dt-bindings: dma: ti: Add K3 BCDMA V2 Sai Sree Kartheek Adivi
@ 2026-08-11 6:32 ` Krzysztof Kozlowski
0 siblings, 0 replies; 35+ messages in thread
From: Krzysztof Kozlowski @ 2026-08-11 6:32 UTC (permalink / raw)
To: Sai Sree Kartheek Adivi
Cc: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, dmaengine, devicetree, linux-kernel,
linux-arm-kernel, r-sharma3, gehariprasath
On Mon, Aug 10, 2026 at 08:44:07PM +0530, Sai Sree Kartheek Adivi wrote:
> New binding document for Texas Instruments K3 Block Copy DMA (BCDMA) V2.
>
> BCDMA V2 is introduced as part of AM62L.
>
> Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
Please explain dropping tag. I could not find a reason for that in cover
letter.
Dropping this from patchwork.
Best regards,
Krzysztof
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 14/19] dt-bindings: dma: ti: Add K3 PKTDMA V2
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
` (12 preceding siblings ...)
2026-08-10 15:14 ` [PATCH v8 13/19] dt-bindings: dma: ti: Add K3 BCDMA V2 Sai Sree Kartheek Adivi
@ 2026-08-10 15:14 ` Sai Sree Kartheek Adivi
2026-08-10 15:14 ` [PATCH v8 15/19] dmaengine: ti: k3-psil-am62l: Add AM62Lx PSIL and PDMA data Sai Sree Kartheek Adivi
` (4 subsequent siblings)
18 siblings, 0 replies; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:14 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
New binding document for Texas Instruments K3 Packet DMA (PKTDMA) V2.
PKTDMA V2 is introduced as part of AM62L.
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
.../bindings/dma/ti/ti,am62l-dmss-pktdma.yaml | 189 ++++++++++++++++++
1 file changed, 189 insertions(+)
create mode 100644 Documentation/devicetree/bindings/dma/ti/ti,am62l-dmss-pktdma.yaml
diff --git a/Documentation/devicetree/bindings/dma/ti/ti,am62l-dmss-pktdma.yaml b/Documentation/devicetree/bindings/dma/ti/ti,am62l-dmss-pktdma.yaml
new file mode 100644
index 0000000000000..caeacd4cf5ab3
--- /dev/null
+++ b/Documentation/devicetree/bindings/dma/ti/ti,am62l-dmss-pktdma.yaml
@@ -0,0 +1,189 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+# Copyright (C) 2026 Texas Instruments Incorporated
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/dma/ti/ti,am62l-dmss-pktdma.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Texas Instruments K3 DMSS PKTDMA V2
+
+maintainers:
+ - Sai Sree Kartheek Adivi <s-adivi@ti.com>
+
+description:
+ The PKTDMA V2 is intended to perform similar functions as the packet mode
+ channels of K3 UDMA-P. PKTDMA V2 only includes Split channels to service
+ PSI-L based peripherals.
+
+ The peripherals can be PSI-L native or legacy, non PSI-L native peripherals
+ with PDMAs. PDMA is tasked to act as a bridge between the PSI-L fabric and the
+ legacy peripheral.
+
+allOf:
+ - $ref: /schemas/dma/dma-controller.yaml#
+
+properties:
+ compatible:
+ const: ti,am62l-dmss-pktdma
+
+ reg:
+ items:
+ - description: Packet DMA Control & Status
+ - description: Channel Realtime
+ - description: Ring Realtime
+
+ reg-names:
+ items:
+ - const: gcfg
+ - const: chanrt
+ - const: ringrt
+
+ "#dma-cells":
+ const: 2
+ description: |
+ cell 1: Flow ID for the peripheral
+ This is the hardware flow index assigned to the peripheral. TX and RX
+ flow indices are mixed across the valid range. For XYMF peripherals
+ (SPI, CRC32) each chip-select/FIFO has a distinct flow ID; use the
+ flow ID for the specific direction and chip-select being requested.
+
+ Please refer to the device documentation for the flow map.
+
+ cell 2: ASEL value for the channel
+
+ interrupts:
+ maxItems: 78
+ description:
+ Interrupts for DMA channels.
+
+ interrupt-names:
+ minItems: 78
+ maxItems: 78
+ items:
+ pattern: "^(t|r)x-([0-9]|1[0-3]|1[6-9]|2[0-9]|3[0-9]|4[0-7]|6[4-9]|7[0-9]|9[6-9]|10[0-9]|11[01])$"
+ description:
+ The name of the interrupt corresponding to the DMA flow.
+ TX flows use the "tx-" prefix, RX flows use the "rx-" prefix.
+
+required:
+ - compatible
+ - reg
+ - reg-names
+ - "#dma-cells"
+ - interrupts
+ - interrupt-names
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ #include <dt-bindings/interrupt-controller/arm-gic.h>
+ #include <dt-bindings/interrupt-controller/irq.h>
+
+ dma-controller@485c0000 {
+ compatible = "ti,am62l-dmss-pktdma";
+ reg = <0x485c0000 0x4000>,
+ <0x48900000 0x80000>,
+ <0x47200000 0x100000>;
+ reg-names = "gcfg", "chanrt", "ringrt";
+
+ #dma-cells = <2>;
+
+ interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 359 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 362 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 363 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 366 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 367 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 370 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 371 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 374 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 375 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 378 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 379 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 322 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 323 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 322 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 323 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 322 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 323 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 322 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 323 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 326 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 327 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 326 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 327 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 326 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 327 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 326 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 327 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 334 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 334 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 334 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 334 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 500 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 501 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 502 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 503 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 504 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 505 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 506 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 507 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 508 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 509 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 510 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 511 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 512 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 513 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 514 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 515 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 484 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 485 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 486 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 487 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 488 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 489 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 490 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 491 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 492 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 493 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 494 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 495 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 496 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 497 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 498 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 499 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "rx-0", "tx-1", "rx-2", "tx-3", "rx-4",
+ "tx-5", "rx-6", "tx-7", "rx-8", "tx-9",
+ "rx-10", "tx-11", "rx-12", "tx-13",
+ "rx-16", "tx-17", "rx-18", "tx-19",
+ "rx-20", "tx-21", "rx-22", "tx-23",
+ "rx-24", "tx-25", "rx-26", "tx-27",
+ "rx-28", "tx-29", "rx-30", "tx-31",
+ "rx-32", "tx-33", "rx-34", "tx-35",
+ "rx-36", "tx-37", "rx-38", "tx-39",
+ "rx-40", "tx-41", "rx-42", "tx-43",
+ "rx-44", "tx-45", "rx-46", "tx-47",
+ "tx-64", "tx-65", "tx-66", "tx-67",
+ "tx-68", "tx-69", "tx-70", "tx-71",
+ "tx-72", "tx-73", "tx-74", "tx-75",
+ "tx-76", "tx-77", "tx-78", "tx-79",
+ "rx-96", "rx-97", "rx-98", "rx-99",
+ "rx-100", "rx-101", "rx-102", "rx-103",
+ "rx-104", "rx-105", "rx-106", "rx-107",
+ "rx-108", "rx-109", "rx-110", "rx-111";
+ };
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v8 15/19] dmaengine: ti: k3-psil-am62l: Add AM62Lx PSIL and PDMA data
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
` (13 preceding siblings ...)
2026-08-10 15:14 ` [PATCH v8 14/19] dt-bindings: dma: ti: Add K3 PKTDMA V2 Sai Sree Kartheek Adivi
@ 2026-08-10 15:14 ` Sai Sree Kartheek Adivi
2026-08-10 16:45 ` sashiko-bot
2026-08-10 15:14 ` [PATCH v8 16/19] dmaengine: ti: k3-udma-v2: New driver for K3 BCDMA_V2 Sai Sree Kartheek Adivi
` (3 subsequent siblings)
18 siblings, 1 reply; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:14 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
Add PSIL and PDMA data for AM62Lx SoC.
Introduce new PSIL_EP_PDMA_XYMF type for channels that have multiple
selectable fifos. Also add a new fifo_id field to psil_endpoint_config
to specify the selectable fifo_id.
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
drivers/dma/ti/Makefile | 3 +-
drivers/dma/ti/k3-psil-am62l.c | 169 +++++++++++++++++++++++++++++++++
drivers/dma/ti/k3-psil-priv.h | 5 +
drivers/dma/ti/k3-psil.c | 78 ++++++++++++++-
include/linux/dma/k3-psil.h | 3 +
5 files changed, 253 insertions(+), 5 deletions(-)
create mode 100644 drivers/dma/ti/k3-psil-am62l.c
diff --git a/drivers/dma/ti/Makefile b/drivers/dma/ti/Makefile
index 3b91c02e55eaf..41bfba944dc6c 100644
--- a/drivers/dma/ti/Makefile
+++ b/drivers/dma/ti/Makefile
@@ -14,6 +14,7 @@ k3-psil-lib-objs := k3-psil.o \
k3-psil-am62.o \
k3-psil-am62a.o \
k3-psil-j784s4.o \
- k3-psil-am62p.o
+ k3-psil-am62p.o \
+ k3-psil-am62l.o
obj-$(CONFIG_TI_K3_PSIL) += k3-psil-lib.o
obj-$(CONFIG_TI_DMA_CROSSBAR) += dma-crossbar.o
diff --git a/drivers/dma/ti/k3-psil-am62l.c b/drivers/dma/ti/k3-psil-am62l.c
new file mode 100644
index 0000000000000..ee77fae3787a4
--- /dev/null
+++ b/drivers/dma/ti/k3-psil-am62l.c
@@ -0,0 +1,169 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2024-2025 Texas Instruments Incorporated - https://www.ti.com
+ */
+
+#include <linux/kernel.h>
+
+#include "k3-psil-priv.h"
+
+#define PSIL_PDMA_XY_TR(x, ch) \
+ { \
+ .thread_id = x, \
+ .ep_config = { \
+ .ep_type = PSIL_EP_PDMA_XY, \
+ .mapped_channel_id = ch, \
+ .default_flow_id = -1, \
+ }, \
+ }
+
+#define PSIL_PDMA_XYMF_TR(x, ch, fifo) \
+ { \
+ .thread_id = x, \
+ .ep_config = { \
+ .ep_type = PSIL_EP_PDMA_XYMF, \
+ .mapped_channel_id = ch, \
+ .default_flow_id = -1, \
+ .fifo_id = fifo, \
+ }, \
+ }
+
+#define PSIL_PDMA_XY_PKT(x, ch) \
+ { \
+ .thread_id = x, \
+ .ep_config = { \
+ .ep_type = PSIL_EP_PDMA_XY, \
+ .mapped_channel_id = ch, \
+ .pkt_mode = 1, \
+ .default_flow_id = -1 \
+ }, \
+ }
+
+#define PSIL_ETHERNET(x, ch, flow_base, flow_cnt) \
+ { \
+ .thread_id = x, \
+ .ep_config = { \
+ .ep_type = PSIL_EP_NATIVE, \
+ .pkt_mode = 1, \
+ .needs_epib = 1, \
+ .psd_size = 16, \
+ .mapped_channel_id = ch, \
+ .flow_start = flow_base, \
+ .flow_num = flow_cnt, \
+ .default_flow_id = flow_base, \
+ }, \
+ }
+
+#define PSIL_PDMA_MCASP(x, ch) \
+ { \
+ .thread_id = x, \
+ .ep_config = { \
+ .ep_type = PSIL_EP_PDMA_XY, \
+ .pdma_acc32 = 1, \
+ .pdma_burst = 1, \
+ .mapped_channel_id = ch, \
+ .default_flow_id = -1 \
+ }, \
+ }
+
+/* PSI-L source thread IDs, used for RX (DMA_DEV_TO_MEM) */
+static struct psil_ep am62l_src_ep_map[] = {
+ /* PDMA_MAIN1 - UART0-6 */
+ PSIL_PDMA_XY_PKT(0x4400, 0),
+ PSIL_PDMA_XY_PKT(0x4401, 2),
+ PSIL_PDMA_XY_PKT(0x4402, 4),
+ PSIL_PDMA_XY_PKT(0x4403, 6),
+ PSIL_PDMA_XY_PKT(0x4404, 8),
+ PSIL_PDMA_XY_PKT(0x4405, 10),
+ PSIL_PDMA_XY_PKT(0x4406, 12),
+ /* PDMA_MAIN0 - SPI0 - CH0-3 */
+ PSIL_PDMA_XYMF_TR(0x4300, 16, 0),
+ PSIL_PDMA_XYMF_TR(0x4300, 18, 1),
+ PSIL_PDMA_XYMF_TR(0x4300, 20, 2),
+ PSIL_PDMA_XYMF_TR(0x4300, 22, 3),
+ /* PDMA_MAIN0 - SPI1 - CH0-3 */
+ PSIL_PDMA_XYMF_TR(0x4301, 24, 0),
+ PSIL_PDMA_XYMF_TR(0x4301, 26, 1),
+ PSIL_PDMA_XYMF_TR(0x4301, 28, 2),
+ PSIL_PDMA_XYMF_TR(0x4301, 30, 3),
+ /* PDMA_MAIN0 - SPI2 - CH0-3 */
+ PSIL_PDMA_XYMF_TR(0x4302, 32, 0),
+ PSIL_PDMA_XYMF_TR(0x4302, 34, 1),
+ PSIL_PDMA_XYMF_TR(0x4302, 36, 2),
+ PSIL_PDMA_XYMF_TR(0x4302, 38, 3),
+ /* PDMA_MAIN0 - SPI3 - CH0-3 */
+ PSIL_PDMA_XYMF_TR(0x4303, 40, 0),
+ PSIL_PDMA_XYMF_TR(0x4303, 42, 1),
+ PSIL_PDMA_XYMF_TR(0x4303, 44, 2),
+ PSIL_PDMA_XYMF_TR(0x4303, 46, 3),
+ /* PDMA_MAIN2 - MCASP0-2 */
+ PSIL_PDMA_MCASP(0x4500, 48),
+ PSIL_PDMA_MCASP(0x4501, 50),
+ PSIL_PDMA_MCASP(0x4502, 52),
+ /* PDMA_MAIN0 - AES */
+ PSIL_PDMA_XY_TR(0x4700, 65),
+ /* PDMA_MAIN0 - ADC */
+ PSIL_PDMA_XY_TR(0x4503, 80),
+ PSIL_PDMA_XY_TR(0x4504, 81),
+ PSIL_ETHERNET(0x4600, 96, 96, 16),
+};
+
+/* PSI-L destination thread IDs, used for TX (DMA_MEM_TO_DEV) */
+static struct psil_ep am62l_dst_ep_map[] = {
+ /* PDMA_MAIN1 - UART0-6 */
+ PSIL_PDMA_XY_PKT(0xC400, 1),
+ PSIL_PDMA_XY_PKT(0xC401, 3),
+ PSIL_PDMA_XY_PKT(0xC402, 5),
+ PSIL_PDMA_XY_PKT(0xC403, 7),
+ PSIL_PDMA_XY_PKT(0xC404, 9),
+ PSIL_PDMA_XY_PKT(0xC405, 11),
+ PSIL_PDMA_XY_PKT(0xC406, 13),
+ /* PDMA_MAIN0 - SPI0 - CH0-3 */
+ PSIL_PDMA_XYMF_TR(0xC300, 17, 0),
+ PSIL_PDMA_XYMF_TR(0xC300, 19, 1),
+ PSIL_PDMA_XYMF_TR(0xC300, 21, 2),
+ PSIL_PDMA_XYMF_TR(0xC300, 23, 3),
+ /* PDMA_MAIN0 - SPI1 - CH0-3 */
+ PSIL_PDMA_XYMF_TR(0xC301, 25, 0),
+ PSIL_PDMA_XYMF_TR(0xC301, 27, 1),
+ PSIL_PDMA_XYMF_TR(0xC301, 29, 2),
+ PSIL_PDMA_XYMF_TR(0xC301, 31, 3),
+ /* PDMA_MAIN0 - SPI2 - CH0-3 */
+ PSIL_PDMA_XYMF_TR(0xC302, 33, 0),
+ PSIL_PDMA_XYMF_TR(0xC302, 35, 1),
+ PSIL_PDMA_XYMF_TR(0xC302, 37, 2),
+ PSIL_PDMA_XYMF_TR(0xC302, 39, 3),
+ /* PDMA_MAIN0 - SPI3 - CH0-3 */
+ PSIL_PDMA_XYMF_TR(0xC303, 41, 0),
+ PSIL_PDMA_XYMF_TR(0xC303, 43, 1),
+ PSIL_PDMA_XYMF_TR(0xC303, 45, 2),
+ PSIL_PDMA_XYMF_TR(0xC303, 47, 3),
+ /* PDMA_MAIN2 - MCASP0-2 */
+ PSIL_PDMA_MCASP(0xC500, 49),
+ PSIL_PDMA_MCASP(0xC501, 51),
+ PSIL_PDMA_MCASP(0xC502, 53),
+ /* PDMA_MAIN0 - SHA */
+ PSIL_PDMA_XY_TR(0xC700, 64),
+ /* PDMA_MAIN0 - AES */
+ PSIL_PDMA_XY_TR(0xC701, 66),
+ /* PDMA_MAIN0 - CRC32 - CH0-1 */
+ PSIL_PDMA_XYMF_TR(0xC702, 67, 0),
+ PSIL_PDMA_XYMF_TR(0xC702, 68, 1),
+ /* CPSW3G */
+ PSIL_ETHERNET(0xc600, 64, 64, 2),
+ PSIL_ETHERNET(0xc601, 66, 66, 2),
+ PSIL_ETHERNET(0xc602, 68, 68, 2),
+ PSIL_ETHERNET(0xc603, 70, 70, 2),
+ PSIL_ETHERNET(0xc604, 72, 72, 2),
+ PSIL_ETHERNET(0xc605, 74, 74, 2),
+ PSIL_ETHERNET(0xc606, 76, 76, 2),
+ PSIL_ETHERNET(0xc607, 78, 78, 2),
+};
+
+struct psil_ep_map am62l_ep_map = {
+ .name = "am62l",
+ .src = am62l_src_ep_map,
+ .src_count = ARRAY_SIZE(am62l_src_ep_map),
+ .dst = am62l_dst_ep_map,
+ .dst_count = ARRAY_SIZE(am62l_dst_ep_map),
+};
diff --git a/drivers/dma/ti/k3-psil-priv.h b/drivers/dma/ti/k3-psil-priv.h
index a577be97e3447..970afd46a79e6 100644
--- a/drivers/dma/ti/k3-psil-priv.h
+++ b/drivers/dma/ti/k3-psil-priv.h
@@ -35,6 +35,10 @@ struct psil_ep_map {
};
struct psil_endpoint_config *psil_get_ep_config(u32 thread_id);
+struct psil_endpoint_config *psil_get_ep_config_by_id(u32 channel_id,
+ bool is_pktdma,
+ u32 *thread_id,
+ bool *dev_to_mem);
/* SoC PSI-L endpoint maps */
extern struct psil_ep_map am654_ep_map;
@@ -46,5 +50,6 @@ extern struct psil_ep_map am62_ep_map;
extern struct psil_ep_map am62a_ep_map;
extern struct psil_ep_map j784s4_ep_map;
extern struct psil_ep_map am62p_ep_map;
+extern struct psil_ep_map am62l_ep_map;
#endif /* K3_PSIL_PRIV_H_ */
diff --git a/drivers/dma/ti/k3-psil.c b/drivers/dma/ti/k3-psil.c
index c4b6f0df46861..3a9b43e179d1e 100644
--- a/drivers/dma/ti/k3-psil.c
+++ b/drivers/dma/ti/k3-psil.c
@@ -28,6 +28,7 @@ static const struct soc_device_attribute k3_soc_devices[] = {
{ .family = "J784S4", .data = &j784s4_ep_map },
{ .family = "AM62PX", .data = &am62p_ep_map },
{ .family = "J722S", .data = &am62p_ep_map },
+ { .family = "AM62LX", .data = &am62l_ep_map },
{ /* sentinel */ }
};
@@ -71,12 +72,68 @@ struct psil_endpoint_config *psil_get_ep_config(u32 thread_id)
}
EXPORT_SYMBOL_GPL(psil_get_ep_config);
+struct psil_endpoint_config *psil_get_ep_config_by_id(u32 channel_id,
+ bool is_pktdma,
+ u32 *thread_id,
+ bool *dev_to_mem)
+{
+ int i;
+
+ mutex_lock(&ep_map_mutex);
+ if (!soc_ep_map) {
+ const struct soc_device_attribute *soc;
+
+ soc = soc_device_match(k3_soc_devices);
+ if (soc) {
+ soc_ep_map = soc->data;
+ } else {
+ pr_err("PSIL: No compatible machine found for map\n");
+ mutex_unlock(&ep_map_mutex);
+ return ERR_PTR(-ENOTSUPP);
+ }
+ }
+
+ if (soc_ep_map->src) {
+ for (i = 0; i < soc_ep_map->src_count; i++) {
+ struct psil_ep *ep = &soc_ep_map->src[i];
+
+ if (ep->ep_config.mapped_channel_id != (s16)channel_id)
+ continue;
+ if ((bool)ep->ep_config.pkt_mode != is_pktdma)
+ continue;
+ *thread_id = ep->thread_id;
+ *dev_to_mem = true;
+ mutex_unlock(&ep_map_mutex);
+ return &ep->ep_config;
+ }
+ }
+
+ if (soc_ep_map->dst) {
+ for (i = 0; i < soc_ep_map->dst_count; i++) {
+ struct psil_ep *ep = &soc_ep_map->dst[i];
+
+ if (ep->ep_config.mapped_channel_id != (s16)channel_id)
+ continue;
+ if ((bool)ep->ep_config.pkt_mode != is_pktdma)
+ continue;
+ *thread_id = ep->thread_id;
+ *dev_to_mem = false;
+ mutex_unlock(&ep_map_mutex);
+ return &ep->ep_config;
+ }
+ }
+
+ mutex_unlock(&ep_map_mutex);
+ return ERR_PTR(-ENOENT);
+}
+EXPORT_SYMBOL_GPL(psil_get_ep_config_by_id);
+
int psil_set_new_ep_config(struct device *dev, const char *name,
struct psil_endpoint_config *ep_config)
{
struct psil_endpoint_config *dst_ep_config;
struct of_phandle_args dma_spec;
- u32 thread_id;
+ u32 thread_id = 0;
int index;
if (!dev || !dev->of_node)
@@ -90,9 +147,22 @@ int psil_set_new_ep_config(struct device *dev, const char *name,
index, &dma_spec))
return -ENOENT;
- thread_id = dma_spec.args[0];
-
- dst_ep_config = psil_get_ep_config(thread_id);
+ if (of_device_is_compatible(dma_spec.np, "ti,am62l-dmss-pktdma")) {
+ bool dev_to_mem;
+
+ dst_ep_config = psil_get_ep_config_by_id(dma_spec.args[0],
+ true,
+ &thread_id, &dev_to_mem);
+ } else if (of_device_is_compatible(dma_spec.np, "ti,am62l-dmss-bcdma")) {
+ bool dev_to_mem;
+
+ dst_ep_config = psil_get_ep_config_by_id(dma_spec.args[0],
+ false,
+ &thread_id, &dev_to_mem);
+ } else {
+ thread_id = dma_spec.args[0];
+ dst_ep_config = psil_get_ep_config(thread_id);
+ }
if (IS_ERR(dst_ep_config)) {
pr_err("PSIL: thread ID 0x%04x not defined in map\n",
thread_id);
diff --git a/include/linux/dma/k3-psil.h b/include/linux/dma/k3-psil.h
index 5f106d852f1cf..36e347311f8b2 100644
--- a/include/linux/dma/k3-psil.h
+++ b/include/linux/dma/k3-psil.h
@@ -35,6 +35,7 @@ enum udma_tp_level {
enum psil_endpoint_type {
PSIL_EP_NATIVE = 0,
PSIL_EP_PDMA_XY,
+ PSIL_EP_PDMA_XYMF,
PSIL_EP_PDMA_MCAN,
PSIL_EP_PDMA_AASRC,
};
@@ -78,6 +79,8 @@ struct psil_endpoint_config {
u16 flow_start;
u16 flow_num;
s16 default_flow_id;
+ /* XYMF FIFO index (0-3 for CS0-CS3), Only for PSIL_EP_PDMA_XYMF */
+ u8 fifo_id;
};
int psil_set_new_ep_config(struct device *dev, const char *name,
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 15/19] dmaengine: ti: k3-psil-am62l: Add AM62Lx PSIL and PDMA data
2026-08-10 15:14 ` [PATCH v8 15/19] dmaengine: ti: k3-psil-am62l: Add AM62Lx PSIL and PDMA data Sai Sree Kartheek Adivi
@ 2026-08-10 16:45 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-08-10 16:45 UTC (permalink / raw)
To: Sai Sree Kartheek Adivi
Cc: devicetree, conor+dt, Frank.Li, robh, vkoul, dmaengine
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] psil_set_new_ep_config() uses the incorrect dma-cells index for BCDMA channel ID lookup.
- [Medium] Misleading error message on lookup failure in psil_set_new_ep_config() logs '0x0000'.
--
--- Patch [15]: [PATCH v8 15/19] dmaengine: ti: k3-psil-am62l: Add AM62Lx PSIL and PDMA data ---
commit 341f27f741b8359a8b0d9ea36665be0d14b7d6b0
Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>
dmaengine: ti: k3-psil-am62l: Add AM62Lx PSIL and PDMA data
This commit adds PSIL and PDMA data for the AM62Lx SoC. It also introduces a
new PSIL_EP_PDMA_XYMF type for channels that have multiple selectable fifos
and adds a fifo_id field to the psil_endpoint_config structure.
> diff --git a/drivers/dma/ti/k3-psil.c b/drivers/dma/ti/k3-psil.c
> index c4b6f0df46861..3a9b43e179d1e 100644
> --- a/drivers/dma/ti/k3-psil.c
> +++ b/drivers/dma/ti/k3-psil.c
[ ... ]
> @@ -90,9 +147,22 @@ int psil_set_new_ep_config(struct device *dev, const char *name,
> index, &dma_spec))
> return -ENOENT;
>
> - thread_id = dma_spec.args[0];
> -
> - dst_ep_config = psil_get_ep_config(thread_id);
> + if (of_device_is_compatible(dma_spec.np, "ti,am62l-dmss-pktdma")) {
> + bool dev_to_mem;
> +
> + dst_ep_config = psil_get_ep_config_by_id(dma_spec.args[0],
> + true,
> + &thread_id, &dev_to_mem);
> + } else if (of_device_is_compatible(dma_spec.np, "ti,am62l-dmss-bcdma")) {
> + bool dev_to_mem;
> +
> + dst_ep_config = psil_get_ep_config_by_id(dma_spec.args[0],
> + false,
> + &thread_id, &dev_to_mem);
[Severity: High]
For devices matching ti,am62l-dmss-bcdma, does this code pass the trigger type
instead of the mapped channel ID to psil_get_ep_config_by_id?
If dma_spec.args[0] is the trigger type for a BCDMA node (which has 4 cells),
this lookup might consistently fail with -ENOENT since it will not match a
valid mapped channel ID. Would passing dma_spec.args[2] be the intended
approach here?
> + } else {
> + thread_id = dma_spec.args[0];
> + dst_ep_config = psil_get_ep_config(thread_id);
> + }
> if (IS_ERR(dst_ep_config)) {
> pr_err("PSIL: thread ID 0x%04x not defined in map\n",
> thread_id);
[Severity: Medium]
When psil_get_ep_config_by_id fails to find the endpoint, it returns
ERR_PTR(-ENOENT) without updating the thread_id out-parameter.
Since thread_id is initialized to 0 at the start of psil_set_new_ep_config,
would this error path print an uninitialized thread ID (0x0000) upon a lookup
failure? This might hide the actual failing channel or thread ID and make
debugging difficult.
> of_node_put(dma_spec.np);
> return PTR_ERR(dst_ep_config);
> }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260810151423.1948224-1-s-adivi@ti.com?part=15
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 16/19] dmaengine: ti: k3-udma-v2: New driver for K3 BCDMA_V2
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
` (14 preceding siblings ...)
2026-08-10 15:14 ` [PATCH v8 15/19] dmaengine: ti: k3-psil-am62l: Add AM62Lx PSIL and PDMA data Sai Sree Kartheek Adivi
@ 2026-08-10 15:14 ` Sai Sree Kartheek Adivi
2026-08-10 17:04 ` sashiko-bot
2026-08-10 15:14 ` [PATCH v8 17/19] dmaengine: ti: k3-udma-v2: Add support for PKTDMA V2 Sai Sree Kartheek Adivi
` (2 subsequent siblings)
18 siblings, 1 reply; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:14 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
Add support for BCDMA_V2.
The BCDMA_V2 is different than the existing BCDMA supported by the
k3-udma driver.
The changes in BCDMA_V2 are:
- Autopair: There is no longer a need for PSIL pair and AUTOPAIR bit
needs to set in the RT_CTL register.
- Static channel mapping: Each channel is mapped to a single peripheral.
- Direct IRQs: There is no INT-A and interrupt lines from DMA are
directly connected to GIC.
- Remote side configuration handled by DMA. So no need to write to PEER
registers to START / STOP / PAUSE / TEARDOWN.
- Unified Channel Space: Tx and Rx channels share a single register
space. Each channel index is specifically fixed in hardware as either
Tx or Rx in an interleaved manner.
Also, since a version member is introduced in the match_data, Add
version v1 in match_data of SoCs using v1 DMA.
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
drivers/dma/ti/Kconfig | 14 +-
drivers/dma/ti/Makefile | 1 +
drivers/dma/ti/k3-udma-common.c | 91 +-
drivers/dma/ti/k3-udma-v2.c | 1319 +++++++++++++++++++++++++++++
drivers/dma/ti/k3-udma.c | 9 +
drivers/dma/ti/k3-udma.h | 123 +--
include/linux/soc/ti/k3-ringacc.h | 3 +
7 files changed, 1488 insertions(+), 72 deletions(-)
create mode 100644 drivers/dma/ti/k3-udma-v2.c
diff --git a/drivers/dma/ti/Kconfig b/drivers/dma/ti/Kconfig
index 712e456015459..40713bd1e8e9b 100644
--- a/drivers/dma/ti/Kconfig
+++ b/drivers/dma/ti/Kconfig
@@ -49,6 +49,18 @@ config TI_K3_UDMA
Enable support for the TI UDMA (Unified DMA) controller. This
DMA engine is used in AM65x and j721e.
+config TI_K3_UDMA_V2
+ tristate "Texas Instruments K3 UDMA v2 support"
+ depends on ARCH_K3
+ select DMA_ENGINE
+ select DMA_VIRTUAL_CHANNELS
+ select TI_K3_UDMA_COMMON
+ select TI_K3_RINGACC
+ select TI_K3_PSIL
+ help
+ Enable support for the TI UDMA (Unified DMA) v2 controller. This
+ DMA engine is used in AM62L.
+
config TI_K3_UDMA_COMMON
tristate
default n
@@ -63,7 +75,7 @@ config TI_K3_UDMA_GLUE_LAYER
config TI_K3_PSIL
tristate
- default TI_K3_UDMA
+ default TI_K3_UDMA || TI_K3_UDMA_V2
config TI_DMA_CROSSBAR
bool
diff --git a/drivers/dma/ti/Makefile b/drivers/dma/ti/Makefile
index 41bfba944dc6c..296aa3421e71b 100644
--- a/drivers/dma/ti/Makefile
+++ b/drivers/dma/ti/Makefile
@@ -3,6 +3,7 @@ obj-$(CONFIG_TI_CPPI41) += cppi41.o
obj-$(CONFIG_TI_EDMA) += edma.o
obj-$(CONFIG_DMA_OMAP) += omap-dma.o
obj-$(CONFIG_TI_K3_UDMA) += k3-udma.o
+obj-$(CONFIG_TI_K3_UDMA_V2) += k3-udma-v2.o
obj-$(CONFIG_TI_K3_UDMA_COMMON) += k3-udma-common.o
obj-$(CONFIG_TI_K3_UDMA_GLUE_LAYER) += k3-udma-glue.o
k3-psil-lib-objs := k3-psil.o \
diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
index 01b66e9f026b4..f9dd6edf3eacb 100644
--- a/drivers/dma/ti/k3-udma-common.c
+++ b/drivers/dma/ti/k3-udma-common.c
@@ -171,8 +171,13 @@ bool udma_is_desc_really_done(struct udma_chan *uc, struct udma_desc *d)
uc->config.dir != DMA_MEM_TO_DEV || !(uc->config.tx_flags & DMA_PREP_INTERRUPT))
return true;
- peer_bcnt = udma_tchanrt_read(uc, UDMA_CHAN_RT_PEER_BCNT_REG);
- bcnt = udma_tchanrt_read(uc, UDMA_CHAN_RT_BCNT_REG);
+ if (uc->ud->match_data->version == K3_UDMA_V1) {
+ peer_bcnt = udma_tchanrt_read(uc, UDMA_CHAN_RT_PEER_BCNT_REG);
+ bcnt = udma_tchanrt_read(uc, UDMA_CHAN_RT_BCNT_REG);
+ } else {
+ peer_bcnt = udma_chanrt_read(uc, UDMA_CHAN_RT_PERIPH_BCNT_REG);
+ bcnt = udma_chanrt_read(uc, UDMA_CHAN_RT_BCNT_REG);
+ }
/* Transfer is incomplete, store current residue and time stamp */
if (peer_bcnt < bcnt) {
@@ -319,6 +324,7 @@ udma_prep_slave_sg_tr(struct udma_chan *uc, struct scatterlist *sgl,
size_t tr_size;
int num_tr = 0;
int tr_idx = 0;
+ u32 extra_flags = 0;
u64 asel;
/* estimate the number of TRs we will need */
@@ -342,6 +348,16 @@ udma_prep_slave_sg_tr(struct udma_chan *uc, struct scatterlist *sgl,
else
asel = (u64)uc->config.asel << K3_ADDRESS_ASEL_SHIFT;
+ /*
+ * BCDMA V2 stalls and stops processing further TRs if a TR's ICNT0
+ * is not a multiple of 16 bytes. Setting EOP on every TR (not just
+ * the last one) avoids that stall condition. Intentional, not a bug.
+ */
+ if (uc->ud->match_data->type == DMA_TYPE_BCDMA &&
+ uc->ud->match_data->version == K3_UDMA_V2 &&
+ dir == DMA_MEM_TO_DEV)
+ extra_flags = CPPI5_TR_CSF_EOP;
+
tr_req = d->hwdesc[0].tr_req_base;
for_each_sg(sgl, sgent, sglen, i) {
dma_addr_t sg_addr = sg_dma_address(sgent);
@@ -358,7 +374,7 @@ udma_prep_slave_sg_tr(struct udma_chan *uc, struct scatterlist *sgl,
cppi5_tr_init(&tr_req[tr_idx].flags, CPPI5_TR_TYPE1, false,
false, CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
- cppi5_tr_csf_set(&tr_req[tr_idx].flags, CPPI5_TR_CSF_SUPR_EVT);
+ cppi5_tr_csf_set(&tr_req[tr_idx].flags, CPPI5_TR_CSF_SUPR_EVT | extra_flags);
sg_addr |= asel;
tr_req[tr_idx].addr = sg_addr;
@@ -372,7 +388,7 @@ udma_prep_slave_sg_tr(struct udma_chan *uc, struct scatterlist *sgl,
false, false,
CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
cppi5_tr_csf_set(&tr_req[tr_idx].flags,
- CPPI5_TR_CSF_SUPR_EVT);
+ CPPI5_TR_CSF_SUPR_EVT | extra_flags);
tr_req[tr_idx].addr = sg_addr + tr0_cnt1 * tr0_cnt0;
tr_req[tr_idx].icnt0 = tr1_cnt0;
@@ -593,7 +609,7 @@ int udma_configure_statictr(struct udma_chan *uc, struct udma_desc *d,
enum dma_slave_buswidth dev_width,
u16 elcnt)
{
- if (uc->config.ep_type != PSIL_EP_PDMA_XY)
+ if (uc->config.ep_type != PSIL_EP_PDMA_XY && uc->config.ep_type != PSIL_EP_PDMA_XYMF)
return 0;
/* Bus width translates to the element size (ES) */
@@ -951,7 +967,8 @@ udma_prep_dma_cyclic_tr(struct udma_chan *uc, dma_addr_t buf_addr,
* As we are in cyclic mode, we do not know which period might be the
* last one, so set the flag for each period.
*/
- if (uc->config.ep_type == PSIL_EP_PDMA_XY &&
+ if ((uc->config.ep_type == PSIL_EP_PDMA_XY ||
+ uc->config.ep_type == PSIL_EP_PDMA_XYMF) &&
uc->ud->match_data->type == DMA_TYPE_BCDMA) {
period_csf = CPPI5_TR_CSF_EOP;
}
@@ -2052,6 +2069,8 @@ int udma_get_tchan(struct udma_chan *uc)
uc->tchan = NULL;
return ret;
}
+ if (ud->match_data->version == K3_UDMA_V2)
+ uc->chan = uc->tchan;
if (ud->tflow_cnt) {
int tflow_id;
@@ -2102,6 +2121,8 @@ int udma_get_rchan(struct udma_chan *uc)
uc->rchan = NULL;
return ret;
}
+ if (ud->match_data->version == K3_UDMA_V2)
+ uc->chan = uc->rchan;
return 0;
}
@@ -2383,9 +2404,16 @@ static int bcdma_setup_resources(struct udma_dev *ud)
ud->tchan_map = devm_bitmap_zalloc(dev, ud->tchan_cnt, GFP_KERNEL);
ud->tchans = devm_kcalloc(dev, ud->tchan_cnt, sizeof(*ud->tchans),
GFP_KERNEL);
- ud->rchan_map = devm_bitmap_zalloc(dev, ud->rchan_cnt, GFP_KERNEL);
- ud->rchans = devm_kcalloc(dev, ud->rchan_cnt, sizeof(*ud->rchans),
- GFP_KERNEL);
+ if (ud->match_data->version == K3_UDMA_V1) {
+ ud->rchan_map = devm_bitmap_zalloc(dev, ud->rchan_cnt, GFP_KERNEL);
+ ud->rchans = devm_kcalloc(dev, ud->rchan_cnt, sizeof(*ud->rchans),
+ GFP_KERNEL);
+ } else {
+ ud->rchan_map = ud->tchan_map;
+ ud->rchans = ud->tchans;
+ ud->chan_map = ud->tchan_map;
+ ud->chans = ud->tchans;
+ }
/* BCDMA do not really have flows, but the driver expect it */
ud->rflow_in_use = devm_kcalloc(dev, BITS_TO_LONGS(ud->rchan_cnt),
sizeof(unsigned long),
@@ -2480,11 +2508,18 @@ int k3_udma_setup_resources(struct udma_dev *ud)
if (ret)
return ret;
- ch_count = ud->bchan_cnt + ud->tchan_cnt + ud->rchan_cnt;
- if (ud->bchan_cnt)
- ch_count -= bitmap_weight(ud->bchan_map, ud->bchan_cnt);
- ch_count -= bitmap_weight(ud->tchan_map, ud->tchan_cnt);
- ch_count -= bitmap_weight(ud->rchan_map, ud->rchan_cnt);
+ if (ud->match_data->version == K3_UDMA_V1) {
+ ch_count = ud->bchan_cnt + ud->tchan_cnt + ud->rchan_cnt;
+ if (ud->bchan_cnt)
+ ch_count -= bitmap_weight(ud->bchan_map, ud->bchan_cnt);
+ ch_count -= bitmap_weight(ud->tchan_map, ud->tchan_cnt);
+ ch_count -= bitmap_weight(ud->rchan_map, ud->rchan_cnt);
+ } else {
+ ch_count = ud->bchan_cnt + ud->tchan_cnt;
+ if (ud->bchan_cnt)
+ ch_count -= bitmap_weight(ud->bchan_map, ud->bchan_cnt);
+ ch_count -= bitmap_weight(ud->tchan_map, ud->tchan_cnt);
+ }
if (!ch_count)
return -ENODEV;
@@ -2506,15 +2541,25 @@ int k3_udma_setup_resources(struct udma_dev *ud)
ud->rflow_cnt));
break;
case DMA_TYPE_BCDMA:
- dev_info(dev,
- "Channels: %d (bchan: %u, tchan: %u, rchan: %u)\n",
- ch_count,
- ud->bchan_cnt - bitmap_weight(ud->bchan_map,
- ud->bchan_cnt),
- ud->tchan_cnt - bitmap_weight(ud->tchan_map,
- ud->tchan_cnt),
- ud->rchan_cnt - bitmap_weight(ud->rchan_map,
- ud->rchan_cnt));
+ if (ud->match_data->version == K3_UDMA_V1) {
+ dev_info(dev,
+ "Channels: %d (bchan: %u, tchan: %u, rchan: %u)\n",
+ ch_count,
+ ud->bchan_cnt - bitmap_weight(ud->bchan_map,
+ ud->bchan_cnt),
+ ud->tchan_cnt - bitmap_weight(ud->tchan_map,
+ ud->tchan_cnt),
+ ud->rchan_cnt - bitmap_weight(ud->rchan_map,
+ ud->rchan_cnt));
+ } else {
+ dev_info(dev,
+ "Channels: %d (bchan: %u, chan: %u)\n",
+ ch_count,
+ ud->bchan_cnt - bitmap_weight(ud->bchan_map,
+ ud->bchan_cnt),
+ ud->chan_cnt - bitmap_weight(ud->chan_map,
+ ud->chan_cnt));
+ }
break;
case DMA_TYPE_PKTDMA:
dev_info(dev,
diff --git a/drivers/dma/ti/k3-udma-v2.c b/drivers/dma/ti/k3-udma-v2.c
new file mode 100644
index 0000000000000..b9ce58d1934a9
--- /dev/null
+++ b/drivers/dma/ti/k3-udma-v2.c
@@ -0,0 +1,1319 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Derived from K3 UDMA driver (k3-udma.c)
+ * Copyright (C) 2024-2025 Texas Instruments Incorporated - http://www.ti.com
+ * Author: Peter Ujfalusi <peter.ujfalusi@ti.com>
+ * Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/dmaengine.h>
+#include <linux/dma-mapping.h>
+#include <linux/dmapool.h>
+#include <linux/err.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/list.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/sys_soc.h>
+#include <linux/of.h>
+#include <linux/of_dma.h>
+#include <linux/of_irq.h>
+#include <linux/workqueue.h>
+#include <linux/completion.h>
+#include <linux/iopoll.h>
+#include <linux/soc/ti/k3-ringacc.h>
+
+#include "../virt-dma.h"
+#include "k3-udma.h"
+#include "k3-psil-priv.h"
+
+static const char * const v2_mmr_names[] = {
+ [V2_MMR_GCFG] = "gcfg",
+ [V2_MMR_BCHANRT] = "bchanrt",
+ [V2_MMR_CHANRT] = "chanrt",
+};
+
+static int udma_v2_check_chan_autopair_completion(struct udma_chan *uc)
+{
+ u32 val;
+
+ val = udma_chanrt_read(uc, UDMA_CHAN_RT_CTL_REG);
+ if (val & UDMA_CHAN_RT_CTL_PAIR_TIMEOUT)
+ return -ETIMEDOUT;
+ else if (val & UDMA_CHAN_RT_CTL_PAIR_COMPLETE)
+ return 1;
+
+ /* timeout didn't occur and also pairing didn't happen yet. */
+ return 0;
+}
+
+static bool udma_v2_is_chan_paused(struct udma_chan *uc)
+{
+ u32 val, pause_mask;
+
+ if (uc->config.dir == DMA_MEM_TO_MEM) {
+ val = udma_chanrt_read(uc, UDMA_CHAN_RT_CTL_REG);
+ pause_mask = UDMA_CHAN_RT_CTL_PAUSE;
+ } else {
+ val = udma_chanrt_read(uc, UDMA_CHAN_RT_PDMA_STATE_REG);
+ pause_mask = UDMA_CHAN_RT_PDMA_STATE_PAUSE;
+ }
+
+ if (val & pause_mask)
+ return true;
+
+ return false;
+}
+
+static void udma_v2_decrement_byte_counters(struct udma_chan *uc, u32 val)
+{
+ udma_chanrt_write(uc, UDMA_CHAN_RT_BCNT_REG, val);
+ udma_chanrt_write(uc, UDMA_CHAN_RT_SBCNT_REG, val);
+ if (uc->config.ep_type != PSIL_EP_NATIVE)
+ udma_chanrt_write(uc, UDMA_CHAN_RT_PERIPH_BCNT_REG, val);
+}
+
+static void udma_v2_reset_counters(struct udma_chan *uc)
+{
+ u32 val;
+
+ val = udma_chanrt_read(uc, UDMA_CHAN_RT_BCNT_REG);
+ udma_chanrt_write(uc, UDMA_CHAN_RT_BCNT_REG, val);
+
+ val = udma_chanrt_read(uc, UDMA_CHAN_RT_SBCNT_REG);
+ udma_chanrt_write(uc, UDMA_CHAN_RT_SBCNT_REG, val);
+
+ val = udma_chanrt_read(uc, UDMA_CHAN_RT_PCNT_REG);
+ udma_chanrt_write(uc, UDMA_CHAN_RT_PCNT_REG, val);
+
+ if (!uc->bchan) {
+ val = udma_chanrt_read(uc, UDMA_CHAN_RT_PERIPH_BCNT_REG);
+ udma_chanrt_write(uc, UDMA_CHAN_RT_PERIPH_BCNT_REG, val);
+ }
+}
+
+static int udma_v2_reset_chan(struct udma_chan *uc, bool hard)
+{
+ udma_chanrt_write(uc, UDMA_CHAN_RT_CTL_REG, 0);
+
+ /* Reset all counters */
+ udma_v2_reset_counters(uc);
+
+ /* Hard reset: re-initialize the channel to reset */
+ if (hard) {
+ struct udma_chan_config ucc_backup;
+ int ret;
+
+ memcpy(&ucc_backup, &uc->config, sizeof(uc->config));
+ uc->ud->ddev.device_free_chan_resources(&uc->vc.chan);
+
+ /* restore the channel configuration */
+ memcpy(&uc->config, &ucc_backup, sizeof(uc->config));
+ ret = uc->ud->ddev.device_alloc_chan_resources(&uc->vc.chan);
+ if (ret)
+ return ret;
+
+ /*
+ * Setting forced teardown after forced reset helps recovering
+ * the rchan.
+ */
+ if (uc->config.dir == DMA_DEV_TO_MEM)
+ udma_chanrt_update_bits(uc, UDMA_CHAN_RT_CTL_REG,
+ UDMA_CHAN_RT_CTL_EN | UDMA_CHAN_RT_CTL_TDOWN |
+ UDMA_CHAN_RT_CTL_FTDOWN,
+ UDMA_CHAN_RT_CTL_EN | UDMA_CHAN_RT_CTL_TDOWN |
+ UDMA_CHAN_RT_CTL_FTDOWN);
+ }
+ uc->state = UDMA_CHAN_IS_IDLE;
+
+ return 0;
+}
+
+static int udma_v2_start(struct udma_chan *uc)
+{
+ struct virt_dma_desc *vd = vchan_next_desc(&uc->vc);
+ struct udma_dev *ud = uc->ud;
+ int status;
+
+ if (!vd) {
+ uc->desc = NULL;
+ return -ENOENT;
+ }
+
+ list_del(&vd->node);
+
+ uc->desc = to_udma_desc(&vd->tx);
+
+ /* Channel is already running and does not need reconfiguration */
+ if (udma_is_chan_running(uc) && !udma_chan_needs_reconfiguration(uc)) {
+ udma_start_desc(uc);
+ goto out;
+ }
+
+ /* Make sure that we clear the teardown bit, if it is set */
+ ud->reset_chan(uc, false);
+
+ /* Push descriptors before we start the channel */
+ udma_start_desc(uc);
+
+ switch (uc->config.dir) {
+ case DMA_DEV_TO_MEM:
+ /* Config remote TR */
+ if (uc->config.ep_type == PSIL_EP_PDMA_XY ||
+ uc->config.ep_type == PSIL_EP_PDMA_XYMF) {
+ u32 val = PDMA_STATIC_TR_Y(uc->desc->static_tr.elcnt) |
+ PDMA_STATIC_TR_X(uc->desc->static_tr.elsize);
+ const struct udma_match_data *match_data =
+ uc->ud->match_data;
+
+ if (uc->config.enable_acc32)
+ val |= PDMA_STATIC_TR_XY_ACC32;
+ if (uc->config.enable_burst)
+ val |= PDMA_STATIC_TR_XY_BURST;
+
+ udma_chanrt_write(uc,
+ UDMA_CHAN_RT_STATIC_TR_XY_REG,
+ val);
+
+ udma_chanrt_write(uc,
+ UDMA_CHAN_RT_STATIC_TR_Z_REG,
+ PDMA_STATIC_TR_Z(uc->desc->static_tr.bstcnt,
+ match_data->statictr_z_mask));
+
+ /* save the current staticTR configuration */
+ memcpy(&uc->static_tr, &uc->desc->static_tr,
+ sizeof(uc->static_tr));
+ }
+
+ if (uc->config.ep_type == PSIL_EP_PDMA_XYMF)
+ udma_chanrt_write(uc, UDMA_CHAN_RT_FIFO_SEL_REG, uc->config.fifo_id);
+
+ udma_chanrt_write(uc, UDMA_CHAN_RT_CTL_REG,
+ UDMA_CHAN_RT_CTL_EN | UDMA_CHAN_RT_CTL_AUTOPAIR);
+
+ /* Poll for autopair completion */
+ read_poll_timeout_atomic(udma_v2_check_chan_autopair_completion,
+ status, status != 0, 100, 500, false, uc);
+
+ if (status <= 0)
+ return -ETIMEDOUT;
+
+ break;
+ case DMA_MEM_TO_DEV:
+ /* Config remote TR */
+ if (uc->config.ep_type == PSIL_EP_PDMA_XY ||
+ uc->config.ep_type == PSIL_EP_PDMA_XYMF) {
+ u32 val = PDMA_STATIC_TR_Y(uc->desc->static_tr.elcnt) |
+ PDMA_STATIC_TR_X(uc->desc->static_tr.elsize);
+
+ if (uc->config.enable_acc32)
+ val |= PDMA_STATIC_TR_XY_ACC32;
+ if (uc->config.enable_burst)
+ val |= PDMA_STATIC_TR_XY_BURST;
+
+ udma_chanrt_write(uc,
+ UDMA_CHAN_RT_STATIC_TR_XY_REG,
+ val);
+
+ /* save the current staticTR configuration */
+ memcpy(&uc->static_tr, &uc->desc->static_tr,
+ sizeof(uc->static_tr));
+ }
+
+ if (uc->config.ep_type == PSIL_EP_PDMA_XYMF)
+ udma_chanrt_write(uc, UDMA_CHAN_RT_FIFO_SEL_REG, uc->config.fifo_id);
+
+ udma_chanrt_write(uc, UDMA_CHAN_RT_CTL_REG,
+ UDMA_CHAN_RT_CTL_EN | UDMA_CHAN_RT_CTL_AUTOPAIR);
+
+ /* Poll for autopair completion */
+ read_poll_timeout_atomic(udma_v2_check_chan_autopair_completion,
+ status, status != 0, 100, 500, false, uc);
+
+ if (status <= 0)
+ return -ETIMEDOUT;
+
+ break;
+ case DMA_MEM_TO_MEM:
+ udma_bchanrt_write(uc, UDMA_CHAN_RT_CTL_REG,
+ UDMA_CHAN_RT_CTL_EN);
+ udma_bchanrt_write(uc, UDMA_CHAN_RT_CTL_REG,
+ UDMA_CHAN_RT_CTL_EN);
+
+ break;
+ default:
+ return -EINVAL;
+ }
+
+ uc->state = UDMA_CHAN_IS_ACTIVE;
+out:
+
+ return 0;
+}
+
+static int udma_v2_stop(struct udma_chan *uc)
+{
+ uc->state = UDMA_CHAN_IS_TERMINATING;
+ reinit_completion(&uc->teardown_completed);
+
+ if (uc->config.dir == DMA_DEV_TO_MEM) {
+ if (!uc->cyclic && !uc->desc)
+ udma_push_to_ring(uc, -1);
+ }
+
+ if (uc->config.dir != DMA_MEM_TO_MEM)
+ udma_chanrt_write(uc, UDMA_CHAN_RT_PEER_REG(8), UDMA_CHAN_RT_PEER_REG8_FLUSH);
+
+ udma_chanrt_update_bits(uc, UDMA_CHAN_RT_CTL_REG,
+ UDMA_CHAN_RT_CTL_EN | UDMA_CHAN_RT_CTL_TDOWN,
+ UDMA_CHAN_RT_CTL_EN | UDMA_CHAN_RT_CTL_TDOWN);
+
+ return 0;
+}
+
+static irqreturn_t udma_v2_udma_irq_handler(int irq, void *data)
+{
+ struct udma_chan *uc = data;
+ struct udma_dev *ud = uc->ud;
+ struct udma_desc *d;
+
+ switch (uc->config.dir) {
+ case DMA_DEV_TO_MEM:
+ k3_ringacc_ring_clear_irq(uc->rflow->r_ring);
+ break;
+ case DMA_MEM_TO_DEV:
+ case DMA_MEM_TO_MEM:
+ k3_ringacc_ring_clear_irq(uc->tchan->tc_ring);
+ break;
+ default:
+ return -ENOENT;
+ }
+
+ spin_lock(&uc->vc.lock);
+ d = uc->desc;
+ if (d) {
+ d->tr_idx = (d->tr_idx + 1) % d->sglen;
+
+ if (uc->cyclic) {
+ vchan_cyclic_callback(&d->vd);
+ } else {
+ /* TODO: figure out the real amount of data */
+ ud->decrement_byte_counters(uc, d->residue);
+ ud->start(uc);
+ vchan_cookie_complete(&d->vd);
+ }
+ }
+
+ spin_unlock(&uc->vc.lock);
+
+ return IRQ_HANDLED;
+}
+
+static irqreturn_t udma_v2_ring_irq_handler(int irq, void *data)
+{
+ struct udma_chan *uc = data;
+ struct udma_dev *ud = uc->ud;
+ struct udma_desc *d;
+ dma_addr_t paddr = 0;
+ u32 intr_status, reg;
+
+ switch (uc->config.dir) {
+ case DMA_DEV_TO_MEM:
+ intr_status = k3_ringacc_ring_get_irq_status(uc->rflow->r_ring);
+ break;
+ case DMA_MEM_TO_DEV:
+ case DMA_MEM_TO_MEM:
+ intr_status = k3_ringacc_ring_get_irq_status(uc->tchan->tc_ring);
+ break;
+ default:
+ return IRQ_NONE;
+ }
+
+ if (!intr_status)
+ return IRQ_NONE; /* Not this channel's interrupt */
+
+ reg = udma_chanrt_read(uc, UDMA_CHAN_RT_CTL_REG);
+
+ if (intr_status & K3_RINGACC_RT_INT_STATUS_TR) {
+ /* check teardown status */
+ if ((reg & UDMA_CHAN_RT_CTL_TDOWN) && !(reg & UDMA_CHAN_RT_CTL_EN))
+ complete_all(&uc->teardown_completed);
+ udma_v2_udma_irq_handler(irq, data);
+
+ if (!(intr_status & K3_RINGACC_RT_INT_STATUS_COMPLETE))
+ return IRQ_HANDLED;
+ }
+
+ if (udma_pop_from_ring(uc, &paddr) || !paddr)
+ return IRQ_NONE;
+
+ spin_lock(&uc->vc.lock);
+
+ /* Teardown completion message */
+ if (cppi5_desc_is_tdcm(paddr)) {
+ complete_all(&uc->teardown_completed);
+
+ if (uc->terminated_desc) {
+ udma_desc_free(&uc->terminated_desc->vd);
+ uc->terminated_desc = NULL;
+ }
+
+ if (!uc->desc)
+ ud->start(uc);
+
+ goto out;
+ }
+
+ d = udma_udma_desc_from_paddr(uc, paddr);
+
+ if (d) {
+ dma_addr_t desc_paddr = udma_curr_cppi5_desc_paddr(d,
+ d->desc_idx);
+ if (desc_paddr != paddr) {
+ dev_err(uc->ud->dev, "not matching descriptors!\n");
+ goto out;
+ }
+
+ if (d == uc->desc) {
+ /* active descriptor */
+ if (uc->cyclic) {
+ udma_cyclic_packet_elapsed(uc);
+ vchan_cyclic_callback(&d->vd);
+ } else {
+ if (udma_is_desc_really_done(uc, d)) {
+ ud->decrement_byte_counters(uc, d->residue);
+ ud->start(uc);
+ vchan_cookie_complete(&d->vd);
+ } else {
+ schedule_delayed_work(&uc->tx_drain.work,
+ 0);
+ }
+ }
+ } else {
+ /*
+ * terminated descriptor, mark the descriptor as
+ * completed to update the channel's cookie marker
+ */
+ dma_cookie_complete(&d->vd.tx);
+ }
+ }
+out:
+ spin_unlock(&uc->vc.lock);
+
+ return IRQ_HANDLED;
+}
+
+static int bcdma_v2_get_bchan(struct udma_chan *uc)
+{
+ struct udma_dev *ud = uc->ud;
+ enum udma_tp_level tpl;
+ int ret;
+
+ if (uc->bchan) {
+ dev_dbg(ud->dev, "chan%d: already have bchan%d allocated\n",
+ uc->id, uc->bchan->id);
+ return 0;
+ }
+
+ /*
+ * Use normal channels for peripherals, and highest TPL channel for
+ * mem2mem
+ */
+ if (uc->config.tr_trigger_type)
+ tpl = 0;
+ else
+ tpl = ud->bchan_tpl.levels - 1;
+
+ /*
+ * UDMA V2 uses a static 1:1 mapping between the virtual channel index
+ * (uc->id) and the hardware bchan/tchan/rchan index -- unlike V1, which
+ * dynamically allocates from a shared pool. Passing uc->id directly to
+ * __udma_reserve_*() is intentional, not a bug.
+ */
+ uc->bchan = __udma_reserve_bchan(ud, tpl, uc->id);
+ if (IS_ERR(uc->bchan)) {
+ ret = PTR_ERR(uc->bchan);
+ uc->bchan = NULL;
+ return ret;
+ }
+ uc->chan = uc->bchan;
+ uc->tchan = uc->bchan;
+
+ return 0;
+}
+
+static int bcdma_v2_alloc_bchan_resources(struct udma_chan *uc)
+{
+ struct k3_ring_cfg ring_cfg;
+ struct udma_dev *ud = uc->ud;
+ int ret;
+
+ ret = bcdma_v2_get_bchan(uc);
+ if (ret)
+ return ret;
+
+ ret = k3_ringacc_request_rings_pair(ud->ringacc, ud->match_data->chan_cnt + uc->id, -1,
+ &uc->bchan->t_ring,
+ &uc->bchan->tc_ring);
+ if (ret) {
+ ret = -EBUSY;
+ goto err_ring;
+ }
+
+ memset(&ring_cfg, 0, sizeof(ring_cfg));
+ ring_cfg.size = K3_UDMA_DEFAULT_RING_SIZE;
+ ring_cfg.elm_size = K3_RINGACC_RING_ELSIZE_8;
+ ring_cfg.mode = K3_RINGACC_RING_MODE_RING;
+
+ k3_configure_chan_coherency(&uc->vc.chan, ud->asel);
+ ring_cfg.asel = ud->asel;
+ ring_cfg.dma_dev = dmaengine_get_dma_device(&uc->vc.chan);
+
+ ret = k3_ringacc_ring_cfg(uc->bchan->t_ring, &ring_cfg);
+ if (ret)
+ goto err_ringcfg;
+
+ return 0;
+
+err_ringcfg:
+ k3_ringacc_ring_free(uc->bchan->tc_ring);
+ uc->bchan->tc_ring = NULL;
+ k3_ringacc_ring_free(uc->bchan->t_ring);
+ uc->bchan->t_ring = NULL;
+ k3_configure_chan_coherency(&uc->vc.chan, 0);
+err_ring:
+ bcdma_put_bchan(uc);
+
+ return ret;
+}
+
+static int udma_v2_alloc_tx_resources(struct udma_chan *uc)
+{
+ struct k3_ring_cfg ring_cfg;
+ struct udma_dev *ud = uc->ud;
+ struct udma_tchan *tchan;
+ int ring_idx, ret;
+
+ ret = udma_get_tchan(uc);
+ if (ret)
+ return ret;
+
+ tchan = uc->tchan;
+ if (tchan->tflow_id >= 0)
+ ring_idx = tchan->tflow_id;
+ else
+ ring_idx = tchan->id;
+
+ ret = k3_ringacc_request_rings_pair(ud->ringacc, ring_idx, -1,
+ &tchan->t_ring,
+ &tchan->tc_ring);
+ if (ret) {
+ ret = -EBUSY;
+ goto err_ring;
+ }
+
+ memset(&ring_cfg, 0, sizeof(ring_cfg));
+ ring_cfg.size = K3_UDMA_DEFAULT_RING_SIZE;
+ ring_cfg.elm_size = K3_RINGACC_RING_ELSIZE_8;
+ ring_cfg.mode = K3_RINGACC_RING_MODE_RING;
+
+ k3_configure_chan_coherency(&uc->vc.chan, uc->config.asel);
+ ring_cfg.asel = uc->config.asel;
+ ring_cfg.dma_dev = dmaengine_get_dma_device(&uc->vc.chan);
+
+ ret = k3_ringacc_ring_cfg(tchan->t_ring, &ring_cfg);
+ ret |= k3_ringacc_ring_cfg(tchan->tc_ring, &ring_cfg);
+
+ if (ret)
+ goto err_ringcfg;
+
+ return 0;
+
+err_ringcfg:
+ k3_ringacc_ring_free(uc->tchan->tc_ring);
+ uc->tchan->tc_ring = NULL;
+ k3_ringacc_ring_free(uc->tchan->t_ring);
+ uc->tchan->t_ring = NULL;
+err_ring:
+ udma_put_tchan(uc);
+
+ return ret;
+}
+
+static int udma_v2_alloc_rx_resources(struct udma_chan *uc)
+{
+ struct udma_dev *ud = uc->ud;
+ struct k3_ring_cfg ring_cfg;
+ struct udma_rflow *rflow;
+ int fd_ring_id;
+ int ret;
+
+ ret = udma_get_rchan(uc);
+ if (ret)
+ return ret;
+
+ /* For MEM_TO_MEM we don't need rflow or rings */
+ if (uc->config.dir == DMA_MEM_TO_MEM)
+ return 0;
+
+ if (uc->config.default_flow_id >= 0)
+ ret = udma_get_rflow(uc, uc->config.default_flow_id);
+ else
+ ret = udma_get_rflow(uc, uc->rchan->id);
+
+ if (ret) {
+ ret = -EBUSY;
+ goto err_rflow;
+ }
+
+ rflow = uc->rflow;
+ if (ud->tflow_cnt)
+ fd_ring_id = ud->tflow_cnt + rflow->id;
+ else
+ fd_ring_id = uc->rchan->id;
+ ret = k3_ringacc_request_rings_pair(ud->ringacc, fd_ring_id, -1,
+ &rflow->fd_ring, &rflow->r_ring);
+ if (ret) {
+ ret = -EBUSY;
+ goto err_ring;
+ }
+
+ memset(&ring_cfg, 0, sizeof(ring_cfg));
+
+ ring_cfg.elm_size = K3_RINGACC_RING_ELSIZE_8;
+ ring_cfg.size = K3_UDMA_DEFAULT_RING_SIZE;
+ ring_cfg.mode = K3_RINGACC_RING_MODE_RING;
+
+ k3_configure_chan_coherency(&uc->vc.chan, uc->config.asel);
+ ring_cfg.asel = uc->config.asel;
+ ring_cfg.dma_dev = dmaengine_get_dma_device(&uc->vc.chan);
+
+ ret = k3_ringacc_ring_cfg(rflow->fd_ring, &ring_cfg);
+
+ ring_cfg.size = K3_UDMA_DEFAULT_RING_SIZE;
+ ret |= k3_ringacc_ring_cfg(rflow->r_ring, &ring_cfg);
+
+ if (ret)
+ goto err_ringcfg;
+
+ return 0;
+
+err_ringcfg:
+ k3_ringacc_ring_free(rflow->r_ring);
+ rflow->r_ring = NULL;
+ k3_ringacc_ring_free(rflow->fd_ring);
+ rflow->fd_ring = NULL;
+err_ring:
+ udma_put_rflow(uc);
+err_rflow:
+ udma_put_rchan(uc);
+
+ return ret;
+}
+
+static int bcdma_v2_alloc_chan_resources(struct dma_chan *chan)
+{
+ struct udma_chan *uc = to_udma_chan(chan);
+ struct udma_dev *ud = to_udma_dev(chan->device);
+ struct platform_device *pdev = to_platform_device(ud->dev);
+ char irq_name[10];
+ u32 irq_ring_idx;
+ int ret;
+
+ /* Only TR mode is supported */
+ uc->config.pkt_mode = false;
+
+ /*
+ * Make sure that the completion is in a known state:
+ * No teardown, the channel is idle
+ */
+ reinit_completion(&uc->teardown_completed);
+ complete_all(&uc->teardown_completed);
+ uc->state = UDMA_CHAN_IS_IDLE;
+
+ switch (uc->config.dir) {
+ case DMA_MEM_TO_MEM:
+ /* Non synchronized - mem to mem type of transfer */
+ dev_dbg(uc->ud->dev, "%s: chan%d as MEM-to-MEM\n", __func__,
+ uc->id);
+
+ ret = bcdma_v2_alloc_bchan_resources(uc);
+ if (ret)
+ return ret;
+
+ irq_ring_idx = ud->match_data->chan_cnt + uc->id;
+ break;
+ case DMA_MEM_TO_DEV:
+ /* Slave transfer synchronized - mem to dev (TX) transfer */
+ dev_dbg(uc->ud->dev, "%s: chan%d as MEM-to-DEV\n", __func__,
+ uc->id);
+
+ ret = udma_v2_alloc_tx_resources(uc);
+ if (ret) {
+ uc->config.remote_thread_id = -1;
+ return ret;
+ }
+
+ uc->config.src_thread = ud->psil_base + uc->tchan->id;
+ uc->config.dst_thread = uc->config.remote_thread_id;
+ uc->config.dst_thread |= K3_PSIL_DST_THREAD_ID_OFFSET;
+
+ irq_ring_idx = uc->tchan->id;
+
+ break;
+ case DMA_DEV_TO_MEM:
+ /* Slave transfer synchronized - dev to mem (RX) transfer */
+ dev_dbg(uc->ud->dev, "%s: chan%d as DEV-to-MEM\n", __func__,
+ uc->id);
+
+ ret = udma_v2_alloc_rx_resources(uc);
+ if (ret) {
+ uc->config.remote_thread_id = -1;
+ return ret;
+ }
+
+ uc->config.src_thread = uc->config.remote_thread_id;
+ uc->config.dst_thread = (ud->psil_base + uc->rchan->id) |
+ K3_PSIL_DST_THREAD_ID_OFFSET;
+
+ irq_ring_idx = uc->rchan->id;
+
+ break;
+ default:
+ /* Can not happen */
+ dev_err(uc->ud->dev, "%s: chan%d invalid direction (%u)\n",
+ __func__, uc->id, uc->config.dir);
+ return -EINVAL;
+ }
+
+ /* check if the channel configuration was successful */
+ if (ret)
+ goto err_res_free;
+
+ if (udma_is_chan_running(uc)) {
+ dev_warn(ud->dev, "chan%d: is running!\n", uc->id);
+ ud->reset_chan(uc, false);
+ if (udma_is_chan_running(uc)) {
+ dev_err(ud->dev, "chan%d: won't stop!\n", uc->id);
+ ret = -EBUSY;
+ goto err_res_free;
+ }
+ }
+
+ uc->dma_dev = dmaengine_get_dma_device(chan);
+ if (uc->config.dir == DMA_MEM_TO_MEM && !uc->config.tr_trigger_type) {
+ uc->config.hdesc_size =
+ cppi5_trdesc_calc_size(sizeof(struct cppi5_tr_type15_t), 2);
+
+ uc->hdesc_pool = dma_pool_create(uc->name, ud->ddev.dev,
+ uc->config.hdesc_size,
+ ud->desc_align,
+ 0);
+ if (!uc->hdesc_pool) {
+ dev_err(ud->ddev.dev,
+ "Descriptor pool allocation failed\n");
+ uc->use_dma_pool = false;
+ ret = -ENOMEM;
+ goto err_res_free;
+ }
+
+ uc->use_dma_pool = true;
+ } else if (uc->config.dir != DMA_MEM_TO_MEM) {
+ uc->psil_paired = true;
+ }
+
+ INIT_DELAYED_WORK(&uc->tx_drain.work, udma_check_tx_completion);
+
+ snprintf(irq_name, sizeof(irq_name), "chan%u", irq_ring_idx);
+ uc->irq_num_ring = platform_get_irq_byname(pdev, irq_name);
+ if (uc->irq_num_ring < 0) {
+ ret = uc->irq_num_ring;
+ goto err_res_free;
+ }
+
+ ret = request_irq(uc->irq_num_ring, udma_v2_ring_irq_handler,
+ IRQF_SHARED | IRQF_TRIGGER_HIGH, uc->name, uc);
+ if (ret) {
+ dev_err(ud->dev, "chan%d: ring irq request failed\n", uc->id);
+ goto err_irq_free;
+ }
+
+ udma_reset_rings(uc);
+
+ return 0;
+
+err_irq_free:
+ uc->irq_num_ring = 0;
+ uc->irq_num_udma = 0;
+err_res_free:
+ bcdma_free_bchan_resources(uc);
+ udma_free_tx_resources(uc);
+ udma_free_rx_resources(uc);
+
+ udma_reset_uchan(uc);
+
+ if (uc->use_dma_pool) {
+ dma_pool_destroy(uc->hdesc_pool);
+ uc->use_dma_pool = false;
+ }
+
+ return ret;
+}
+
+static enum dma_status udma_v2_tx_status(struct dma_chan *chan,
+ dma_cookie_t cookie,
+ struct dma_tx_state *txstate)
+{
+ struct udma_chan *uc = to_udma_chan(chan);
+ enum dma_status ret;
+ unsigned long flags;
+
+ spin_lock_irqsave(&uc->vc.lock, flags);
+
+ ret = dma_cookie_status(chan, cookie, txstate);
+
+ if (!udma_is_chan_running(uc))
+ ret = DMA_COMPLETE;
+
+ if (ret == DMA_IN_PROGRESS && udma_v2_is_chan_paused(uc))
+ ret = DMA_PAUSED;
+
+ if (ret == DMA_COMPLETE || !txstate)
+ goto out;
+
+ if (uc->desc && uc->desc->vd.tx.cookie == cookie) {
+ u32 peer_bcnt = 0;
+ u32 bcnt = 0;
+ u32 residue = uc->desc->residue;
+ u32 delay = 0;
+
+ if (uc->desc->dir == DMA_MEM_TO_DEV) {
+ bcnt = udma_chanrt_read(uc, UDMA_CHAN_RT_SBCNT_REG);
+
+ if (uc->config.ep_type != PSIL_EP_NATIVE) {
+ peer_bcnt = udma_chanrt_read(uc, UDMA_CHAN_RT_PERIPH_BCNT_REG);
+
+ if (bcnt > peer_bcnt)
+ delay = bcnt - peer_bcnt;
+ }
+ } else if (uc->desc->dir == DMA_DEV_TO_MEM) {
+ bcnt = udma_chanrt_read(uc, UDMA_CHAN_RT_BCNT_REG);
+
+ if (uc->config.ep_type != PSIL_EP_NATIVE) {
+ peer_bcnt = udma_chanrt_read(uc, UDMA_CHAN_RT_PERIPH_BCNT_REG);
+
+ if (peer_bcnt > bcnt)
+ delay = peer_bcnt - bcnt;
+ }
+ } else {
+ bcnt = udma_chanrt_read(uc, UDMA_CHAN_RT_BCNT_REG);
+ }
+
+ if (bcnt && !(bcnt % uc->desc->residue))
+ residue = 0;
+ else
+ residue -= bcnt % uc->desc->residue;
+
+ if (!residue && (uc->config.dir == DMA_DEV_TO_MEM || !delay)) {
+ ret = DMA_COMPLETE;
+ delay = 0;
+ }
+
+ dma_set_residue(txstate, residue);
+ dma_set_in_flight_bytes(txstate, delay);
+
+ } else {
+ ret = DMA_COMPLETE;
+ }
+
+out:
+ spin_unlock_irqrestore(&uc->vc.lock, flags);
+ return ret;
+}
+
+static int udma_v2_pause(struct dma_chan *chan)
+{
+ struct udma_chan *uc = to_udma_chan(chan);
+ unsigned long flags;
+
+ /* pause the channel */
+ spin_lock_irqsave(&uc->vc.lock, flags);
+ udma_chanrt_update_bits(uc, UDMA_CHAN_RT_CTL_REG,
+ UDMA_CHAN_RT_CTL_PAUSE, UDMA_CHAN_RT_CTL_PAUSE);
+ spin_unlock_irqrestore(&uc->vc.lock, flags);
+
+ return 0;
+}
+
+static int udma_v2_resume(struct dma_chan *chan)
+{
+ struct udma_chan *uc = to_udma_chan(chan);
+ unsigned long flags;
+
+ /* resume the channel */
+ spin_lock_irqsave(&uc->vc.lock, flags);
+ udma_chanrt_update_bits(uc, UDMA_CHAN_RT_CTL_REG,
+ UDMA_CHAN_RT_CTL_PAUSE, 0);
+ spin_unlock_irqrestore(&uc->vc.lock, flags);
+
+ return 0;
+}
+
+static struct platform_driver bcdma_v2_driver;
+
+static bool udma_v2_dma_filter_fn(struct dma_chan *chan, void *param)
+{
+ struct udma_v2_filter_param *filter_param;
+ struct psil_endpoint_config *ep_config;
+ struct udma_chan_config *ucc;
+ struct udma_chan *uc;
+ struct udma_dev *ud;
+
+ if (chan->device->dev->driver != &bcdma_v2_driver.driver)
+ return false;
+
+ uc = to_udma_chan(chan);
+ ucc = &uc->config;
+ ud = uc->ud;
+ filter_param = param;
+
+ if (filter_param->asel > 15) {
+ dev_err(ud->dev, "Invalid channel asel: %u\n",
+ filter_param->asel);
+ return false;
+ }
+
+ ucc->asel = filter_param->asel;
+ ucc->tr_trigger_type = filter_param->tr_trigger_type;
+
+ if (ucc->tr_trigger_type) {
+ ucc->dir = DMA_MEM_TO_MEM;
+ goto triggered_bchan;
+ } else {
+ u32 thread_id;
+ bool dev_to_mem;
+
+ ep_config = psil_get_ep_config_by_id(filter_param->channel_id,
+ (ud->match_data->type == DMA_TYPE_PKTDMA),
+ &thread_id, &dev_to_mem);
+ if (IS_ERR(ep_config)) {
+ dev_err(ud->dev, "No config for channel %u\n",
+ filter_param->channel_id);
+ ucc->atype = 0;
+ ucc->asel = 0;
+ return false;
+ }
+ ucc->remote_thread_id = thread_id;
+ ucc->dir = dev_to_mem ? DMA_DEV_TO_MEM : DMA_MEM_TO_DEV;
+ }
+ if (IS_ERR(ep_config)) {
+ dev_err(ud->dev, "No configuration for psi-l thread 0x%04x\n",
+ ucc->remote_thread_id);
+ ucc->dir = DMA_MEM_TO_MEM;
+ ucc->remote_thread_id = -1;
+ ucc->atype = 0;
+ ucc->asel = 0;
+ return false;
+ }
+
+ ucc->pkt_mode = ep_config->pkt_mode;
+ ucc->channel_tpl = ep_config->channel_tpl;
+ ucc->notdpkt = ep_config->notdpkt;
+ ucc->ep_type = ep_config->ep_type;
+ ucc->fifo_id = ep_config->fifo_id;
+
+ if (ud->match_data->version == K3_UDMA_V2 &&
+ ep_config->mapped_channel_id >= 0) {
+ ucc->mapped_channel_id = ep_config->mapped_channel_id;
+ ucc->default_flow_id = ep_config->default_flow_id;
+ } else {
+ ucc->mapped_channel_id = -1;
+ ucc->default_flow_id = -1;
+ }
+
+ ucc->needs_epib = ep_config->needs_epib;
+ ucc->psd_size = ep_config->psd_size;
+ ucc->metadata_size =
+ (ucc->needs_epib ? CPPI5_INFO0_HDESC_EPIB_SIZE : 0) +
+ ucc->psd_size;
+
+ if (ucc->ep_type != PSIL_EP_NATIVE) {
+ const struct udma_match_data *match_data = ud->match_data;
+
+ if ((match_data->flags & UDMA_FLAG_PDMA_ACC32) && ep_config->pdma_acc32)
+ ucc->enable_acc32 = true;
+ else
+ ucc->enable_acc32 = false;
+
+ if ((match_data->flags & UDMA_FLAG_PDMA_BURST) && ep_config->pdma_burst)
+ ucc->enable_burst = true;
+ else
+ ucc->enable_burst = false;
+ }
+ if (ucc->pkt_mode)
+ ucc->hdesc_size = ALIGN(sizeof(struct cppi5_host_desc_t) +
+ ucc->metadata_size, ud->desc_align);
+
+ dev_dbg(ud->dev, "chan%d: Remote thread: 0x%04x (%s)\n", uc->id,
+ ucc->remote_thread_id, dmaengine_get_direction_text(ucc->dir));
+
+ return true;
+
+triggered_bchan:
+ dev_dbg(ud->dev, "chan%d: triggered channel (type: %u)\n", uc->id,
+ ucc->tr_trigger_type);
+
+ return true;
+}
+
+static struct dma_chan *udma_v2_of_xlate(struct of_phandle_args *dma_spec,
+ struct of_dma *ofdma)
+{
+ struct udma_dev *ud = ofdma->of_dma_data;
+ dma_cap_mask_t mask = ud->ddev.cap_mask;
+ struct udma_v2_filter_param filter_param;
+ struct dma_chan *chan;
+
+ if (ud->match_data->type == DMA_TYPE_BCDMA) {
+ if (dma_spec->args_count != 4)
+ return NULL;
+
+ filter_param.tr_trigger_type = dma_spec->args[0];
+ filter_param.trigger_param = dma_spec->args[1];
+ filter_param.channel_id = dma_spec->args[2];
+ filter_param.asel = dma_spec->args[3];
+ } else {
+ if (dma_spec->args_count != 1 && dma_spec->args_count != 2)
+ return NULL;
+
+ filter_param.channel_id = dma_spec->args[0];
+ filter_param.tr_trigger_type = 0;
+ if (dma_spec->args_count == 2)
+ filter_param.asel = dma_spec->args[1];
+ else
+ filter_param.asel = 0;
+ }
+
+ chan = __dma_request_channel(&mask, udma_v2_dma_filter_fn, &filter_param,
+ ofdma->of_node);
+ if (!chan) {
+ dev_err(ud->dev, "get channel fail in %s.\n", __func__);
+ return ERR_PTR(-EINVAL);
+ }
+
+ return chan;
+}
+
+static struct udma_match_data bcdma_v2_am62l_data = {
+ .type = DMA_TYPE_BCDMA,
+ .version = K3_UDMA_V2,
+ .psil_base = 0x2000, /* for tchan and rchan, not applicable to bchan */
+ .enable_memcpy_support = true, /* Supported via bchan */
+ .flags = UDMA_FLAGS_J7_CLASS,
+ .statictr_z_mask = GENMASK(23, 0),
+ .burst_size = {
+ TI_SCI_RM_UDMAP_CHAN_BURST_SIZE_64_BYTES, /* Normal Channels */
+ 0, /* No H Channels */
+ 0, /* No UH Channels */
+ },
+ .bchan_cnt = 16,
+ .chan_cnt = 128,
+ .tchan_cnt = 128,
+ .rchan_cnt = 128,
+};
+
+static const struct of_device_id udma_of_match[] = {
+ {
+ .compatible = "ti,am62l-dmss-bcdma",
+ .data = &bcdma_v2_am62l_data,
+ },
+ { /* Sentinel */ },
+};
+
+static const struct soc_device_attribute k3_soc_devices[] = {
+ { .family = "AM62LX", },
+ { /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, udma_of_match);
+
+static int udma_v2_get_mmrs(struct platform_device *pdev, struct udma_dev *ud)
+{
+ int i;
+
+ ud->mmrs[V2_MMR_GCFG] = devm_platform_ioremap_resource_byname(pdev,
+ v2_mmr_names[V2_MMR_GCFG]);
+ if (IS_ERR(ud->mmrs[V2_MMR_GCFG]))
+ return PTR_ERR(ud->mmrs[V2_MMR_GCFG]);
+
+ ud->bchan_cnt = ud->match_data->bchan_cnt;
+ /* There are no tchan and rchan in BCDMA_V2.
+ * Duplicate chan as tchan and rchan to keep the common code
+ * in k3-udma-common.c functional for BCDMA_V2.
+ */
+ ud->chan_cnt = ud->match_data->chan_cnt;
+ ud->tchan_cnt = ud->match_data->chan_cnt;
+ ud->rchan_cnt = ud->match_data->chan_cnt;
+ ud->rflow_cnt = ud->chan_cnt;
+
+ for (i = 1; i < V2_MMR_LAST; i++) {
+ if (i == V2_MMR_BCHANRT && ud->bchan_cnt == 0)
+ continue;
+ if (i == V2_MMR_CHANRT && ud->chan_cnt == 0)
+ continue;
+
+ ud->mmrs[i] = devm_platform_ioremap_resource_byname(pdev, v2_mmr_names[i]);
+ if (IS_ERR(ud->mmrs[i]))
+ return PTR_ERR(ud->mmrs[i]);
+ }
+
+ return 0;
+}
+
+static int udma_v2_probe(struct platform_device *pdev)
+{
+ const struct soc_device_attribute *soc;
+ struct device *dev = &pdev->dev;
+ const struct of_device_id *match;
+ struct udma_dev *ud;
+ int ch_count, i, ret;
+
+ ret = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(48));
+ if (ret)
+ dev_err(dev, "failed to set dma mask stuff\n");
+
+ ud = devm_kzalloc(dev, sizeof(*ud), GFP_KERNEL);
+ if (!ud)
+ return -ENOMEM;
+
+ match = of_match_node(udma_of_match, dev->of_node);
+ if (!match) {
+ dev_err(dev, "No compatible match found\n");
+ return -ENODEV;
+ }
+ ud->match_data = match->data;
+
+ ud->soc_data = ud->match_data->soc_data;
+ if (!ud->soc_data) {
+ soc = soc_device_match(k3_soc_devices);
+ if (!soc) {
+ dev_err(dev, "No compatible SoC found\n");
+ return -ENODEV;
+ }
+ ud->soc_data = soc->data;
+ }
+ // Setup function pointers
+ ud->start = udma_v2_start;
+ ud->stop = udma_v2_stop;
+ ud->reset_chan = udma_v2_reset_chan;
+ ud->decrement_byte_counters = udma_v2_decrement_byte_counters;
+ ud->bcdma_setup_sci_resources = NULL;
+
+ ret = udma_v2_get_mmrs(pdev, ud);
+ if (ret)
+ return ret;
+
+ struct k3_ringacc_init_data ring_init_data = {0};
+
+ ring_init_data.num_rings = ud->bchan_cnt + ud->chan_cnt;
+
+ ud->ringacc = k3_ringacc_dmarings_init(pdev, &ring_init_data);
+
+ if (IS_ERR(ud->ringacc))
+ return PTR_ERR(ud->ringacc);
+
+ dma_cap_set(DMA_SLAVE, ud->ddev.cap_mask);
+
+ dma_cap_set(DMA_CYCLIC, ud->ddev.cap_mask);
+ ud->ddev.device_prep_dma_cyclic = udma_prep_dma_cyclic;
+
+ ud->ddev.device_config = udma_slave_config;
+ ud->ddev.device_prep_slave_sg = udma_prep_slave_sg;
+ ud->ddev.device_issue_pending = udma_issue_pending;
+ ud->ddev.device_tx_status = udma_v2_tx_status;
+ ud->ddev.device_pause = udma_v2_pause;
+ ud->ddev.device_resume = udma_v2_resume;
+ ud->ddev.device_terminate_all = udma_terminate_all;
+ ud->ddev.device_synchronize = udma_synchronize;
+#ifdef CONFIG_DEBUG_FS
+ ud->ddev.dbg_summary_show = udma_dbg_summary_show;
+#endif
+
+ ud->ddev.device_alloc_chan_resources =
+ bcdma_v2_alloc_chan_resources;
+
+ ud->ddev.device_free_chan_resources = udma_free_chan_resources;
+
+ ud->ddev.src_addr_widths = TI_UDMAC_BUSWIDTHS;
+ ud->ddev.dst_addr_widths = TI_UDMAC_BUSWIDTHS;
+ ud->ddev.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
+ ud->ddev.residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
+ ud->ddev.desc_metadata_modes = DESC_METADATA_CLIENT |
+ DESC_METADATA_ENGINE;
+ if (ud->match_data->enable_memcpy_support &&
+ !(ud->match_data->type == DMA_TYPE_BCDMA && ud->bchan_cnt == 0)) {
+ dma_cap_set(DMA_MEMCPY, ud->ddev.cap_mask);
+ ud->ddev.device_prep_dma_memcpy = udma_prep_dma_memcpy;
+ ud->ddev.directions |= BIT(DMA_MEM_TO_MEM);
+ }
+
+ ud->ddev.dev = dev;
+ ud->dev = dev;
+ ud->psil_base = ud->match_data->psil_base;
+
+ INIT_LIST_HEAD(&ud->ddev.channels);
+ INIT_LIST_HEAD(&ud->desc_to_purge);
+
+ ch_count = k3_udma_setup_resources(ud);
+ if (ch_count <= 0)
+ return ch_count;
+
+ spin_lock_init(&ud->lock);
+ INIT_WORK(&ud->purge_work, udma_purge_desc_work);
+
+ ud->desc_align = 64;
+ if (ud->desc_align < dma_get_cache_alignment())
+ ud->desc_align = dma_get_cache_alignment();
+
+ ret = udma_setup_rx_flush(ud);
+ if (ret)
+ return ret;
+
+ for (i = 0; i < ud->bchan_cnt; i++) {
+ struct udma_bchan *bchan = &ud->bchans[i];
+
+ bchan->id = i;
+ bchan->reg_rt = ud->mmrs[V2_MMR_BCHANRT] + i * 0x1000;
+ }
+
+ for (i = 0; i < ud->tchan_cnt; i++) {
+ struct udma_tchan *tchan = &ud->tchans[i];
+
+ tchan->id = i;
+ tchan->reg_rt = ud->mmrs[V2_MMR_CHANRT] + i * 0x1000;
+ }
+
+ for (i = 0; i < ud->rchan_cnt; i++) {
+ struct udma_rchan *rchan = &ud->rchans[i];
+
+ rchan->id = i;
+ rchan->reg_rt = ud->mmrs[V2_MMR_CHANRT] + i * 0x1000;
+ }
+
+ for (i = 0; i < ud->rflow_cnt; i++) {
+ struct udma_rflow *rflow = &ud->rflows[i];
+
+ rflow->id = i;
+ rflow->reg_rt = ud->rflow_rt + i * 0x2000;
+ }
+
+ for (i = 0; i < ch_count; i++) {
+ struct udma_chan *uc = &ud->channels[i];
+
+ uc->ud = ud;
+ uc->vc.desc_free = udma_desc_free;
+ uc->id = i;
+ uc->bchan = NULL;
+ uc->tchan = NULL;
+ uc->rchan = NULL;
+ uc->config.remote_thread_id = -1;
+ uc->config.mapped_channel_id = -1;
+ uc->config.default_flow_id = -1;
+ uc->config.dir = DMA_MEM_TO_MEM;
+ uc->name = devm_kasprintf(dev, GFP_KERNEL, "%s chan%d",
+ dev_name(dev), i);
+
+ vchan_init(&uc->vc, &ud->ddev);
+ /* Use custom vchan completion handling */
+ tasklet_setup(&uc->vc.task, udma_vchan_complete);
+ init_completion(&uc->teardown_completed);
+ INIT_DELAYED_WORK(&uc->tx_drain.work, udma_check_tx_completion);
+ }
+
+ /* Configure the copy_align to the maximum burst size the device supports */
+ ud->ddev.copy_align = udma_get_copy_align(ud);
+
+ ret = dma_async_device_register(&ud->ddev);
+ if (ret) {
+ dev_err(dev, "failed to register slave DMA engine: %d\n", ret);
+ return ret;
+ }
+
+ platform_set_drvdata(pdev, ud);
+
+ ret = of_dma_controller_register(dev->of_node, udma_v2_of_xlate, ud);
+ if (ret) {
+ dev_err(dev, "failed to register of_dma controller\n");
+ dma_async_device_unregister(&ud->ddev);
+ }
+
+ return ret;
+}
+
+static int __maybe_unused udma_v2_pm_suspend(struct device *dev)
+{
+ struct udma_dev *ud = dev_get_drvdata(dev);
+ struct dma_device *dma_dev = &ud->ddev;
+ struct dma_chan *chan;
+ struct udma_chan *uc;
+
+ list_for_each_entry(chan, &dma_dev->channels, device_node) {
+ if (chan->client_count) {
+ uc = to_udma_chan(chan);
+ /* backup the channel configuration */
+ memcpy(&uc->backup_config, &uc->config,
+ sizeof(struct udma_chan_config));
+ dev_dbg(dev, "Suspending channel %s\n",
+ dma_chan_name(chan));
+ ud->ddev.device_free_chan_resources(chan);
+ }
+ }
+
+ return 0;
+}
+
+static int __maybe_unused udma_v2_pm_resume(struct device *dev)
+{
+ struct udma_dev *ud = dev_get_drvdata(dev);
+ struct dma_device *dma_dev = &ud->ddev;
+ struct dma_chan *chan;
+ struct udma_chan *uc;
+ int ret;
+
+ list_for_each_entry(chan, &dma_dev->channels, device_node) {
+ if (chan->client_count) {
+ uc = to_udma_chan(chan);
+ /* restore the channel configuration */
+ memcpy(&uc->config, &uc->backup_config,
+ sizeof(struct udma_chan_config));
+ dev_dbg(dev, "Resuming channel %s\n",
+ dma_chan_name(chan));
+ ret = ud->ddev.device_alloc_chan_resources(chan);
+ if (ret)
+ return ret;
+ }
+ }
+
+ return 0;
+}
+
+static const struct dev_pm_ops udma_pm_ops = {
+ SET_LATE_SYSTEM_SLEEP_PM_OPS(udma_v2_pm_suspend, udma_v2_pm_resume)
+};
+
+static struct platform_driver bcdma_v2_driver = {
+ .driver = {
+ .name = "ti-udma-v2",
+ .of_match_table = udma_of_match,
+ .suppress_bind_attrs = true,
+ .pm = &udma_pm_ops,
+ },
+ .probe = udma_v2_probe,
+};
+
+module_platform_driver(bcdma_v2_driver);
+MODULE_DESCRIPTION("Texas Instruments K3 UDMA v2 support");
+MODULE_LICENSE("GPL");
diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index ddedd51ab26d9..6bf35dfec5e4e 100644
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -1810,6 +1810,7 @@ static struct dma_chan *udma_of_xlate(struct of_phandle_args *dma_spec,
static struct udma_match_data am654_main_data = {
.type = DMA_TYPE_UDMA,
+ .version = K3_UDMA_V1,
.psil_base = 0x1000,
.enable_memcpy_support = true,
.statictr_z_mask = GENMASK(11, 0),
@@ -1822,6 +1823,7 @@ static struct udma_match_data am654_main_data = {
static struct udma_match_data am654_mcu_data = {
.type = DMA_TYPE_UDMA,
+ .version = K3_UDMA_V1,
.psil_base = 0x6000,
.enable_memcpy_support = false,
.statictr_z_mask = GENMASK(11, 0),
@@ -1834,6 +1836,7 @@ static struct udma_match_data am654_mcu_data = {
static struct udma_match_data j721e_main_data = {
.type = DMA_TYPE_UDMA,
+ .version = K3_UDMA_V1,
.psil_base = 0x1000,
.enable_memcpy_support = true,
.flags = UDMA_FLAGS_J7_CLASS,
@@ -1847,6 +1850,7 @@ static struct udma_match_data j721e_main_data = {
static struct udma_match_data j721e_mcu_data = {
.type = DMA_TYPE_UDMA,
+ .version = K3_UDMA_V1,
.psil_base = 0x6000,
.enable_memcpy_support = false, /* MEM_TO_MEM is slow via MCU UDMA */
.flags = UDMA_FLAGS_J7_CLASS,
@@ -1876,6 +1880,7 @@ static struct udma_soc_data j721s2_bcdma_csi_soc_data = {
static struct udma_match_data am62a_bcdma_csirx_data = {
.type = DMA_TYPE_BCDMA,
+ .version = K3_UDMA_V1,
.psil_base = 0x3100,
.enable_memcpy_support = false,
.burst_size = {
@@ -1888,6 +1893,7 @@ static struct udma_match_data am62a_bcdma_csirx_data = {
static struct udma_match_data am64_bcdma_data = {
.type = DMA_TYPE_BCDMA,
+ .version = K3_UDMA_V1,
.psil_base = 0x2000, /* for tchan and rchan, not applicable to bchan */
.enable_memcpy_support = true, /* Supported via bchan */
.flags = UDMA_FLAGS_J7_CLASS,
@@ -1901,6 +1907,7 @@ static struct udma_match_data am64_bcdma_data = {
static struct udma_match_data am64_pktdma_data = {
.type = DMA_TYPE_PKTDMA,
+ .version = K3_UDMA_V1,
.psil_base = 0x1000,
.enable_memcpy_support = false, /* PKTDMA does not support MEM_TO_MEM */
.flags = UDMA_FLAGS_J7_CLASS,
@@ -1914,6 +1921,7 @@ static struct udma_match_data am64_pktdma_data = {
static struct udma_match_data j721s2_bcdma_csi_data = {
.type = DMA_TYPE_BCDMA,
+ .version = K3_UDMA_V1,
.psil_base = 0x2000,
.enable_memcpy_support = false,
.burst_size = {
@@ -1926,6 +1934,7 @@ static struct udma_match_data j721s2_bcdma_csi_data = {
static struct udma_match_data j722s_bcdma_csi_data = {
.type = DMA_TYPE_BCDMA,
+ .version = K3_UDMA_V1,
.psil_base = 0x3100,
.enable_memcpy_support = false,
.burst_size = {
diff --git a/drivers/dma/ti/k3-udma.h b/drivers/dma/ti/k3-udma.h
index d64b670d42490..b2e5455b1087e 100644
--- a/drivers/dma/ti/k3-udma.h
+++ b/drivers/dma/ti/k3-udma.h
@@ -32,6 +32,12 @@
#define UDMA_CHAN_RT_SWTRIG_REG 0x8
#define UDMA_CHAN_RT_STDATA_REG 0x80
+#define UDMA_CHAN_RT_STATIC_TR_XY_REG 0x800
+#define UDMA_CHAN_RT_STATIC_TR_Z_REG 0x804
+#define UDMA_CHAN_RT_PERIPH_BCNT_REG 0x810
+#define UDMA_CHAN_RT_FIFO_SEL_REG 0x824
+#define UDMA_CHAN_RT_PDMA_STATE_REG 0x80c
+
#define UDMA_CHAN_RT_PEER_REG(i) (0x200 + ((i) * 0x4))
#define UDMA_CHAN_RT_PEER_STATIC_TR_XY_REG \
UDMA_CHAN_RT_PEER_REG(0) /* PSI-L: 0x400 */
@@ -71,8 +77,16 @@
#define UDMA_CHAN_RT_CTL_TDOWN BIT(30)
#define UDMA_CHAN_RT_CTL_PAUSE BIT(29)
#define UDMA_CHAN_RT_CTL_FTDOWN BIT(28)
+#define UDMA_CHAN_RT_CTL_AUTOPAIR BIT(23)
+#define UDMA_CHAN_RT_CTL_PAIR_TIMEOUT BIT(17)
+#define UDMA_CHAN_RT_CTL_PAIR_COMPLETE BIT(16)
#define UDMA_CHAN_RT_CTL_ERROR BIT(0)
+/* UDMA_CHAN_RT_PDMA_STATE_REG */
+#define UDMA_CHAN_RT_PDMA_STATE_IN_EVT BIT(31)
+#define UDMA_CHAN_RT_PDMA_STATE_TDOWN BIT(30)
+#define UDMA_CHAN_RT_PDMA_STATE_PAUSE BIT(29)
+
/* UDMA_CHAN_RT_PEER_RT_EN_REG */
#define UDMA_PEER_RT_EN_ENABLE BIT(31)
#define UDMA_PEER_RT_EN_TEARDOWN BIT(30)
@@ -103,6 +117,9 @@
*/
#define PDMA_STATIC_TR_Z(x, mask) ((x) & (mask))
+/* UDMA_CHAN_RT_PEER_REG(8) */
+#define UDMA_CHAN_RT_PEER_REG8_FLUSH 0x09000000
+
/* Address Space Select */
#define K3_ADDRESS_ASEL_SHIFT 48
@@ -208,6 +225,11 @@ enum k3_dma_type {
DMA_TYPE_PKTDMA,
};
+enum k3_dma_version {
+ K3_UDMA_V1 = 0,
+ K3_UDMA_V2,
+};
+
enum udma_mmr {
MMR_GCFG = 0,
MMR_BCHANRT,
@@ -216,6 +238,13 @@ enum udma_mmr {
MMR_LAST,
};
+enum udma_v2_mmr {
+ V2_MMR_GCFG = 0,
+ V2_MMR_BCHANRT,
+ V2_MMR_CHANRT,
+ V2_MMR_LAST,
+};
+
struct udma_filter_param {
int remote_thread_id;
u32 atype;
@@ -223,6 +252,13 @@ struct udma_filter_param {
u32 tr_trigger_type;
};
+struct udma_v2_filter_param {
+ u32 tr_trigger_type;
+ u32 trigger_param;
+ u32 channel_id;
+ u32 asel;
+};
+
struct udma_tchan {
void __iomem *reg_rt;
@@ -234,17 +270,13 @@ struct udma_tchan {
};
#define udma_bchan udma_tchan
+#define udma_rchan udma_tchan
struct udma_rflow {
int id;
struct k3_ring *fd_ring; /* Free Descriptor ring */
struct k3_ring *r_ring; /* Receive ring */
-};
-
-struct udma_rchan {
void __iomem *reg_rt;
-
- int id;
};
struct udma_oes_offsets {
@@ -266,12 +298,19 @@ struct udma_oes_offsets {
struct udma_match_data {
enum k3_dma_type type;
+ enum k3_dma_version version;
u32 psil_base;
bool enable_memcpy_support;
u32 flags;
u32 statictr_z_mask;
u8 burst_size[3];
struct udma_soc_data *soc_data;
+ u32 bchan_cnt;
+ u32 chan_cnt;
+ u32 tchan_cnt;
+ u32 rchan_cnt;
+ u32 tflow_cnt;
+ u32 rflow_cnt;
};
struct udma_soc_data {
@@ -306,6 +345,7 @@ struct udma_dev {
struct dma_device ddev;
struct device *dev;
void __iomem *mmrs[MMR_LAST];
+ void __iomem *rflow_rt;
const struct udma_match_data *match_data;
const struct udma_soc_data *soc_data;
@@ -326,12 +366,14 @@ struct udma_dev {
struct udma_rx_flush rx_flush;
int bchan_cnt;
+ int chan_cnt;
int tchan_cnt;
int echan_cnt;
int rchan_cnt;
int rflow_cnt;
int tflow_cnt;
unsigned long *bchan_map;
+ unsigned long *chan_map;
unsigned long *tchan_map;
unsigned long *rchan_map;
unsigned long *rflow_gp_map;
@@ -340,6 +382,7 @@ struct udma_dev {
unsigned long *tflow_map;
struct udma_bchan *bchans;
+ struct udma_tchan *chans;
struct udma_tchan *tchans;
struct udma_rchan *rchans;
struct udma_rflow *rflows;
@@ -411,6 +454,7 @@ struct udma_chan_config {
bool enable_acc32;
bool enable_burst;
enum udma_tp_level channel_tpl; /* Channel Throughput Level */
+ u8 fifo_id; /* XYMF FIFO index */
u32 tr_trigger_type;
unsigned long tx_flags;
@@ -434,6 +478,7 @@ struct udma_chan {
char *name;
struct udma_bchan *bchan;
+ struct udma_tchan *chan;
struct udma_tchan *tchan;
struct udma_rchan *rchan;
struct udma_rflow *rflow;
@@ -503,51 +548,33 @@ static inline void udma_update_bits(void __iomem *base, int reg,
writel(tmp, base + reg);
}
-/* TCHANRT */
-static inline u32 udma_tchanrt_read(struct udma_chan *uc, int reg)
-{
- if (!uc->tchan)
- return 0;
- return udma_read(uc->tchan->reg_rt, reg);
-}
-
-static inline void udma_tchanrt_write(struct udma_chan *uc, int reg, u32 val)
-{
- if (!uc->tchan)
- return;
- udma_write(uc->tchan->reg_rt, reg, val);
+#define _UDMA_REG_ACCESS(channel) \
+static inline u32 udma_##channel##rt_read(struct udma_chan *uc, int reg) \
+{ \
+ if (!uc->channel) \
+ return 0; \
+ return udma_read(uc->channel->reg_rt, reg); \
+} \
+\
+static inline void udma_##channel##rt_write(struct udma_chan *uc, int reg, u32 val) \
+{ \
+ if (!uc->channel) \
+ return; \
+ udma_write(uc->channel->reg_rt, reg, val); \
+} \
+\
+static inline void udma_##channel##rt_update_bits(struct udma_chan *uc, int reg, \
+ u32 mask, u32 val) \
+{ \
+ if (!uc->channel) \
+ return; \
+ udma_update_bits(uc->channel->reg_rt, reg, mask, val); \
}
-static inline void udma_tchanrt_update_bits(struct udma_chan *uc, int reg,
- u32 mask, u32 val)
-{
- if (!uc->tchan)
- return;
- udma_update_bits(uc->tchan->reg_rt, reg, mask, val);
-}
-
-/* RCHANRT */
-static inline u32 udma_rchanrt_read(struct udma_chan *uc, int reg)
-{
- if (!uc->rchan)
- return 0;
- return udma_read(uc->rchan->reg_rt, reg);
-}
-
-static inline void udma_rchanrt_write(struct udma_chan *uc, int reg, u32 val)
-{
- if (!uc->rchan)
- return;
- udma_write(uc->rchan->reg_rt, reg, val);
-}
-
-static inline void udma_rchanrt_update_bits(struct udma_chan *uc, int reg,
- u32 mask, u32 val)
-{
- if (!uc->rchan)
- return;
- udma_update_bits(uc->rchan->reg_rt, reg, mask, val);
-}
+_UDMA_REG_ACCESS(chan);
+_UDMA_REG_ACCESS(bchan);
+_UDMA_REG_ACCESS(tchan);
+_UDMA_REG_ACCESS(rchan);
static inline dma_addr_t udma_curr_cppi5_desc_paddr(struct udma_desc *d,
int idx)
diff --git a/include/linux/soc/ti/k3-ringacc.h b/include/linux/soc/ti/k3-ringacc.h
index 9f2d141c988bd..1ac01b97dd923 100644
--- a/include/linux/soc/ti/k3-ringacc.h
+++ b/include/linux/soc/ti/k3-ringacc.h
@@ -10,6 +10,9 @@
#include <linux/types.h>
+#define K3_RINGACC_RT_INT_STATUS_COMPLETE BIT(0)
+#define K3_RINGACC_RT_INT_STATUS_TR BIT(2)
+
struct device_node;
/**
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 16/19] dmaengine: ti: k3-udma-v2: New driver for K3 BCDMA_V2
2026-08-10 15:14 ` [PATCH v8 16/19] dmaengine: ti: k3-udma-v2: New driver for K3 BCDMA_V2 Sai Sree Kartheek Adivi
@ 2026-08-10 17:04 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-08-10 17:04 UTC (permalink / raw)
To: Sai Sree Kartheek Adivi
Cc: vkoul, robh, conor+dt, devicetree, Frank.Li, dmaengine
Thank you for your contribution! Sashiko AI review found 6 potential issue(s) to consider:
- [High] Unconstrained virtual channel ID (`uc->id`) is used as a hardware index for `bchan` allocation, leading to out-of-bounds array and bitmap accesses.
- [High] Missing `.remove` function in `bcdma_v2_driver` causes a use-after-free on module unload.
- [High] PM suspend forcefully frees active channel resources and descriptor pools, causing Use-After-Free on resume.
- [Medium] Lockless call to `complete_all()` races with `reinit_completion()` during channel teardown.
- [Low] `TI_K3_UDMA_V2` selects `TI_K3_RINGACC` without inheriting its dependencies, causing Kconfig unmet dependency warnings.
- [Low] The return values of consecutive `k3_ringacc_ring_cfg` calls are accumulated using a bitwise OR, which mangles negative error codes.
--
--- Patch [16]: [PATCH v8 16/19] dmaengine: ti: k3-udma-v2: New driver for K3 BCDMA_V2 ---
commit 61b786131a37c8bebad4a083b46e1ce421934a6f
Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>
dmaengine: ti: k3-udma-v2: New driver for K3 BCDMA_V2
Add support for BCDMA_V2, which differs from existing BCDMA by not
requiring PSIL pairing, using static channel mapping, direct IRQs,
and having a unified channel space.
> diff --git a/drivers/dma/ti/Kconfig b/drivers/dma/ti/Kconfig
> --- a/drivers/dma/ti/Kconfig
> +++ b/drivers/dma/ti/Kconfig
> @@ -49,6 +49,18 @@ config TI_K3_UDMA
> Enable support for the TI UDMA (Unified DMA) controller. This
> DMA engine is used in AM65x and j721e.
>
> +config TI_K3_UDMA_V2
> + tristate "Texas Instruments K3 UDMA v2 support"
> + depends on ARCH_K3
> + select DMA_ENGINE
> + select DMA_VIRTUAL_CHANNELS
> + select TI_K3_UDMA_COMMON
> + select TI_K3_RINGACC
[Severity: Low]
Is it possible for this select statement to cause unmet dependency warnings?
TI_K3_RINGACC depends on TI_SCI_INTA_IRQCHIP, but select bypasses dependencies,
which could lead to build warnings if the IRQ chip driver is disabled.
> + select TI_K3_PSIL
> + help
> + Enable support for the TI UDMA (Unified DMA) v2 controller. This
> + DMA engine is used in AM62L.
> +
> config TI_K3_UDMA_COMMON
[ ... ]
> diff --git a/drivers/dma/ti/k3-udma-v2.c b/drivers/dma/ti/k3-udma-v2.c
> new file mode 100644
> --- /dev/null
> +++ b/drivers/dma/ti/k3-udma-v2.c
[ ... ]
> +static int udma_v2_stop(struct udma_chan *uc)
> +{
> + uc->state = UDMA_CHAN_IS_TERMINATING;
> + reinit_completion(&uc->teardown_completed);
[Severity: Medium]
Can a data race occur between the interrupt handler and this stop function?
In the interrupt handler, complete_all() is called without a lock. Concurrently,
a channel termination path holding the channel lock could call udma_v2_stop(),
which runs reinit_completion(). If reinit_completion() occurs right after
complete_all(), the completion gets cleared before waiting threads consume it,
potentially causing a timeout.
> +
> + if (uc->config.dir == DMA_DEV_TO_MEM) {
[ ... ]
> +static int bcdma_v2_get_bchan(struct udma_chan *uc)
> +{
> + struct udma_dev *ud = uc->ud;
> + enum udma_tp_level tpl;
> + int ret;
> +
> + if (uc->bchan) {
> + dev_dbg(ud->dev, "chan%d: already have bchan%d allocated\n",
> + uc->id, uc->bchan->id);
> + return 0;
> + }
> +
> + /*
> + * Use normal channels for peripherals, and highest TPL channel for
> + * mem2mem
> + */
> + if (uc->config.tr_trigger_type)
> + tpl = 0;
> + else
> + tpl = ud->bchan_tpl.levels - 1;
> +
> + /*
> + * UDMA V2 uses a static 1:1 mapping between the virtual channel index
> + * (uc->id) and the hardware bchan/tchan/rchan index -- unlike V1, which
> + * dynamically allocates from a shared pool. Passing uc->id directly to
> + * __udma_reserve_*() is intentional, not a bug.
> + */
> + uc->bchan = __udma_reserve_bchan(ud, tpl, uc->id);
[Severity: High]
Could this result in out-of-bounds accesses? The DMA filter function accepts
virtual channels for MEM_TO_MEM workflows without enforcing that uc->id is
within the valid bchan count limit (16). If previous allocations consume the
first 16 channels, a subsequent request would get an ID >= 16. Passing this
unconstrained ID directly to __udma_reserve_bchan would perform an
out-of-bounds set_bit() on the ud->bchan_map bitmap and read out of bounds.
> + if (IS_ERR(uc->bchan)) {
> + ret = PTR_ERR(uc->bchan);
> + uc->bchan = NULL;
> + return ret;
> + }
> + uc->chan = uc->bchan;
> + uc->tchan = uc->bchan;
> +
> + return 0;
> +}
> +
> +static int bcdma_v2_alloc_bchan_resources(struct udma_chan *uc)
> +{
> + struct k3_ring_cfg ring_cfg;
> + struct udma_dev *ud = uc->ud;
> + int ret;
> +
> + ret = bcdma_v2_get_bchan(uc);
> + if (ret)
> + return ret;
> +
> + ret = k3_ringacc_request_rings_pair(ud->ringacc, ud->match_data->chan_cnt + uc->id, -1,
[Severity: High]
Following the above logic, requesting a ring pair with this unconstrained
uc->id could also exceed the bounds of the num_rings array here.
> + &uc->bchan->t_ring,
> + &uc->bchan->tc_ring);
[ ... ]
> +static int udma_v2_alloc_tx_resources(struct udma_chan *uc)
> +{
> + struct k3_ring_cfg ring_cfg;
> + struct udma_dev *ud = uc->ud;
> + struct udma_tchan *tchan;
> + int ring_idx, ret;
[ ... ]
> + ret = k3_ringacc_ring_cfg(tchan->t_ring, &ring_cfg);
> + ret |= k3_ringacc_ring_cfg(tchan->tc_ring, &ring_cfg);
[Severity: Low]
Does accumulating return values with a bitwise OR mangle negative error codes?
If the first call fails with an error like -EINVAL, ORing the result of the
second call will produce a corrupted error code, destroying the original
POSIX error mapping.
> +
> + if (ret)
> + goto err_ringcfg;
[ ... ]
> +static int __maybe_unused udma_v2_pm_suspend(struct device *dev)
> +{
> + struct udma_dev *ud = dev_get_drvdata(dev);
> + struct dma_device *dma_dev = &ud->ddev;
> + struct dma_chan *chan;
> + struct udma_chan *uc;
> +
> + list_for_each_entry(chan, &dma_dev->channels, device_node) {
> + if (chan->client_count) {
> + uc = to_udma_chan(chan);
> + /* backup the channel configuration */
> + memcpy(&uc->backup_config, &uc->config,
> + sizeof(struct udma_chan_config));
> + dev_dbg(dev, "Suspending channel %s\n",
> + dma_chan_name(chan));
> + ud->ddev.device_free_chan_resources(chan);
[Severity: High]
Is it safe to free active channel resources and descriptor pools during
suspend? DMA clients generally only pause transfers during suspend and expect
their pre-allocated descriptors to remain valid.
> + }
> + }
> +
> + return 0;
> +}
> +
> +static int __maybe_unused udma_v2_pm_resume(struct device *dev)
> +{
> + struct udma_dev *ud = dev_get_drvdata(dev);
> + struct dma_device *dma_dev = &ud->ddev;
> + struct dma_chan *chan;
> + struct udma_chan *uc;
> + int ret;
> +
> + list_for_each_entry(chan, &dma_dev->channels, device_node) {
> + if (chan->client_count) {
> + uc = to_udma_chan(chan);
> + /* restore the channel configuration */
> + memcpy(&uc->config, &uc->backup_config,
> + sizeof(struct udma_chan_config));
> + dev_dbg(dev, "Resuming channel %s\n",
> + dma_chan_name(chan));
> + ret = ud->ddev.device_alloc_chan_resources(chan);
[Severity: High]
Reallocating a new pool on resume leaves clients holding dangling pointers to
the old destroyed pool, which could cause a use-after-free when they attempt
to submit or free their old descriptors.
> + if (ret)
> + return ret;
> + }
> + }
> +
> + return 0;
> +}
> +
> +static const struct dev_pm_ops udma_pm_ops = {
> + SET_LATE_SYSTEM_SLEEP_PM_OPS(udma_v2_pm_suspend, udma_v2_pm_resume)
> +};
> +
> +static struct platform_driver bcdma_v2_driver = {
> + .driver = {
> + .name = "ti-udma-v2",
> + .of_match_table = udma_of_match,
> + .suppress_bind_attrs = true,
> + .pm = &udma_pm_ops,
> + },
> + .probe = udma_v2_probe,
> +};
[Severity: High]
Should this platform driver include a remove callback? Without it, module
unload leaves the DMA engine core and OF subsystems with dangling pointers to
the freed ud->ddev structure, which could cause a use-after-free on subsequent
access when the module is removed.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260810151423.1948224-1-s-adivi@ti.com?part=16
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 17/19] dmaengine: ti: k3-udma-v2: Add support for PKTDMA V2
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
` (15 preceding siblings ...)
2026-08-10 15:14 ` [PATCH v8 16/19] dmaengine: ti: k3-udma-v2: New driver for K3 BCDMA_V2 Sai Sree Kartheek Adivi
@ 2026-08-10 15:14 ` Sai Sree Kartheek Adivi
2026-08-10 17:09 ` sashiko-bot
2026-08-10 15:14 ` [PATCH v8 18/19] dmaengine: ti: k3-udma-v2: Update glue layer to support " Sai Sree Kartheek Adivi
2026-08-10 15:14 ` [PATCH v8 19/19] dmaengine: ti: k3-udma: Validate resource ID and fix logging in reservation Sai Sree Kartheek Adivi
18 siblings, 1 reply; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:14 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
The PKTDMA V2 is different than the existing PKTDMA supported by the
k3-udma driver.
The changes in PKTDMA V2 are:
- Autopair: There is no longer a need for PSIL pair and AUTOPAIR bit
needs to set in the RT_CTL register.
- Static channel mapping: Each channel is mapped to a single
peripheral.
- Direct IRQs: There is no INT-A and interrupt lines from DMA are
directly connected to GIC.
- Remote side configuration handled by DMA. So no need to write to
PEER registers to START / STOP / PAUSE / TEARDOWN.
- Unified Channel Space: Tx and Rx channels share a single register
space. Each channel index is specifically fixed in hardware as either
Tx or Rx in an interleaved manner.
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
drivers/dma/ti/k3-udma-common.c | 35 +++--
drivers/dma/ti/k3-udma-glue.c | 23 ++++
drivers/dma/ti/k3-udma-private.c | 12 +-
drivers/dma/ti/k3-udma-v2.c | 224 +++++++++++++++++++++++++++++--
drivers/dma/ti/k3-udma.h | 3 +
5 files changed, 269 insertions(+), 28 deletions(-)
diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
index f9dd6edf3eacb..d5d7158a37f8f 100644
--- a/drivers/dma/ti/k3-udma-common.c
+++ b/drivers/dma/ti/k3-udma-common.c
@@ -2461,9 +2461,16 @@ static int pktdma_setup_resources(struct udma_dev *ud)
ud->tchan_map = devm_bitmap_zalloc(dev, ud->tchan_cnt, GFP_KERNEL);
ud->tchans = devm_kcalloc(dev, ud->tchan_cnt, sizeof(*ud->tchans),
GFP_KERNEL);
- ud->rchan_map = devm_bitmap_zalloc(dev, ud->rchan_cnt, GFP_KERNEL);
- ud->rchans = devm_kcalloc(dev, ud->rchan_cnt, sizeof(*ud->rchans),
- GFP_KERNEL);
+ if (ud->match_data->version == K3_UDMA_V1) {
+ ud->rchan_map = devm_bitmap_zalloc(dev, ud->rchan_cnt, GFP_KERNEL);
+ ud->rchans = devm_kcalloc(dev, ud->rchan_cnt, sizeof(*ud->rchans),
+ GFP_KERNEL);
+ } else {
+ ud->rchan_map = ud->tchan_map;
+ ud->rchans = ud->tchans;
+ ud->chan_map = ud->tchan_map;
+ ud->chans = ud->tchans;
+ }
ud->rflow_in_use = devm_kcalloc(dev, BITS_TO_LONGS(ud->rflow_cnt),
sizeof(unsigned long),
GFP_KERNEL);
@@ -2562,13 +2569,21 @@ int k3_udma_setup_resources(struct udma_dev *ud)
}
break;
case DMA_TYPE_PKTDMA:
- dev_info(dev,
- "Channels: %d (tchan: %u, rchan: %u)\n",
- ch_count,
- ud->tchan_cnt - bitmap_weight(ud->tchan_map,
- ud->tchan_cnt),
- ud->rchan_cnt - bitmap_weight(ud->rchan_map,
- ud->rchan_cnt));
+ if (ud->match_data->version == K3_UDMA_V1) {
+ dev_info(dev,
+ "Channels: %d (tchan: %u, rchan: %u)\n",
+ ch_count,
+ ud->tchan_cnt - bitmap_weight(ud->tchan_map,
+ ud->tchan_cnt),
+ ud->rchan_cnt - bitmap_weight(ud->rchan_map,
+ ud->rchan_cnt));
+ } else {
+ dev_info(dev,
+ "Channels: %d (tchan + rchan: %u)\n",
+ ch_count,
+ ud->chan_cnt - bitmap_weight(ud->chan_map,
+ ud->chan_cnt));
+ }
break;
default:
break;
diff --git a/drivers/dma/ti/k3-udma-glue.c b/drivers/dma/ti/k3-udma-glue.c
index 686dc140293eb..bec4deb480e60 100644
--- a/drivers/dma/ti/k3-udma-glue.c
+++ b/drivers/dma/ti/k3-udma-glue.c
@@ -166,6 +166,29 @@ static int of_k3_udma_glue_parse_chn(struct device_node *chn_np,
goto out_put_spec;
thread_id = dma_spec.args[0];
+
+ /*
+ * V2 PKTDMA DT specifiers encode the hardware flow/channel ID in
+ * args[0] rather than the PSI-L thread ID used by V1. Resolve the
+ * PSI-L thread ID before the common path checks the direction bit.
+ */
+ if (common->udmax->match_data->version == K3_UDMA_V2 &&
+ xudma_is_pktdma(common->udmax)) {
+ struct psil_endpoint_config *ep_cfg;
+ u32 psil_thread_id;
+ bool dev_to_mem;
+
+ ep_cfg = psil_get_ep_config_by_id(thread_id, DMA_TYPE_PKTDMA,
+ &psil_thread_id, &dev_to_mem);
+ if (IS_ERR(ep_cfg)) {
+ dev_err(common->dev,
+ "No PSI-L config for flow %u\n", thread_id);
+ ret = PTR_ERR(ep_cfg);
+ goto out_put_spec;
+ }
+ thread_id = psil_thread_id;
+ }
+
if (dma_spec.args_count == 2) {
if (dma_spec.args[1] > 2 && !xudma_is_pktdma(common->udmax)) {
dev_err(common->dev, "Invalid channel atype: %u\n",
diff --git a/drivers/dma/ti/k3-udma-private.c b/drivers/dma/ti/k3-udma-private.c
index 44c097fff5ee6..92d44ef9593d1 100644
--- a/drivers/dma/ti/k3-udma-private.c
+++ b/drivers/dma/ti/k3-udma-private.c
@@ -174,16 +174,20 @@ EXPORT_SYMBOL(xudma_is_pktdma);
int xudma_pktdma_tflow_get_irq(struct udma_dev *ud, int udma_tflow_id)
{
- const struct udma_oes_offsets *oes = &ud->soc_data->oes;
+ struct platform_device *pdev = to_platform_device(ud->dev);
+ char irq_name[10];
- return msi_get_virq(ud->dev, udma_tflow_id + oes->pktdma_tchan_flow);
+ snprintf(irq_name, sizeof(irq_name), "tx-%u", udma_tflow_id);
+ return platform_get_irq_byname(pdev, irq_name);
}
EXPORT_SYMBOL(xudma_pktdma_tflow_get_irq);
int xudma_pktdma_rflow_get_irq(struct udma_dev *ud, int udma_rflow_id)
{
- const struct udma_oes_offsets *oes = &ud->soc_data->oes;
+ struct platform_device *pdev = to_platform_device(ud->dev);
+ char irq_name[10];
- return msi_get_virq(ud->dev, udma_rflow_id + oes->pktdma_rchan_flow);
+ snprintf(irq_name, sizeof(irq_name), "rx-%u", udma_rflow_id);
+ return platform_get_irq_byname(pdev, irq_name);
}
EXPORT_SYMBOL(xudma_pktdma_rflow_get_irq);
diff --git a/drivers/dma/ti/k3-udma-v2.c b/drivers/dma/ti/k3-udma-v2.c
index b9ce58d1934a9..c46341e768cdc 100644
--- a/drivers/dma/ti/k3-udma-v2.c
+++ b/drivers/dma/ti/k3-udma-v2.c
@@ -572,7 +572,7 @@ static int udma_v2_alloc_rx_resources(struct udma_chan *uc)
rflow = uc->rflow;
if (ud->tflow_cnt)
- fd_ring_id = ud->tflow_cnt + rflow->id;
+ fd_ring_id = rflow->id;
else
fd_ring_id = uc->rchan->id;
ret = k3_ringacc_request_rings_pair(ud->ringacc, fd_ring_id, -1,
@@ -764,6 +764,146 @@ static int bcdma_v2_alloc_chan_resources(struct dma_chan *chan)
return ret;
}
+static int pktdma_v2_alloc_chan_resources(struct dma_chan *chan)
+{
+ struct udma_chan *uc = to_udma_chan(chan);
+ struct udma_dev *ud = to_udma_dev(chan->device);
+ struct platform_device *pdev = to_platform_device(ud->dev);
+ char irq_name[10];
+ u32 irq_ring_idx;
+ int ret;
+
+ /*
+ * Make sure that the completion is in a known state:
+ * No teardown, the channel is idle
+ */
+ reinit_completion(&uc->teardown_completed);
+ complete_all(&uc->teardown_completed);
+ uc->state = UDMA_CHAN_IS_IDLE;
+
+ switch (uc->config.dir) {
+ case DMA_MEM_TO_DEV:
+ /* Slave transfer synchronized - mem to dev (TX) transfer */
+ dev_dbg(uc->ud->dev, "%s: chan%d as MEM-to-DEV\n", __func__,
+ uc->id);
+
+ ret = udma_v2_alloc_tx_resources(uc);
+ if (ret) {
+ uc->config.remote_thread_id = -1;
+ return ret;
+ }
+
+ uc->config.src_thread = ud->psil_base + uc->tchan->id;
+ uc->config.dst_thread = uc->config.remote_thread_id;
+ uc->config.dst_thread |= K3_PSIL_DST_THREAD_ID_OFFSET;
+
+ irq_ring_idx = uc->config.mapped_channel_id;
+ break;
+ case DMA_DEV_TO_MEM:
+ /* Slave transfer synchronized - dev to mem (RX) transfer */
+ dev_dbg(uc->ud->dev, "%s: chan%d as DEV-to-MEM\n", __func__,
+ uc->id);
+
+ ret = udma_v2_alloc_rx_resources(uc);
+ if (ret) {
+ uc->config.remote_thread_id = -1;
+ return ret;
+ }
+
+ uc->config.src_thread = uc->config.remote_thread_id;
+ uc->config.dst_thread = (ud->psil_base + uc->rchan->id) |
+ K3_PSIL_DST_THREAD_ID_OFFSET;
+
+ irq_ring_idx = uc->config.mapped_channel_id;
+ udma_write(uc->rflow->reg_rt, UDMA_RX_FLOWRT_RFA, BIT(28));
+ break;
+ default:
+ /* Can not happen */
+ dev_err(uc->ud->dev, "%s: chan%d invalid direction (%u)\n",
+ __func__, uc->id, uc->config.dir);
+ return -EINVAL;
+ }
+
+ /* check if the channel configuration was successful */
+ if (ret)
+ goto err_res_free;
+
+ if (udma_is_chan_running(uc)) {
+ dev_warn(ud->dev, "chan%d: is running!\n", uc->id);
+ ud->reset_chan(uc, false);
+ if (udma_is_chan_running(uc)) {
+ dev_err(ud->dev, "chan%d: won't stop!\n", uc->id);
+ ret = -EBUSY;
+ goto err_res_free;
+ }
+ }
+
+ uc->dma_dev = dmaengine_get_dma_device(chan);
+ uc->hdesc_pool = dma_pool_create(uc->name, uc->dma_dev,
+ uc->config.hdesc_size, ud->desc_align,
+ 0);
+ if (!uc->hdesc_pool) {
+ dev_err(ud->ddev.dev,
+ "Descriptor pool allocation failed\n");
+ uc->use_dma_pool = false;
+ ret = -ENOMEM;
+ goto err_res_free;
+ }
+
+ uc->use_dma_pool = true;
+
+ uc->psil_paired = true;
+
+ INIT_DELAYED_WORK(&uc->tx_drain.work, udma_check_tx_completion);
+
+ if (uc->config.dir == DMA_MEM_TO_DEV)
+ snprintf(irq_name, sizeof(irq_name), "tx-%u", irq_ring_idx);
+ else
+ snprintf(irq_name, sizeof(irq_name), "rx-%u", irq_ring_idx);
+ uc->irq_num_ring = platform_get_irq_byname(pdev, irq_name);
+ if (uc->irq_num_ring < 0) {
+ ret = uc->irq_num_ring;
+ goto err_res_free;
+ }
+
+ ret = request_irq(uc->irq_num_ring, udma_v2_ring_irq_handler,
+ IRQF_SHARED | IRQF_TRIGGER_HIGH, uc->name, uc);
+
+ if (ret) {
+ dev_err(ud->dev, "chan%d: ring irq request failed\n", uc->id);
+ goto err_irq_free;
+ }
+
+ uc->irq_num_udma = 0;
+
+ udma_reset_rings(uc);
+
+ if (uc->tchan)
+ dev_dbg(ud->dev,
+ "chan%d: tchan%d, tflow%d, Remote thread: 0x%04x\n",
+ uc->id, uc->tchan->id, uc->tchan->tflow_id,
+ uc->config.remote_thread_id);
+ else if (uc->rchan)
+ dev_dbg(ud->dev,
+ "chan%d: rchan%d, rflow%d, Remote thread: 0x%04x\n",
+ uc->id, uc->rchan->id, uc->rflow->id,
+ uc->config.remote_thread_id);
+ return 0;
+
+err_irq_free:
+ uc->irq_num_ring = 0;
+err_res_free:
+ udma_free_tx_resources(uc);
+ udma_free_rx_resources(uc);
+
+ udma_reset_uchan(uc);
+
+ dma_pool_destroy(uc->hdesc_pool);
+ uc->use_dma_pool = false;
+
+ return ret;
+}
+
static enum dma_status udma_v2_tx_status(struct dma_chan *chan,
dma_cookie_t cookie,
struct dma_tx_state *txstate)
@@ -864,6 +1004,7 @@ static int udma_v2_resume(struct dma_chan *chan)
}
static struct platform_driver bcdma_v2_driver;
+static struct platform_driver pktdma_v2_driver;
static bool udma_v2_dma_filter_fn(struct dma_chan *chan, void *param)
{
@@ -873,7 +1014,8 @@ static bool udma_v2_dma_filter_fn(struct dma_chan *chan, void *param)
struct udma_chan *uc;
struct udma_dev *ud;
- if (chan->device->dev->driver != &bcdma_v2_driver.driver)
+ if (chan->device->dev->driver != &bcdma_v2_driver.driver &&
+ chan->device->dev->driver != &pktdma_v2_driver.driver)
return false;
uc = to_udma_chan(chan);
@@ -1026,11 +1168,34 @@ static struct udma_match_data bcdma_v2_am62l_data = {
.rchan_cnt = 128,
};
+static struct udma_match_data pktdma_v2_am62l_data = {
+ .type = DMA_TYPE_PKTDMA,
+ .version = K3_UDMA_V2,
+ .psil_base = 0x1000,
+ .enable_memcpy_support = false, /* PKTDMA does not support MEM_TO_MEM */
+ .flags = UDMA_FLAGS_J7_CLASS,
+ .statictr_z_mask = GENMASK(23, 0),
+ .burst_size = {
+ TI_SCI_RM_UDMAP_CHAN_BURST_SIZE_64_BYTES, /* Normal Channels */
+ 0, /* No H Channels */
+ 0, /* No UH Channels */
+ },
+ .tchan_cnt = 97,
+ .rchan_cnt = 97,
+ .chan_cnt = 97,
+ .tflow_cnt = 112,
+ .rflow_cnt = 112,
+};
+
static const struct of_device_id udma_of_match[] = {
{
.compatible = "ti,am62l-dmss-bcdma",
.data = &bcdma_v2_am62l_data,
},
+ {
+ .compatible = "ti,am62l-dmss-pktdma",
+ .data = &pktdma_v2_am62l_data,
+ },
{ /* Sentinel */ },
};
@@ -1049,15 +1214,23 @@ static int udma_v2_get_mmrs(struct platform_device *pdev, struct udma_dev *ud)
if (IS_ERR(ud->mmrs[V2_MMR_GCFG]))
return PTR_ERR(ud->mmrs[V2_MMR_GCFG]);
- ud->bchan_cnt = ud->match_data->bchan_cnt;
- /* There are no tchan and rchan in BCDMA_V2.
+ /* There are no tchan and rchan in BCDMA_V2 and PKTDMA_V2.
* Duplicate chan as tchan and rchan to keep the common code
- * in k3-udma-common.c functional for BCDMA_V2.
+ * in k3-udma-common.c functional.
*/
- ud->chan_cnt = ud->match_data->chan_cnt;
- ud->tchan_cnt = ud->match_data->chan_cnt;
- ud->rchan_cnt = ud->match_data->chan_cnt;
- ud->rflow_cnt = ud->chan_cnt;
+ if (ud->match_data->type == DMA_TYPE_BCDMA) {
+ ud->bchan_cnt = ud->match_data->bchan_cnt;
+ ud->chan_cnt = ud->match_data->chan_cnt;
+ ud->tchan_cnt = ud->match_data->chan_cnt;
+ ud->rchan_cnt = ud->match_data->chan_cnt;
+ ud->rflow_cnt = ud->chan_cnt;
+ } else if (ud->match_data->type == DMA_TYPE_PKTDMA) {
+ ud->chan_cnt = ud->match_data->chan_cnt;
+ ud->tchan_cnt = ud->match_data->tchan_cnt;
+ ud->rchan_cnt = ud->match_data->rchan_cnt;
+ ud->tflow_cnt = ud->match_data->tflow_cnt;
+ ud->rflow_cnt = ud->match_data->rflow_cnt;
+ }
for (i = 1; i < V2_MMR_LAST; i++) {
if (i == V2_MMR_BCHANRT && ud->bchan_cnt == 0)
@@ -1111,6 +1284,7 @@ static int udma_v2_probe(struct platform_device *pdev)
ud->reset_chan = udma_v2_reset_chan;
ud->decrement_byte_counters = udma_v2_decrement_byte_counters;
ud->bcdma_setup_sci_resources = NULL;
+ ud->pktdma_setup_sci_resources = NULL;
ret = udma_v2_get_mmrs(pdev, ud);
if (ret)
@@ -1118,7 +1292,17 @@ static int udma_v2_probe(struct platform_device *pdev)
struct k3_ringacc_init_data ring_init_data = {0};
- ring_init_data.num_rings = ud->bchan_cnt + ud->chan_cnt;
+ if (ud->match_data->type == DMA_TYPE_BCDMA) {
+ ring_init_data.num_rings = ud->bchan_cnt + ud->chan_cnt;
+ } else if (ud->match_data->type == DMA_TYPE_PKTDMA) {
+ ring_init_data.num_rings = ud->rflow_cnt;
+
+ ud->rflow_rt = devm_platform_ioremap_resource_byname(pdev, "ringrt");
+ if (IS_ERR(ud->rflow_rt))
+ return PTR_ERR(ud->rflow_rt);
+
+ ring_init_data.base_rt = ud->rflow_rt;
+ }
ud->ringacc = k3_ringacc_dmarings_init(pdev, &ring_init_data);
@@ -1127,8 +1311,10 @@ static int udma_v2_probe(struct platform_device *pdev)
dma_cap_set(DMA_SLAVE, ud->ddev.cap_mask);
- dma_cap_set(DMA_CYCLIC, ud->ddev.cap_mask);
- ud->ddev.device_prep_dma_cyclic = udma_prep_dma_cyclic;
+ if (ud->match_data->type != DMA_TYPE_PKTDMA) {
+ dma_cap_set(DMA_CYCLIC, ud->ddev.cap_mask);
+ ud->ddev.device_prep_dma_cyclic = udma_prep_dma_cyclic;
+ }
ud->ddev.device_config = udma_slave_config;
ud->ddev.device_prep_slave_sg = udma_prep_slave_sg;
@@ -1142,8 +1328,18 @@ static int udma_v2_probe(struct platform_device *pdev)
ud->ddev.dbg_summary_show = udma_dbg_summary_show;
#endif
- ud->ddev.device_alloc_chan_resources =
- bcdma_v2_alloc_chan_resources;
+ switch (ud->match_data->type) {
+ case DMA_TYPE_BCDMA:
+ ud->ddev.device_alloc_chan_resources =
+ bcdma_v2_alloc_chan_resources;
+ break;
+ case DMA_TYPE_PKTDMA:
+ ud->ddev.device_alloc_chan_resources =
+ pktdma_v2_alloc_chan_resources;
+ break;
+ default:
+ return -EINVAL;
+ }
ud->ddev.device_free_chan_resources = udma_free_chan_resources;
diff --git a/drivers/dma/ti/k3-udma.h b/drivers/dma/ti/k3-udma.h
index b2e5455b1087e..2a9686f7a09bc 100644
--- a/drivers/dma/ti/k3-udma.h
+++ b/drivers/dma/ti/k3-udma.h
@@ -27,8 +27,11 @@
#define UDMA_RX_FLOW_ID_FW_OES_REG 0x80
#define UDMA_RX_FLOW_ID_FW_STATUS_REG 0x88
+#define UDMA_RX_FLOWRT_RFA 0x8
+
/* BCHANRT/TCHANRT/RCHANRT registers */
#define UDMA_CHAN_RT_CTL_REG 0x0
+#define UDMA_CHAN_RT_CFG_REG 0x4
#define UDMA_CHAN_RT_SWTRIG_REG 0x8
#define UDMA_CHAN_RT_STDATA_REG 0x80
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 17/19] dmaengine: ti: k3-udma-v2: Add support for PKTDMA V2
2026-08-10 15:14 ` [PATCH v8 17/19] dmaengine: ti: k3-udma-v2: Add support for PKTDMA V2 Sai Sree Kartheek Adivi
@ 2026-08-10 17:09 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-08-10 17:09 UTC (permalink / raw)
To: Sai Sree Kartheek Adivi
Cc: conor+dt, dmaengine, Frank.Li, vkoul, robh, devicetree
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:
New issues:
- [Critical] Unconditional replacement of MSI interrupt fetching breaks existing V1 PKTDMA devices.
- [High] Unconditional dma_pool_destroy in error path causes a double-free of a dangling pointer.
- [High] udma_v2_stop writes to PEER registers on PKTDMA V2, violating hardware spec.
- [Low] Uninitialized static platform_driver used in DMA filter function.
Pre-existing issues:
- [High] DMA Use-After-Free if channel refuses to stop during allocation.
--
--- Patch [17]: [PATCH v8 17/19] dmaengine: ti: k3-udma-v2: Add support for PKTDMA V2 ---
commit 97b7da552f385a68cda5edae3dfd22d57863e91d
Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>
dmaengine: ti: k3-udma-v2: Add support for PKTDMA V2
The PKTDMA V2 is different than the existing PKTDMA supported by the
k3-udma driver.
The changes in PKTDMA V2 are:
[ ... ]
> - Direct IRQs: There is no INT-A and interrupt lines from DMA are
> directly connected to GIC.
> - Remote side configuration handled by DMA. So no need to write to
> PEER registers to START / STOP / PAUSE / TEARDOWN.
[Severity: High]
Does the implementation match this description? udma_v2_stop() is used by
PKTDMA V2 through the udma_v2_probe() assignment, but it unconditionally
writes to UDMA_CHAN_RT_PEER_REG for all non-MEM_TO_MEM transfers.
Will writing to these PEER registers on PKTDMA V2 hardware cause any
unexpected hardware exceptions?
> diff --git a/drivers/dma/ti/k3-udma-private.c b/drivers/dma/ti/k3-udma-private.c
> index 44c097fff5ee6..92d44ef9593d1 100644
> --- a/drivers/dma/ti/k3-udma-private.c
> +++ b/drivers/dma/ti/k3-udma-private.c
> @@ -174,16 +174,20 @@ EXPORT_SYMBOL(xudma_is_pktdma);
>
> int xudma_pktdma_tflow_get_irq(struct udma_dev *ud, int udma_tflow_id)
> {
> - const struct udma_oes_offsets *oes = &ud->soc_data->oes;
> + struct platform_device *pdev = to_platform_device(ud->dev);
> + char irq_name[10];
>
> - return msi_get_virq(ud->dev, udma_tflow_id + oes->pktdma_tchan_flow);
> + snprintf(irq_name, sizeof(irq_name), "tx-%u", udma_tflow_id);
> + return platform_get_irq_byname(pdev, irq_name);
> }
[Severity: Critical]
Does this unconditional replacement break existing V1 PKTDMA devices?
Client drivers for V1 devices that share this exported function will now call
platform_get_irq_byname() instead of msi_get_virq().
Since V1 device tree nodes do not define named "tx-%u" interrupts, will this
cause backward compatibility breakage and failures for V1 hardware?
> EXPORT_SYMBOL(xudma_pktdma_tflow_get_irq);
>
> int xudma_pktdma_rflow_get_irq(struct udma_dev *ud, int udma_rflow_id)
> {
> - const struct udma_oes_offsets *oes = &ud->soc_data->oes;
> + struct platform_device *pdev = to_platform_device(ud->dev);
> + char irq_name[10];
>
> - return msi_get_virq(ud->dev, udma_rflow_id + oes->pktdma_rchan_flow);
> + snprintf(irq_name, sizeof(irq_name), "rx-%u", udma_rflow_id);
> + return platform_get_irq_byname(pdev, irq_name);
> }
[Severity: Critical]
Similarly, does this break the RX flow interrupt fetching for V1 devices
that rely on the older MSI approach?
> diff --git a/drivers/dma/ti/k3-udma-v2.c b/drivers/dma/ti/k3-udma-v2.c
> index b9ce58d1934a9..c46341e768cdc 100644
> --- a/drivers/dma/ti/k3-udma-v2.c
> +++ b/drivers/dma/ti/k3-udma-v2.c
> @@ -764,6 +764,146 @@ static int bcdma_v2_alloc_chan_resources(struct dma_chan *chan)
> return ret;
> }
>
> +static int pktdma_v2_alloc_chan_resources(struct dma_chan *chan)
> +{
[ ... ]
> + if (udma_is_chan_running(uc)) {
> + dev_warn(ud->dev, "chan%d: is running!\n", uc->id);
> + ud->reset_chan(uc, false);
> + if (udma_is_chan_running(uc)) {
> + dev_err(ud->dev, "chan%d: won't stop!\n", uc->id);
> + ret = -EBUSY;
> + goto err_res_free;
> + }
> + }
[Severity: High]
This is a pre-existing issue, but can this lead to a DMA use-after-free
if the channel refuses to stop?
The error path frees the newly allocated DMA rings, but the hardware ring
was already configured to point to this memory earlier in the function via
udma_v2_alloc_tx_resources() or udma_v2_alloc_rx_resources().
If the hardware is still running, could it continue writing to the freed
memory?
[ ... ]
> +err_res_free:
> + udma_free_tx_resources(uc);
> + udma_free_rx_resources(uc);
> +
> + udma_reset_uchan(uc);
> +
> + dma_pool_destroy(uc->hdesc_pool);
> + uc->use_dma_pool = false;
> +
> + return ret;
> +}
[Severity: High]
Can this cause a double-free of a dangling pointer?
Unlike the BCDMA equivalent, the dma_pool_destroy() call here is
unconditional. If the error path is taken early (e.g., from the
udma_is_chan_running() check above) before a new pool is allocated,
uc->hdesc_pool might still point to an already destroyed pool.
Should this be guarded with a check for uc->use_dma_pool?
> @@ -864,6 +1004,7 @@ static int udma_v2_resume(struct dma_chan *chan)
> }
>
> static struct platform_driver bcdma_v2_driver;
> +static struct platform_driver pktdma_v2_driver;
>
> static bool udma_v2_dma_filter_fn(struct dma_chan *chan, void *param)
> {
> @@ -873,7 +1014,8 @@ static bool udma_v2_dma_filter_fn(struct dma_chan *chan, void *param)
> struct udma_chan *uc;
> struct udma_dev *ud;
>
> - if (chan->device->dev->driver != &bcdma_v2_driver.driver)
> + if (chan->device->dev->driver != &bcdma_v2_driver.driver &&
> + chan->device->dev->driver != &pktdma_v2_driver.driver)
> return false;
[Severity: Low]
Is pktdma_v2_driver intentionally left uninitialized here?
It is declared as a static struct platform_driver, but doesn't appear to be
defined anywhere in this patch, making this pointer comparison potentially
meaningless.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260810151423.1948224-1-s-adivi@ti.com?part=17
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 18/19] dmaengine: ti: k3-udma-v2: Update glue layer to support PKTDMA V2
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
` (16 preceding siblings ...)
2026-08-10 15:14 ` [PATCH v8 17/19] dmaengine: ti: k3-udma-v2: Add support for PKTDMA V2 Sai Sree Kartheek Adivi
@ 2026-08-10 15:14 ` Sai Sree Kartheek Adivi
2026-08-10 17:20 ` sashiko-bot
2026-08-10 15:14 ` [PATCH v8 19/19] dmaengine: ti: k3-udma: Validate resource ID and fix logging in reservation Sai Sree Kartheek Adivi
18 siblings, 1 reply; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:14 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
Update glue layer to support PKTDMA V2 for non DMAengine users.
The updates include
- Handling absence of TISCI
- Direct IRQs
- Autopair: Lack of PSIL pair.
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
drivers/dma/ti/Kconfig | 2 +-
drivers/dma/ti/k3-udma-glue.c | 182 ++++++++++++++++++++++++-------
drivers/dma/ti/k3-udma-private.c | 15 +++
drivers/dma/ti/k3-udma.h | 10 ++
4 files changed, 168 insertions(+), 41 deletions(-)
diff --git a/drivers/dma/ti/Kconfig b/drivers/dma/ti/Kconfig
index 40713bd1e8e9b..ada2ea8aca4b0 100644
--- a/drivers/dma/ti/Kconfig
+++ b/drivers/dma/ti/Kconfig
@@ -68,7 +68,7 @@ config TI_K3_UDMA_COMMON
config TI_K3_UDMA_GLUE_LAYER
tristate "Texas Instruments UDMA Glue layer for non DMAengine users"
depends on ARCH_K3 || COMPILE_TEST
- depends on TI_K3_UDMA
+ depends on TI_K3_UDMA || TI_K3_UDMA_V2
help
Say y here to support the K3 NAVSS DMA glue interface
If unsure, say N.
diff --git a/drivers/dma/ti/k3-udma-glue.c b/drivers/dma/ti/k3-udma-glue.c
index bec4deb480e60..9b9921e904bc2 100644
--- a/drivers/dma/ti/k3-udma-glue.c
+++ b/drivers/dma/ti/k3-udma-glue.c
@@ -12,6 +12,7 @@
#include <linux/dma-mapping.h>
#include <linux/io.h>
#include <linux/init.h>
+#include <linux/iopoll.h>
#include <linux/of.h>
#include <linux/platform_device.h>
#include <linux/soc/ti/k3-ringacc.h>
@@ -267,6 +268,19 @@ static int k3_udma_glue_cfg_tx_chn(struct k3_udma_glue_tx_channel *tx_chn)
const struct udma_tisci_rm *tisci_rm = tx_chn->common.tisci_rm;
struct ti_sci_msg_rm_udmap_tx_ch_cfg req;
+ if (!tisci_rm->tisci) {
+ u32 val = 0;
+
+ if (tx_chn->tx_filt_einfo)
+ val |= UDMA_CHAN_CFG_FILT_EINFO;
+ if (tx_chn->tx_filt_pswords)
+ val |= UDMA_CHAN_CFG_FILT_PSWORDS;
+
+ xudma_tchanrt_write(tx_chn->udma_tchanx, UDMA_CHAN_RT_CFG_REG, val);
+
+ return 0;
+ }
+
memset(&req, 0, sizeof(req));
req.valid_params = TI_SCI_MSG_VALUE_RM_UDMAP_CH_PAUSE_ON_ERR_VALID |
@@ -525,21 +539,38 @@ int k3_udma_glue_enable_tx_chn(struct k3_udma_glue_tx_channel *tx_chn)
{
int ret;
- ret = xudma_navss_psil_pair(tx_chn->common.udmax,
- tx_chn->common.src_thread,
- tx_chn->common.dst_thread);
- if (ret) {
- dev_err(tx_chn->common.dev, "PSI-L request err %d\n", ret);
- return ret;
- }
+ if (tx_chn->common.udmax->match_data->version == K3_UDMA_V1) {
+ ret = xudma_navss_psil_pair(tx_chn->common.udmax,
+ tx_chn->common.src_thread,
+ tx_chn->common.dst_thread);
+ if (ret) {
+ dev_err(tx_chn->common.dev, "PSI-L request err %d\n", ret);
+ return ret;
+ }
- tx_chn->psil_paired = true;
+ tx_chn->psil_paired = true;
- xudma_tchanrt_write(tx_chn->udma_tchanx, UDMA_CHAN_RT_PEER_RT_EN_REG,
- UDMA_PEER_RT_EN_ENABLE);
+ xudma_tchanrt_write(tx_chn->udma_tchanx, UDMA_CHAN_RT_PEER_RT_EN_REG,
+ UDMA_PEER_RT_EN_ENABLE);
- xudma_tchanrt_write(tx_chn->udma_tchanx, UDMA_CHAN_RT_CTL_REG,
- UDMA_CHAN_RT_CTL_EN);
+ xudma_tchanrt_write(tx_chn->udma_tchanx, UDMA_CHAN_RT_CTL_REG,
+ UDMA_CHAN_RT_CTL_EN);
+ } else {
+ u32 val;
+
+ xudma_tchanrt_write(tx_chn->udma_tchanx, UDMA_CHAN_RT_CTL_REG,
+ UDMA_CHAN_RT_CTL_AUTOPAIR | UDMA_CHAN_RT_CTL_EN);
+
+ ret = read_poll_timeout(xudma_tchanrt_read, val,
+ val & (UDMA_CHAN_RT_CTL_PAIR_COMPLETE |
+ UDMA_CHAN_RT_CTL_PAIR_TIMEOUT),
+ 100, 500, false,
+ tx_chn->udma_tchanx, UDMA_CHAN_RT_CTL_REG);
+ if (ret || (val & UDMA_CHAN_RT_CTL_PAIR_TIMEOUT)) {
+ dev_err(tx_chn->common.dev, "TX channel autopair timeout\n");
+ return -ETIMEDOUT;
+ }
+ }
k3_udma_glue_dump_tx_rt_chn(tx_chn, "txchn en");
return 0;
@@ -573,8 +604,16 @@ void k3_udma_glue_tdown_tx_chn(struct k3_udma_glue_tx_channel *tx_chn,
k3_udma_glue_dump_tx_rt_chn(tx_chn, "txchn tdown1");
- xudma_tchanrt_write(tx_chn->udma_tchanx, UDMA_CHAN_RT_CTL_REG,
- UDMA_CHAN_RT_CTL_EN | UDMA_CHAN_RT_CTL_TDOWN);
+ if (tx_chn->common.udmax->match_data->version == K3_UDMA_V1) {
+ xudma_tchanrt_write(tx_chn->udma_tchanx, UDMA_CHAN_RT_CTL_REG,
+ UDMA_CHAN_RT_CTL_EN | UDMA_CHAN_RT_CTL_TDOWN);
+ } else {
+ val = xudma_tchanrt_read(tx_chn->udma_tchanx, UDMA_CHAN_RT_CTL_REG);
+ xudma_tchanrt_write(tx_chn->udma_tchanx, UDMA_CHAN_RT_CTL_REG,
+ val | UDMA_CHAN_RT_CTL_TDOWN);
+ xudma_tchanrt_write(tx_chn->udma_tchanx, UDMA_CHAN_RT_PEER_REG(8),
+ UDMA_CHAN_RT_PEER_REG8_FLUSH);
+ }
val = xudma_tchanrt_read(tx_chn->udma_tchanx, UDMA_CHAN_RT_CTL_REG);
@@ -589,10 +628,12 @@ void k3_udma_glue_tdown_tx_chn(struct k3_udma_glue_tx_channel *tx_chn,
i++;
}
- val = xudma_tchanrt_read(tx_chn->udma_tchanx,
- UDMA_CHAN_RT_PEER_RT_EN_REG);
- if (sync && (val & UDMA_PEER_RT_EN_ENABLE))
- dev_err(tx_chn->common.dev, "TX tdown peer not stopped\n");
+ if (tx_chn->common.udmax->match_data->version == K3_UDMA_V1) {
+ val = xudma_tchanrt_read(tx_chn->udma_tchanx,
+ UDMA_CHAN_RT_PEER_RT_EN_REG);
+ if (sync && (val & UDMA_PEER_RT_EN_ENABLE))
+ dev_err(tx_chn->common.dev, "TX tdown peer not stopped\n");
+ }
k3_udma_glue_dump_tx_rt_chn(tx_chn, "txchn tdown2");
}
EXPORT_SYMBOL_GPL(k3_udma_glue_tdown_tx_chn);
@@ -705,7 +746,6 @@ static int k3_udma_glue_cfg_rx_chn(struct k3_udma_glue_rx_channel *rx_chn)
TI_SCI_MSG_VALUE_RM_UDMAP_CH_CHAN_TYPE_VALID |
TI_SCI_MSG_VALUE_RM_UDMAP_CH_ATYPE_VALID;
- req.nav_id = tisci_rm->tisci_dev_id;
req.index = rx_chn->udma_rchan_id;
req.rx_fetch_size = rx_chn->common.hdesc_size >> 2;
/*
@@ -725,11 +765,24 @@ static int k3_udma_glue_cfg_rx_chn(struct k3_udma_glue_rx_channel *rx_chn)
req.rx_chan_type = TI_SCI_RM_UDMAP_CHAN_TYPE_PKT_PBRR;
req.rx_atype = rx_chn->common.atype_asel;
+ if (!tisci_rm->tisci) {
+ u32 val = 0;
+
+ if (rx_chn->common.epib)
+ val |= UDMA_CHAN_CFG_FILT_EINFO;
+ if (rx_chn->common.psdata_size)
+ val |= UDMA_CHAN_CFG_FILT_PSWORDS;
+
+ xudma_rchanrt_write(rx_chn->udma_rchanx, UDMA_CHAN_RT_CFG_REG, val);
+
+ return 0;
+ }
+
+ req.nav_id = tisci_rm->tisci_dev_id;
ret = tisci_rm->tisci_udmap_ops->rx_ch_cfg(tisci_rm->tisci, &req);
if (ret)
dev_err(rx_chn->common.dev, "rchan%d cfg failed %d\n",
- rx_chn->udma_rchan_id, ret);
-
+ rx_chn->udma_rchan_id, ret);
return ret;
}
@@ -778,8 +831,11 @@ static int k3_udma_glue_cfg_rx_flow(struct k3_udma_glue_rx_channel *rx_chn,
}
if (xudma_is_pktdma(rx_chn->common.udmax)) {
- rx_ringfdq_id = flow->udma_rflow_id +
+ if (tisci_rm->tisci)
+ rx_ringfdq_id = flow->udma_rflow_id +
xudma_get_rflow_ring_offset(rx_chn->common.udmax);
+ else
+ rx_ringfdq_id = flow->udma_rflow_id;
rx_ring_id = 0;
} else {
rx_ring_id = flow_cfg->ring_rxq_id;
@@ -826,6 +882,19 @@ static int k3_udma_glue_cfg_rx_flow(struct k3_udma_glue_rx_channel *rx_chn,
rx_ringfdq_id = k3_ringacc_get_ring_id(flow->ringrxfdq);
}
+ if (!tisci_rm->tisci) {
+ u32 val = 0;
+
+ if (rx_chn->common.epib)
+ val |= UDMA_FLOWRT_RFA_RX_EINFO_PRESENT;
+ if (rx_chn->common.psdata_size)
+ val |= UDMA_FLOWRT_RFA_RX_PSINFO_PRESENT;
+
+ xudma_rflowrt_write(flow->udma_rflow, UDMA_RX_FLOWRT_RFA, val);
+ rx_chn->flows_ready++;
+ return 0;
+ }
+
memset(&req, 0, sizeof(req));
req.valid_params =
@@ -1330,6 +1399,9 @@ int k3_udma_glue_rx_flow_enable(struct k3_udma_glue_rx_channel *rx_chn,
if (!rx_chn->remote)
return -EINVAL;
+ if (!tisci_rm->tisci)
+ return 0;
+
rx_ring_id = k3_ringacc_get_ring_id(flow->ringrx);
rx_ringfdq_id = k3_ringacc_get_ring_id(flow->ringrxfdq);
@@ -1371,6 +1443,9 @@ int k3_udma_glue_rx_flow_disable(struct k3_udma_glue_rx_channel *rx_chn,
if (!rx_chn->remote)
return -EINVAL;
+ if (!tisci_rm->tisci)
+ return 0;
+
memset(&req, 0, sizeof(req));
req.valid_params =
TI_SCI_MSG_VALUE_RM_UDMAP_FLOW_DEST_QNUM_VALID |
@@ -1406,21 +1481,38 @@ int k3_udma_glue_enable_rx_chn(struct k3_udma_glue_rx_channel *rx_chn)
if (rx_chn->flows_ready < rx_chn->flow_num)
return -EINVAL;
- ret = xudma_navss_psil_pair(rx_chn->common.udmax,
- rx_chn->common.src_thread,
- rx_chn->common.dst_thread);
- if (ret) {
- dev_err(rx_chn->common.dev, "PSI-L request err %d\n", ret);
- return ret;
- }
+ if (rx_chn->common.udmax->match_data->version == K3_UDMA_V1) {
+ ret = xudma_navss_psil_pair(rx_chn->common.udmax,
+ rx_chn->common.src_thread,
+ rx_chn->common.dst_thread);
+ if (ret) {
+ dev_err(rx_chn->common.dev, "PSI-L request err %d\n", ret);
+ return ret;
+ }
- rx_chn->psil_paired = true;
+ rx_chn->psil_paired = true;
- xudma_rchanrt_write(rx_chn->udma_rchanx, UDMA_CHAN_RT_CTL_REG,
- UDMA_CHAN_RT_CTL_EN);
+ xudma_rchanrt_write(rx_chn->udma_rchanx, UDMA_CHAN_RT_CTL_REG,
+ UDMA_CHAN_RT_CTL_EN);
- xudma_rchanrt_write(rx_chn->udma_rchanx, UDMA_CHAN_RT_PEER_RT_EN_REG,
- UDMA_PEER_RT_EN_ENABLE);
+ xudma_rchanrt_write(rx_chn->udma_rchanx, UDMA_CHAN_RT_PEER_RT_EN_REG,
+ UDMA_PEER_RT_EN_ENABLE);
+ } else {
+ u32 val;
+
+ xudma_rchanrt_write(rx_chn->udma_rchanx, UDMA_CHAN_RT_CTL_REG,
+ UDMA_CHAN_RT_CTL_AUTOPAIR | UDMA_CHAN_RT_CTL_EN);
+
+ ret = read_poll_timeout(xudma_rchanrt_read, val,
+ val & (UDMA_CHAN_RT_CTL_PAIR_COMPLETE |
+ UDMA_CHAN_RT_CTL_PAIR_TIMEOUT),
+ 100, 500, false,
+ rx_chn->udma_rchanx, UDMA_CHAN_RT_CTL_REG);
+ if (ret || (val & UDMA_CHAN_RT_CTL_PAIR_TIMEOUT)) {
+ dev_err(rx_chn->common.dev, "RX channel autopair timeout\n");
+ return -ETIMEDOUT;
+ }
+ }
k3_udma_glue_dump_rx_rt_chn(rx_chn, "rxrt en");
return 0;
@@ -1457,8 +1549,16 @@ void k3_udma_glue_tdown_rx_chn(struct k3_udma_glue_rx_channel *rx_chn,
k3_udma_glue_dump_rx_rt_chn(rx_chn, "rxrt tdown1");
- xudma_rchanrt_write(rx_chn->udma_rchanx, UDMA_CHAN_RT_PEER_RT_EN_REG,
- UDMA_PEER_RT_EN_ENABLE | UDMA_PEER_RT_EN_TEARDOWN);
+ if (rx_chn->common.udmax->match_data->version == K3_UDMA_V1) {
+ xudma_rchanrt_write(rx_chn->udma_rchanx, UDMA_CHAN_RT_PEER_RT_EN_REG,
+ UDMA_PEER_RT_EN_ENABLE | UDMA_PEER_RT_EN_TEARDOWN);
+ } else {
+ xudma_rchanrt_write(rx_chn->udma_rchanx, UDMA_CHAN_RT_PEER_REG(8),
+ UDMA_CHAN_RT_PEER_REG8_FLUSH);
+ val = xudma_rchanrt_read(rx_chn->udma_rchanx, UDMA_CHAN_RT_CTL_REG);
+ xudma_rchanrt_write(rx_chn->udma_rchanx, UDMA_CHAN_RT_CTL_REG,
+ val | UDMA_CHAN_RT_CTL_TDOWN);
+ }
val = xudma_rchanrt_read(rx_chn->udma_rchanx, UDMA_CHAN_RT_CTL_REG);
@@ -1473,10 +1573,12 @@ void k3_udma_glue_tdown_rx_chn(struct k3_udma_glue_rx_channel *rx_chn,
i++;
}
- val = xudma_rchanrt_read(rx_chn->udma_rchanx,
- UDMA_CHAN_RT_PEER_RT_EN_REG);
- if (sync && (val & UDMA_PEER_RT_EN_ENABLE))
- dev_err(rx_chn->common.dev, "TX tdown peer not stopped\n");
+ if (rx_chn->common.udmax->match_data->version == K3_UDMA_V1) {
+ val = xudma_rchanrt_read(rx_chn->udma_rchanx,
+ UDMA_CHAN_RT_PEER_RT_EN_REG);
+ if (sync && (val & UDMA_PEER_RT_EN_ENABLE))
+ dev_err(rx_chn->common.dev, "TX tdown peer not stopped\n");
+ }
k3_udma_glue_dump_rx_rt_chn(rx_chn, "rxrt tdown2");
}
EXPORT_SYMBOL_GPL(k3_udma_glue_tdown_rx_chn);
diff --git a/drivers/dma/ti/k3-udma-private.c b/drivers/dma/ti/k3-udma-private.c
index 92d44ef9593d1..d6d99f60519a1 100644
--- a/drivers/dma/ti/k3-udma-private.c
+++ b/drivers/dma/ti/k3-udma-private.c
@@ -3,6 +3,10 @@
* Copyright (C) 2019 Texas Instruments Incorporated - http://www.ti.com
* Author: Peter Ujfalusi <peter.ujfalusi@ti.com>
*/
+#include <linux/irq.h>
+#include <linux/irqchip.h>
+#include <linux/irqdomain.h>
+#include <linux/interrupt.h>
#include <linux/of.h>
#include <linux/of_platform.h>
@@ -165,6 +169,7 @@ void xudma_##res##rt_write(struct udma_##res *p, int reg, u32 val) \
EXPORT_SYMBOL(xudma_##res##rt_write)
XUDMA_RT_IO_FUNCTIONS(tchan);
XUDMA_RT_IO_FUNCTIONS(rchan);
+XUDMA_RT_IO_FUNCTIONS(rflow);
int xudma_is_pktdma(struct udma_dev *ud)
{
@@ -174,6 +179,11 @@ EXPORT_SYMBOL(xudma_is_pktdma);
int xudma_pktdma_tflow_get_irq(struct udma_dev *ud, int udma_tflow_id)
{
+ if (ud->match_data->version == K3_UDMA_V1) {
+ const struct udma_oes_offsets *oes = &ud->soc_data->oes;
+
+ return msi_get_virq(ud->dev, udma_tflow_id + oes->pktdma_tchan_flow);
+ }
struct platform_device *pdev = to_platform_device(ud->dev);
char irq_name[10];
@@ -184,6 +194,11 @@ EXPORT_SYMBOL(xudma_pktdma_tflow_get_irq);
int xudma_pktdma_rflow_get_irq(struct udma_dev *ud, int udma_rflow_id)
{
+ if (ud->match_data->version == K3_UDMA_V1) {
+ const struct udma_oes_offsets *oes = &ud->soc_data->oes;
+
+ return msi_get_virq(ud->dev, udma_rflow_id + oes->pktdma_rchan_flow);
+ }
struct platform_device *pdev = to_platform_device(ud->dev);
char irq_name[10];
diff --git a/drivers/dma/ti/k3-udma.h b/drivers/dma/ti/k3-udma.h
index 2a9686f7a09bc..aa7425380dbef 100644
--- a/drivers/dma/ti/k3-udma.h
+++ b/drivers/dma/ti/k3-udma.h
@@ -85,6 +85,14 @@
#define UDMA_CHAN_RT_CTL_PAIR_COMPLETE BIT(16)
#define UDMA_CHAN_RT_CTL_ERROR BIT(0)
+/* UDMA_CHAN_CFG_REG */
+#define UDMA_CHAN_CFG_FILT_EINFO BIT(30)
+#define UDMA_CHAN_CFG_FILT_PSWORDS BIT(29)
+
+/* UDMA_RX_FLOWRT_RFA */
+#define UDMA_FLOWRT_RFA_RX_EINFO_PRESENT BIT(30)
+#define UDMA_FLOWRT_RFA_RX_PSINFO_PRESENT BIT(29)
+
/* UDMA_CHAN_RT_PDMA_STATE_REG */
#define UDMA_CHAN_RT_PDMA_STATE_IN_EVT BIT(31)
#define UDMA_CHAN_RT_PDMA_STATE_TDOWN BIT(30)
@@ -747,6 +755,8 @@ u32 xudma_rchanrt_read(struct udma_rchan *rchan, int reg);
void xudma_rchanrt_write(struct udma_rchan *rchan, int reg, u32 val);
bool xudma_rflow_is_gp(struct udma_dev *ud, int id);
int xudma_get_rflow_ring_offset(struct udma_dev *ud);
+u32 xudma_rflowrt_read(struct udma_rflow *rflow, int reg);
+void xudma_rflowrt_write(struct udma_rflow *rflow, int reg, u32 val);
int xudma_is_pktdma(struct udma_dev *ud);
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 18/19] dmaengine: ti: k3-udma-v2: Update glue layer to support PKTDMA V2
2026-08-10 15:14 ` [PATCH v8 18/19] dmaengine: ti: k3-udma-v2: Update glue layer to support " Sai Sree Kartheek Adivi
@ 2026-08-10 17:20 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-08-10 17:20 UTC (permalink / raw)
To: Sai Sree Kartheek Adivi
Cc: Frank.Li, conor+dt, devicetree, vkoul, dmaengine, robh
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Hardware TX and RX channels are left enabled if the V2 autopairing process times out, leading to potential DMA Use-After-Free.
- [Low] Unmet direct dependency for `TI_K3_RINGACC` when `TI_K3_UDMA_V2` is selected.
--
--- Patch [18]: [PATCH v8 18/19] dmaengine: ti: k3-udma-v2: Update glue layer to support PKTDMA V2 ---
commit 679ff99789e75f58a08b38ae95963dd08f423c94
Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>
dmaengine: ti: k3-udma-v2: Update glue layer to support PKTDMA V2
Update glue layer to support PKTDMA V2 for non DMAengine users.
The updates include handling absence of TISCI, direct IRQs, and
Autopair: Lack of PSIL pair.
> diff --git a/drivers/dma/ti/Kconfig b/drivers/dma/ti/Kconfig
> index 40713bd1e8e9b..ada2ea8aca4b0 100644
> --- a/drivers/dma/ti/Kconfig
> +++ b/drivers/dma/ti/Kconfig
> @@ -68,7 +68,7 @@ config TI_K3_UDMA_COMMON
> config TI_K3_UDMA_GLUE_LAYER
> tristate "Texas Instruments UDMA Glue layer for non DMAengine users"
> depends on ARCH_K3 || COMPILE_TEST
> - depends on TI_K3_UDMA
> + depends on TI_K3_UDMA || TI_K3_UDMA_V2
[Severity: Low]
Does selecting TI_K3_UDMA_V2 cause an unmet dependency warning?
TI_K3_UDMA_V2 selects TI_K3_RINGACC but lacks the depends on
TI_SCI_INTA_IRQCHIP dependency required by TI_K3_RINGACC.
> help
> Say y here to support the K3 NAVSS DMA glue interface
> If unsure, say N.
[ ... ]
> diff --git a/drivers/dma/ti/k3-udma-glue.c b/drivers/dma/ti/k3-udma-glue.c
> index bec4deb480e60..9b9921e904bc2 100644
> --- a/drivers/dma/ti/k3-udma-glue.c
> +++ b/drivers/dma/ti/k3-udma-glue.c
[ ... ]
> @@ -525,21 +539,38 @@ int k3_udma_glue_enable_tx_chn(struct k3_udma_glue_tx_channel *tx_chn)
> {
> int ret;
>
> - ret = xudma_navss_psil_pair(tx_chn->common.udmax,
> - tx_chn->common.src_thread,
> - tx_chn->common.dst_thread);
> - if (ret) {
> - dev_err(tx_chn->common.dev, "PSI-L request err %d\n", ret);
> - return ret;
> - }
> + if (tx_chn->common.udmax->match_data->version == K3_UDMA_V1) {
[ ... ]
> + } else {
> + u32 val;
> +
> + xudma_tchanrt_write(tx_chn->udma_tchanx, UDMA_CHAN_RT_CTL_REG,
> + UDMA_CHAN_RT_CTL_AUTOPAIR | UDMA_CHAN_RT_CTL_EN);
> +
> + ret = read_poll_timeout(xudma_tchanrt_read, val,
> + val & (UDMA_CHAN_RT_CTL_PAIR_COMPLETE |
> + UDMA_CHAN_RT_CTL_PAIR_TIMEOUT),
> + 100, 500, false,
> + tx_chn->udma_tchanx, UDMA_CHAN_RT_CTL_REG);
> + if (ret || (val & UDMA_CHAN_RT_CTL_PAIR_TIMEOUT)) {
> + dev_err(tx_chn->common.dev, "TX channel autopair timeout\n");
> + return -ETIMEDOUT;
> + }
[Severity: High]
If the autopairing times out, does this leave the TX channel enabled?
Since UDMA_CHAN_RT_CTL_EN was set before the timeout and is not cleared on
this error path, could the hardware eventually pair and perform DMA accesses
to freed memory if callers assume a failure means the channel is inactive?
> + }
>
> k3_udma_glue_dump_tx_rt_chn(tx_chn, "txchn en");
> return 0;
[ ... ]
> @@ -1406,21 +1481,38 @@ int k3_udma_glue_enable_rx_chn(struct k3_udma_glue_rx_channel *rx_chn)
> if (rx_chn->flows_ready < rx_chn->flow_num)
> return -EINVAL;
>
> - ret = xudma_navss_psil_pair(rx_chn->common.udmax,
> - rx_chn->common.src_thread,
> - rx_chn->common.dst_thread);
> - if (ret) {
> - dev_err(rx_chn->common.dev, "PSI-L request err %d\n", ret);
> - return ret;
> - }
> + if (rx_chn->common.udmax->match_data->version == K3_UDMA_V1) {
[ ... ]
> + } else {
> + u32 val;
> +
> + xudma_rchanrt_write(rx_chn->udma_rchanx, UDMA_CHAN_RT_CTL_REG,
> + UDMA_CHAN_RT_CTL_AUTOPAIR | UDMA_CHAN_RT_CTL_EN);
> +
> + ret = read_poll_timeout(xudma_rchanrt_read, val,
> + val & (UDMA_CHAN_RT_CTL_PAIR_COMPLETE |
> + UDMA_CHAN_RT_CTL_PAIR_TIMEOUT),
> + 100, 500, false,
> + rx_chn->udma_rchanx, UDMA_CHAN_RT_CTL_REG);
> + if (ret || (val & UDMA_CHAN_RT_CTL_PAIR_TIMEOUT)) {
> + dev_err(rx_chn->common.dev, "RX channel autopair timeout\n");
> + return -ETIMEDOUT;
> + }
[Severity: High]
Similarly for the RX channel, if the autopairing times out, does this return
-ETIMEDOUT without disabling the hardware channel?
Could this lead to memory corruption if the hardware operates after the driver
has freed the associated ring buffers?
> + }
>
> k3_udma_glue_dump_rx_rt_chn(rx_chn, "rxrt en");
> return 0;
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260810151423.1948224-1-s-adivi@ti.com?part=18
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 19/19] dmaengine: ti: k3-udma: Validate resource ID and fix logging in reservation
2026-08-10 15:13 [PATCH v8 00/19] dmaengine: ti: Add support for BCDMA v2 and PKTDMA v2 Sai Sree Kartheek Adivi
` (17 preceding siblings ...)
2026-08-10 15:14 ` [PATCH v8 18/19] dmaengine: ti: k3-udma-v2: Update glue layer to support " Sai Sree Kartheek Adivi
@ 2026-08-10 15:14 ` Sai Sree Kartheek Adivi
2026-08-10 17:35 ` sashiko-bot
18 siblings, 1 reply; 35+ messages in thread
From: Sai Sree Kartheek Adivi @ 2026-08-10 15:14 UTC (permalink / raw)
To: peter.ujfalusi, vigneshr, vkoul, Frank.Li, robh, krzk+dt,
conor+dt, nm, ssantosh, s-adivi, dmaengine, devicetree,
linux-kernel, linux-arm-kernel, r-sharma3, gehariprasath
The `__udma_reserve_##res` macro currently lacks a bounds check for
the provided `id`. If a caller passes an ID exceeding the resource
count (`ud->res##_cnt`), `test_bit()` performs an out-of-bounds
memory access on the bitmap.
Additionally, the macro returns `-ENOENT` when a resource is already
in use, which is semantically incorrect. The logging logic is also
broken, printing the literal "res##<id>" instead of the resource
name.
Update the macro to:
1. Validate `id` against `ud->res##_cnt` and return `-EINVAL` if out
of bounds.
2. Return `-EBUSY` instead of `-ENOENT` when a resource is already
reserved, correctly reflecting the resource state.
3. Use the stringification operator `#res` to correctly print the
resource name (e.g., "tchan") in error messages.
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
---
drivers/dma/ti/k3-udma-common.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
index d5d7158a37f8f..381e1a30c0be7 100644
--- a/drivers/dma/ti/k3-udma-common.c
+++ b/drivers/dma/ti/k3-udma-common.c
@@ -2016,9 +2016,14 @@ struct udma_##res *__udma_reserve_##res(struct udma_dev *ud, \
int id) \
{ \
if (id >= 0) { \
+ if (id >= ud->res##_cnt) { \
+ dev_err(ud->dev, \
+ #res " id %d is out of bounds.\n", id); \
+ return ERR_PTR(-EINVAL); \
+ } \
if (test_bit(id, ud->res##_map)) { \
- dev_err(ud->dev, "res##%d is in use\n", id); \
- return ERR_PTR(-ENOENT); \
+ dev_err(ud->dev, #res "%d is in use\n", id); \
+ return ERR_PTR(-EBUSY); \
} \
} else { \
int start; \
--
2.54.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 19/19] dmaengine: ti: k3-udma: Validate resource ID and fix logging in reservation
2026-08-10 15:14 ` [PATCH v8 19/19] dmaengine: ti: k3-udma: Validate resource ID and fix logging in reservation Sai Sree Kartheek Adivi
@ 2026-08-10 17:35 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-08-10 17:35 UTC (permalink / raw)
To: Sai Sree Kartheek Adivi
Cc: Frank.Li, dmaengine, robh, conor+dt, devicetree, vkoul
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Pre-existing issues:
- [High] The K3 UDMA resource allocation APIs perform unprotected, non-atomic test-and-set sequences on resource bitmaps, leading to concurrent allocations of the same hardware DMA channel.
- [High] Missing bounds check on `tflow_id` when allocating a transmit flow in `udma_get_tchan()`, leading to potential out-of-bounds bitmap access and incorrect error return.
--
--- Patch [19]: [PATCH v8 19/19] dmaengine: ti: k3-udma: Validate resource ID and fix logging in reservation ---
commit 491caa42a0fc50724787a5febd8ecf1dd0d46ac0
Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>
dmaengine: ti: k3-udma: Validate resource ID and fix logging in reservation
The __udma_reserve_##res macro currently lacks a bounds check for
the provided id. If a caller passes an ID exceeding the resource
count (ud->res##_cnt), test_bit() performs an out-of-bounds
memory access on the bitmap.
Additionally, the macro returns -ENOENT when a resource is already
in use, which is semantically incorrect.
Update the macro to validate the id, return -EBUSY instead of -ENOENT
for reserved resources, and properly print the resource name.
> diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
> index d5d7158a37f8f..381e1a30c0be7 100644
> --- a/drivers/dma/ti/k3-udma-common.c
> +++ b/drivers/dma/ti/k3-udma-common.c
> @@ -2016,9 +2016,14 @@ struct udma_##res *__udma_reserve_##res(struct udma_dev *ud, \
> int id) \
> { \
> if (id >= 0) { \
> + if (id >= ud->res##_cnt) { \
> + dev_err(ud->dev, \
> + #res " id %d is out of bounds.\n", id); \
> + return ERR_PTR(-EINVAL); \
> + } \
> if (test_bit(id, ud->res##_map)) { \
> - dev_err(ud->dev, "res##%d is in use\n", id); \
> - return ERR_PTR(-ENOENT); \
> + dev_err(ud->dev, #res "%d is in use\n", id); \
> + return ERR_PTR(-EBUSY); \
> } \
[Severity: High]
This is a pre-existing issue, but does this unprotected non-atomic
test-and-set sequence on the resource bitmap allow concurrent allocations of
the same hardware DMA channel?
If multiple client drivers request resources during parallel asynchronous
probe without external synchronization:
Driver 1 checks test_bit():
if (test_bit(id, ud->res##_map)) { ... }
Driver 2 checks test_bit() concurrently:
if (test_bit(id, ud->res##_map)) { ... }
Both drivers then proceed to set the same bit at the end of the macro:
set_bit(id, ud->res##_map);
Could they both receive the same DMA channel?
This same unprotected pattern appears in __udma_get_rflow() and
__udma_alloc_gp_rflow_range().
[Severity: High]
This isn't a bug introduced by this patch, but while adding bounds checks
here, should we also add them to udma_get_tchan() in the same file?
In udma_get_tchan(), tflow_id is used in test_bit() and set_bit() on
ud->tflow_map without being validated against ud->tflow_cnt:
if (test_bit(tflow_id, ud->tflow_map)) {
dev_err(ud->dev, "tflow%d is in use\n", tflow_id);
clear_bit(uc->tchan->id, ud->tchan_map);
uc->tchan = NULL;
return -ENOENT;
}
uc->tchan->tflow_id = tflow_id;
set_bit(tflow_id, ud->tflow_map);
Can this write beyond the bounds of the bitmap if an invalid default_flow_id
is supplied from the Device Tree, or if tchan_cnt > tflow_cnt?
Additionally, it looks like this function still returns -ENOENT instead of
-EBUSY when a resource is already in use.
> } else { \
> int start; \
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260810151423.1948224-1-s-adivi@ti.com?part=19
^ permalink raw reply [flat|nested] 35+ messages in thread