[PATCH v10 1/2] net: airoha: npu: fix missing streaming DMA mask

[PATCH v10 1/2] net: airoha: npu: fix missing streaming DMA mask

[Daniel Pawlik]

The driver calls dma_set_coherent_mask() but never dma_set_mask(),
leaving the streaming DMA mask at the bus default. On the non-coherent
EN7581 platform (Cortex-A53), this causes the NPU mailbox to hang
after approximately 41 calls when using streaming DMA mappings.

Replace dma_set_coherent_mask() with dma_set_mask_and_coherent() to
set both the streaming and coherent DMA masks, matching standard
driver practice.

Fixes: 6f884eb87a79 ("net: airoha: Fix DMA direction for NPU mailbox buffer")
Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260814110017.2795022-1-pawlik.dan@gmail.com/
Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260809152813.585797-1-pawlik.dan@gmail.com/
Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260805070851.2885888-1-pawlik.dan@gmail.com/
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Daniel Pawlik <pawlik.dan@gmail.com>
---
 drivers/net/ethernet/airoha/airoha_npu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/airoha/airoha_npu.c b/drivers/net/ethernet/airoha/airoha_npu.c
index b679bed952de..4045d1eb93ea 100644
--- a/drivers/net/ethernet/airoha/airoha_npu.c
+++ b/drivers/net/ethernet/airoha/airoha_npu.c
@@ -766,7 +766,7 @@ static int airoha_npu_probe(struct platform_device *pdev)
 		npu->irqs[i] = irq;
 	}
 
-	err = dma_set_coherent_mask(dev, DMA_BIT_MASK(32));
+	err = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
 	if (err)
 		return err;
 
-- 
2.55.0

[PATCH v10 2/2] net: airoha: npu: use cacheline-sized buffers for mailbox DMA

[Daniel Pawlik]

On non-coherent ARM64 (EN7581), the kernel's dma_direct_map_page()
forces swiotlb bounce buffering when:

  !IS_ALIGNED(phys | size, dma_get_cache_alignment())

The NPU mailbox buffers are 12-24 bytes, well below the 64-byte cache
line size, so this check always fails regardless of physical address
alignment. The swiotlb sync path itself works correctly, but the
EN7581 NPU cannot DMA-write to the swiotlb bounce buffer address
range — it reads commands fine (mbox_status=0x7 success) but never
writes responses back, leaving response fields as zeros.

This was confirmed through five boot traces on a Gemtek W1700K:

  - Boots 1-4: all streaming DMA through swiotlb (is_swiotlb=1),
    bounce buffer byte-identical to pre-map after NPU completion,
    even after explicit CPU cache invalidation (dcache_inval_poc).
    NPU version reads 0.0.

  - Boot 5: kmalloc'd cache-line-aligned buffer bypasses swiotlb
    (is_swiotlb=0 on all 169 mappings), NPU writes response data
    directly, version reads 0.1111, WiFi fully functional.

Fix by rounding mailbox buffer allocations up to
dma_get_cache_alignment() and mapping the rounded length. The original
payload size is still programmed into the mailbox length register.
kmalloc returns cache-line-aligned pointers on ARM64 for allocations
>= ARCH_KMALLOC_MINALIGN, so the IS_ALIGNED check passes and swiotlb
is not triggered.

Fixes: 6f884eb87a79 ("net: airoha: Fix DMA direction for NPU mailbox buffer")
Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260814110017.2795022-1-pawlik.dan@gmail.com/
Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260809152813.585797-1-pawlik.dan@gmail.com/
Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260805070851.2885888-1-pawlik.dan@gmail.com/
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Daniel Pawlik <pawlik.dan@gmail.com>
---
 drivers/net/ethernet/airoha/airoha_npu.c | 25 +++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/drivers/net/ethernet/airoha/airoha_npu.c b/drivers/net/ethernet/airoha/airoha_npu.c
index 4045d1eb93ea..3416f921f961 100644
--- a/drivers/net/ethernet/airoha/airoha_npu.c
+++ b/drivers/net/ethernet/airoha/airoha_npu.c
@@ -5,6 +5,7 @@
  */
 
 #include <linux/devcoredump.h>
+#include <linux/dma-mapping.h>
 #include <linux/firmware.h>
 #include <linux/platform_device.h>
 #include <linux/of_net.h>
@@ -160,15 +161,21 @@ struct wlan_mbox_data {
 	DECLARE_FLEX_ARRAY(u8, d);
 };
 
+static size_t airoha_npu_mbox_size(size_t len)
+{
+	return ALIGN(len, dma_get_cache_alignment());
+}
+
 static int airoha_npu_send_msg(struct airoha_npu *npu, int func_id,
 			       void *p, int size)
 {
 	u16 core = 0; /* FIXME */
 	u32 val, offset = core << 4;
 	dma_addr_t dma_addr;
+	size_t map_len = airoha_npu_mbox_size(size);
 	int ret;
 
-	dma_addr = dma_map_single(npu->dev, p, size, DMA_BIDIRECTIONAL);
+	dma_addr = dma_map_single(npu->dev, p, map_len, DMA_BIDIRECTIONAL);
 	ret = dma_mapping_error(npu->dev, dma_addr);
 	if (ret)
 		return ret;
@@ -191,7 +198,7 @@ static int airoha_npu_send_msg(struct airoha_npu *npu, int func_id,
 
 	spin_unlock_bh(&npu->cores[core].lock);
 
-	dma_unmap_single(npu->dev, dma_addr, size, DMA_BIDIRECTIONAL);
+	dma_unmap_single(npu->dev, dma_addr, map_len, DMA_BIDIRECTIONAL);
 
 	return ret;
 }
@@ -333,7 +340,7 @@ static int airoha_npu_ppe_init(struct airoha_npu *npu)
 	struct ppe_mbox_data *ppe_data;
 	int err;
 
-	ppe_data = kzalloc_obj(*ppe_data);
+	ppe_data = kzalloc(airoha_npu_mbox_size(sizeof(*ppe_data)), GFP_KERNEL);
 	if (!ppe_data)
 		return -ENOMEM;
 
@@ -354,7 +361,7 @@ static int airoha_npu_ppe_deinit(struct airoha_npu *npu)
 	struct ppe_mbox_data *ppe_data;
 	int err;
 
-	ppe_data = kzalloc_obj(*ppe_data);
+	ppe_data = kzalloc(airoha_npu_mbox_size(sizeof(*ppe_data)), GFP_KERNEL);
 	if (!ppe_data)
 		return -ENOMEM;
 
@@ -375,7 +382,7 @@ static int airoha_npu_ppe_flush_sram_entries(struct airoha_npu *npu,
 	struct ppe_mbox_data *ppe_data;
 	int err;
 
-	ppe_data = kzalloc_obj(*ppe_data);
+	ppe_data = kzalloc(airoha_npu_mbox_size(sizeof(*ppe_data)), GFP_KERNEL);
 	if (!ppe_data)
 		return -ENOMEM;
 
@@ -399,7 +406,7 @@ static int airoha_npu_foe_commit_entry(struct airoha_npu *npu,
 	struct ppe_mbox_data *ppe_data;
 	int err;
 
-	ppe_data = kzalloc_obj(*ppe_data, GFP_ATOMIC);
+	ppe_data = kzalloc(airoha_npu_mbox_size(sizeof(*ppe_data)), GFP_ATOMIC);
 	if (!ppe_data)
 		return -ENOMEM;
 
@@ -434,7 +441,7 @@ static int airoha_npu_ppe_stats_setup(struct airoha_npu *npu,
 	int err, size = num_stats_entries * sizeof(*npu->stats);
 	struct ppe_mbox_data *ppe_data;
 
-	ppe_data = kzalloc_obj(*ppe_data, GFP_ATOMIC);
+	ppe_data = kzalloc(airoha_npu_mbox_size(sizeof(*ppe_data)), GFP_ATOMIC);
 	if (!ppe_data)
 		return -ENOMEM;
 
@@ -466,7 +473,7 @@ static int airoha_npu_wlan_msg_send(struct airoha_npu *npu, int ifindex,
 	int err, len;
 
 	len = sizeof(*wlan_data) + data_len;
-	wlan_data = kzalloc(len, gfp);
+	wlan_data = kzalloc(airoha_npu_mbox_size(len), gfp);
 	if (!wlan_data)
 		return -ENOMEM;
 
@@ -489,7 +496,7 @@ static int airoha_npu_wlan_msg_get(struct airoha_npu *npu, int ifindex,
 	int err, len;
 
 	len = sizeof(*wlan_data) + data_len;
-	wlan_data = kzalloc(len, gfp);
+	wlan_data = kzalloc(airoha_npu_mbox_size(len), gfp);
 	if (!wlan_data)
 		return -ENOMEM;
 
-- 
2.55.0

Re: [PATCH v10 1/2] net: airoha: npu: fix missing streaming DMA mask

[Lorenzo Bianconi]

[-- Attachment #1: Type: text/plain, Size: 1667 bytes --]

> The driver calls dma_set_coherent_mask() but never dma_set_mask(),
> leaving the streaming DMA mask at the bus default. On the non-coherent
> EN7581 platform (Cortex-A53), this causes the NPU mailbox to hang
> after approximately 41 calls when using streaming DMA mappings.
> 
> Replace dma_set_coherent_mask() with dma_set_mask_and_coherent() to
> set both the streaming and coherent DMA masks, matching standard
> driver practice.
> 
> Fixes: 6f884eb87a79 ("net: airoha: Fix DMA direction for NPU mailbox buffer")
> Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260814110017.2795022-1-pawlik.dan@gmail.com/
> Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260809152813.585797-1-pawlik.dan@gmail.com/
> Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260805070851.2885888-1-pawlik.dan@gmail.com/
> Assisted-by: Claude:claude-opus-4-6
> Signed-off-by: Daniel Pawlik <pawlik.dan@gmail.com>

Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>

> ---
>  drivers/net/ethernet/airoha/airoha_npu.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/airoha/airoha_npu.c b/drivers/net/ethernet/airoha/airoha_npu.c
> index b679bed952de..4045d1eb93ea 100644
> --- a/drivers/net/ethernet/airoha/airoha_npu.c
> +++ b/drivers/net/ethernet/airoha/airoha_npu.c
> @@ -766,7 +766,7 @@ static int airoha_npu_probe(struct platform_device *pdev)
>  		npu->irqs[i] = irq;
>  	}
>  
> -	err = dma_set_coherent_mask(dev, DMA_BIT_MASK(32));
> +	err = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
>  	if (err)
>  		return err;
>  
> -- 
> 2.55.0
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v10 1/2] net: airoha: npu: fix missing streaming DMA mask

[Jakub Kicinski]

On Thu, 20 Aug 2026 10:59:40 +0200 Daniel Pawlik wrote:
> The driver calls dma_set_coherent_mask() but never dma_set_mask(),
> leaving the streaming DMA mask at the bus default. On the non-coherent
> EN7581 platform (Cortex-A53), this causes the NPU mailbox to hang
> after approximately 41 calls when using streaming DMA mappings.

Can you confirm if patch 2 is still needed after this fix?

Re: [PATCH v10 1/2] net: airoha: npu: fix missing streaming DMA mask

[Daniel Pawlik]

Hi,

I tested both patches independently:

- Patch 1 alone (DMA mask): NPU reports version 0.0 - probe fails.
  The streaming mask is correct but 24-byte buffers still bounce
  through swiotlb, and the NPU can't write to that address range.

- Patch 2 alone (cacheline buffers): NPU reports version 0.1111 -
  works. Cache-line-aligned allocations bypass swiotlb entirely.

So patch 2 is the essential fix, but patch 1 is still good to have as
a defensive measure - without a proper streaming DMA mask, any
future sub-cacheline streaming mapping would silently break.

Dan

sob., 22 sie 2026 o 21:27 Jakub Kicinski <kuba@kernel.org> napisał(a):
>
> On Thu, 20 Aug 2026 10:59:40 +0200 Daniel Pawlik wrote:
> > The driver calls dma_set_coherent_mask() but never dma_set_mask(),
> > leaving the streaming DMA mask at the bus default. On the non-coherent
> > EN7581 platform (Cortex-A53), this causes the NPU mailbox to hang
> > after approximately 41 calls when using streaming DMA mappings.
>
> Can you confirm if patch 2 is still needed after this fix?



--
Z poważaniem,
Daniel Pawlik

Re: [PATCH v10 1/2] net: airoha: npu: fix missing streaming DMA mask

[Lorenzo Bianconi]

[-- Attachment #1: Type: text/plain, Size: 1498 bytes --]

> Hi,
> 
> I tested both patches independently:
> 
> - Patch 1 alone (DMA mask): NPU reports version 0.0 - probe fails.
>   The streaming mask is correct but 24-byte buffers still bounce
>   through swiotlb, and the NPU can't write to that address range.

I guess we need to understand why swiotlb bounce buffers are not working
here since these are valid address where the device should be capable of
performing DMA ops.

Adding Airoha folks in the loop. Any input on this?

> 
> - Patch 2 alone (cacheline buffers): NPU reports version 0.1111 -
>   works. Cache-line-aligned allocations bypass swiotlb entirely.

I guess this is just a workaround for this particular case.

Regards,
Lorenzo

> 
> So patch 2 is the essential fix, but patch 1 is still good to have as
> a defensive measure - without a proper streaming DMA mask, any
> future sub-cacheline streaming mapping would silently break.
> 
> Dan
> 
> sob., 22 sie 2026 o 21:27 Jakub Kicinski <kuba@kernel.org> napisał(a):
> >
> > On Thu, 20 Aug 2026 10:59:40 +0200 Daniel Pawlik wrote:
> > > The driver calls dma_set_coherent_mask() but never dma_set_mask(),
> > > leaving the streaming DMA mask at the bus default. On the non-coherent
> > > EN7581 platform (Cortex-A53), this causes the NPU mailbox to hang
> > > after approximately 41 calls when using streaming DMA mappings.
> >
> > Can you confirm if patch 2 is still needed after this fix?
> 
> 
> 
> --
> Z poważaniem,
> Daniel Pawlik

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v10 1/2] net: airoha: npu: fix missing streaming DMA mask

[Jakub Kicinski]

On Thu, 20 Aug 2026 10:59:40 +0200 Daniel Pawlik wrote:
> The driver calls dma_set_coherent_mask() but never dma_set_mask(),
> leaving the streaming DMA mask at the bus default. On the non-coherent
> EN7581 platform (Cortex-A53), this causes the NPU mailbox to hang
> after approximately 41 calls when using streaming DMA mappings.
> 
> Replace dma_set_coherent_mask() with dma_set_mask_and_coherent() to
> set both the streaming and coherent DMA masks, matching standard
> driver practice.

I'm going to take this in as it's uncontroversial and obviously correct.
Hopefully we hear something to understand the second one better before
merging.

Re: [PATCH v10 1/2] net: airoha: npu: fix missing streaming DMA mask

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 20 Aug 2026 10:59:40 +0200 you wrote:
> The driver calls dma_set_coherent_mask() but never dma_set_mask(),
> leaving the streaming DMA mask at the bus default. On the non-coherent
> EN7581 platform (Cortex-A53), this causes the NPU mailbox to hang
> after approximately 41 calls when using streaming DMA mappings.
> 
> Replace dma_set_coherent_mask() with dma_set_mask_and_coherent() to
> set both the streaming and coherent DMA masks, matching standard
> driver practice.
> 
> [...]

Here is the summary with links:
  - [v10,1/2] net: airoha: npu: fix missing streaming DMA mask
    https://git.kernel.org/netdev/net/c/6fe7e31a45e3
  - [v10,2/2] net: airoha: npu: use cacheline-sized buffers for mailbox DMA
    (no matching commit)

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html