Re: [PATCH v10 12/19] drivers: soc: ti: k3-ringacc: handle absence of tisci

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] dma: missing hardware synchronization in ring disable
--

commit 38d8e8375a9ffecbdf7a3fb0318fe6f0998f6f61
Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>

drivers: soc: ti: k3-ringacc: handle absence of tisci

This patch adds direct register write support for ring accelerator operations
on platforms without TISCI firmware, such as AM62L. It implements alternate
paths for ring reset, configuration, and freeing when the TISCI handle is
absent.

> diff --git a/drivers/soc/ti/k3-ringacc.c b/drivers/soc/ti/k3-ringacc.c
> index 5966db4327b13..15fab94e8cad0 100644
> --- a/drivers/soc/ti/k3-ringacc.c
> +++ b/drivers/soc/ti/k3-ringacc.c

[ ... ]

> @@ -576,10 +653,28 @@ static void k3_ringacc_ring_free_sci(struct k3_ring *ring)
>  	ring_cfg.index = ring->ring_id;
>  	ring_cfg.valid_params = TI_SCI_MSG_VALUE_RM_ALL_NO_ORDER;
>  
> -	ret = ringacc->tisci_ring_ops->set_cfg(ringacc->tisci, &ring_cfg);
> -	if (ret)
> -		dev_err(ringacc->dev, "TISCI ring free fail (%d) ring_idx %d\n",
> -			ret, ring->ring_id);
> +	if (!ringacc->tisci) {
> +		u32 reg;
> +
> +		writel(K3_RINGACC_RT_INT_ENABLE_SET_COMPLETE | K3_RINGACC_RT_INT_ENABLE_SET_TR,
> +		       &ring->intr->clr);
> +
> +		reg = readl(&ring->cfg->size);
> +		reg &= ~K3_DMARING_CFG_SIZE_MASK;
> +		reg |= ring_cfg.count & K3_DMARING_CFG_SIZE_MASK;
> +
> +		writel(reg, &ring->cfg->size);
> +
> +		writel(ring_cfg.addr_lo, &ring->cfg->ba_lo);

[Severity: High]
Is it safe to clear the base addresses immediately after initiating the ring
disable here in k3_ringacc_ring_free_sci()?

When handling non-TISCI platforms, the code clears the size bits to disable
the ring but does not poll the hardware to ensure the disable is complete
before zeroing ba_lo and ba_hi.

In k3_ringacc_ring_reset_sci(), there is a 100us readl_poll_timeout() to wait
for the hardware to acknowledge the disable. If the hardware is still
asynchronously tearing down the ring when k3_ringacc_ring_free() subsequently
calls dma_free_coherent() on this memory, could this lead to IOMMU faults or
memory corruption?

> +		writel((ring_cfg.addr_hi & K3_DMARING_CFG_ADDR_HI_MASK) +
> +				(ring_cfg.asel << K3_DMARING_CFG_ASEL_SHIFT),
> +				&ring->cfg->ba_hi);
> +	} else {
> +		ret = ringacc->tisci_ring_ops->set_cfg(ringacc->tisci, &ring_cfg);
> +		if (ret)
> +			dev_err(ringacc->dev, "TISCI ring free fail (%d) ring_idx %d\n",
> +				ret, ring->ring_id);
> +	}
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260928025749.1055383-1-s-adivi@ti.com?part=12