From: Alexandre Belloni <alexandre.belloni@bootlin.com>
To: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Cc: linux-i3c@lists.infradead.org, "Prabhakaran,
Krishna" <krishna.prabhakaran@intel.com>
Subject: Re: [PATCH] i3c: mipi-i3c-hci: Use physical device pointer with DMA API
Date: Wed, 19 Feb 2025 20:32:40 +0100 [thread overview]
Message-ID: <20250219193240c9692dda@mail.local> (raw)
In-Reply-To: <69fc72be-4200-48c9-9396-91e3180524e2@linux.intel.com>
On 13/02/2025 14:58:02+0200, Jarkko Nikula wrote:
> Hi
>
> On 2/3/25 4:55 PM, Jarkko Nikula wrote:
> > DMA transfer faults on Intel hardware when the IOMMU is enabled and
> > driver initialization will fail when attempting to do the first transfer:
> >
> > DMAR: DRHD: handling fault status reg 2
> > DMAR: [DMA Read NO_PASID] Request device [00:11.0] fault addr 0x676e3000 [fault reason 0x71] SM: Present bit in first-level paging entry
> > i3c mipi-i3c-hci.0: ring 0: Transfer Aborted
> > mipi-i3c-hci mipi-i3c-hci.0: probe with driver mipi-i3c-hci failed with error -62
> >
> > Reason for this is that the IOMMU setup is done for the physical devices
> > only and not for the virtual I3C Controller device object.
> >
> > Therefore use the pointer to a physical device object with the DMA API.
> >
> > Reported-by: Prabhakaran, Krishna <krishna.prabhakaran@intel.com>
> > Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
> > ---
> > drivers/i3c/master/mipi-i3c-hci/dma.c | 45 ++++++++++++++++++---------
> > 1 file changed, 31 insertions(+), 14 deletions(-)
> >
> Please don't apply this.
>
> KFENCE started detecting memory corruption from the
> i3c_hci_free_safe_xfer_buf() when IOMMU is on with this patch. Corruption is
> not limited to a bounce buffer only but thanks to KFENCE was noticed.
>
> Which is obviously much worse than the DMAR fault and driver not loading.
>
> The corruption happens after the last DMA write address for transfers where
> size is not multiple of DWORDs corrupting the remaining bytes on it or
> extending also to a next DWORD depending on buffer alignment and transfer
> length.
>
> I'm currently investigating the root cause for this with the experts.
>
> So before this patch it'd need to have a change to the bounce buffer
> implementation (extend to other use cases and allocate extra DWORDs) and
> apply this patch only after it.
Thanks for the heads up, I was going to apply it!
--
Alexandre Belloni, co-owner and COO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
--
linux-i3c mailing list
linux-i3c@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-i3c
prev parent reply other threads:[~2025-02-19 19:43 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-03 14:55 [PATCH] i3c: mipi-i3c-hci: Use physical device pointer with DMA API Jarkko Nikula
2025-02-13 12:58 ` Jarkko Nikula
2025-02-19 19:32 ` Alexandre Belloni [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250219193240c9692dda@mail.local \
--to=alexandre.belloni@bootlin.com \
--cc=jarkko.nikula@linux.intel.com \
--cc=krishna.prabhakaran@intel.com \
--cc=linux-i3c@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).