Re: [PATCH v6 2/9] dmaengine: add a bus for DMA channel devices

[Frank Li <Frank.li@oss.nxp.com>]

On Thu, Nov 12, 2026 at 03:53:05PM +0800, Peng Fan (OSS) wrote:
> From: Peng Fan <peng.fan@nxp.com>
>
> DMA channel devices are currently created as class devices without a bus.
> This works for sysfs, but it prevents per-channel DMA/IOMMU configuration:
> of_dma_configure() only probes the IOMMU when dev->bus is set, and the
> IOMMU core only installs probe/release notifiers for buses listed in
> iommu_buses[].
>
> Drivers that need per-channel IOMMU support currently work around this by
> assigning dev->bus after device_register(). That leaves the bus subsystem
> reference count unbalanced because bus_add_device() already ran with a NULL
> bus, and bus_remove_device() will later drop a reference that was never
> taken. For example, tegra186-gpc-dma.c assigns chdev->bus after channel
> registration. Review noted that this can underflow the platform bus
> reference count and lead to a use-after-free when the device is removed.
>
> Add a dedicated bus for DMA channel devices and register it during
> dmaengine initialisation. Use core_initcall so the bus exists before any
> IOMMU driver can call iommu_device_register(), which iterates iommu_buses[]
> and fails on an unregistered bus. The match callback always reports no
> match, so no driver can bind to these devices. A follow-up patch will
> register the channel devices on this bus.
>
> Clean up the unmap pools if dmaengine initialisation fails after they have
> been allocated.
>
> Signed-off-by: Peng Fan <peng.fan@nxp.com>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/dma/dmaengine.c   | 28 +++++++++++++++++++++++++---
>  include/linux/dmaengine.h |  4 ++++
>  2 files changed, 29 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
> index 34be53487a21..e1022d297674 100644
> --- a/drivers/dma/dmaengine.c
> +++ b/drivers/dma/dmaengine.c
> @@ -1643,6 +1643,17 @@ void dma_run_dependencies(struct dma_async_tx_descriptor *tx)
>  }
>  EXPORT_SYMBOL_GPL(dma_run_dependencies);
>
> +static int dma_chan_bus_match(struct device *dev,
> +			      const struct device_driver *drv)
> +{
> +	return 0;
> +}
> +
> +const struct bus_type dmaengine_chan_bus_type = {
> +	.name  = "dmaengine-chan",
> +	.match = dma_chan_bus_match,
> +};
> +
>  static int __init dma_bus_init(void)
>  {
>  	int err = dmaengine_init_unmap_pool();
> @@ -1650,10 +1661,21 @@ static int __init dma_bus_init(void)
>  	if (err)
>  		return err;
>
> +	err = bus_register(&dmaengine_chan_bus_type);
> +	if (err)
> +		goto err_destroy_unmap_pool;
> +
>  	err = class_register(&dma_devclass);
> -	if (!err)
> -		dmaengine_debugfs_init();
> +	if (err)
> +		goto err_unregister_bus;
>
> +	dmaengine_debugfs_init();
> +	return 0;
> +
> +err_unregister_bus:
> +	bus_unregister(&dmaengine_chan_bus_type);
> +err_destroy_unmap_pool:
> +	dmaengine_destroy_unmap_pool();
>  	return err;
>  }
> -arch_initcall(dma_bus_init);
> +core_initcall(dma_bus_init);
> diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
> index 805668fbe437..be9308739676 100644
> --- a/include/linux/dmaengine.h
> +++ b/include/linux/dmaengine.h
> @@ -412,6 +412,10 @@ struct dma_chan_dev {
>  	bool chan_dma_dev;
>  };
>
> +#ifdef CONFIG_DMA_ENGINE
> +extern const struct bus_type dmaengine_chan_bus_type;
> +#endif
> +
>  /**
>   * enum dma_slave_buswidth - defines bus width of the DMA slave
>   * device, source or target buses
>
> --
> 2.34.1
>