[PATCH] iommu/pages: Fix iommu_pages_flush_incoherent() for non-x86

[PATCH] iommu/pages: Fix iommu_pages_flush_incoherent() for non-x86

[Mostafa Saleh]

The dma_sync_single_for_device() function expects a dma_addr_t, but
iommu_pages_flush_incoherent() was incorrectly passing a virtual
address.

Since iommu_pages_start_incoherent() enforces a 1:1 mapping between
DMA addresses and physical addresses (checked via WARN_ON), we can
convert the virtual address to a physical address before passing it to
the DMA API.

This also  matches the behaviour of the other non-x86 in
iommu_pages_free_incoherent(), which uses virt_to_phys(virt);

Fixes: 36ae67b13976 ("iommu/pages: Add support for incoherent IOMMU page table walkers")
Signed-off-by: Mostafa Saleh <smostafa@google.com>
---
 drivers/iommu/iommu-pages.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/iommu-pages.h b/drivers/iommu/iommu-pages.h
index ae9da4f571f6..e9e605b5fa3a 100644
--- a/drivers/iommu/iommu-pages.h
+++ b/drivers/iommu/iommu-pages.h
@@ -137,7 +137,7 @@ static inline void iommu_pages_flush_incoherent(struct device *dma_dev,
 						void *virt, size_t offset,
 						size_t len)
 {
-	dma_sync_single_for_device(dma_dev, (uintptr_t)virt + offset, len,
+	dma_sync_single_for_device(dma_dev, virt_to_phys(virt) + offset, len,
 				   DMA_TO_DEVICE);
 }
 void iommu_pages_stop_incoherent_list(struct iommu_pages_list *list,
-- 
2.54.0.rc2.544.gc7ae2d5bb8-goog

Re: [PATCH] iommu/pages: Fix iommu_pages_flush_incoherent() for non-x86

[Jason Gunthorpe]

On Fri, Apr 24, 2026 at 11:50:51AM +0000, Mostafa Saleh wrote:
> The dma_sync_single_for_device() function expects a dma_addr_t, but
> iommu_pages_flush_incoherent() was incorrectly passing a virtual
> address.
> 
> Since iommu_pages_start_incoherent() enforces a 1:1 mapping between
> DMA addresses and physical addresses (checked via WARN_ON), we can
> convert the virtual address to a physical address before passing it to
> the DMA API.
> 
> This also  matches the behaviour of the other non-x86 in
> iommu_pages_free_incoherent(), which uses virt_to_phys(virt);
> 
> Fixes: 36ae67b13976 ("iommu/pages: Add support for incoherent IOMMU page table walkers")
> Signed-off-by: Mostafa Saleh <smostafa@google.com>
> ---
>  drivers/iommu/iommu-pages.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>

Jason

Re: [PATCH] iommu/pages: Fix iommu_pages_flush_incoherent() for non-x86

[Pranjal Shrivastava]

On Fri, Apr 24, 2026 at 11:50:51AM +0000, Mostafa Saleh wrote:
> The dma_sync_single_for_device() function expects a dma_addr_t, but
> iommu_pages_flush_incoherent() was incorrectly passing a virtual
> address.
> 
> Since iommu_pages_start_incoherent() enforces a 1:1 mapping between
> DMA addresses and physical addresses (checked via WARN_ON), we can
> convert the virtual address to a physical address before passing it to
> the DMA API.
> 
> This also  matches the behaviour of the other non-x86 in
> iommu_pages_free_incoherent(), which uses virt_to_phys(virt);
> 
> Fixes: 36ae67b13976 ("iommu/pages: Add support for incoherent IOMMU page table walkers")
> Signed-off-by: Mostafa Saleh <smostafa@google.com>
> ---
>  drivers/iommu/iommu-pages.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iommu/iommu-pages.h b/drivers/iommu/iommu-pages.h
> index ae9da4f571f6..e9e605b5fa3a 100644
> --- a/drivers/iommu/iommu-pages.h
> +++ b/drivers/iommu/iommu-pages.h
> @@ -137,7 +137,7 @@ static inline void iommu_pages_flush_incoherent(struct device *dma_dev,
>  						void *virt, size_t offset,
>  						size_t len)
>  {
> -	dma_sync_single_for_device(dma_dev, (uintptr_t)virt + offset, len,
> +	dma_sync_single_for_device(dma_dev, virt_to_phys(virt) + offset, len,
>  				   DMA_TO_DEVICE);
>  }
>  void iommu_pages_stop_incoherent_list(struct iommu_pages_list *list,

Nice catch! 

Additionally, I think we should update the comment in
iommu_pages_start_incoherent() to clarify the restriction. The current
comment says:

"The DMA API is not allowed to do anything other than DMA direct."

But dma_direct actually handles bus offsets perfectly fine. However,
this code fails on platforms with a bus offset is because of the strict
check:

   WARN_ON(dma != virt_to_phys(virt))
   
which enforces a strict 1:1 mapping.

So saying that we only allow dma_direct is a bit misleading as to why
bus offsets fail here. We should update that comment to something like:

diff --git a/drivers/iommu/iommu-pages.c b/drivers/iommu/iommu-pages.c
index 3bab175d8557..3904de686206 100644
--- a/drivers/iommu/iommu-pages.c
+++ b/drivers/iommu/iommu-pages.c
@@ -161,9 +161,11 @@ int iommu_pages_start_incoherent(void *virt, struct device *dma_dev)
                        return -EINVAL;

                /*
-                * The DMA API is not allowed to do anything other than DMA
-                * direct. It would be nice to also check
-                * dev_is_dma_coherent(dma_dev));
+                * We enforce a strict 1:1 mapping (dma == phys). This means
+                * platforms with a bus offset or those that require translation for
+                * the IOMMU's own memory are not supported, even though dma_direct
+                * could otherwise handle bus offsets.
+                * It would be nice to also check dev_is_dma_coherent(dma_dev));
                 */
                if (WARN_ON(dma != virt_to_phys(virt))) {
                        dma_unmap_single(dma_dev, dma, ioptdesc_mem_size(iopt),

For the fix:
Reviewed-by: Pranjal Shrivastava <praan@google.com>

Thanks,
Praan