From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794046063; b=Qr+n59VUu7Pq9xT5nJYzwGeYijwoCbkN6J0WIn4D2/jriH/xFeDvYVvb9QnVHbHy6l5C XyEdOx4ZFnPn2yR0DNBk6xAExlbj79oqK0MtGrsZwxrOvRRh7Lo8/x6tTQb8JeC9O8irt 4jQhLq6G0hC1EdzFNybh2QxBAP14wPtyd1lcT0ZD0nN4q8GVOMJ8Ap2+8cWU4e42bkwPV N1Rk1jJjthguk5zvwgRqTqQ7SySb8X/Z/R/EBN6VtVqCGFlt04Bb8QGBsJQutMjZg3NkP iB8IjFZGkGeLjp7oCGg4HPzQVEieiWROKBfKMqDY/tGqzHO3aAVmmmTv69Aduj6iDmg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794046063; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=qNNBSuFL+miPxaP9Ls001ZYVNIp/DLvggfVu5sGpId0=; b=dNMYS4MEQufOuGw7UIx36wChiqDq/Xg55oGldNZOHewkvBKKFtAjaCyZklbodOWjT2Mn DzwLkDZyPlNYumGE5NenjRvZd7M3T6r72cFIta8F8ySXl7UbBSCqC8TbPMhV8EbN1//3J 2CE2fTI/QX2JcWnp9qTM/1iVQ34cOMXyqFJyj+GuyGeQdvQHRcJN6OutJ9L1t1Gv6YmJX YrFFi0Dy7loZLetmbRXbo2UjdzZOuHTYQUzRwgk9pZ/ScdMiPA1d0A3FZx6HUgjjztt8/ zCftM+POMi4HHgiZ4ZfWViYHZfU4L9j6+6G7OGNMfxmfwlTDGxUdwuF3spSI3xWRJwQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b="ntnI/zKz"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 82851606A326 for ; Sat, 7 Nov 2026 10:07:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=ntnI/zKz Received: by smtp.kernel.org (Postfix) with ESMTPSA id C4B861F008A1; Sat, 7 Nov 2026 10:07:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794046063; bh=qNNBSuFL+miPxaP9Ls001ZYVNIp/DLvggfVu5sGpId0=; h=From:To:Cc:Subject:Date; b=ntnI/zKzqdFk8FJCyMyh0IuUjgncWHK3BNJ31tuncQrOfanpRvvFqYKD+NWUUJxyH sRgGykYljpNljb0qQqcFT78c+PqjDuMpsNsFoVKu8Aq4Wf+xVND6a4Uw6g8D72voHq 6ETWXwZsDehmdAfo3Ry+XpMzqO5r/wmjqb6VK5yfFGcZwVQRvnFkzWM3h776DU4cWM 9PmMWF6sCEwAODNZEv44O7/0fyVTyUFCnApUFXqhHX/OroLtR3Ty0NHnBEKdHScpi0 niyoOS1D/ajAbRBrbDkjdXTYu3nm5yB5btjTYMjzdQbmZ4JGzz18XjcOlw9SihQ2Nj pJSKo0W9heeNg== From: Sasha Levin To: busanna.reddy@oss.qualcomm.com, vikash.garodia@oss.qualcomm.com, dmitry.baryshkov@oss.qualcomm.com, bod@kernel.org Cc: stable@vger.kernel.org Subject: FAILED: patch "[PATCH] media: iris: Fix iova allocation from restrict region" failed to apply to 6.18-stable tree Date: Sat, 7 Nov 2026 05:07:41 -0500 Message-ID: <20261107050741-failed-6.18-200473c198b2@kernel.org> X-Mailer: git-send-email 2.53.0 X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.18-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y git checkout FETCH_HEAD git cherry-pick -x 200473c198b201c308dfb916fb3233074d9407fa # git commit -s git send-email --to '' --in-reply-to '20261107050741-failed-6.18-200473c198b2@kernel.org' --subject-prefix 'PATCH 6.18.y' 'HEAD^..' Thanks, Sasha ------------------ original commit in Linus's tree ------------------ >From 200473c198b201c308dfb916fb3233074d9407fa Mon Sep 17 00:00:00 2001 From: Vishnu Reddy Date: Tue, 18 Aug 2026 20:43:22 +0530 Subject: [PATCH] media: iris: Fix iova allocation from restrict region The VPU issues DMA through several SMMU streams, and the hardware does not give every stream the same addressable range. The non-pixel stream cannot address the low 600MB of IOVA space, while the pixel stream can address the full range: +-----------------------------------------------------------+ | non-pixel stream addressable range (600 MB - 3.5 GB) | | 0x25800000 - 0xe0000000 | +-----------------------------------------------------------+ | pixel stream addressable range (0 - 3.5 GB) | | 0x00000000 - 0xe0000000 | +-----------------------------------------------------------+ A single "iommus" property on the video-codec node puts every stream in one IOMMU domain sharing one IOVA space, so nothing stops a non-pixel buffer from landing below 600MB. Once an allocation lands below that boundary the hardware faults, which shows up as unhandled SMMU page faults and spontaneous reboots. https://gitlab.freedesktop.org/drm/msm/-/work_items/100 Fix this by reserving the 0-600MB range, below the boundary the non-pixel stream cannot address, using dma_iova_try_alloc() so the IOMMU-DMA core never hands that range out to a real DMA mapping. This reserves only IOVA space, it does not allocate any physical memory. Since sub-nodes for non-pixel, pixel, and secure streams do not exist yet and only a single device is available, the restriction is applied to both non-pixel and pixel stream IDs. Fixes: d7378f84e94e ("media: iris: introduce iris core state management with shared queues") Cc: stable@vger.kernel.org Reviewed-by: Vikash Garodia Reviewed-by: Dmitry Baryshkov Signed-off-by: Vishnu Reddy Signed-off-by: Bryan O'Donoghue --- drivers/media/platform/qcom/iris/iris_core.h | 6 ++ drivers/media/platform/qcom/iris/iris_probe.c | 62 ++++++++++++++++++- 2 files changed, 67 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/qcom/iris/iris_core.h b/drivers/media/platform/qcom/iris/iris_core.h index 24da60448cf24..3e4cf652bf39a 100644 --- a/drivers/media/platform/qcom/iris/iris_core.h +++ b/drivers/media/platform/qcom/iris/iris_core.h @@ -7,6 +7,7 @@ #define __IRIS_CORE_H__ #include +#include #include #include @@ -25,6 +26,9 @@ struct icc_info { #define IRIS_FW_VERSION_LENGTH 128 #define IFACEQ_CORE_PKT_SIZE (1024 * 4) +#define IRIS_NP_RESERVE_IOVA_START 0x0 +#define IRIS_NP_RESERVE_IOVA_SIZE 0x25800000 + enum domain_type { ENCODER = BIT(0), DECODER = BIT(1), @@ -77,6 +81,7 @@ struct qcom_ubwc_cfg_data; * @instances: a list_head of all instances * @inst_fw_caps_dec: an array of supported instance capabilities by decoder * @inst_fw_caps_enc: an array of supported instance capabilities by encoder + * @iova_state: a pointer to an array of dma_iova_state entries reserved for restricted IOVA region */ struct iris_core { @@ -123,6 +128,7 @@ struct iris_core { /* encoder and decoder have overlapping caps, so two different arrays are required */ struct platform_inst_fw_cap inst_fw_caps_dec[INST_FW_CAP_MAX]; struct platform_inst_fw_cap inst_fw_caps_enc[INST_FW_CAP_MAX]; + struct dma_iova_state *iova_state; }; int iris_core_init(struct iris_core *core); diff --git a/drivers/media/platform/qcom/iris/iris_probe.c b/drivers/media/platform/qcom/iris/iris_probe.c index e4acf4a74f944..6581a969fe3fb 100644 --- a/drivers/media/platform/qcom/iris/iris_probe.c +++ b/drivers/media/platform/qcom/iris/iris_probe.c @@ -150,6 +150,57 @@ static int iris_init_resources(struct iris_core *core) return iris_init_resets(core); } +static void iris_unreserve_iova_region(struct device *dev, struct dma_iova_state *iova_state) +{ + unsigned int i; + + for (i = 0; dma_iova_size(&iova_state[i]); i++) + dma_iova_free(dev, &iova_state[i]); +} + +static int iris_reserve_iova_region(struct device *dev, struct dma_iova_state **iova_state, + unsigned long start, unsigned long size) +{ + unsigned long dma_limit = dev->bus_dma_limit; + unsigned long end, rem, chunk; + struct dma_iova_state *state; + unsigned int count = 0; + int ret = -ENOMEM; + + state = devm_kcalloc(dev, BITS_PER_TYPE(dma_addr_t) + 1, sizeof(*state), GFP_KERNEL); + if (!state) + return ret; + + end = start + size; + rem = end - max(start, PAGE_SIZE); + dev->bus_dma_limit = end - 1; + + while (rem) { + chunk = min(end & -end, (u64)1 << (fls64(rem) - 1)); + + if (!dma_iova_try_alloc(dev, &state[count], 0, chunk)) + goto err_free_iova; + + if (state[count].addr != end - chunk || state[count].__size != chunk) + goto err_free_iova; + + rem -= chunk; + end -= chunk; + count++; + } + + *iova_state = state; + dev->bus_dma_limit = dma_limit; + + return 0; + +err_free_iova: + iris_unreserve_iova_region(dev, state); + dev->bus_dma_limit = dma_limit; + + return ret; +} + static int iris_register_video_device(struct iris_core *core, enum domain_type type) { struct video_device *vdev; @@ -207,6 +258,8 @@ static void iris_remove(struct platform_device *pdev) v4l2_device_unregister(&core->v4l2_dev); + iris_unreserve_iova_region(core->dev, core->iova_state); + mutex_destroy(&core->lock); } @@ -269,10 +322,15 @@ static int iris_probe(struct platform_device *pdev) if (ret) return ret; - ret = v4l2_device_register(dev, &core->v4l2_dev); + ret = iris_reserve_iova_region(dev, &core->iova_state, IRIS_NP_RESERVE_IOVA_START, + IRIS_NP_RESERVE_IOVA_SIZE); if (ret) return ret; + ret = v4l2_device_register(dev, &core->v4l2_dev); + if (ret) + goto err_unresv_iova_region; + ret = iris_register_video_device(core, DECODER); if (ret) goto err_v4l2_unreg; @@ -306,6 +364,8 @@ static int iris_probe(struct platform_device *pdev) video_unregister_device(core->vdev_dec); err_v4l2_unreg: v4l2_device_unregister(&core->v4l2_dev); +err_unresv_iova_region: + iris_unreserve_iova_region(dev, core->iova_state); return ret; } -- 2.53.0