From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794063038; b=kBicI8VKb0/wcIT3fs39l8sfw3tKywjJKDiMMWJIVQfl4bq7ZN4uUgi3Dv13ZF+kVLcF EgtqdVVZcKASB7t3CYhBuMV+b9by+g3Ui5x05CcwXzBrnTCIJe5xUnxDkLNsAcR99kjf+ zWjwRZf7mrE2XMUgC0f1b+kXC5uL82EEhLRtJGwNL4QIWFbkTE07ULes8LkjLNO1JI9Is zIE5ZI1EuVMNhUrjX35EkDFNH+Q0DT5FRY55W8rr0WfhmCOJeOcHHuL9qpZeWnPNFxIXD L7SnFvBMZF8JT4WFfL1nfqpFlGjIs4wE0c5WjASIHBw+k2xT09BCrZN4VoTQQICb1uQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794063038; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=62G4tqHs5Xya7xawO0hqAmtVoC7WK9s7uL3ENy6lR00=; b=CSbyIMgk3eeKCf3qqmt2riY+zwVSdT7/2dNxRKRQWdjVJd58zRrD6rdWWp1NVPd61YlO 5CgSkXnwUrlRIzZAsWIiKkRmHoITRjHolZirfgUQAUONCK9khPKG8HvWFsJCu1hWqNDEV YOQWL7x2gv6pz9jmAm1JijSaHMdz8YN/7j28Q13w4zYi72C6OjMl6fnbLvT9ci8mnVu4l UA4rkwRXMb2Um0aHsGeWnjW6k9imMkcxIz7KDu1wtVQR5haxK5s45ywzcvAMY6HWi3ROI wisRkf07DHTcFsvS/ONy9UhiguImXoy19B38CWEi1MsGQR5G1O91blk3TEMl5VB7AKw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=xJnt6iNm; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AEE8A606EEA1; Sat, 7 Nov 2026 14:50:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=xJnt6iNm Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5C16A1F0089F; Sat, 7 Nov 2026 14:50:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794063037; bh=62G4tqHs5Xya7xawO0hqAmtVoC7WK9s7uL3ENy6lR00=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=xJnt6iNmjFCd97HBZYUcZKx100gsM+9W9cyLpmVGU+ghs8j1gQYyUZRJTipI5Q/TY nZFBe1jQW3Z8b8/kJUHhWmSbU73KfmoF2JROdB6Pe20ylM3efuRTiklMlp85kYsmHE KgKQzpj2X7Ds1H0yFyzp+mD1HWHnnQwAYH3z2+9w= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Vikash Garodia , Dmitry Baryshkov , Vishnu Reddy , Bryan ODonoghue , Sasha Levin Subject: [PATCH 6.18 286/869] media: venus: Fix iova allocation from restrict region Date: Sat, 7 Nov 2026 08:49:28 -0500 Message-ID: <20261107134901.472649149@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134852.069646174@linuxfoundation.org> References: <20261107134852.069646174@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Vishnu Reddy [ Upstream commit 953439251b596cee039fbfeaffeb1d88a4b40f43 ] The VPU issues DMA through several SMMU streams, and the hardware does not give every stream the same addressable range. The non-pixel stream cannot address the low 600MB of IOVA space, while the pixel stream can address the full range: +-----------------------------------------------------------+ | non-pixel stream addressable range (600 MB - 3.5 GB) | | 0x25800000 - 0xe0000000 | +-----------------------------------------------------------+ | pixel stream addressable range (0 - 3.5 GB) | | 0x00000000 - 0xe0000000 | +-----------------------------------------------------------+ A single "iommus" property on the video-codec node puts every stream in one IOMMU domain sharing one IOVA space, so nothing stops a non-pixel buffer from landing below 600MB. Once an allocation lands below that boundary the hardware faults, which shows up as unhandled SMMU page faults and spontaneous reboots. https://gitlab.freedesktop.org/drm/msm/-/work_items/100 Fix this by reserving the 0-600MB range, below the boundary the non-pixel stream cannot address, using dma_iova_try_alloc() so the IOMMU-DMA core never hands that range out to a real DMA mapping. This reserves only IOVA space, it does not allocate any physical memory. Since sub-nodes for non-pixel, pixel, and secure streams do not exist yet and only a single device is available, the restriction is applied to both non-pixel and pixel stream IDs. Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions") Cc: stable@vger.kernel.org Reviewed-by: Vikash Garodia Reviewed-by: Dmitry Baryshkov Signed-off-by: Vishnu Reddy [bod: took iova_state description from iris and applied to venus in core.h] Signed-off-by: Bryan O'Donoghue Signed-off-by: Sasha Levin --- drivers/media/platform/qcom/venus/core.c | 66 ++++++++++++++++++++++-- drivers/media/platform/qcom/venus/core.h | 6 +++ 2 files changed, 69 insertions(+), 3 deletions(-) diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c index 66a750ed16096..236934a0022a9 100644 --- a/drivers/media/platform/qcom/venus/core.c +++ b/drivers/media/platform/qcom/venus/core.c @@ -374,6 +374,57 @@ static int venus_add_dynamic_nodes(struct venus_core *core) static void venus_remove_dynamic_nodes(struct venus_core *core) {} #endif +static void venus_unreserve_iova_region(struct device *dev, struct dma_iova_state *state) +{ + unsigned int i; + + for (i = 0; dma_iova_size(&state[i]); i++) + dma_iova_free(dev, &state[i]); +} + +static int venus_reserve_iova_region(struct device *dev, struct dma_iova_state **iova_state, + unsigned long start, unsigned long size) +{ + unsigned long dma_limit = dev->bus_dma_limit; + unsigned long end, rem, chunk; + struct dma_iova_state *state; + unsigned int count = 0; + int ret = -ENOMEM; + + state = devm_kcalloc(dev, BITS_PER_TYPE(dma_addr_t) + 1, sizeof(*state), GFP_KERNEL); + if (!state) + return ret; + + end = start + size; + rem = end - max(start, PAGE_SIZE); + dev->bus_dma_limit = end - 1; + + while (rem) { + chunk = min(end & -end, (u64)1 << (fls64(rem) - 1)); + + if (!dma_iova_try_alloc(dev, &state[count], 0, chunk)) + goto err_free_iova; + + if (state[count].addr != end - chunk || state[count].__size != chunk) + goto err_free_iova; + + rem -= chunk; + end -= chunk; + count++; + } + + *iova_state = state; + dev->bus_dma_limit = dma_limit; + + return 0; + +err_free_iova: + venus_unreserve_iova_region(dev, state); + dev->bus_dma_limit = dma_limit; + + return ret; +} + static int venus_probe(struct platform_device *pdev) { struct device *dev = &pdev->dev; @@ -418,10 +469,15 @@ static int venus_probe(struct platform_device *pdev) return ret; } - ret = dma_set_mask_and_coherent(dev, core->res->dma_mask); + ret = venus_reserve_iova_region(dev, &core->iova_state, VENUS_NP_RESERVE_IOVA_START, + VENUS_NP_RESERVE_IOVA_SIZE); if (ret) goto err_core_put; + ret = dma_set_mask_and_coherent(dev, core->res->dma_mask); + if (ret) + goto err_unresv_iova_region; + dma_set_max_seg_size(dev, UINT_MAX); INIT_LIST_HEAD(&core->instances); @@ -431,13 +487,13 @@ static int venus_probe(struct platform_device *pdev) ret = hfi_create(core, &venus_core_ops); if (ret) - goto err_core_put; + goto err_unresv_iova_region; ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread, IRQF_TRIGGER_HIGH | IRQF_ONESHOT, "venus", core); if (ret) - goto err_core_put; + goto err_unresv_iova_region; venus_assign_register_offsets(core); @@ -522,6 +578,8 @@ static int venus_probe(struct platform_device *pdev) v4l2_device_unregister(&core->v4l2_dev); err_hfi_destroy: hfi_destroy(core); +err_unresv_iova_region: + venus_unreserve_iova_region(dev, core->iova_state); err_core_put: if (core->pm_ops->core_put) core->pm_ops->core_put(core); @@ -559,6 +617,8 @@ static void venus_remove(struct platform_device *pdev) hfi_destroy(core); + venus_unreserve_iova_region(dev, core->iova_state); + mutex_destroy(&core->pm_lock); mutex_destroy(&core->lock); venus_dbgfs_deinit(core); diff --git a/drivers/media/platform/qcom/venus/core.h b/drivers/media/platform/qcom/venus/core.h index 70e7b40affa93..497e8f50290fe 100644 --- a/drivers/media/platform/qcom/venus/core.h +++ b/drivers/media/platform/qcom/venus/core.h @@ -8,6 +8,7 @@ #define __VENUS_CORE_H_ #include +#include #include #include #include @@ -30,6 +31,9 @@ #define VENUS_MAX_FPS 240 +#define VENUS_NP_RESERVE_IOVA_START 0x0 +#define VENUS_NP_RESERVE_IOVA_SIZE 0x25800000 + extern int venus_fw_debug; struct freq_tbl { @@ -183,6 +187,7 @@ struct venus_format { * @dump_core: a flag indicating that a core dump is required * @ocs: OF changeset pointer * @hwmode_dev: a flag indicating that HW_CTRL_TRIGGER is used in clock driver + * @iova_state: a pointer to an array of dma_iova_state entries reserved for restricted IOVA region */ struct venus_core { void __iomem *base; @@ -243,6 +248,7 @@ struct venus_core { unsigned long dump_core; struct of_changeset *ocs; bool hwmode_dev; + struct dma_iova_state *iova_state; }; struct vdec_controls { -- 2.53.0