[PATCH] i3c: mipi-i3c-hci: Use physical device pointer with DMA API

[Jarkko Nikula]

Hi

On 2/3/25 4:55 PM, Jarkko Nikula wrote:
> DMA transfer faults on Intel hardware when the IOMMU is enabled and
> driver initialization will fail when attempting to do the first transfer:
> 
> 	DMAR: DRHD: handling fault status reg 2
> 	DMAR: [DMA Read NO_PASID] Request device [00:11.0] fault addr 0x676e3000 [fault reason 0x71] SM: Present bit in first-level paging entry
> 	i3c mipi-i3c-hci.0: ring 0: Transfer Aborted
> 	mipi-i3c-hci mipi-i3c-hci.0: probe with driver mipi-i3c-hci failed with error -62
> 
> Reason for this is that the IOMMU setup is done for the physical devices
> only and not for the virtual I3C Controller device object.
> 
> Therefore use the pointer to a physical device object with the DMA API.
> 
> Reported-by: Prabhakaran, Krishna <krishna.prabhakaran at intel.com>
> Signed-off-by: Jarkko Nikula <jarkko.nikula at linux.intel.com>
> ---
>   drivers/i3c/master/mipi-i3c-hci/dma.c | 45 ++++++++++++++++++---------
>   1 file changed, 31 insertions(+), 14 deletions(-)
> 
Please don't apply this.

KFENCE started detecting memory corruption from the 
i3c_hci_free_safe_xfer_buf() when IOMMU is on with this patch. 
Corruption is not limited to a bounce buffer only but thanks to KFENCE 
was noticed.

Which is obviously much worse than the DMAR fault and driver not loading.

The corruption happens after the last DMA write address for transfers 
where size is not multiple of DWORDs corrupting the remaining bytes on 
it or extending also to a next DWORD depending on buffer alignment and 
transfer length.

I'm currently investigating the root cause for this with the experts.

So before this patch it'd need to have a change to the bounce buffer 
implementation (extend to other use cases and allocate extra DWORDs) and 
apply this patch only after it.