[PATCH] ARM: dma-mapping: split cache maintenance at highmem boundary

[Karl Mehltretter]

dma_cache_maint_page() processes highmem pages one at a time, but passes
the complete remaining range to a cache operation when the current page
is lowmem. If a physically contiguous range starts in lowmem and crosses
into highmem, the operation continues beyond high_memory through virtual
addresses which do not map the highmem pages.

On a Raspberry Pi 400 running an ARM32 LPAE kernel, an 8 KiB scatterlist
entry crossing this boundary caused a deterministic data abort at f0000000
in v7_dma_clean_range().

Limit the crossing lowmem iteration to the end of its page. Subsequent
iterations advance page by page until the existing highmem path takes
over. Keep the bulk operation for ranges contained in lowmem.

Fixes: 43377453af83 ("[ARM] introduce dma_cache_maint_page()")
Cc: stable at vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter at gmail.com>
---
Testing:

- Raspberry Pi 400, ARM32 LPAE, 8 KiB scatterlist entry crossing the
  0x30000000 lowmem/highmem boundary: all four unpatched boots panicked at
  f0000000 in v7_dma_clean_range(). All four patched boots completed. Three
  100-iteration patched runs checked 409,600 bytes in each DMA direction
  with zero mismatches.
- W=1 builds of arch/arm/mm/dma-mapping.o passed with CONFIG_HIGHMEM=y and
  CONFIG_HIGHMEM=n. They emitted only five pre-existing kernel-doc warnings.

The hardware kernels used base 986c24e0fe44. dma-mapping.c is unchanged
between that commit and this patch's base, 893e11787f78.

 arch/arm/mm/dma-mapping.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 7761099dde9e..887209a09226 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -663,6 +663,9 @@ static void dma_cache_maint_page(phys_addr_t phys, size_t size,
 		} else {
 			phys += offset;
 			vaddr = phys_to_virt(phys);
+			if (IS_ENABLED(CONFIG_HIGHMEM) &&
+			    len > (unsigned long)high_memory - (unsigned long)vaddr)
+				len = PAGE_SIZE - offset;
 			op(vaddr, len, dir);
 		}
 		offset = 0;
-- 
2.53.0