Newer variants of the MMC controller support a 34-bit physical address
space by using word addresses instead of byte addresses. However, the
code truncates the DMA descriptor address to 32 bits before applying the
shift. This breaks DMA for descriptors allocated above the 32-bit limit.

Fixes: 3536b82e5853 ("mmc: sunxi: add support for A100 mmc controller")
Signed-off-by: Samuel Holland <samuel@sholland.org>
---

 drivers/mmc/host/sunxi-mmc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/mmc/host/sunxi-mmc.c b/drivers/mmc/host/sunxi-mmc.c
index c62afd212692..46f9e2923d86 100644
--- a/drivers/mmc/host/sunxi-mmc.c
+++ b/drivers/mmc/host/sunxi-mmc.c
@@ -377,8 +377,9 @@ static void sunxi_mmc_init_idma_des(struct sunxi_mmc_host *host,
 		pdes[i].buf_addr_ptr1 =
 			cpu_to_le32(sg_dma_address(&data->sg[i]) >>
 				    host->cfg->idma_des_shift);
-		pdes[i].buf_addr_ptr2 = cpu_to_le32((u32)next_desc >>
-						    host->cfg->idma_des_shift);
+		pdes[i].buf_addr_ptr2 =
+			cpu_to_le32(next_desc >>
+				    host->cfg->idma_des_shift);
 	}
 
 	pdes[0].config |= cpu_to_le32(SDXC_IDMAC_DES0_FD);
-- 
2.35.1

On Mon, 25 Apr 2022 at 01:17, Samuel Holland <samuel@sholland.org> wrote:
>
> Newer variants of the MMC controller support a 34-bit physical address
> space by using word addresses instead of byte addresses. However, the
> code truncates the DMA descriptor address to 32 bits before applying the
> shift. This breaks DMA for descriptors allocated above the 32-bit limit.
>
> Fixes: 3536b82e5853 ("mmc: sunxi: add support for A100 mmc controller")
> Signed-off-by: Samuel Holland <samuel@sholland.org>

Applied for fixes and by adding a stable tag, thanks!

Kind regards
Uffe


> ---
>
>  drivers/mmc/host/sunxi-mmc.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/mmc/host/sunxi-mmc.c b/drivers/mmc/host/sunxi-mmc.c
> index c62afd212692..46f9e2923d86 100644
> --- a/drivers/mmc/host/sunxi-mmc.c
> +++ b/drivers/mmc/host/sunxi-mmc.c
> @@ -377,8 +377,9 @@ static void sunxi_mmc_init_idma_des(struct sunxi_mmc_host *host,
>                 pdes[i].buf_addr_ptr1 =
>                         cpu_to_le32(sg_dma_address(&data->sg[i]) >>
>                                     host->cfg->idma_des_shift);
> -               pdes[i].buf_addr_ptr2 = cpu_to_le32((u32)next_desc >>
> -                                                   host->cfg->idma_des_shift);
> +               pdes[i].buf_addr_ptr2 =
> +                       cpu_to_le32(next_desc >>
> +                                   host->cfg->idma_des_shift);
>         }
>
>         pdes[0].config |= cpu_to_le32(SDXC_IDMAC_DES0_FD);
> --
> 2.35.1
>

Dne ponedeljek, 25. april 2022 ob 01:17:50 CEST je Samuel Holland napisal(a):
> Newer variants of the MMC controller support a 34-bit physical address
> space by using word addresses instead of byte addresses. However, the
> code truncates the DMA descriptor address to 32 bits before applying the
> shift. This breaks DMA for descriptors allocated above the 32-bit limit.
> 
> Fixes: 3536b82e5853 ("mmc: sunxi: add support for A100 mmc controller")
> Signed-off-by: Samuel Holland <samuel@sholland.org>

Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>

Best regards,
Jernej

> ---
> 
>  drivers/mmc/host/sunxi-mmc.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/mmc/host/sunxi-mmc.c b/drivers/mmc/host/sunxi-mmc.c
> index c62afd212692..46f9e2923d86 100644
> --- a/drivers/mmc/host/sunxi-mmc.c
> +++ b/drivers/mmc/host/sunxi-mmc.c
> @@ -377,8 +377,9 @@ static void sunxi_mmc_init_idma_des(struct 
sunxi_mmc_host *host,
>  		pdes[i].buf_addr_ptr1 =
>  			cpu_to_le32(sg_dma_address(&data->sg[i]) >>
>  				    host->cfg->idma_des_shift);
> -		pdes[i].buf_addr_ptr2 = cpu_to_le32((u32)next_desc >>
> -						    host-
>cfg->idma_des_shift);
> +		pdes[i].buf_addr_ptr2 =
> +			cpu_to_le32(next_desc >>
> +				    host->cfg->idma_des_shift);
>  	}
>  
>  	pdes[0].config |= cpu_to_le32(SDXC_IDMAC_DES0_FD);
> -- 
> 2.35.1
> 
>

On Sun, 24 Apr 2022 18:17:50 -0500
Samuel Holland <samuel@sholland.org> wrote:

Hi Samuel,

thanks for sending this.

> Newer variants of the MMC controller support a 34-bit physical address
> space by using word addresses instead of byte addresses. However, the
> code truncates the DMA descriptor address to 32 bits before applying the
> shift. This breaks DMA for descriptors allocated above the 32-bit limit.
> 
> Fixes: 3536b82e5853 ("mmc: sunxi: add support for A100 mmc controller")
> Signed-off-by: Samuel Holland <samuel@sholland.org>
> ---
> 
>  drivers/mmc/host/sunxi-mmc.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/mmc/host/sunxi-mmc.c b/drivers/mmc/host/sunxi-mmc.c
> index c62afd212692..46f9e2923d86 100644
> --- a/drivers/mmc/host/sunxi-mmc.c
> +++ b/drivers/mmc/host/sunxi-mmc.c
> @@ -377,8 +377,9 @@ static void sunxi_mmc_init_idma_des(struct sunxi_mmc_host *host,
>  		pdes[i].buf_addr_ptr1 =
>  			cpu_to_le32(sg_dma_address(&data->sg[i]) >>
>  				    host->cfg->idma_des_shift);
> -		pdes[i].buf_addr_ptr2 = cpu_to_le32((u32)next_desc >>
> -						    host->cfg->idma_des_shift);
> +		pdes[i].buf_addr_ptr2 =
> +			cpu_to_le32(next_desc >>
> +				    host->cfg->idma_des_shift);

I had mentioned this problem on the original patch before[1] and had
this fixed in my re-submission[2], so it looks good to me:

Reviewed-by: Andre Przywara <andre.przywara@arm.com>

Cheers,
Andre

[1]https://lore.kernel.org/linux-arm-kernel/65401815-cb2e-58ec-7653-f09d6a25804c@arm.com/
[2]https://lore.kernel.org/linux-arm-kernel/20210118020848.11721-3-andre.przywara@arm.com/

>  	}
>  
>  	pdes[0].config |= cpu_to_le32(SDXC_IDMAC_DES0_FD);