arch/sparc/kernel/iommu.c | 2 ++ arch/sparc/kernel/pci_sun4v.c | 2 ++ 2 files changed, 4 insertions(+)
From: Stian Halseth <stian@itx.no>
'phys' may include an offset within the page, while 'base_paddr' is already
page-aligned. This caused incorrect DMA mapping in dma_4u_map_phys and
dma_4v_map_phys.
Fix both functions by masking phys with IO_PAGE_MASK or subtracting the
page offset, covering both generic SPARC code and sun4v.
Fixes: 38c0d0ebf520 ("sparc: Use physical address DMA mapping")
Reported-by: Stian Halseth <stian@itx.no>
Closes: https://github.com/sparclinux/issues/issues/75
Suggested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Stian Halseth <stian@itx.no>
---
Changelog:
v3:
- Use IO_PAGE_MASK for alignment in both dma_4u_map_phys and dma_4v_map_phys
- Align phys before the loop in pci_sun4v.c
- Drop masking inside iommu_batch_add()
v2: https://lore.kernel.org/all/20260217171104.5643-3-stian@itx.no/
- Add Fixes tag
- Add Closes tag
- Trim commit message to 80-column lines
- Remove newlines
- Subject: Remove the "iommu/pci_sun4v:" (generic sparc patch, not specific to sun4v)
v1: https://lore.kernel.org/all/20260217150350.3541-2-stian@itx.no/
---
arch/sparc/kernel/iommu.c | 2 ++
arch/sparc/kernel/pci_sun4v.c | 2 ++
2 files changed, 4 insertions(+)
diff --git a/arch/sparc/kernel/iommu.c b/arch/sparc/kernel/iommu.c
index 46ef88bc9c26..7613ab0ffb89 100644
--- a/arch/sparc/kernel/iommu.c
+++ b/arch/sparc/kernel/iommu.c
@@ -312,6 +312,8 @@ static dma_addr_t dma_4u_map_phys(struct device *dev, phys_addr_t phys,
if (direction != DMA_TO_DEVICE)
iopte_protection |= IOPTE_WRITE;
+ phys &= IO_PAGE_MASK;
+
for (i = 0; i < npages; i++, base++, phys += IO_PAGE_SIZE)
iopte_val(*base) = iopte_protection | phys;
diff --git a/arch/sparc/kernel/pci_sun4v.c b/arch/sparc/kernel/pci_sun4v.c
index 791f0a76665f..58ca4148f86b 100644
--- a/arch/sparc/kernel/pci_sun4v.c
+++ b/arch/sparc/kernel/pci_sun4v.c
@@ -410,6 +410,8 @@ static dma_addr_t dma_4v_map_phys(struct device *dev, phys_addr_t phys,
iommu_batch_start(dev, prot, entry);
+ phys &= IO_PAGE_MASK;
+
for (i = 0; i < npages; i++, phys += IO_PAGE_SIZE) {
long err = iommu_batch_add(phys, mask);
if (unlikely(err < 0L))
--
2.53.0
On 18.02.2026 13:00, stian@itx.no wrote:
> From: Stian Halseth <stian@itx.no>
>
> 'phys' may include an offset within the page, while 'base_paddr' is already
> page-aligned. This caused incorrect DMA mapping in dma_4u_map_phys and
> dma_4v_map_phys.
>
> Fix both functions by masking phys with IO_PAGE_MASK or subtracting the
> page offset, covering both generic SPARC code and sun4v.
>
> Fixes: 38c0d0ebf520 ("sparc: Use physical address DMA mapping")
> Reported-by: Stian Halseth <stian@itx.no>
> Closes: https://protect2.fireeye.com/v1/url?k=7ae4b721-1b6fa20e-7ae53c6e-74fe485cbfe7-9b567c88f1f84114&q=1&e=1e25ada4-9521-4797-a8c9-57719379250d&u=https%3A%2F%2Fgithub.com%2Fsparclinux%2Fissues%2Fissues%2F75
> Suggested-by: Marek Szyprowski <m.szyprowski@samsung.com>
> Signed-off-by: Stian Halseth <stian@itx.no>
Applied to dma-mapping-fixes branch with slightly adjusted commit
description (to match v3 changes). Thanks!
> ---
> Changelog:
> v3:
> - Use IO_PAGE_MASK for alignment in both dma_4u_map_phys and dma_4v_map_phys
> - Align phys before the loop in pci_sun4v.c
> - Drop masking inside iommu_batch_add()
>
> v2: https://lore.kernel.org/all/20260217171104.5643-3-stian@itx.no/
> - Add Fixes tag
> - Add Closes tag
> - Trim commit message to 80-column lines
> - Remove newlines
> - Subject: Remove the "iommu/pci_sun4v:" (generic sparc patch, not specific to sun4v)
>
> v1: https://lore.kernel.org/all/20260217150350.3541-2-stian@itx.no/
> ---
> arch/sparc/kernel/iommu.c | 2 ++
> arch/sparc/kernel/pci_sun4v.c | 2 ++
> 2 files changed, 4 insertions(+)
>
> diff --git a/arch/sparc/kernel/iommu.c b/arch/sparc/kernel/iommu.c
> index 46ef88bc9c26..7613ab0ffb89 100644
> --- a/arch/sparc/kernel/iommu.c
> +++ b/arch/sparc/kernel/iommu.c
> @@ -312,6 +312,8 @@ static dma_addr_t dma_4u_map_phys(struct device *dev, phys_addr_t phys,
> if (direction != DMA_TO_DEVICE)
> iopte_protection |= IOPTE_WRITE;
>
> + phys &= IO_PAGE_MASK;
> +
> for (i = 0; i < npages; i++, base++, phys += IO_PAGE_SIZE)
> iopte_val(*base) = iopte_protection | phys;
>
> diff --git a/arch/sparc/kernel/pci_sun4v.c b/arch/sparc/kernel/pci_sun4v.c
> index 791f0a76665f..58ca4148f86b 100644
> --- a/arch/sparc/kernel/pci_sun4v.c
> +++ b/arch/sparc/kernel/pci_sun4v.c
> @@ -410,6 +410,8 @@ static dma_addr_t dma_4v_map_phys(struct device *dev, phys_addr_t phys,
>
> iommu_batch_start(dev, prot, entry);
>
> + phys &= IO_PAGE_MASK;
> +
> for (i = 0; i < npages; i++, phys += IO_PAGE_SIZE) {
> long err = iommu_batch_add(phys, mask);
> if (unlikely(err < 0L))
Best regards
--
Marek Szyprowski, PhD
Samsung R&D Institute Poland
> On Feb 18, 2026, at 20:00, stian@itx.no wrote:
>
> From: Stian Halseth <stian@itx.no>
>
> 'phys' may include an offset within the page, while 'base_paddr' is already
> page-aligned. This caused incorrect DMA mapping in dma_4u_map_phys and
> dma_4v_map_phys.
>
> Fix both functions by masking phys with IO_PAGE_MASK or subtracting the
> page offset, covering both generic SPARC code and sun4v.
>
> Fixes: 38c0d0ebf520 ("sparc: Use physical address DMA mapping")
> Reported-by: Stian Halseth <stian@itx.no>
> Closes: https://github.com/sparclinux/issues/issues/75
> Suggested-by: Marek Szyprowski <m.szyprowski@samsung.com>
> Signed-off-by: Stian Halseth <stian@itx.no>
> ---
> Changelog:
> v3:
> - Use IO_PAGE_MASK for alignment in both dma_4u_map_phys and dma_4v_map_phys
> - Align phys before the loop in pci_sun4v.c
> - Drop masking inside iommu_batch_add()
>
> v2: https://lore.kernel.org/all/20260217171104.5643-3-stian@itx.no/
> - Add Fixes tag
> - Add Closes tag
> - Trim commit message to 80-column lines
> - Remove newlines
> - Subject: Remove the "iommu/pci_sun4v:" (generic sparc patch, not specific to sun4v)
>
> v1: https://lore.kernel.org/all/20260217150350.3541-2-stian@itx.no/
> ---
> arch/sparc/kernel/iommu.c | 2 ++
> arch/sparc/kernel/pci_sun4v.c | 2 ++
> 2 files changed, 4 insertions(+)
>
> diff --git a/arch/sparc/kernel/iommu.c b/arch/sparc/kernel/iommu.c
> index 46ef88bc9c26..7613ab0ffb89 100644
> --- a/arch/sparc/kernel/iommu.c
> +++ b/arch/sparc/kernel/iommu.c
> @@ -312,6 +312,8 @@ static dma_addr_t dma_4u_map_phys(struct device *dev, phys_addr_t phys,
> if (direction != DMA_TO_DEVICE)
> iopte_protection |= IOPTE_WRITE;
>
> + phys &= IO_PAGE_MASK;
> +
> for (i = 0; i < npages; i++, base++, phys += IO_PAGE_SIZE)
> iopte_val(*base) = iopte_protection | phys;
>
> diff --git a/arch/sparc/kernel/pci_sun4v.c b/arch/sparc/kernel/pci_sun4v.c
> index 791f0a76665f..58ca4148f86b 100644
> --- a/arch/sparc/kernel/pci_sun4v.c
> +++ b/arch/sparc/kernel/pci_sun4v.c
> @@ -410,6 +410,8 @@ static dma_addr_t dma_4v_map_phys(struct device *dev, phys_addr_t phys,
>
> iommu_batch_start(dev, prot, entry);
>
> + phys &= IO_PAGE_MASK;
> +
> for (i = 0; i < npages; i++, phys += IO_PAGE_SIZE) {
> long err = iommu_batch_add(phys, mask);
> if (unlikely(err < 0L))
> --
> 2.53.0
>
>
Tested-by: Han Gao <gaohan@iscas.ac.cn> # on SPARC Enterprise T5220
On 18/2/26 20:00, stian@itx.no wrote:
> From: Stian Halseth <stian@itx.no>
>
> 'phys' may include an offset within the page, while 'base_paddr' is already
> page-aligned. This caused incorrect DMA mapping in dma_4u_map_phys and
> dma_4v_map_phys.
>
> Fix both functions by masking phys with IO_PAGE_MASK or subtracting the
> page offset, covering both generic SPARC code and sun4v.
>
> Fixes: 38c0d0ebf520 ("sparc: Use physical address DMA mapping")
> Reported-by: Stian Halseth <stian@itx.no>
> Closes: https://github.com/sparclinux/issues/issues/75
> Suggested-by: Marek Szyprowski <m.szyprowski@samsung.com>
> Signed-off-by: Stian Halseth <stian@itx.no>
> ---
> Changelog:
> v3:
> - Use IO_PAGE_MASK for alignment in both dma_4u_map_phys and dma_4v_map_phys
> - Align phys before the loop in pci_sun4v.c
> - Drop masking inside iommu_batch_add()
>
> v2: https://lore.kernel.org/all/20260217171104.5643-3-stian@itx.no/
> - Add Fixes tag
> - Add Closes tag
> - Trim commit message to 80-column lines
> - Remove newlines
> - Subject: Remove the "iommu/pci_sun4v:" (generic sparc patch, not specific to sun4v)
>
> v1: https://lore.kernel.org/all/20260217150350.3541-2-stian@itx.no/
> ---
> arch/sparc/kernel/iommu.c | 2 ++
> arch/sparc/kernel/pci_sun4v.c | 2 ++
> 2 files changed, 4 insertions(+)
>
> diff --git a/arch/sparc/kernel/iommu.c b/arch/sparc/kernel/iommu.c
> index 46ef88bc9c26..7613ab0ffb89 100644
> --- a/arch/sparc/kernel/iommu.c
> +++ b/arch/sparc/kernel/iommu.c
> @@ -312,6 +312,8 @@ static dma_addr_t dma_4u_map_phys(struct device *dev, phys_addr_t phys,
> if (direction != DMA_TO_DEVICE)
> iopte_protection |= IOPTE_WRITE;
>
> + phys &= IO_PAGE_MASK;
> +
> for (i = 0; i < npages; i++, base++, phys += IO_PAGE_SIZE)
> iopte_val(*base) = iopte_protection | phys;
>
> diff --git a/arch/sparc/kernel/pci_sun4v.c b/arch/sparc/kernel/pci_sun4v.c
> index 791f0a76665f..58ca4148f86b 100644
> --- a/arch/sparc/kernel/pci_sun4v.c
> +++ b/arch/sparc/kernel/pci_sun4v.c
> @@ -410,6 +410,8 @@ static dma_addr_t dma_4v_map_phys(struct device *dev, phys_addr_t phys,
>
> iommu_batch_start(dev, prot, entry);
>
> + phys &= IO_PAGE_MASK;
> +
> for (i = 0; i < npages; i++, phys += IO_PAGE_SIZE) {
> long err = iommu_batch_add(phys, mask);
> if (unlikely(err < 0L))
Tested-by: Nathaniel Roach <nroach44@nroach44.id.au>
© 2016 - 2026 Red Hat, Inc.