* [PATCH net-next v3 1/2] dt-bindings: net: qcom,bam-dmux: Add memory-region and qcom,vmid properties
2026-10-21 6:39 [PATCH net-next v3 0/2] net: wwan: qcom_bam_dmux: Add restricted DMA pool support Vishnu Santhosh
@ 2026-10-21 6:39 ` Vishnu Santhosh
2026-10-21 6:39 ` [PATCH net-next v3 2/2] net: wwan: qcom_bam_dmux: Assign restricted DMA pool to remote processor Vishnu Santhosh
2026-10-21 21:34 ` [PATCH net-next v3 0/2] net: wwan: qcom_bam_dmux: Add restricted DMA pool support Jakub Kicinski
2 siblings, 0 replies; 4+ messages in thread
From: Vishnu Santhosh @ 2026-10-21 6:39 UTC (permalink / raw)
To: Stephan Gerhold, Andrew Lunn, David S. Miller, Jakub Kicinski,
Paolo Abeni, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Loic Poulain, Sergey Ryazanov, Johannes Berg, Eric Dumazet,
Eric Dumazet
Cc: linux-arm-msm, netdev, devicetree, linux-kernel, Vishnu Santhosh,
Deepak Kumar Singh
Some Qualcomm SoCs, such as Shikra, run the modem in a separate security
domain with restricted access to system memory. BAM-DMUX DMA mappings
must therefore be constrained to a designated region that can be shared
with the modem.
Add an optional memory-region property to reference a restricted DMA
pool used for BAM-DMUX mappings, and a qcom,vmid property to identify the
remote execution environment that is granted access to the pool through
SCM.
Require memory-region whenever qcom,vmid is specified.
Add the qcom,shikra-bam-dmux compatible, with qcom,bam-dmux as fallback,
and require both properties for it.
Co-developed-by: Deepak Kumar Singh <deepak.singh@oss.qualcomm.com>
Signed-off-by: Deepak Kumar Singh <deepak.singh@oss.qualcomm.com>
Signed-off-by: Vishnu Santhosh <vishnu.santhosh@oss.qualcomm.com>
---
.../devicetree/bindings/net/qcom,bam-dmux.yaml | 36 +++++++++++++++++++++-
1 file changed, 35 insertions(+), 1 deletion(-)
diff --git a/Documentation/devicetree/bindings/net/qcom,bam-dmux.yaml b/Documentation/devicetree/bindings/net/qcom,bam-dmux.yaml
index 33746c238513d72366bc52359fb10f275475b331..f7388d24c8612b5a99d5d0e66cfbe2de3b1c9e0d 100644
--- a/Documentation/devicetree/bindings/net/qcom,bam-dmux.yaml
+++ b/Documentation/devicetree/bindings/net/qcom,bam-dmux.yaml
@@ -22,7 +22,11 @@ description: |
properties:
compatible:
- const: qcom,bam-dmux
+ oneOf:
+ - const: qcom,bam-dmux
+ - items:
+ - const: qcom,shikra-bam-dmux
+ - const: qcom,bam-dmux
interrupts:
description:
@@ -72,6 +76,22 @@ properties:
- const: tx
- const: rx
+ memory-region:
+ maxItems: 1
+ description:
+ Phandle to a reserved-memory node compatible with restricted-dma-pool.
+ The BAM-DMUX device uses the pool for DMA mappings.
+
+ qcom,vmid:
+ $ref: /schemas/types.yaml#/definitions/uint32-array
+ maxItems: 1
+ items:
+ minimum: 1
+ maximum: 63
+ description:
+ VMID of the remote execution environment that is granted access to the
+ restricted DMA pool through SCM.
+
required:
- compatible
- interrupts
@@ -81,6 +101,20 @@ required:
- dmas
- dma-names
+dependencies:
+ qcom,vmid: [ memory-region ]
+
+allOf:
+ - if:
+ properties:
+ compatible:
+ contains:
+ const: qcom,shikra-bam-dmux
+ then:
+ required:
+ - memory-region
+ - qcom,vmid
+
additionalProperties: false
examples:
--
2.34.1
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH net-next v3 2/2] net: wwan: qcom_bam_dmux: Assign restricted DMA pool to remote processor
2026-10-21 6:39 [PATCH net-next v3 0/2] net: wwan: qcom_bam_dmux: Add restricted DMA pool support Vishnu Santhosh
2026-10-21 6:39 ` [PATCH net-next v3 1/2] dt-bindings: net: qcom,bam-dmux: Add memory-region and qcom,vmid properties Vishnu Santhosh
@ 2026-10-21 6:39 ` Vishnu Santhosh
2026-10-21 21:34 ` [PATCH net-next v3 0/2] net: wwan: qcom_bam_dmux: Add restricted DMA pool support Jakub Kicinski
2 siblings, 0 replies; 4+ messages in thread
From: Vishnu Santhosh @ 2026-10-21 6:39 UTC (permalink / raw)
To: Stephan Gerhold, Andrew Lunn, David S. Miller, Jakub Kicinski,
Paolo Abeni, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Loic Poulain, Sergey Ryazanov, Johannes Berg, Eric Dumazet,
Eric Dumazet
Cc: linux-arm-msm, netdev, devicetree, linux-kernel, Vishnu Santhosh,
Deepak Kumar Singh
Some Qualcomm SoCs, such as Shikra, run the modem in a separate security
domain with restricted access to system memory. BAM-DMUX DMA mappings
and BAM descriptor FIFOs must therefore be constrained to a designated
memory region that can be shared with the modem. Accesses outside that
region can trigger an XPU violation.
When qcom,vmid is present, require a restricted DMA pool and assign the
entire pool to both the local and remote execution environments before
requesting the DMA channels.
This ensures that BAM-DMUX mappings are within the assigned region. When
the BAM DMA controller references the same pool, its descriptor FIFOs
are covered by the assignment as well.
Track the assigned execution environments explicitly and reclaim the
pool for the local environment after DMA channels and mappings are
released during remove or probe error cleanup. Skip the reclaim and
leave the pool assigned if the remote side did not acknowledge the
power-down, since it may still access the pool.
Fail probing when restricted DMA pool support is unavailable, when the
VMID property is malformed, when memory-region does not reference a
restricted DMA pool, or when the pool is not attached to the device.
Co-developed-by: Deepak Kumar Singh <deepak.singh@oss.qualcomm.com>
Signed-off-by: Deepak Kumar Singh <deepak.singh@oss.qualcomm.com>
Signed-off-by: Vishnu Santhosh <vishnu.santhosh@oss.qualcomm.com>
---
drivers/net/wwan/Kconfig | 1 +
drivers/net/wwan/qcom_bam_dmux.c | 119 ++++++++++++++++++++++++++++++++++++++-
2 files changed, 117 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wwan/Kconfig b/drivers/net/wwan/Kconfig
index 958dbc7347fa84ee869439bf8b503037faab8bef..1b133c56231615269698140187ca3141dfe48dbf 100644
--- a/drivers/net/wwan/Kconfig
+++ b/drivers/net/wwan/Kconfig
@@ -65,6 +65,7 @@ config MHI_WWAN_MBIM
config QCOM_BAM_DMUX
tristate "Qualcomm BAM-DMUX WWAN network driver"
depends on (DMA_ENGINE && PM && QCOM_SMEM_STATE) || COMPILE_TEST
+ select QCOM_SCM
help
The BAM Data Multiplexer provides access to the network data channels
of modems integrated into many older Qualcomm SoCs, e.g. Qualcomm
diff --git a/drivers/net/wwan/qcom_bam_dmux.c b/drivers/net/wwan/qcom_bam_dmux.c
index cc6ace8d64371eb8d00c638a39b234ee540b83c9..fa3621224a56e34086635e1abe1220c3ae40e899 100644
--- a/drivers/net/wwan/qcom_bam_dmux.c
+++ b/drivers/net/wwan/qcom_bam_dmux.c
@@ -9,14 +9,17 @@
#include <linux/completion.h>
#include <linux/dma-mapping.h>
#include <linux/dmaengine.h>
+#include <linux/firmware/qcom/qcom_scm.h>
#include <linux/if_arp.h>
#include <linux/interrupt.h>
#include <linux/module.h>
#include <linux/netdevice.h>
+#include <linux/of_reserved_mem.h>
#include <linux/platform_device.h>
#include <linux/pm_runtime.h>
#include <linux/soc/qcom/smem_state.h>
#include <linux/spinlock.h>
+#include <linux/swiotlb.h>
#include <linux/wait.h>
#include <linux/workqueue.h>
#include <net/pkt_sched.h>
@@ -75,6 +78,9 @@ struct bam_dmux {
struct completion pc_ack_completion;
struct dma_chan *rx, *tx;
+ phys_addr_t dma_pool_base;
+ size_t dma_pool_size;
+ u64 dma_pool_perms;
struct bam_dmux_skb_dma rx_skbs[BAM_DMUX_NUM_SKB];
struct bam_dmux_skb_dma tx_skbs[BAM_DMUX_NUM_SKB];
spinlock_t tx_lock; /* Protect tx_skbs, tx_next_skb */
@@ -762,6 +768,96 @@ static int __maybe_unused bam_dmux_runtime_resume(struct device *dev)
return 0;
}
+static int bam_dmux_assign_dma_pool(struct bam_dmux *dmux)
+{
+ struct device *dev = dmux->dev;
+ struct device_node *rmem_np;
+ struct reserved_mem *rmem;
+ struct qcom_scm_vmperm dst[2];
+ u64 src = BIT_ULL(QCOM_SCM_VMID_HLOS);
+ u32 vmid;
+ int ret;
+
+ if (!of_property_present(dev->of_node, "qcom,vmid"))
+ return 0;
+
+ ret = of_property_read_u32(dev->of_node, "qcom,vmid", &vmid);
+ if (ret)
+ return dev_err_probe(dev, ret, "Failed to read qcom,vmid\n");
+ if (vmid == QCOM_SCM_VMID_HLOS || vmid >= BITS_PER_TYPE(u64))
+ return dev_err_probe(dev, -EINVAL, "Invalid qcom,vmid %u\n", vmid);
+
+ if (!IS_ENABLED(CONFIG_DMA_RESTRICTED_POOL))
+ return dev_err_probe(dev, -EOPNOTSUPP,
+ "qcom,vmid requires DMA_RESTRICTED_POOL\n");
+
+ rmem_np = of_parse_phandle(dev->of_node, "memory-region", 0);
+ if (!rmem_np)
+ return dev_err_probe(dev, -EINVAL,
+ "qcom,vmid requires memory-region\n");
+
+ if (!of_device_is_compatible(rmem_np, "restricted-dma-pool")) {
+ of_node_put(rmem_np);
+ return dev_err_probe(dev, -EINVAL,
+ "memory-region must reference a restricted DMA pool\n");
+ }
+
+ rmem = of_reserved_mem_lookup(rmem_np);
+ of_node_put(rmem_np);
+ if (!rmem)
+ return dev_err_probe(dev, -EINVAL,
+ "Failed to look up restricted DMA pool\n");
+
+ if (!is_swiotlb_for_alloc(dev))
+ return dev_err_probe(dev, -EINVAL,
+ "Restricted DMA pool not attached\n");
+
+ if (!qcom_scm_is_available())
+ return -EPROBE_DEFER;
+
+ dst[0].vmid = QCOM_SCM_VMID_HLOS;
+ dst[0].perm = QCOM_SCM_PERM_RW;
+ dst[1].vmid = vmid;
+ dst[1].perm = QCOM_SCM_PERM_RW;
+
+ ret = qcom_scm_assign_mem(rmem->base, rmem->size, &src, dst,
+ ARRAY_SIZE(dst));
+ if (ret)
+ return dev_err_probe(dev, ret,
+ "SCM assign restricted DMA pool failed\n");
+
+ dmux->dma_pool_base = rmem->base;
+ dmux->dma_pool_size = rmem->size;
+ /* Track the destination VMIDs explicitly for the reclaim operation. */
+ dmux->dma_pool_perms = BIT_ULL(QCOM_SCM_VMID_HLOS) | BIT_ULL(vmid);
+
+ return 0;
+}
+
+static void bam_dmux_reclaim_dma_pool(struct bam_dmux *dmux)
+{
+ struct qcom_scm_vmperm hlos = {
+ .vmid = QCOM_SCM_VMID_HLOS,
+ .perm = QCOM_SCM_PERM_RW,
+ };
+ u64 src = dmux->dma_pool_perms;
+ int ret;
+
+ if (!dmux->dma_pool_perms)
+ return;
+
+ ret = qcom_scm_assign_mem(dmux->dma_pool_base, dmux->dma_pool_size, &src,
+ &hlos, 1);
+ if (ret) {
+ dev_err(dmux->dev, "SCM reclaim restricted DMA pool failed: %d\n", ret);
+ return;
+ }
+
+ dmux->dma_pool_perms = 0;
+}
+
+static void bam_dmux_remove(struct platform_device *pdev);
+
static int bam_dmux_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
@@ -796,6 +892,10 @@ static int bam_dmux_probe(struct platform_device *pdev)
"Failed to get pc-ack state\n");
dmux->pc_ack_mask = BIT(bit);
+ ret = bam_dmux_assign_dma_pool(dmux);
+ if (ret)
+ return ret;
+
init_waitqueue_head(&dmux->pc_wait);
init_completion(&dmux->pc_ack_completion);
complete_all(&dmux->pc_ack_completion);
@@ -829,8 +929,11 @@ static int bam_dmux_probe(struct platform_device *pdev)
ret = irq_get_irqchip_state(dmux->pc_irq, IRQCHIP_STATE_LINE_LEVEL,
&dmux->pc_state);
- if (ret)
- goto err_disable_pm;
+ if (ret) {
+ /* The PC IRQ may already have powered up the RX path */
+ bam_dmux_remove(pdev);
+ return ret;
+ }
/* Check if remote finished initialization before us */
if (dmux->pc_state) {
@@ -845,6 +948,7 @@ static int bam_dmux_probe(struct platform_device *pdev)
err_disable_pm:
pm_runtime_disable(dev);
pm_runtime_dont_use_autosuspend(dev);
+ bam_dmux_reclaim_dma_pool(dmux);
return ret;
}
@@ -853,6 +957,7 @@ static void bam_dmux_remove(struct platform_device *pdev)
struct bam_dmux *dmux = platform_get_drvdata(pdev);
struct device *dev = dmux->dev;
LIST_HEAD(list);
+ bool remote_suspended;
int i;
/* Unregister network interfaces */
@@ -872,13 +977,21 @@ static void bam_dmux_remove(struct platform_device *pdev)
pm_runtime_set_suspended(dev);
/* Try to wait for remote side to drop power vote */
- if (!wait_event_timeout(dmux->pc_wait, !dmux->rx, BAM_DMUX_REMOTE_TIMEOUT))
+ remote_suspended = wait_event_timeout(dmux->pc_wait, !dmux->rx,
+ BAM_DMUX_REMOTE_TIMEOUT);
+ if (!remote_suspended)
dev_err(dev, "Timed out waiting for remote side to suspend\n");
/* Make sure everything is cleaned up before we return */
disable_irq(dmux->pc_irq);
bam_dmux_power_off(dmux);
bam_dmux_free_skbs(dmux->tx_skbs, DMA_TO_DEVICE);
+
+ /* The remote side may still access the pool if it did not suspend */
+ if (remote_suspended)
+ bam_dmux_reclaim_dma_pool(dmux);
+ else if (dmux->dma_pool_perms)
+ dev_warn(dev, "Leaving restricted DMA pool assigned to remote\n");
}
static const struct dev_pm_ops bam_dmux_pm_ops = {
--
2.34.1
^ permalink raw reply [flat|nested] 4+ messages in thread