[PATCH] ARM: dma-mapping: split cache maintenance at highmem boundary

[PATCH] ARM: dma-mapping: split cache maintenance at highmem boundary

[Karl Mehltretter]

dma_cache_maint_page() processes highmem pages one at a time, but passes
the complete remaining range to a cache operation when the current page
is lowmem. If a physically contiguous range starts in lowmem and crosses
into highmem, the operation continues beyond high_memory through virtual
addresses which do not map the highmem pages.

On a Raspberry Pi 400 running an ARM32 LPAE kernel, an 8 KiB scatterlist
entry crossing this boundary caused a deterministic data abort at f0000000
in v7_dma_clean_range().

Limit the crossing lowmem iteration to the end of its page. Subsequent
iterations advance page by page until the existing highmem path takes
over. Keep the bulk operation for ranges contained in lowmem.

Fixes: 43377453af83 ("[ARM] introduce dma_cache_maint_page()")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Testing:

- Raspberry Pi 400, ARM32 LPAE, 8 KiB scatterlist entry crossing the
  0x30000000 lowmem/highmem boundary: all four unpatched boots panicked at
  f0000000 in v7_dma_clean_range(). All four patched boots completed. Three
  100-iteration patched runs checked 409,600 bytes in each DMA direction
  with zero mismatches.
- W=1 builds of arch/arm/mm/dma-mapping.o passed with CONFIG_HIGHMEM=y and
  CONFIG_HIGHMEM=n. They emitted only five pre-existing kernel-doc warnings.

The hardware kernels used base 986c24e0fe44. dma-mapping.c is unchanged
between that commit and this patch's base, 893e11787f78.

 arch/arm/mm/dma-mapping.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 7761099dde9e..887209a09226 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -663,6 +663,9 @@ static void dma_cache_maint_page(phys_addr_t phys, size_t size,
 		} else {
 			phys += offset;
 			vaddr = phys_to_virt(phys);
+			if (IS_ENABLED(CONFIG_HIGHMEM) &&
+			    len > (unsigned long)high_memory - (unsigned long)vaddr)
+				len = PAGE_SIZE - offset;
 			op(vaddr, len, dir);
 		}
 		offset = 0;
-- 
2.53.0

Re: [PATCH] ARM: dma-mapping: split cache maintenance at highmem boundary

[Arnd Bergmann]

On Wed, Sep 9, 2026, at 08:44, Karl Mehltretter wrote:
> dma_cache_maint_page() processes highmem pages one at a time, but passes
> the complete remaining range to a cache operation when the current page
> is lowmem. If a physically contiguous range starts in lowmem and crosses
> into highmem, the operation continues beyond high_memory through virtual
> addresses which do not map the highmem pages.
>
> On a Raspberry Pi 400 running an ARM32 LPAE kernel, an 8 KiB scatterlist
> entry crossing this boundary caused a deterministic data abort at f0000000
> in v7_dma_clean_range().
>
> Limit the crossing lowmem iteration to the end of its page. Subsequent
> iterations advance page by page until the existing highmem path takes
> over. Keep the bulk operation for ranges contained in lowmem.
>
> Fixes: 43377453af83 ("[ARM] introduce dma_cache_maint_page()")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>

Hi Karl,

I can see how the fix addresses the problem, but I don't yet see
how you can arrive in this situation. What type of memory allocation
can produce a physically contiguous page range from multiple
zones?

      Arnd

Re: [PATCH] ARM: dma-mapping: split cache maintenance at highmem boundary

[Karl Mehltretter]

On Wed, Sep 09, 2026 at 09:24:23AM +0100, Arnd Bergmann wrote:
> I can see how the fix addresses the problem, but I don't yet see
> how you can arrive in this situation. What type of memory allocation
> can produce a physically contiguous page range from multiple
> zones?
> 

Hi Arnd,

You're right that a buddy allocation cannot span zones. I found this issue
during code review while investigating another ARM DMA issue. I plan to
post a patch for that soon.

My Pi test deliberately reserved the last lowmem and first highmem pages
in DT. It confirms the crash with a crossing SG entry, but I have not
found an ordinary workload that creates one. I should have made that
clear in the changelog.

In a follow-up QEMU test, sg_alloc_table_from_pages() merged the reserved
pair into one 8192-byte entry. It checks that the pages are physically
adjacent but does not check page_zone().

I also searched a bit for a real-world example. Rockchip's vendor 4.4
boot-logo code looks like a possible case: it builds an SG table from
firmware-reserved pages and calls dma_map_sg() when no display IOMMU is
used. Product logs show the boot-logo feature in use, but I found no
record of its reserved memory crossing the lowmem/highmem boundary.
Such a crossing seems unlikely.

I still think the change is worthwhile. For v2, I will update the
changelog to make the test setup and its limits clear. I may also drop the
Cc: stable tag.

Thanks,
Karl

Re: [PATCH] ARM: dma-mapping: split cache maintenance at highmem boundary

[Robin Murphy]

On 10/09/2026 7:24 am, Karl Mehltretter wrote:
> On Wed, Sep 09, 2026 at 09:24:23AM +0100, Arnd Bergmann wrote:
>> I can see how the fix addresses the problem, but I don't yet see
>> how you can arrive in this situation. What type of memory allocation
>> can produce a physically contiguous page range from multiple
>> zones?
>>
> 
> Hi Arnd,
> 
> You're right that a buddy allocation cannot span zones. I found this issue
> during code review while investigating another ARM DMA issue. I plan to
> post a patch for that soon.
> 
> My Pi test deliberately reserved the last lowmem and first highmem pages
> in DT. It confirms the crash with a crossing SG entry, but I have not
> found an ordinary workload that creates one. I should have made that
> clear in the changelog.
> 
> In a follow-up QEMU test, sg_alloc_table_from_pages() merged the reserved
> pair into one 8192-byte entry. It checks that the pages are physically
> adjacent but does not check page_zone().
> 
> I also searched a bit for a real-world example. Rockchip's vendor 4.4
> boot-logo code looks like a possible case: it builds an SG table from
> firmware-reserved pages and calls dma_map_sg() when no display IOMMU is
> used. Product logs show the boot-logo feature in use, but I found no
> record of its reserved memory crossing the lowmem/highmem boundary.
> Such a crossing seems unlikely.

That is completely bogus to begin with though. Calling dma_map_* on 
reserved non-kernel memory is liable to blow up in various ways anyway 
(e.g. in sparsemem page_to_pfn/pfn_to_page) - what's the justification 
for being more lenient towards one particular corner of invalid usage?

Thanks,
Robin.

> I still think the change is worthwhile. For v2, I will update the
> changelog to make the test setup and its limits clear. I may also drop the
> Cc: stable tag.
> 
> Thanks,
> Karl