linux-kernel - Re: [PATCH 3/9] dma: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2394e63f-1df7-764e-5489-3567065707a1@quicinc.com>
Date: Fri, 19 Sep 2025 11:26:55 +0530
From: Md Sadre Alam <quic_mdalam@...cinc.com>
To: Konrad Dybcio <konrad.dybcio@....qualcomm.com>, <broonie@...nel.org>,
        <robh@...nel.org>, <krzk+dt@...nel.org>, <conor+dt@...nel.org>,
        <andersson@...nel.org>, <konradybcio@...nel.org>, <vkoul@...nel.org>,
        <linux-arm-msm@...r.kernel.org>, <linux-spi@...r.kernel.org>,
        <devicetree@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <dmaengine@...r.kernel.org>
CC: <quic_varada@...cinc.com>
Subject: Re: [PATCH 3/9] dma: qcom: bam_dma: Fix command element mask field
 for BAM v1.6.0+



On 9/18/2025 3:57 PM, Konrad Dybcio wrote:
> On 9/18/25 11:40 AM, Md Sadre Alam wrote:
>> BAM version 1.6.0 and later changed the behavior of the mask field in
>> command elements for read operations. In newer BAM versions, the mask
>> field for read commands contains the upper 4 bits of the destination
>> address to support 36-bit addressing, while for write commands it
>> continues to function as a traditional write mask.
> 
> So the hardware can read from higher addresses but not write to them?
No,
Write Operations: Can target any 32-bit address in the peripheral 
address space (up to 4GB)

Read Operations: Can read from any 32-bit peripheral address and
place the data into 36-bit memory addresses (up to 64GB) starting
from BAM v1.6.0
> 
> Plus, you didn't explain what the mask register does on BAM <1.6.0.
> If it really masks the address, all reads will now point to 0x0
The mask field never masks addresses in any BAM version. Here's the 
complete specification:

BAM Command Element Structure

Write Command Elements (All BAM Versions):

| Field  | Bits  | Description                                         |
|--------|-------|-----------------------------------------------------|
| 1st DW | 31:24 | Command (must be 0 for write)                       |
|        | 23:0  | Address - target address in peripheral              |
|-----------------------------------------------------------------------
| 2nd DW | 31:0  | Data - the data to be written                       |
------------------------------------------------------------------------
| 3rd DW | 31:0  | Mask - 32-bit mask defining which bits to modify    |
-----------------------------------------------------------------------
| 4th DW | 31:0  | Reserved                                            |
------------------------------------------------------------------------

Read Command Elements (BAM < v1.6.0):

| Field  | Bits  | Description                                         |
|--------|-------|-----------------------------------------------------|
| 1st DW | 31:24 | Command (must be 1 for read)                        |
|        | 23:0  | Address - source address in peripheral              |
------------------------------------------------------------------------
| 2nd DW | 31:0  | Destination - memory address to write read-data     |
------------------------------------------------------------------------
| 3rd DW | 31:0  | Reserved (IGNORED by hardware)                      |
------------------------------------------------------------------------
| 4th DW | 31:0  | Reserved                                            |
------------------------------------------------------------------------

Read Command Elements (BAM >= v1.6.0):

| Field  | Bits  | Description                                         |
|--------|-------|-----------------------------------------------------|
| 1st DW | 31:24 | Command (must be 1 for read)                        |
|        | 23:0  | Address - source address in peripheral              |
------------------------------------------------------------------------
| 2nd DW | 31:0  | Destination - 32 LSBs of 36-bit destination addr    |
------------------------------------------------------------------------
| 3rd DW | 31:4  | Reserved                                            |
|        | 3:0   | Destination Address 4 MSBs (bits 35:32)             |
------------------------------------------------------------------------
| 4th DW | 31:0  | Reserved                                            |
------------------------------------------------------------------------

For Read Commands:
- BAM < v1.6.0: 3rd Dword completely ignored by hardware
- BAM >= v1.6.0: 3rd Dword[3:0] contains upper 4 bits of destination
address

Thanks,
Alam.