[4.0.5] sdhci+swiotlb => Corrupted low memory

All of lore.kernel.org
 help / color / mirror / Atom feed

* [4.0.5] sdhci+swiotlb => Corrupted low memory
@ 2015-06-12  8:46 Jiri Slaby
       [not found] ` <1434102302-11189-1-git-send-email-jslaby@suse.cz>
  0 siblings, 1 reply; 2+ messages in thread
From: Jiri Slaby @ 2015-06-12  8:46 UTC (permalink / raw)
  To: linux-mmc, Konrad Rzeszutek Wilk, Ulf Hansson; +Cc: Linux kernel mailing list

Hi,

today I plugged in an SD card into the laptop's built-in reader on
x86-64 and got "Corrupted low memory" as a result:
Corrupted low memory at ffff880000001000 (1000 phys) = 22b7d67df2f6d1cf
Corrupted low memory at ffff880000001008 (1008 phys) = 63848a5216b7dd95
Corrupted low memory at ffff880000001010 (1010 phys) = 330eb7ddef39e427
Corrupted low memory at ffff880000001018 (1018 phys) = 8017ac7295039bda
Corrupted low memory at ffff880000001020 (1020 phys) = 8ce039eac119074f
Corrupted low memory at ffff880000001028 (1028 phys) = f2de46b94adf3ef4
Corrupted low memory at ffff880000001030 (1030 phys) = d1d3f48600fff7be
Corrupted low memory at ffff880000001038 (1038 phys) = 3f7e796b65efa819
Corrupted low memory at ffff880000001040 (1040 phys) = 79c63b3920597681
Corrupted low memory at ffff880000001048 (1048 phys) = 608c93712487996f
Corrupted low memory at ffff880000001050 (1050 phys) = 1f5354ad4f729cf1
...
Corrupted low memory at ffff88000000fff0 (fff0 phys) = e1e41c03059ba547
Corrupted low memory at ffff88000000fff8 (fff8 phys) = e20f4297ab84fbe

The reader:
02:00.0 System peripheral [0880]: Ricoh Co Ltd MMC/SD Host Controller
[1180:e822] (rev 07)

MMC complained upon insertion (this happens sometimes and can be fixed
by replugging):

mmc0: new high speed SDHC card at address e624
mmcblk0: mmc0:e624 SU16G 14.8 GiB
mmcblk0: error -84 transferring data, sector 0, nr 8, cmd response
0x900, card status 0xb00
mmc0: tried to reset card
mmcblk0: error -84 transferring data, sector 0, nr 8, cmd response
0x900, card status 0xb00
mmcblk0: retrying using single block read
mmcblk0: error -84 transferring data, sector 0, nr 8, cmd response
0x900, card status 0x0
blk_update_request: I/O error, dev mmcblk0, sector 0
mmcblk0: error -84 transferring data, sector 1, nr 7, cmd response
0x900, card status 0x0
blk_update_request: I/O error, dev mmcblk0, sector 1
mmcblk0: error -84 transferring data, sector 2, nr 6, cmd response
0x900, card status 0x0
blk_update_request: I/O error, dev mmcblk0, sector 2
mmcblk0: error -84 transferring data, sector 3, nr 5, cmd response
0x900, card status 0x0
blk_update_request: I/O error, dev mmcblk0, sector 3
mmcblk0: error -84 transferring data, sector 4, nr 4, cmd response
0x900, card status 0x0
blk_update_request: I/O error, dev mmcblk0, sector 4
mmcblk0: error -84 transferring data, sector 5, nr 3, cmd response
0x900, card status 0x0
blk_update_request: I/O error, dev mmcblk0, sector 5
mmcblk0: error -84 transferring data, sector 6, nr 2, cmd response
0x900, card status 0x0
blk_update_request: I/O error, dev mmcblk0, sector 6
mmcblk0: error -84 transferring data, sector 7, nr 1, cmd response
0x900, card status 0x0
blk_update_request: I/O error, dev mmcblk0, sector 7
Buffer I/O error on dev mmcblk0, logical block 0, async page read
mmcblk0: error -84 transferring data, sector 0, nr 8, cmd response
0x900, card status 0xb00
mmcblk0: retrying using single block read
mmcblk0: error -84 transferring data, sector 0, nr 8, cmd response
0x900, card status 0x0
blk_update_request: I/O error, dev mmcblk0, sector 0
mmcblk0: error -84 transferring data, sector 1, nr 7, cmd response
0x900, card status 0x0
blk_update_request: I/O error, dev mmcblk0, sector 1
mmcblk0: error -84 transferring data, sector 2, nr 6, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 3, nr 5, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 4, nr 4, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 5, nr 3, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 6, nr 2, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 7, nr 1, cmd response
0x900, card status 0x0
Buffer I/O error on dev mmcblk0, logical block 0, async page read
mmcblk0: error -84 transferring data, sector 0, nr 8, cmd response
0x900, card status 0xb00
mmcblk0: retrying using single block read
mmcblk0: error -84 transferring data, sector 0, nr 8, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 1, nr 7, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 2, nr 6, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 3, nr 5, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 4, nr 4, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 5, nr 3, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 6, nr 2, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 7, nr 1, cmd response
0x900, card status 0x0
Buffer I/O error on dev mmcblk0, logical block 0, async page read
ldm_validate_partition_table(): Disk read failed.
mmcblk0: error -84 transferring data, sector 0, nr 8, cmd response
0x900, card status 0xb00
mmcblk0: retrying using single block read
mmcblk0: error -84 transferring data, sector 0, nr 8, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 1, nr 7, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 2, nr 6, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 3, nr 5, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 4, nr 4, cmd response
0x900, card status 0x0
mmcblk0: error -84 transferring data, sector 6, nr 2, cmd response
0x900, card status 0x0
mmc0: tried to reset card
Buffer I/O error on dev mmcblk0, logical block 0, async page read
 mmcblk0: unable to read partition table

Then SWIOTLB complained a lot:
swiotlb_tbl_map_single: 555 callbacks suppressed
sdhci-pci 0000:02:00.0: swiotlb buffer is full (sz: 65536 bytes)
DMA: Out of SW-IOMMU space for 65536 bytes at device 0000:02:00.0
sdhci-pci 0000:02:00.0: swiotlb buffer is full (sz: 65536 bytes)
DMA: Out of SW-IOMMU space for 65536 bytes at device 0000:02:00.0

This SWIOTLB splat is intermixed with WARNINGs from sdhci:
WARNING: CPU: 0 PID: 8669 at drivers/mmc/host/sdhci.c:857
sdhci_prepare_data+0x8ec/0x900 [sdhci]()

There is a lot of them. Full log of these:
http://www.fi.muni.cz/~xslaby/sklad/panics/sdhci.txt

I checked the DMA mappings in sdhci.c, but they seem to be OK:
                sg_count = dma_map_sg(...);
...
        if (sg_count == 0)
                return -EINVAL;

AND
        host->align_addr = dma_map_single(mmc_dev(host->mmc), ...);
        if (dma_mapping_error(mmc_dev(host->mmc), host->align_addr))
                goto fail;

Any ideas?

thanks,
-- 
js
suse labs

^ permalink raw reply	[flat|nested] 2+ messages in thread

[parent not found: <1434102302-11189-1-git-send-email-jslaby@suse.cz>]

* Re: [PATCH 1/1] mmc: sdhci: fix low memory corruption
       [not found] ` <1434102302-11189-1-git-send-email-jslaby@suse.cz>
@ 2015-06-15  9:55   ` Ulf Hansson
  0 siblings, 0 replies; 2+ messages in thread
From: Ulf Hansson @ 2015-06-15  9:55 UTC (permalink / raw)
  To: Jiri Slaby
  Cc: linux-kernel@vger.kernel.org, konrad.wilk, linux-mmc, # 4.0+,
	Haibo Chen

On 12 June 2015 at 11:45, Jiri Slaby <jslaby@suse.cz> wrote:
> When dma mapping (dma_map_sg) fails in sdhci_pre_dma_transfer, -EINVAL
> is returned. There are 3 callers of sdhci_pre_dma_transfer:
> * sdhci_pre_req and sdhci_adma_table_pre: handle negative return
> * sdhci_prepare_data: handles 0 (error) and "else" (good) only
>
> sdhci_prepare_data is therefore broken. When it receives -EINVAL from
> sdhci_pre_dma_transfer, it assumes 1 sg mapping was mapped. Later,
> this non-existant mapping with address 0 is kmap'ped and written to:
> Corrupted low memory at ffff880000001000 (1000 phys) = 22b7d67df2f6d1cf
> Corrupted low memory at ffff880000001008 (1008 phys) = 63848a5216b7dd95
> Corrupted low memory at ffff880000001010 (1010 phys) = 330eb7ddef39e427
> Corrupted low memory at ffff880000001018 (1018 phys) = 8017ac7295039bda
> Corrupted low memory at ffff880000001020 (1020 phys) = 8ce039eac119074f
> ...
>
> So teach sdhci_prepare_data to understand negative return values from
> sdhci_pre_dma_transfer and disable DMA in that case, as well as for
> zero.
>
> It was introduced in 348487cb28e66b032bae1b38424d81bf5b444408 (mmc:
> sdhci: use pipeline mmc requests to improve performance). The commit
> seems to be suspicious also by assigning host->sg_count both in
> sdhci_pre_dma_transfer and sdhci_adma_table_pre.
>
> Signed-off-by: Jiri Slaby <jslaby@suse.cz>
> Cc: stable@vger.kernel.org # 4.0+
> Fixes: 348487cb28e6
> Cc: Ulf Hansson <ulf.hansson@linaro.org>
> Cc: Haibo Chen <haibo.chen@freescale.com>

Thanks, applied for next.

Kind regards
Uffe

> ---
>  drivers/mmc/host/sdhci.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
> index 1b4861ddfb38..55e7f9a9858a 100644
> --- a/drivers/mmc/host/sdhci.c
> +++ b/drivers/mmc/host/sdhci.c
> @@ -834,7 +834,7 @@ static void sdhci_prepare_data(struct sdhci_host *host, struct mmc_command *cmd)
>                         int sg_cnt;
>
>                         sg_cnt = sdhci_pre_dma_transfer(host, data, NULL);
> -                       if (sg_cnt == 0) {
> +                       if (sg_cnt <= 0) {
>                                 /*
>                                  * This only happens when someone fed
>                                  * us an invalid request.
> --
> 2.4.2
>

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2015-06-15  9:55 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-06-12  8:46 [4.0.5] sdhci+swiotlb => Corrupted low memory Jiri Slaby
     [not found] ` <1434102302-11189-1-git-send-email-jslaby@suse.cz>
2015-06-15  9:55   ` [PATCH 1/1] mmc: sdhci: fix low memory corruption Ulf Hansson

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.