From mboxrd@z Thu Jan 1 00:00:00 1970 From: Robin Murphy Subject: Re: [PATCH v4 3/6] iommu: add ARM short descriptor page table allocator. Date: Fri, 9 Oct 2015 18:41:51 +0100 Message-ID: <5617FC5F.60505@arm.com> References: <1438597279-2937-1-git-send-email-yong.wu@mediatek.com> <1438597279-2937-4-git-send-email-yong.wu@mediatek.com> <20150916155824.GM28771@arm.com> <1442501662.8145.151.camel@mhfsdcap03> <1442931167.17514.39.camel@mhfsdcap03> <20151009155750.GS26278@arm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=WINDOWS-1252; format=flowed Content-Transfer-Encoding: 8BIT Return-path: In-Reply-To: <20151009155750.GS26278-5wv7dgnIgG8@public.gmane.org> Sender: devicetree-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Will Deacon , Yong Wu Cc: Mark Rutland , Catalin Marinas , "youhua.li-NuS5LvNUpcJWk0Htik3J/w@public.gmane.org" , Thierry Reding , "k.zhang-NuS5LvNUpcJWk0Htik3J/w@public.gmane.org" , "devicetree-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , "arnd-r2nGTMty4D4@public.gmane.org" , Tomasz Figa , Rob Herring , "linux-mediatek-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org" , Matthias Brugger , "linux-arm-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org" , "pebolle-IWqWACnzNjzz+pZb47iToQ@public.gmane.org" , "frederic.chen-NuS5LvNUpcJWk0Htik3J/w@public.gmane.org" , "srv_heupstream-NuS5LvNUpcJWk0Htik3J/w@public.gmane.org" , "linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , "iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org" , Daniel List-Id: iommu@lists.linux-foundation.org On 09/10/15 16:57, Will Deacon wrote: > On Tue, Sep 22, 2015 at 03:12:47PM +0100, Yong Wu wrote: >> I would like to show you a problem I met, The recursion here may >> lead to stack overflow while we test FHD video decode. >> >> From the log, I get the internal variable in the error case: the >> "size" is 0x100000, the "iova" is 0xfea00000, but at that time the >> "blk_size" is 0x1000 as it was the map of small-page. so it enter the >> recursion here. >> >> After check the unmap flow, there is only a iommu_unmap in >> __iommu_dma_unmap, and it won't check the physical address align in >> iommu_unmap. > > That sounds like a bug in __iommu_dma_unmap. Robin? Isn't it just cf27ec930be9 again wearing different trousers? All I do is call iommu_unmap with the same total size that was mapped originally. Robin. -- To unsubscribe from this list: send the line "unsubscribe devicetree" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 From: robin.murphy@arm.com (Robin Murphy) Date: Fri, 9 Oct 2015 18:41:51 +0100 Subject: [PATCH v4 3/6] iommu: add ARM short descriptor page table allocator. In-Reply-To: <20151009155750.GS26278@arm.com> References: <1438597279-2937-1-git-send-email-yong.wu@mediatek.com> <1438597279-2937-4-git-send-email-yong.wu@mediatek.com> <20150916155824.GM28771@arm.com> <1442501662.8145.151.camel@mhfsdcap03> <1442931167.17514.39.camel@mhfsdcap03> <20151009155750.GS26278@arm.com> Message-ID: <5617FC5F.60505@arm.com> To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On 09/10/15 16:57, Will Deacon wrote: > On Tue, Sep 22, 2015 at 03:12:47PM +0100, Yong Wu wrote: >> I would like to show you a problem I met, The recursion here may >> lead to stack overflow while we test FHD video decode. >> >> From the log, I get the internal variable in the error case: the >> "size" is 0x100000, the "iova" is 0xfea00000, but at that time the >> "blk_size" is 0x1000 as it was the map of small-page. so it enter the >> recursion here. >> >> After check the unmap flow, there is only a iommu_unmap in >> __iommu_dma_unmap, and it won't check the physical address align in >> iommu_unmap. > > That sounds like a bug in __iommu_dma_unmap. Robin? Isn't it just cf27ec930be9 again wearing different trousers? All I do is call iommu_unmap with the same total size that was mapped originally. Robin. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933628AbbJIRl5 (ORCPT ); Fri, 9 Oct 2015 13:41:57 -0400 Received: from eu-smtp-delivery-143.mimecast.com ([207.82.80.143]:19243 "EHLO eu-smtp-delivery-143.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933417AbbJIRlz convert rfc822-to-8bit (ORCPT ); Fri, 9 Oct 2015 13:41:55 -0400 Subject: Re: [PATCH v4 3/6] iommu: add ARM short descriptor page table allocator. To: Will Deacon , Yong Wu References: <1438597279-2937-1-git-send-email-yong.wu@mediatek.com> <1438597279-2937-4-git-send-email-yong.wu@mediatek.com> <20150916155824.GM28771@arm.com> <1442501662.8145.151.camel@mhfsdcap03> <1442931167.17514.39.camel@mhfsdcap03> <20151009155750.GS26278@arm.com> Cc: Mark Rutland , Catalin Marinas , "youhua.li@mediatek.com" , Thierry Reding , "k.zhang@mediatek.com" , "devicetree@vger.kernel.org" , "arnd@arndb.de" , Tomasz Figa , Rob Herring , "linux-mediatek@lists.infradead.org" , Matthias Brugger , "linux-arm-kernel@lists.infradead.org" , "pebolle@tiscali.nl" , "frederic.chen@mediatek.com" , "srv_heupstream@mediatek.com" , "linux-kernel@vger.kernel.org" , "iommu@lists.linux-foundation.org" , Daniel Kurtz , Sasha Hauer , Lucas Stach From: Robin Murphy Message-ID: <5617FC5F.60505@arm.com> Date: Fri, 9 Oct 2015 18:41:51 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: <20151009155750.GS26278@arm.com> X-OriginalArrivalTime: 09 Oct 2015 17:41:52.0141 (UTC) FILETIME=[C83273D0:01D102B9] X-MC-Unique: KHpwtdsLSKCsuiZ57evmgg-1 Content-Type: text/plain; charset=WINDOWS-1252; format=flowed Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 09/10/15 16:57, Will Deacon wrote: > On Tue, Sep 22, 2015 at 03:12:47PM +0100, Yong Wu wrote: >> I would like to show you a problem I met, The recursion here may >> lead to stack overflow while we test FHD video decode. >> >> From the log, I get the internal variable in the error case: the >> "size" is 0x100000, the "iova" is 0xfea00000, but at that time the >> "blk_size" is 0x1000 as it was the map of small-page. so it enter the >> recursion here. >> >> After check the unmap flow, there is only a iommu_unmap in >> __iommu_dma_unmap, and it won't check the physical address align in >> iommu_unmap. > > That sounds like a bug in __iommu_dma_unmap. Robin? Isn't it just cf27ec930be9 again wearing different trousers? All I do is call iommu_unmap with the same total size that was mapped originally. Robin.