From: linux@arm.linux.org.uk (Russell King - ARM Linux)
To: linux-arm-kernel@lists.infradead.org
Subject: [PATCH] mmci: call flush_dcache_page() outside of atomic kmap
Date: Sat, 1 Jan 2011 12:05:52 +0000 [thread overview]
Message-ID: <20110101120539.GA25924@n2100.arm.linux.org.uk> (raw)
In-Reply-To: <1293878168-12741-1-git-send-email-rabin@rab.in>
On Sat, Jan 01, 2011 at 04:06:08PM +0530, Rabin Vincent wrote:
> While booting a QEMU Versatile/PB system with the root file system on
> SD, the following WARN_ON hits:
>
> ------------[ cut here ]------------
> WARNING: at /home/rabin/kernel/arm/lib/scatterlist.c:426 sg_miter_stop+0x64/0x9c()
> Modules linked in:
> [<c0031da4>] (unwind_backtrace+0x0/0xe4) from [<c003d5c0>] (warn_slowpath_common+0x4c/0x64)
> [<c003d5c0>] (warn_slowpath_common+0x4c/0x64) from [<c003d5f0>] (warn_slowpath_null+0x18/0x1c)
> [<c003d5f0>] (warn_slowpath_null+0x18/0x1c) from [<c0148338>] (sg_miter_stop+0x64/0x9c)
> [<c0148338>] (sg_miter_stop+0x64/0x9c) from [<c01a892c>] (mmci_pio_irq+0x1fc/0x270)
> [<c01a892c>] (mmci_pio_irq+0x1fc/0x270) from [<c0065928>] (handle_IRQ_event+0x24/0xf0)
> [<c0065928>] (handle_IRQ_event+0x24/0xf0) from [<c0067930>] (handle_level_irq+0xa4/0x114)
> [<c0067930>] (handle_level_irq+0xa4/0x114) from [<c0036258>] (sic_handle_irq+0x50/0x60)
> [<c0036258>] (sic_handle_irq+0x50/0x60) from [<c0022070>] (asm_do_IRQ+0x70/0x94)
> [<c0022070>] (asm_do_IRQ+0x70/0x94) from [<c002c0b4>] (__irq_svc+0x34/0xa0)
>
> It's the WARN_ON(!irqs_disabled()) in sg_miter_stop():
>
> if (miter->__flags & SG_MITER_ATOMIC) {
> WARN_ON(!irqs_disabled());
> kunmap_atomic(miter->addr, KM_BIO_SRC_IRQ);
> }
>
> This is because if the cache is VIVT, flush_dcache_page() calls
> __flush_dcache_aliases() when a user space mapping exists. That
> function uses flush_dcache_mmap_unlock() which is spin_unlock_irq(),
> which enables interrupts. Fix this by calling flush_dcache_page() only
> after the sg_miter is stopped.
I think there's some questions that need to be answered here first:
1. Why does this not trigger on real PB926 hardware?
2. Why the hell is a page being submitted which is mapped into userspace
yet has not already been populated with data from the card?
(2) is a serious error, what it means is that userspace can access the
data which was _previously_ in the page before the page has been read
with the required data.
In any case, this patch is unacceptable - trying to fix it by saving the
IRQ-disabled state around each scatterlist iterator function in case it
returns with IRQs enabled is just not on. It's a bodge at best, and at
worst it's opening up windows for a pile of races.
next prev parent reply other threads:[~2011-01-01 12:05 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-01-01 10:36 [PATCH] mmci: call flush_dcache_page() outside of atomic kmap Rabin Vincent
2011-01-01 12:05 ` Russell King - ARM Linux [this message]
2011-01-01 14:28 ` Rabin Vincent
2011-01-01 22:13 ` Russell King - ARM Linux
2011-01-02 4:38 ` Rabin Vincent
2011-01-02 5:11 ` Rabin Vincent
2011-01-02 5:20 ` Rabin Vincent
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110101120539.GA25924@n2100.arm.linux.org.uk \
--to=linux@arm.linux.org.uk \
--cc=linux-arm-kernel@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).