Dan Williams 628706b739 net_dma: mark broken ... commit 7787380336 upstream. net_dma can cause data to be copied to a stale mapping if a copy-on-write fault occurs during dma. The application sees missing data. The following trace is triggered by modifying the kernel to WARN if it ever triggers copy-on-write on a page that is undergoing dma: WARNING: CPU: 24 PID: 2529 at lib/dma-debug.c:485 debug_dma_assert_idle+0xd2/0x120() ioatdma 0000:00:04.0: DMA-API: cpu touching an active dma mapped page [pfn=0x16bcd9] Modules linked in: iTCO_wdt iTCO_vendor_support ioatdma lpc_ich pcspkr dca CPU: 24 PID: 2529 Comm: linbug Tainted: G W 3.13.0-rc1+ #353 00000000000001e5 ffff88016f45f688 ffffffff81751041 ffff88017ab0ef70 ffff88016f45f6d8 ffff88016f45f6c8 ffffffff8104ed9c ffffffff810f3646 ffff8801768f4840 0000000000000282 ffff88016f6cca10 00007fa2bb699349 Call Trace: [<ffffffff81751041>] dump_stack+0x46/0x58 [<ffffffff8104ed9c>] warn_slowpath_common+0x8c/0xc0 [<ffffffff810f3646>] ? ftrace_pid_func+0x26/0x30 [<ffffffff8104ee86>] warn_slowpath_fmt+0x46/0x50 [<ffffffff8139c062>] debug_dma_assert_idle+0xd2/0x120 [<ffffffff81154a40>] do_wp_page+0xd0/0x790 [<ffffffff811582ac>] handle_mm_fault+0x51c/0xde0 [<ffffffff813830b9>] ? copy_user_enhanced_fast_string+0x9/0x20 [<ffffffff8175fc2c>] __do_page_fault+0x19c/0x530 [<ffffffff8175c196>] ? _raw_spin_lock_bh+0x16/0x40 [<ffffffff810f3539>] ? trace_clock_local+0x9/0x10 [<ffffffff810fa1f4>] ? rb_reserve_next_event+0x64/0x310 [<ffffffffa0014c00>] ? ioat2_dma_prep_memcpy_lock+0x60/0x130 [ioatdma] [<ffffffff8175ffce>] do_page_fault+0xe/0x10 [<ffffffff8175c862>] page_fault+0x22/0x30 [<ffffffff81643991>] ? __kfree_skb+0x51/0xd0 [<ffffffff813830b9>] ? copy_user_enhanced_fast_string+0x9/0x20 [<ffffffff81388ea2>] ? memcpy_toiovec+0x52/0xa0 [<ffffffff8164770f>] skb_copy_datagram_iovec+0x5f/0x2a0 [<ffffffff8169d0f4>] tcp_rcv_established+0x674/0x7f0 [<ffffffff816a68c5>] tcp_v4_do_rcv+0x2e5/0x4a0 [..] ---[ end trace e30e3b01191b7617 ]--- Mapped at: [<ffffffff8139c169>] debug_dma_map_page+0xb9/0x160 [<ffffffff8142bf47>] dma_async_memcpy_pg_to_pg+0x127/0x210 [<ffffffff8142cce9>] dma_memcpy_pg_to_iovec+0x119/0x1f0 [<ffffffff81669d3c>] dma_skb_copy_datagram_iovec+0x11c/0x2b0 [<ffffffff8169d1ca>] tcp_rcv_established+0x74a/0x7f0: ...the problem is that the receive path falls back to cpu-copy in several locations and this trace is just one of the areas. A few options were considered to fix this: 1/ sync all dma whenever a cpu copy branch is taken 2/ modify the page fault handler to hold off while dma is in-flight Option 1 adds yet more cpu overhead to an "offload" that struggles to compete with cpu-copy. Option 2 adds checks for behavior that is already documented as broken when using get_user_pages(). At a minimum a debug mode is warranted to catch and flag these violations of the dma-api vs get_user_pages(). Thanks to David for his reproducer. Cc: Dave Jiang <dave.jiang@intel.com> Cc: Vinod Koul <vinod.koul@intel.com> Cc: Alexander Duyck <alexander.h.duyck@intel.com> Reported-by: David Whipple <whipple@securedatainnovations.ch> Acked-by: David S. Miller <davem@davemloft.net> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2014-01-08 09:42:11 -08:00
..
ioat	ioat: Fix DMA memory sync direction correct flag	2013-01-27 20:47:44 -08:00
ipu
ppc4xx
amba-pl08x.c	dmaengine/amba-pl08x : reset phychan_hold on terminate all	2012-04-25 15:10:57 +05:30
at_hdmac.c	dmaengine: at_hdmac: check that each sg data length is non-null	2012-10-02 10:30:10 -07:00
at_hdmac_regs.h
coh901318.c	Merge branch 'akpm' (Andrew's patch-bomb)	2012-04-05 15:30:34 -07:00
coh901318_lli.c
coh901318_lli.h
dmaengine.c	drivers/dma/dmaengine.c: lower the priority of 'failed to get' dma channel message	2012-10-13 05:38:38 +09:00
dmaengine.h
dmatest.c
dw_dmac.c
dw_dmac_regs.h
ep93xx_dma.c	dmaengine: fix cyclic dma usage	2012-05-15 08:43:40 +05:30
fsldma.c
fsldma.h
imx-dma.c	dmaengine: imx-dma: fix slow path issue in prep_dma_cyclic	2013-10-13 15:42:49 -07:00
imx-sdma.c	Merge branch 'next' of git://git.infradead.org/users/vkoul/slave-dma	2012-03-29 15:34:57 -07:00
intel_mid_dma.c
intel_mid_dma_regs.h
iop-adma.c	dmaengine-fixes for 3.4-rc3	2012-04-10 15:30:16 -07:00
iovlock.c
Kconfig	net_dma: mark broken	2014-01-08 09:42:11 -08:00
Makefile
mpc512x_dma.c
mv_xor.c
mv_xor.h
mxs-dma.c	dma: mxs-dma: enable channel in device_issue_pending call	2012-04-20 15:35:58 +05:30
pch_dma.c	pch_dma: Use GFP_ATOMIC because called from interrupt context	2013-05-19 10:54:48 -07:00
pl330.c	drivers/dma/pl330.c: fix locking in pl330_free_chan_resources()	2013-07-21 18:19:02 -07:00
sa11x0-dma.c	ARM: sa11x0: fix build errors from DMA engine API updates	2012-03-30 11:46:20 +01:00
shdma.c
shdma.h
sirf-dma.c	dmaengine: sirf: fix a typo in moving running dma_desc to active queue	2012-10-31 10:03:02 -07:00
ste_dma40.c	dma/ste_dma40: fix erroneous comparison	2012-04-23 18:07:05 +05:30
ste_dma40_ll.c
ste_dma40_ll.h	dma40: Improve the logic of stopping logical chan	2012-04-23 17:56:17 +05:30
timb_dma.c
TODO
txx9dmac.c
txx9dmac.h