linux-toradex.git/drivers/dma, branch v3.10.28

net_dma: mark broken

2014-01-09T20:24:21+00:00

commit 77873803363c9e831fc1d1e6895c084279090c22 upstream.

net_dma can cause data to be copied to a stale mapping if a
copy-on-write fault occurs during dma.  The application sees missing
data.

The following trace is triggered by modifying the kernel to WARN if it
ever triggers copy-on-write on a page that is undergoing dma:

 WARNING: CPU: 24 PID: 2529 at lib/dma-debug.c:485 debug_dma_assert_idle+0xd2/0x120()
 ioatdma 0000:00:04.0: DMA-API: cpu touching an active dma mapped page [pfn=0x16bcd9]
 Modules linked in: iTCO_wdt iTCO_vendor_support ioatdma lpc_ich pcspkr dca
 CPU: 24 PID: 2529 Comm: linbug Tainted: G        W    3.13.0-rc1+ #353
  00000000000001e5 ffff88016f45f688 ffffffff81751041 ffff88017ab0ef70
  ffff88016f45f6d8 ffff88016f45f6c8 ffffffff8104ed9c ffffffff810f3646
  ffff8801768f4840 0000000000000282 ffff88016f6cca10 00007fa2bb699349
 Call Trace:
  [] dump_stack+0x46/0x58
  [] warn_slowpath_common+0x8c/0xc0
  [] ? ftrace_pid_func+0x26/0x30
  [] warn_slowpath_fmt+0x46/0x50
  [] debug_dma_assert_idle+0xd2/0x120
  [] do_wp_page+0xd0/0x790
  [] handle_mm_fault+0x51c/0xde0
  [] ? copy_user_enhanced_fast_string+0x9/0x20
  [] __do_page_fault+0x19c/0x530
  [] ? _raw_spin_lock_bh+0x16/0x40
  [] ? trace_clock_local+0x9/0x10
  [] ? rb_reserve_next_event+0x64/0x310
  [] ? ioat2_dma_prep_memcpy_lock+0x60/0x130 [ioatdma]
  [] do_page_fault+0xe/0x10
  [] page_fault+0x22/0x30
  [] ? __kfree_skb+0x51/0xd0
  [] ? copy_user_enhanced_fast_string+0x9/0x20
  [] ? memcpy_toiovec+0x52/0xa0
  [] skb_copy_datagram_iovec+0x5f/0x2a0
  [] tcp_rcv_established+0x674/0x7f0
  [] tcp_v4_do_rcv+0x2e5/0x4a0
  [..]
 ---[ end trace e30e3b01191b7617 ]---
 Mapped at:
  [] debug_dma_map_page+0xb9/0x160
  [] dma_async_memcpy_pg_to_pg+0x127/0x210
  [] dma_memcpy_pg_to_iovec+0x119/0x1f0
  [] dma_skb_copy_datagram_iovec+0x11c/0x2b0
  [] tcp_rcv_established+0x74a/0x7f0:

...the problem is that the receive path falls back to cpu-copy in
several locations and this trace is just one of the areas.  A few
options were considered to fix this:

1/ sync all dma whenever a cpu copy branch is taken

2/ modify the page fault handler to hold off while dma is in-flight

Option 1 adds yet more cpu overhead to an "offload" that struggles to compete
with cpu-copy.  Option 2 adds checks for behavior that is already documented as
broken when using get_user_pages().  At a minimum a debug mode is warranted to
catch and flag these violations of the dma-api vs get_user_pages().

Thanks to David for his reproducer.

Cc: Dave Jiang 
Cc: Vinod Koul 
Cc: Alexander Duyck 
Reported-by: David Whipple 
Acked-by: David S. Miller 
Signed-off-by: Dan Williams 
Signed-off-by: Greg Kroah-Hartman

ioatdma: fix selection of 16 vs 8 source path

2013-12-04T18:56:45+00:00

commit 21e96c7313486390c694919522a76dfea0a86c59 upstream.

When performing continuations there are implied sources that need to be
added to the source count. Quoting dma_set_maxpq:

/* dma_maxpq - reduce maxpq in the face of continued operations
 * @dma - dma device with PQ capability
 * @flags - to check if DMA_PREP_CONTINUE and DMA_PREP_PQ_DISABLE_P are set
 *
 * When an engine does not support native continuation we need 3 extra
 * source slots to reuse P and Q with the following coefficients:
 * 1/ {00} * P : remove P from Q', but use it as a source for P'
 * 2/ {01} * Q : use Q to continue Q' calculation
 * 3/ {00} * Q : subtract Q from P' to cancel (2)
 *
 * In the case where P is disabled we only need 1 extra source:
 * 1/ {01} * Q : use Q to continue Q' calculation
 */

...fix the selection of the 16 source path to take these implied sources
into account.

Note this also kills the BUG_ON(src_cnt < 9) check in
__ioat3_prep_pq16_lock().  Besides not accounting for implied sources
the check is redundant given we already made the path selection.

Cc: Dave Jiang 
Acked-by: Dave Jiang 
Signed-off-by: Dan Williams 
Signed-off-by: Greg Kroah-Hartman

ioatdma: fix sed pool selection

2013-12-04T18:56:45+00:00

commit 5d48b9b5d80e3aa38a5161565398b1e48a650573 upstream.

The array to lookup the sed pool based on the number of sources
(pq16_idx_to_sedi) is 16 entries and expects a max source index.
However, we pass the total source count which runs off the end of the
array when src_cnt == 16.  The minimal fix is to just pass src_cnt-1,
but given we know the source count is > 8 we can just calculate the sed
pool by (src_cnt - 2) >> 3.

Cc: Dave Jiang 
Acked-by: Dave Jiang 
Signed-off-by: Dan Williams 
Signed-off-by: Greg Kroah-Hartman

dmaengine: imx-dma: fix slow path issue in prep_dma_cyclic

2013-10-13T23:08:34+00:00

commit edc530fe7ee5a562680615d2e7cd205879c751a7 upstream.

When perparing cyclic_dma buffers by the sound layer, it will dump the
following lockdep trace. The leading snd_pcm_action_single get called
with read_lock_irq called. To fix this, we change the kcalloc call from
GFP_KERNEL to GFP_ATOMIC.

WARNING: at kernel/lockdep.c:2740 lockdep_trace_alloc+0xcc/0x114()
DEBUG_LOCKS_WARN_ON(irqs_disabled_flags(flags))
Modules linked in:
CPU: 0 PID: 832 Comm: aplay Not tainted 3.11.0-20130823+ #903
Backtrace:
[] (dump_backtrace+0x0/0x10c) from [] (show_stack+0x18/0x1c)
 r6:c004c090 r5:00000009 r4:c2e0bd18 r3:00404000
[] (show_stack+0x0/0x1c) from [] (dump_stack+0x20/0x28)
[] (dump_stack+0x0/0x28) from [] (warn_slowpath_common+0x54/0x70)
[] (warn_slowpath_common+0x0/0x70) from [] (warn_slowpath_fmt+0x38/0x40)
 r8:00004000 r7:a3b90000 r6:000080d0 r5:60000093 r4:c2e0a000 r3:00000009
[] (warn_slowpath_fmt+0x0/0x40) from [] (lockdep_trace_alloc+0xcc/0x114)
 r3:c03955d8 r2:c03907db
[] (lockdep_trace_alloc+0x0/0x114) from [] (__kmalloc+0x34/0x118)
 r6:000080d0 r5:c3800120 r4:000080d0 r3:c040a0f8
[] (__kmalloc+0x0/0x118) from [] (imxdma_prep_dma_cyclic+0x64/0x168)
 r7:a3b90000 r6:00000004 r5:c39d8420 r4:c3847150
[] (imxdma_prep_dma_cyclic+0x0/0x168) from [] (snd_dmaengine_pcm_trigger+0xa8/0x160)
[] (snd_dmaengine_pcm_trigger+0x0/0x160) from [] (soc_pcm_trigger+0x90/0xb4)
 r8:c058c7b0 r7:c3b8140c r6:c39da560 r5:00000001 r4:c3b81000
[] (soc_pcm_trigger+0x0/0xb4) from [] (snd_pcm_do_start+0x2c/0x38)
 r7:00000000 r6:00000003 r5:c058c7b0 r4:c3b81000
[] (snd_pcm_do_start+0x0/0x38) from [] (snd_pcm_action_single+0x40/0x6c)
[] (snd_pcm_action_single+0x0/0x6c) from [] (snd_pcm_action_lock_irq+0x7c/0x9c)
 r7:00000003 r6:c3b810f0 r5:c3b810f0 r4:c3b81000
[] (snd_pcm_action_lock_irq+0x0/0x9c) from [] (snd_pcm_common_ioctl1+0x7f8/0xfd0)
 r8:c3b7f888 r7:005407b8 r6:c2c991c0 r5:c3b81000 r4:c3b81000 r3:00004142
[] (snd_pcm_common_ioctl1+0x0/0xfd0) from [] (snd_pcm_playback_ioctl1+0x464/0x488)
[] (snd_pcm_playback_ioctl1+0x0/0x488) from [] (snd_pcm_playback_ioctl+0x34/0x40)
 r8:c3b7f888 r7:00004142 r6:00000004 r5:c2c991c0 r4:005407b8
[] (snd_pcm_playback_ioctl+0x0/0x40) from [] (vfs_ioctl+0x30/0x44)
[] (vfs_ioctl+0x0/0x44) from [] (do_vfs_ioctl+0x55c/0x5c0)
[] (do_vfs_ioctl+0x0/0x5c0) from [] (SyS_ioctl+0x40/0x68)
[] (SyS_ioctl+0x0/0x68) from [] (ret_fast_syscall+0x0/0x44)
 r8:c0009544 r7:00000036 r6:bedeaa58 r5:00000000 r4:000000c0

Signed-off-by: Michael Grzeschik 
Signed-off-by: Vinod Koul 
Cc: Jonghwan Choi 
Signed-off-by: Greg Kroah-Hartman

dmaengine: imx-dma: fix callback path in tasklet

2013-10-13T23:08:34+00:00

commit fcaaba6c7136fe47e5a13352f99a64b019b6d2c5 upstream.

We need to free the ld_active list head before jumping into the callback
routine. Otherwise the callback could run into issue_pending and change
our ld_active list head we just going to free. This will run the channel
list into an currupted and undefined state.

Signed-off-by: Michael Grzeschik 
Signed-off-by: Vinod Koul 
Cc: Jonghwan Choi 
Signed-off-by: Greg Kroah-Hartman

dmaengine: imx-dma: fix lockdep issue between irqhandler and tasklet

2013-10-13T23:08:34+00:00

commit 5a276fa6bdf82fd442046969603968c83626ce0b upstream.

The tasklet and irqhandler are using spin_lock while other routines are
using spin_lock_irqsave/restore. This leads to lockdep issues as
described bellow. This patch is changing the code to use
spinlock_irq_save/restore in both code pathes.

As imxdma_xfer_desc always gets called with spin_lock_irqsave lock held,
this patch also removes the spare call inside the routine to avoid
double locking.

[  403.358162] =================================
[  403.362549] [ INFO: inconsistent lock state ]
[  403.366945] 3.10.0-20130823+ #904 Not tainted
[  403.371331] ---------------------------------
[  403.375721] inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
[  403.381769] swapper/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
[  403.386762]  (&(&imxdma->lock)->rlock){?.-...}, at: [] imxdma_tasklet+0x20/0x134
[  403.395201] {IN-HARDIRQ-W} state was registered at:
[  403.400108]   [] mark_lock+0x2a0/0x6b4
[  403.404798]   [] __lock_acquire+0x650/0x1a64
[  403.410004]   [] lock_acquire+0x94/0xa8
[  403.414773]   [] _raw_spin_lock+0x54/0x8c
[  403.419720]   [] dma_irq_handler+0x78/0x254
[  403.424845]   [] handle_irq_event_percpu+0x38/0x1b4
[  403.430670]   [] handle_irq_event+0x44/0x64
[  403.435789]   [] handle_level_irq+0xd8/0xf0
[  403.440903]   [] generic_handle_irq+0x28/0x38
[  403.446194]   [] handle_IRQ+0x68/0x8c
[  403.450789]   [] avic_handle_irq+0x3c/0x48
[  403.455811]   [] __irq_svc+0x44/0x74
[  403.460314]   [] cpu_startup_entry+0x88/0xf4
[  403.465525]   [] rest_init+0xb8/0xe0
[  403.470045]   [] start_kernel+0x28c/0x2d4
[  403.474986]   [] 0xa0008040
[  403.478709] irq event stamp: 50854
[  403.482140] hardirqs last  enabled at (50854): [] tasklet_action+0x38/0xdc
[  403.489954] hardirqs last disabled at (50853): [] tasklet_action+0x20/0xdc
[  403.497761] softirqs last  enabled at (50850): [] _local_bh_enable+0x14/0x18
[  403.505741] softirqs last disabled at (50851): [] irq_exit+0x88/0xdc
[  403.513026]
[  403.513026] other info that might help us debug this:
[  403.519593]  Possible unsafe locking scenario:
[  403.519593]
[  403.525548]        CPU0
[  403.528020]        ----
[  403.530491]   lock(&(&imxdma->lock)->rlock);
[  403.534828]   
[  403.537474]     lock(&(&imxdma->lock)->rlock);
[  403.541983]
[  403.541983]  *** DEADLOCK ***
[  403.541983]
[  403.547951] no locks held by swapper/0.
[  403.551813]
[  403.551813] stack backtrace:
[  403.556222] CPU: 0 PID: 0 Comm: swapper Not tainted 3.10.0-20130823+ #904
[  403.563039] Backtrace:
[  403.565581] [] (dump_backtrace+0x0/0x10c) from [] (show_stack+0x18/0x1c)
[  403.574054]  r6:00000000 r5:c05c51d8 r4:c040bd58 r3:00200000
[  403.579872] [] (show_stack+0x0/0x1c) from [] (dump_stack+0x20/0x28)
[  403.587955] [] (dump_stack+0x0/0x28) from [] (print_usage_bug.part.28+0x224/0x28c)
[  403.597340] [] (print_usage_bug.part.28+0x0/0x28c) from [] (mark_lock+0x440/0x6b4)
[  403.606682]  r8:c004a41c r7:00000000 r6:c040bd58 r5:c040c040 r4:00000002
[  403.613566] [] (mark_lock+0x0/0x6b4) from [] (__lock_acquire+0x6cc/0x1a64)
[  403.622244] [] (__lock_acquire+0x0/0x1a64) from [] (lock_acquire+0x94/0xa8)
[  403.631010] [] (lock_acquire+0x0/0xa8) from [] (_raw_spin_lock+0x54/0x8c)
[  403.639614] [] (_raw_spin_lock+0x0/0x8c) from [] (imxdma_tasklet+0x20/0x134)
[  403.648434]  r6:c3847010 r5:c040e890 r4:c38470d4
[  403.653194] [] (imxdma_tasklet+0x0/0x134) from [] (tasklet_action+0x8c/0xdc)
[  403.662013]  r8:c0599160 r7:00000000 r6:00000000 r5:c040e890 r4:c3847114 r3:c019d75c
[  403.670042] [] (tasklet_action+0x0/0xdc) from [] (__do_softirq+0xe4/0x1f0)
[  403.678687]  r7:00000101 r6:c0402000 r5:c059919c r4:00000001
[  403.684498] [] (__do_softirq+0x0/0x1f0) from [] (irq_exit+0x88/0xdc)
[  403.692652] [] (irq_exit+0x0/0xdc) from [] (handle_IRQ+0x6c/0x8c)
[  403.700514]  r4:00000030 r3:00000110
[  403.704192] [] (handle_IRQ+0x0/0x8c) from [] (avic_handle_irq+0x3c/0x48)
[  403.712664]  r5:c0403f28 r4:c0593ebc
[  403.716343] [] (avic_handle_irq+0x0/0x48) from [] (__irq_svc+0x44/0x74)
[  403.724733] Exception stack(0xc0403f28 to 0xc0403f70)
[  403.729841] 3f20:                   00000001 00000004 00000000 20000013 c0402000 c04104a8
[  403.738078] 3f40: 00000002 c0b69620 a0004000 41069264 a03fb5f4 c0403f7c c0403f40 c0403f70
[  403.746301] 3f60: c004b92c c0009e74 20000013 ffffffff
[  403.751383]  r6:ffffffff r5:20000013 r4:c0009e74 r3:c004b92c
[  403.757210] [] (arch_cpu_idle+0x0/0x4c) from [] (cpu_startup_entry+0x88/0xf4)
[  403.766161] [] (cpu_startup_entry+0x0/0xf4) from [] (rest_init+0xb8/0xe0)
[  403.774753] [] (rest_init+0x0/0xe0) from [] (start_kernel+0x28c/0x2d4)
[  403.783051]  r6:c03fc484 r5:ffffffff r4:c040a0e0
[  403.787797] [] (start_kernel+0x0/0x2d4) from [] (0xa0008040)

Signed-off-by: Michael Grzeschik 
Signed-off-by: Vinod Koul 
Cc: Jonghwan Choi 
Signed-off-by: Greg Kroah-Hartman

dma: pl330: Fix cyclic transfers

2013-08-12T01:35:21+00:00

commit fc51446021f42aca8906e701fc2292965aafcb15 upstream.

Allocate a descriptor for each period of a cyclic transfer, not just the first.
Also since the callback needs to be called for each finished period make sure to
initialize the callback and callback_param fields of each descriptor in a cyclic
transfer.

Signed-off-by: Lars-Peter Clausen 
Signed-off-by: Vinod Koul 
Signed-off-by: Greg Kroah-Hartman

drivers/dma/pl330.c: fix locking in pl330_free_chan_resources()

2013-07-22T01:21:35+00:00

commit da331ba8e9c5de72a27e50f71105395bba6eebe0 upstream.

tasklet_kill() may sleep so call it before taking pch->lock.

Fixes following lockup:

  BUG: scheduling while atomic: cat/2383/0x00000002
  Modules linked in:
    unwind_backtrace+0x0/0xfc
    __schedule_bug+0x4c/0x58
    __schedule+0x690/0x6e0
    sys_sched_yield+0x70/0x78
    tasklet_kill+0x34/0x8c
    pl330_free_chan_resources+0x24/0x88
    dma_chan_put+0x4c/0x50
  [...]
  BUG: spinlock lockup suspected on CPU#0, swapper/0/0
   lock: 0xe52aa04c, .magic: dead4ead, .owner: cat/2383, .owner_cpu: 1
    unwind_backtrace+0x0/0xfc
    do_raw_spin_lock+0x194/0x204
    _raw_spin_lock_irqsave+0x20/0x28
    pl330_tasklet+0x2c/0x5a8
    tasklet_action+0xfc/0x114
    __do_softirq+0xe4/0x19c
    irq_exit+0x98/0x9c
    handle_IPI+0x124/0x16c
    gic_handle_irq+0x64/0x68
    __irq_svc+0x40/0x70
    cpuidle_wrap_enter+0x4c/0xa0
    cpuidle_enter_state+0x18/0x68
    cpuidle_idle_call+0xac/0xe0
    cpu_idle+0xac/0xf0

Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Kyungmin Park 
Acked-by: Jassi Brar 
Cc: Vinod Koul 
Cc: Tomasz Figa 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

dmatest: do not allow to interrupt ongoing tests

2013-06-07T20:43:44+00:00

When user interrupts ongoing transfers the dmatest may end up with console
lockup, oops, or data mismatch. This patch prevents user to abort any ongoing
test.

Documentation is updated accordingly.

Signed-off-by: Andy Shevchenko 
Reported-by: Will Deacon 
Tested-by: Will Deacon 
Signed-off-by: Vinod Koul

dmaengine: ste_dma40: fix pm runtime ref counting

2013-05-27T14:20:32+00:00

The pm runtime reference counting of the driver is broken for the case
when there is more than one transfer queued, leading to the device being
runtime suspend while active.  Fix it.

Signed-off-by: Rabin Vincent 
Acked-by: Linus Walleij 
Cc: stable@vger.kernel.org
Signed-off-by: Vinod Koul