Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH] firewire-ohci: work around oversized DMA reads on JMicron
 controllers
To:     stefanr@s5r6.in-berlin.de
Cc:     Hector Martin <marcan@marcan.st>,
        linux1394-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org
References: <20171103112857.12426-1-marcan@marcan.st>
From:   Clemens Ladisch <clemens@ladisch.de>
Message-ID: <554bac12-e021-2541-6812-ae9a4e0c96ba@ladisch.de>
Date:   Fri, 3 Nov 2017 15:21:30 +0100
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.4.0
MIME-Version: 1.0
In-Reply-To: <20171103112857.12426-1-marcan@marcan.st>
Content-Type: text/plain; charset=us-ascii
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hector Martin wrote:
> At least some JMicron controllers issue buggy oversized DMA reads when
> fetching context descriptors, always fetching 0x20 bytes at once for
> descriptors which are only 0x10 bytes long. This is often harmless, but
> can cause page faults on modern systems with IOMMUs:
>
> DMAR: [DMA Read] Request device [05:00.0] fault addr fff56000 [fault reason 06] PTE Read access is not set
> firewire_ohci 0000:05:00.0: DMA context IT0 has stopped, error code: evt_descriptor_read
>
> This works around the problem by always leaving 0x10 padding bytes at
> the end of descriptor buffer pages, which should be harmless to do
> unconditionally for controllers in case others have the same behavior.
>
> Signed-off-by: Hector Martin <marcan@marcan.st>

Reviewed-by: Clemens Ladisch <clemens@ladisch.de>

> ---
>  drivers/firewire/ohci.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
> index 8bf89267dc25..d731b413cb2c 100644
> --- a/drivers/firewire/ohci.c
> +++ b/drivers/firewire/ohci.c
> @@ -1130,7 +1130,13 @@ static int context_add_buffer(struct context *ctx)
>  		return -ENOMEM;
>
>  	offset = (void *)&desc->buffer - (void *)desc;
> -	desc->buffer_size = PAGE_SIZE - offset;
> +	/*
> +	 * Some controllers, like JMicron ones, always issue 0x20-byte DMA reads
> +	 * for descriptors, even 0x10-byte ones. This can cause page faults when
> +	 * an IOMMU is in use and the oversized read crosses a page boundary.
> +	 * Work around this by always leaving at least 0x10 bytes of padding.
> +	 */
> +	desc->buffer_size = PAGE_SIZE - offset - 0x10;
>  	desc->buffer_bus = bus_addr + offset;
>  	desc->used = 0;
>

From 1583044637121646388@xxx Fri Nov 03 11:36:52 +0000 2017
X-GM-THRID: 1583044637121646388
X-Gmail-Labels: Inbox,Category Forums,HistoricalUnread