Patch "[PATCH 094/135] s390/pci_dma: fix DMA table corruption with > 4 TB" has been added to the 4.4-stable tree
Subsystems (3)
This is a note to let you know that I've just added the patch titled
[PATCH 094/135] s390/pci_dma: fix DMA table corruption with > 4 TB
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
0094-s390-pci_dma-fix-DMA-table-corruption-with-4-TB-main.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
354b1472c4922e12f28e4f9bbd290266132efef3Mon Sep 17 00:00:00 2001
From: Gerald Schaefer <[email protected]>
Date: Mon, 16 Nov 2015 14:35:48 +0100
Subject: [PATCH 094/135] s390/pci_dma: fix DMA table corruption with > 4 TB
main memory
[ Upstream commit 69eea95c48857c9dfcac120d6acea43027627b28 ]
DMA addresses returned from map_page() are calculated by using an iommu bitmap plus a start_dma offset. The size of this bitmap is based on the main memory size. If we have more than (4 TB - start_dma) main memory, the DMA address calculation will also produce addresses > 4 TB. Such addresses cannot be inserted in the 3-level DMA page table, instead the entries modulo 4 TB will be overwritten.
Fix this by restricting the iommu bitmap size to (4 TB - start_dma). Also set zdev->end_dma to the actual end address of the usable range, instead of the theoretical maximum as reported by the hardware, which fixes a sanity check in dma_map() and also the IOMMU API domain geometry aperture calculation.
--- arch/s390/include/asm/pci_dma.h | 2 ++ arch/s390/pci/pci.c | 3 +-- arch/s390/pci/pci_dma.c | 19 ++++++++++++++----- 3 files changed, 17 insertions(+), 7 deletions(-)
arch/s390/include/asm/pci_dma.h +2 -0
@@ -23,6 +23,8 @@ enum zpci_ioat_dtype {#define ZPCI_IOTA_FS_2G 2#define ZPCI_KEY (PAGE_DEFAULT_KEY << 5) +#define ZPCI_TABLE_SIZE_RT (1UL << 42) +#define ZPCI_IOTA_STO_FLAG (ZPCI_IOTA_IOT_ENABLED | ZPCI_KEY | ZPCI_IOTA_DT_ST)#define ZPCI_IOTA_RTTO_FLAG (ZPCI_IOTA_IOT_ENABLED | ZPCI_KEY | ZPCI_IOTA_DT_RT)#define ZPCI_IOTA_RSTO_FLAG (ZPCI_IOTA_IOT_ENABLED | ZPCI_KEY | ZPCI_IOTA_DT_RS)
arch/s390/pci/pci.c +1 -2
@@ -701,8 +701,7 @@ static int zpci_restore(struct device *d goto out;zpci_map_resources (pdev); -zpci_register_ioat (zdev,0 , zdev->start_dma +PAGE_OFFSET , - zdev->start_dma + zdev->iommu_size -1 , +zpci_register_ioat (zdev,0 , zdev->start_dma, zdev->end_dma, (u64 ) zdev->dma_table); out:
arch/s390/pci/pci_dma.c +14 -5
@@ -458,7 +458,19 @@ int zpci_dma_init_device(struct zpci_dev goto out_clean; } - zdev->iommu_size = (unsigned long ) high_memory -PAGE_OFFSET ; +/* +* Restrict the iommu bitmap size to the minimum of the following: +* - main memory size +* - 3-level pagetable address limit minus start_dma offset +* - DMA address range allowed by the hardware (clp query pci fn) +* +* Also set zdev->end_dma to the actual end address of the usable +* range, instead of the theoretical maximum as reported by hardware. +*/ + zdev->iommu_size =min3 ((u64 ) high_memory, +ZPCI_TABLE_SIZE_RT - zdev->start_dma, + zdev->end_dma - zdev->start_dma +1 ); + zdev->end_dma = zdev->start_dma + zdev->iommu_size -1 ; zdev->iommu_pages = zdev->iommu_size >>PAGE_SHIFT ; zdev->iommu_bitmap =vzalloc (zdev->iommu_pages /8 );if (!zdev->iommu_bitmap) {
@@ -466,10 +478,7 @@ int zpci_dma_init_device(struct zpci_dev goto out_reg; } - rc =zpci_register_ioat (zdev, -0 , - zdev->start_dma +PAGE_OFFSET , - zdev->start_dma + zdev->iommu_size -1 , + rc =zpci_register_ioat (zdev,0 , zdev->start_dma, zdev->end_dma, (u64 ) zdev->dma_table);if (rc) goto out_reg;
Patches currently in stable-queue which might be from [email protected] are
queue-4.4/0094-s390-pci_dma-fix-DMA-table-corruption-with-4-TB-main.patch