omap3isp cache error when unloading

Hi all,

I get a warning about a cache error with the following steps:

0. load omap3-isp
1. set up media broken media pipeline. (e.g. set different formats on opposite ends of a link, as will be the case for using the lane shifter)
2. try to capture images. isp_video_streamon() returns -EPIPE from the failed isp_video_validate_pipeline() call.
3. unload omap3-isp module

then I get the following from kmem_cache_destroy():

slab error in kmem_cache_destroy(): cache `iovm_area_cache': Can't free all objects [<c0040318>] (unwind_backtrace+0x0/0xec) from [<c00bfe14>] (kmem_cache_destroy+0x88/0xf4) [<c00bfe14>] (kmem_cache_destroy+0x88/0xf4) from [<c00861f8>] (sys_delete_module+0x1c4/0x230) [<c00861f8>] (sys_delete_module+0x1c4/0x230) from [<c003b680>] (ret_fast_syscall+0x0/0x30)

Then, when reloading the module:
SLAB: cache with size 32 has lost its name

Can somebody else confirm that they also observe this behavior?

Hi Michael,

Quoted 20 lines · On Tuesday 01 March 2011 17:41:01 Michael Jones wrote:

Hi all,

I get a warning about a cache error with the following steps:

0. load omap3-isp
1. set up media broken media pipeline. (e.g. set different formats on opposite ends of a link, as will be the case for using the lane shifter)
2. try to capture images. isp_video_streamon() returns -EPIPE from the failed isp_video_validate_pipeline() call.
3. unload omap3-isp module

then I get the following from kmem_cache_destroy():

slab error in kmem_cache_destroy(): cache `iovm_area_cache': Can't free all objects [<c0040318>] (unwind_backtrace+0x0/0xec) from [<c00bfe14>] (kmem_cache_destroy+0x88/0xf4) [<c00bfe14>] (kmem_cache_destroy+0x88/0xf4) from [<c00861f8>] (sys_delete_module+0x1c4/0x230) [<c00861f8>] (sys_delete_module+0x1c4/0x230) from [<c003b680>] (ret_fast_syscall+0x0/0x30)

Quoted 4 lines

Then, when reloading the module:
SLAB: cache with size 32 has lost its name

Can somebody else confirm that they also observe this behavior?

I can't reproduce that (tried both 2.6.32 and 2.6.37). Could you give me some more details about your exact test procedure (such as how you configure the pipeline) ?

From db35fb8edca2a4f8fd37197d77fd58676cb1dcac Mon Sep 17 00:00:00 2001

Quoted 23 lines · Laurent Pinchart

Hi Michael,

Quoted 20 lines · On Tuesday 01 March 2011 17:41:01 Michael Jones wrote:

Hi all,

I get a warning about a cache error with the following steps:

0. load omap3-isp
1. set up media broken media pipeline. (e.g. set different formats on opposite ends of a link, as will be the case for using the lane shifter)
2. try to capture images. isp_video_streamon() returns -EPIPE from the failed isp_video_validate_pipeline() call.
3. unload omap3-isp module

then I get the following from kmem_cache_destroy():

slab error in kmem_cache_destroy(): cache `iovm_area_cache': Can't free all objects [<c0040318>] (unwind_backtrace+0x0/0xec) from [<c00bfe14>] (kmem_cache_destroy+0x88/0xf4) [<c00bfe14>] (kmem_cache_destroy+0x88/0xf4) from [<c00861f8>] (sys_delete_module+0x1c4/0x230) [<c00861f8>] (sys_delete_module+0x1c4/0x230) from [<c003b680>] (ret_fast_syscall+0x0/0x30)

Quoted 9 lines

Quoted 4 lines

Then, when reloading the module:
SLAB: cache with size 32 has lost its name

Can somebody else confirm that they also observe this behavior?

I can't reproduce that (tried both 2.6.32 and 2.6.37). Could you give me some more details about your exact test procedure (such as how you configure the pipeline) ?

Sorry, I should've mentioned: I'm using your media-0005-omap3isp branch based on 2.6.38-rc5. I didn't have the problem with 2.6.37, either. It's actually not related to mis-configuring the ISP pipeline like I thought at first- it also happens after I have successfully captured images.

I've since tracked down the problem, although I don't understand the cache management well enough to be sure it's a proper fix, so hopefully some new recipients on this can make suggestions/comments.

The patch below solves the problem, which modifies a commit by Fernando Guzman Lugo from December.

From db35fb8edca2a4f8fd37197d77fd58676cb1dcac Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Thu, 3 Mar 2011 16:50:39 +0100
Subject: [PATCH] fix iovmm slab cache error on module unload

modify "OMAP: iommu: create new api to set valid da range"

This modifies commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb.

---
 arch/arm/plat-omap/iovmm.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

arch/arm/plat-omap/iovmm.c +4 -1

index 6dc1296..2fba6f1 100644
@@ -280,7 +280,10 @@ static struct iovm_struct *alloc_iovm_area(struct iommu *obj, u32 da,
 	alignement = PAGE_SIZE;
 
 	if (flags & IOVMF_DA_ANON) {
-		start = obj->da_start;
+		/*
+		 * Reserve the first page for NULL
+		 */
+		start = obj->da_start + PAGE_SIZE;
 
 		if (flags & IOVMF_LINEAR)
 			alignement = iopgsz_max(bytes);

Hi Michael,

Quoted 39 lines · Michael Jones

Quoted 23 lines · Laurent Pinchart

Hi Michael,

Quoted 20 lines · On Tuesday 01 March 2011 17:41:01 Michael Jones wrote:

Hi all,

I get a warning about a cache error with the following steps:

0. load omap3-isp
1. set up media broken media pipeline. (e.g. set different formats on opposite ends of a link, as will be the case for using the lane shifter)
2. try to capture images. isp_video_streamon() returns -EPIPE from the failed isp_video_validate_pipeline() call.
3. unload omap3-isp module

then I get the following from kmem_cache_destroy():

slab error in kmem_cache_destroy(): cache `iovm_area_cache': Can't free all objects [<c0040318>] (unwind_backtrace+0x0/0xec) from [<c00bfe14>] (kmem_cache_destroy+0x88/0xf4) [<c00bfe14>] (kmem_cache_destroy+0x88/0xf4) from [<c00861f8>] (sys_delete_module+0x1c4/0x230) [<c00861f8>] (sys_delete_module+0x1c4/0x230) from [<c003b680>] (ret_fast_syscall+0x0/0x30)

Quoted 9 lines

Quoted 4 lines

Then, when reloading the module:
SLAB: cache with size 32 has lost its name

Can somebody else confirm that they also observe this behavior?

I can't reproduce that (tried both 2.6.32 and 2.6.37). Could you give me some more details about your exact test procedure (such as how you configure the pipeline) ?

Sorry, I should've mentioned: I'm using your media-0005-omap3isp branch based on 2.6.38-rc5. I didn't have the problem with 2.6.37, either. It's actually not related to mis-configuring the ISP pipeline like I thought at first- it also happens after I have successfully captured images.

Quoted 6 lines

I've since tracked down the problem, although I don't understand the cache management well enough to be sure it's a proper fix, so hopefully some new recipients on this can make suggestions/comments.

The patch below solves the problem, which modifies a commit by Fernando Guzman Lugo from December.

Thanks for the patch.

It looks like this patch from Fernando, perhaps unintentionally, also makes the first page mappable so the NULL address is also valid. The NULL address isn't considered valid by the ISP driver which thus does not iommu_vunmap() the NULL address.

Hiroshi, David, what do you think? I think the patch is correct so it could be applied with description changed to mention it disallows mapping the first page again.

Or is there a reason to allow mapping the first page automatically? I personally don't see any.

Sorry, I should've mentioned: I'm using your media-0005-omap3isp branch based on 2.6.38-rc5.  I didn't have the problem with 2.6.37, either. It's actually not related to mis-configuring the ISP pipeline like I thought at first- it also happens after I have successfully captured images.

I've since tracked down the problem, although I don't understand the cache management well enough to be sure it's a proper fix, so hopefully some new recipients on this can make suggestions/comments.

The patch below solves the problem, which modifies a commit by Fernando Guzman Lugo from December.

-Michael

From db35fb8edca2a4f8fd37197d77fd58676cb1dcac Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Thu, 3 Mar 2011 16:50:39 +0100
Subject: [PATCH] fix iovmm slab cache error on module unload

modify "OMAP: iommu: create new api to set valid da range"

This modifies commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb.
---
 arch/arm/plat-omap/iovmm.c |    5 ++++-

 1 files changed, 4 insertions(+), 1 deletions(-)

arch/arm/plat-omap/iovmm.c +0 -0

index 6dc1296..2fba6f1 100644

Hi,

[snip]

Quoted 31 lines

Sorry, I should've mentioned: I'm using your media-0005-omap3isp branch based on 2.6.38-rc5. I didn't have the problem with 2.6.37, either. It's actually not related to mis-configuring the ISP pipeline like I thought at first- it also happens after I have successfully captured images.

I've since tracked down the problem, although I don't understand the cache management well enough to be sure it's a proper fix, so hopefully some new recipients on this can make suggestions/comments.

The patch below solves the problem, which modifies a commit by Fernando Guzman Lugo from December.

-Michael

From db35fb8edca2a4f8fd37197d77fd58676cb1dcac Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Thu, 3 Mar 2011 16:50:39 +0100
Subject: [PATCH] fix iovmm slab cache error on module unload

modify "OMAP: iommu: create new api to set valid da range"

This modifies commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb.

---
 arch/arm/plat-omap/iovmm.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

arch/arm/plat-omap/iovmm.c +0 -0

index 6dc1296..2fba6f1 100644

arch/arm/plat-omap/iovmm.c static struct iovm_struct *alloc_iovm_area(struct iommu *obj, u32 da, · line 286

Quoted 8 lines

arch/arm/plat-omap/iovmm.c +4 -1

@@ -280,7 +280,10 @@ static struct iovm_struct *alloc_iovm_area(struct iommu *obj, u32 da,
       alignement = PAGE_SIZE;
 
       if (flags & IOVMF_DA_ANON) {
-               start = obj->da_start;
+               /*
+                * Reserve the first page for NULL
+                */
+               start = obj->da_start + PAGE_SIZE;

IMO if obj->da_start != 0, no need to add PAGE_SIZE. Otherwise, it does make sense to correct wrong obj->da_start == 0. Another thing is this piece of code is using alignement (alignment) variable instead of PAGE_SIZE (which is the same value).

Br,

David

From 2712f2fd087ca782e964c912c7f1973e7d84f2b7 Mon Sep 17 00:00:00 2001

Hi David,

Quoted 49 lines

Hi,

[snip]

Quoted 31 lines

Sorry, I should've mentioned: I'm using your media-0005-omap3isp branch based on 2.6.38-rc5.  I didn't have the problem with 2.6.37, either. It's actually not related to mis-configuring the ISP pipeline like I thought at first- it also happens after I have successfully captured images.

I've since tracked down the problem, although I don't understand the cache management well enough to be sure it's a proper fix, so hopefully some new recipients on this can make suggestions/comments.

The patch below solves the problem, which modifies a commit by Fernando Guzman Lugo from December.

-Michael

From db35fb8edca2a4f8fd37197d77fd58676cb1dcac Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Thu, 3 Mar 2011 16:50:39 +0100
Subject: [PATCH] fix iovmm slab cache error on module unload

modify "OMAP: iommu: create new api to set valid da range"

This modifies commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb.
---
 arch/arm/plat-omap/iovmm.c |    5 ++++-

 1 files changed, 4 insertions(+), 1 deletions(-)

arch/arm/plat-omap/iovmm.c +0 -0

index 6dc1296..2fba6f1 100644

arch/arm/plat-omap/iovmm.c static struct iovm_struct *alloc_iovm_area(struct iommu *obj, u32 da, · line 286

Quoted 8 lines

arch/arm/plat-omap/iovmm.c +4 -1

@@ -280,7 +280,10 @@ static struct iovm_struct *alloc_iovm_area(struct iommu *obj, u32 da,
        alignement = PAGE_SIZE;
 
        if (flags & IOVMF_DA_ANON) {
-               start = obj->da_start;
+               /*
+                * Reserve the first page for NULL
+                */
+               start = obj->da_start + PAGE_SIZE;

IMO if obj->da_start != 0, no need to add PAGE_SIZE. Otherwise, it does make sense to correct wrong obj->da_start == 0. Another thing is this piece of code is using alignement (alignment) variable instead of PAGE_SIZE (which is the same value).

Quoted 3 lines

Br,

David

I believe the following patch addresses your comments.  I couldn't resist also fixing the misspelling of alignment when I was using the variable in my patch.

-Michael

From 2712f2fd087ca782e964c912c7f1973e7d84f2b7 Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Fri, 4 Mar 2011 15:09:48 +0100
Subject: [PATCH] omap: iovmm: disallow mapping NULL address

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0, which would then not get unmapped. Disallow this again.  And spell variable 'alignment' correctly.

Signed-off-by Michael Jones <[email protected]>

---
 arch/arm/plat-omap/iovmm.c |   16 ++++++++++------

 1 files changed, 10 insertions(+), 6 deletions(-)

arch/arm/plat-omap/iovmm.c +1 -1

index 6dc1296..11c9b76 100644
@@ -271,20 +271,24 @@ static struct iovm_struct *alloc_iovm_area(struct iommu *obj, u32 da,
                                           size_t bytes, u32 flags)
  {
        struct iovm_struct *new, *tmp;
-       u32 start, prev_end, alignement;
+       u32 start, prev_end, alignment;
 
        if (!obj || !bytes)
                return ERR_PTR(-EINVAL);
 
        start = da;

arch/arm/plat-omap/iovmm.c +3 -4

                if (flags & IOVMF_LINEAR)
-                       alignement = iopgsz_max(bytes);
-               start = roundup(start, alignement);
+                       alignment = iopgsz_max(bytes);
+               start = roundup(start, alignment);
        } else if (start < obj->da_start || start > obj->da_end ||
                                        obj->da_end - start < bytes) {
                return ERR_PTR(-EINVAL);

@@ -304,7 +308,7 @@ static struct iovm_struct *alloc_iovm_area(struct iommu *obj, u32 da,
                        goto found;
 
                if (tmp->da_end >= start && flags & IOVMF_DA_ANON)
-                       start = roundup(tmp->da_end + 1, alignement);
+                       start = roundup(tmp->da_end + 1, alignment);
 
                prev_end = tmp->da_end;
        }
--

1.7.4.1

MATRIX VISION GmbH, Talstrasse 16, DE-71570 Oppenweiler
Registergericht: Amtsgericht Stuttgart, HRB 271090
Geschaeftsfuehrer: Gerhard Thullner, Werner Armingeon, Uwe Furtner

Quoted 32 lines

From 2712f2fd087ca782e964c912c7f1973e7d84f2b7 Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Fri, 4 Mar 2011 15:09:48 +0100
Subject: [PATCH] omap: iovmm: disallow mapping NULL address

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0, which would then not get unmapped. Disallow this again.  And spell variable 'alignment' correctly.

Signed-off-by Michael Jones <[email protected]>

---
 arch/arm/plat-omap/iovmm.c |   16 ++++++++++------

 1 files changed, 10 insertions(+), 6 deletions(-)

arch/arm/plat-omap/iovmm.c +2 -2

index 6dc1296..11c9b76 100644
@@ -271,20 +271,24 @@ static struct iovm_struct *alloc_iovm_area(struct iommu *obj, u32 da,
                                           size_t bytes, u32 flags)
  {
        struct iovm_struct *new, *tmp;
-       u32 start, prev_end, alignement;
+       u32 start, prev_end, alignment;
 
        if (!obj || !bytes)
                return ERR_PTR(-EINVAL);
 
        start = da;
-       alignement = PAGE_SIZE;
+       alignment = PAGE_SIZE;
 

arch/arm/plat-omap/iovmm.c static struct iovm_struct *alloc_iovm_area(struct iommu *obj, u32 da, · line 287

Quoted 7 lines

arch/arm/plat-omap/iovmm.c +5 -1

        if (flags & IOVMF_DA_ANON) {
-               start = obj->da_start;
+               /* Don't map address 0 */
+               if (obj->da_start)
+                       start = obj->da_start;
+               else
+                       start = obj->da_start + alignment;

It seems to be fine for me now. Let's see what Hiroshi says.

Regards,

David

Quoted 27 lines

arch/arm/plat-omap/iovmm.c +3 -4

                if (flags & IOVMF_LINEAR)
-                       alignement = iopgsz_max(bytes);
-               start = roundup(start, alignement);
+                       alignment = iopgsz_max(bytes);
+               start = roundup(start, alignment);
        } else if (start < obj->da_start || start > obj->da_end ||
                                        obj->da_end - start < bytes) {
                return ERR_PTR(-EINVAL);

@@ -304,7 +308,7 @@ static struct iovm_struct *alloc_iovm_area(struct iommu *obj, u32 da,
                        goto found;
 
                if (tmp->da_end >= start && flags & IOVMF_DA_ANON)
-                       start = roundup(tmp->da_end + 1, alignement);
+                       start = roundup(tmp->da_end + 1, alignment);
 
                prev_end = tmp->da_end;
        }
--

1.7.4.1

MATRIX VISION GmbH, Talstrasse 16, DE-71570 Oppenweiler
Registergericht: Amtsgericht Stuttgart, HRB 271090
Geschaeftsfuehrer: Gerhard Thullner, Werner Armingeon, Uwe Furtner

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Mon, 7 Mar 2011 13:36:15 +0100
Subject: [PATCH] omap: iommu: disallow mapping NULL address

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0.  Force da_start to exclude the first page.

Signed-off-by Michael Jones <[email protected]>

---
 arch/arm/plat-omap/iommu.c |    6 ++++--

 1 files changed, 4 insertions(+), 2 deletions(-)

arch/arm/plat-omap/iommu.c +4 -3

index 5990ea6..dcb5513 100644
@@ -850,7 +850,7 @@ int iommu_set_da_range(struct iommu *obj, u32 start, u32 end)
        if (end < start || !PAGE_ALIGN(start | end))
                return -EINVAL;
 
-       obj->da_start = start;
+       obj->da_start = max(start, (u32)PAGE_SIZE);
        obj->da_end = end;
 
        return 0;

@@ -950,7 +950,9 @@ static int __devinit omap_iommu_probe(struct platform_device *pdev)
        obj->name = pdata->name;
        obj->dev = &pdev->dev;
        obj->ctx = (void *)obj + sizeof(*obj);
-       obj->da_start = pdata->da_start;
+
+       /* reserve the first page for NULL */
+       obj->da_start = max(pdata->da_start, (u32)PAGE_SIZE);
        obj->da_end = pdata->da_end;
 
        mutex_init(&obj->iommu_lock);
--

1.7.4.1

MATRIX VISION GmbH, Talstrasse 16, DE-71570 Oppenweiler
Registergericht: Amtsgericht Stuttgart, HRB 271090
Geschaeftsfuehrer: Gerhard Thullner, Werner Armingeon, Uwe Furtner

Quoted 5 lines · Michael Jones

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Mon, 7 Mar 2011 13:36:15 +0100
Subject: [PATCH] omap: iommu: disallow mapping NULL address

Quoted 3 lines

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0.  Force da_start to exclude the first page.

what about devices that uses page 0? ipu after reset always starts from 0x00000000 how could we map that address??

Regards,
Fernando.

Quoted 38 lines

Signed-off-by Michael Jones <[email protected]>

---
 arch/arm/plat-omap/iommu.c |    6 ++++--

 1 files changed, 4 insertions(+), 2 deletions(-)

arch/arm/plat-omap/iommu.c +4 -3

index 5990ea6..dcb5513 100644
@@ -850,7 +850,7 @@ int iommu_set_da_range(struct iommu *obj, u32 start, u32 end)
        if (end < start || !PAGE_ALIGN(start | end))
                return -EINVAL;
 
-       obj->da_start = start;
+       obj->da_start = max(start, (u32)PAGE_SIZE);
        obj->da_end = end;
 
        return 0;

@@ -950,7 +950,9 @@ static int __devinit omap_iommu_probe(struct platform_device *pdev)
        obj->name = pdata->name;
        obj->dev = &pdev->dev;
        obj->ctx = (void *)obj + sizeof(*obj);
-       obj->da_start = pdata->da_start;
+
+       /* reserve the first page for NULL */
+       obj->da_start = max(pdata->da_start, (u32)PAGE_SIZE);
        obj->da_end = pdata->da_end;
 
        mutex_init(&obj->iommu_lock);
--

1.7.4.1

MATRIX VISION GmbH, Talstrasse 16, DE-71570 Oppenweiler
Registergericht: Amtsgericht Stuttgart, HRB 271090
Geschaeftsfuehrer: Gerhard Thullner, Werner Armingeon, Uwe Furtner

Quoted 7 lines · Fernando

Quoted 5 lines · Michael Jones

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Mon, 7 Mar 2011 13:36:15 +0100
Subject: [PATCH] omap: iommu: disallow mapping NULL address

Quoted 6 lines

Quoted 3 lines

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0.  Force da_start to exclude the first page.

what about devices that uses page 0? ipu after reset always starts from 0x00000000 how could we map that address??

from 0x0? The driver sees da == 0 as error. May I ask you why do you want it?

Br,

David

Quoted 43 lines

Regards,
Fernando.

Quoted 38 lines

Signed-off-by Michael Jones <[email protected]>

---
 arch/arm/plat-omap/iommu.c |    6 ++++--

 1 files changed, 4 insertions(+), 2 deletions(-)

arch/arm/plat-omap/iommu.c +4 -3

index 5990ea6..dcb5513 100644
@@ -850,7 +850,7 @@ int iommu_set_da_range(struct iommu *obj, u32 start, u32 end)
        if (end < start || !PAGE_ALIGN(start | end))
                return -EINVAL;
 
-       obj->da_start = start;
+       obj->da_start = max(start, (u32)PAGE_SIZE);
        obj->da_end = end;
 
        return 0;

@@ -950,7 +950,9 @@ static int __devinit omap_iommu_probe(struct platform_device *pdev)
        obj->name = pdata->name;
        obj->dev = &pdev->dev;
        obj->ctx = (void *)obj + sizeof(*obj);
-       obj->da_start = pdata->da_start;
+
+       /* reserve the first page for NULL */
+       obj->da_start = max(pdata->da_start, (u32)PAGE_SIZE);
        obj->da_end = pdata->da_end;
 
        mutex_init(&obj->iommu_lock);
--

1.7.4.1

MATRIX VISION GmbH, Talstrasse 16, DE-71570 Oppenweiler
Registergericht: Amtsgericht Stuttgart, HRB 271090
Geschaeftsfuehrer: Gerhard Thullner, Werner Armingeon, Uwe Furtner

Quoted 16 lines · David Cohen

Quoted 13 lines · Fernando

Quoted 8 lines · Michael Jones

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Mon, 7 Mar 2011 13:36:15 +0100
Subject: [PATCH] omap: iommu: disallow mapping NULL address

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0.  Force da_start to exclude the first page.

what about devices that uses page 0? ipu after reset always starts from 0x00000000 how could we map that address??

Quoted 1 line

from 0x0? The driver sees da == 0 as error. May I ask you why do you want it?

unlike DSP that you can load a register with the addres the DSP will boot, IPU core always starts from address 0x00000000, so if you take IPU out of reset it will try to access address 0x0 if not map it, there will be a mmu fault.

Regards,
Fernando.

Quoted 49 lines

Br,

David

Quoted 43 lines

Regards,
Fernando.

Quoted 38 lines

Signed-off-by Michael Jones <[email protected]>

---
 arch/arm/plat-omap/iommu.c |    6 ++++--

 1 files changed, 4 insertions(+), 2 deletions(-)

arch/arm/plat-omap/iommu.c +4 -3

index 5990ea6..dcb5513 100644
@@ -850,7 +850,7 @@ int iommu_set_da_range(struct iommu *obj, u32 start, u32 end)
        if (end < start || !PAGE_ALIGN(start | end))
                return -EINVAL;
 
-       obj->da_start = start;
+       obj->da_start = max(start, (u32)PAGE_SIZE);
        obj->da_end = end;
 
        return 0;

@@ -950,7 +950,9 @@ static int __devinit omap_iommu_probe(struct platform_device *pdev)
        obj->name = pdata->name;
        obj->dev = &pdev->dev;
        obj->ctx = (void *)obj + sizeof(*obj);
-       obj->da_start = pdata->da_start;
+
+       /* reserve the first page for NULL */
+       obj->da_start = max(pdata->da_start, (u32)PAGE_SIZE);
        obj->da_end = pdata->da_end;
 
        mutex_init(&obj->iommu_lock);
--

1.7.4.1

MATRIX VISION GmbH, Talstrasse 16, DE-71570 Oppenweiler
Registergericht: Amtsgericht Stuttgart, HRB 271090
Geschaeftsfuehrer: Gerhard Thullner, Werner Armingeon, Uwe Furtner

Quoted 15 lines · Fernando

Quoted 14 lines · David Cohen

Quoted 12 lines · Fernando

Quoted 8 lines · Michael Jones

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Mon, 7 Mar 2011 13:36:15 +0100
Subject: [PATCH] omap: iommu: disallow mapping NULL address

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0. Force da_start to exclude the first page.

what about devices that uses page 0? ipu after reset always starts from 0x00000000 how could we map that address??

Quoted 7 lines

Quoted 2 lines

from 0x0? The driver sees da == 0 as error. May I ask you why do you want it?

unlike DSP that you can load a register with the addres the DSP will boot, IPU core always starts from address 0x00000000, so if you take IPU out of reset it will try to access address 0x0 if not map it, there will be a mmu fault.

Hm. Looks like the iommu should not restrict any da. The valid da range should rely only on pdata.
Michael, what about just update ISP's da_start on omap-iommu.c file? Set it to 0x1000.

Hi David,

Quoted 24 lines · Fernando

Quoted 22 lines · David Cohen

Quoted 11 lines · Fernando

Quoted 10 lines · Michael Jones

Quoted 8 lines

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Mon, 7 Mar 2011 13:36:15 +0100
Subject: [PATCH] omap: iommu: disallow mapping NULL address

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0.  Force da_start to exclude the first page.

Quoted 5 lines

Quoted 2 lines

what about devices that uses page 0? ipu after reset always starts from 0x00000000 how could we map that address??

from 0x0? The driver sees da == 0 as error. May I ask you why do you want it?

unlike DSP that you can load a register with the addres the DSP will boot, IPU core always starts from address 0x00000000, so if you take IPU out of reset it will try to access address 0x0 if not map it, there will be a mmu fault.

Quoted 4 lines

Hm. Looks like the iommu should not restrict any da. The valid da range should rely only on pdata.
Michael, what about just update ISP's da_start on omap-iommu.c file? Set it to 0x1000.

What about patching the OMAP3 ISP driver to use a non-zero value (maybe -1) as an invalid/freed pointer ?

--
Regards,

Laurent Pinchart

Quoted 1 line · Laurent Pinchart

Hi David,

Hi Laurent,

Quoted 31 lines · On Monday 07 March 2011 20:41:21 David Cohen wrote:

Quoted 28 lines · Fernando

Quoted 15 lines · David Cohen

Quoted 14 lines · Fernando

Quoted 12 lines · Michael Jones

Quoted 8 lines

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Mon, 7 Mar 2011 13:36:15 +0100
Subject: [PATCH] omap: iommu: disallow mapping NULL address

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0.  Force da_start to exclude the first page.

what about devices that uses page 0? ipu after reset always starts from 0x00000000 how could we map that address??

Quoted 7 lines

Quoted 2 lines

from 0x0? The driver sees da == 0 as error. May I ask you why do you want it?

unlike DSP that you can load a register with the addres the DSP will boot, IPU core always starts from address 0x00000000, so if you take IPU out of reset it will try to access address 0x0 if not map it, there will be a mmu fault.

Hm. Looks like the iommu should not restrict any da. The valid da range should rely only on pdata.
Michael, what about just update ISP's da_start on omap-iommu.c file? Set it to 0x1000.

Quoted 2 lines

What about patching the OMAP3 ISP driver to use a non-zero value (maybe -1) as an invalid/freed pointer ?

I wouldn't be comfortable to use 0 (or NULL) value as valid address on ISP driver. The 'da' range (da_start and da_end) is defined per VM and specified as platform data. IMO, to set da_start = 0x1000 seems to be a correct approach for ISP as it's the only client for its IOMMU instance.

Quoted 30 lines · Laurent Pinchart

Quoted 28 lines · On Monday 07 March 2011 20:41:21 David Cohen wrote:

Quoted 15 lines · Fernando

Quoted 14 lines · David Cohen

Quoted 12 lines · Fernando

Quoted 8 lines · Michael Jones

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001 From: Michael Jones <[email protected]>
Date: Mon, 7 Mar 2011 13:36:15 +0100
Subject: [PATCH] omap: iommu: disallow mapping NULL address

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0. Force da_start to exclude the first page.

what about devices that uses page 0? ipu after reset always starts from 0x00000000 how could we map that address??

Quoted 7 lines

Quoted 2 lines

from 0x0? The driver sees da == 0 as error. May I ask you why do you want it?

unlike DSP that you can load a register with the addres the DSP will boot, IPU core always starts from address 0x00000000, so if you take IPU out of reset it will try to access address 0x0 if not map it, there will be a mmu fault.

Hm. Looks like the iommu should not restrict any da. The valid da range should rely only on pdata.
Michael, what about just update ISP's da_start on omap-iommu.c file? Set it to 0x1000.

Quoted 2 lines

What about patching the OMAP3 ISP driver to use a non-zero value (maybe -1) as an invalid/freed pointer ?

I wouldn't be comfortable to use 0 (or NULL) value as valid address on ISP driver.

The 'da' range (da_start and da_end) is defined per VM and specified as platform data. IMO, to set da_start = 0x1000 seems to be> a correct approach for ISP as it's the only client for its IOMMU instance.

Hi David,

Quoted 31 lines · On Monday 07 March 2011 22:35:31 David Cohen wrote:

Quoted 30 lines · Laurent Pinchart

Quoted 28 lines · On Monday 07 March 2011 20:41:21 David Cohen wrote:

Quoted 15 lines · Fernando

Quoted 14 lines · David Cohen

Quoted 12 lines · Fernando

Quoted 8 lines · Michael Jones

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001 From: Michael Jones <[email protected]>
Date: Mon, 7 Mar 2011 13:36:15 +0100
Subject: [PATCH] omap: iommu: disallow mapping NULL address

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0.  Force da_start to exclude the first page.

what about devices that uses page 0? ipu after reset always starts from 0x00000000 how could we map that address??

Quoted 7 lines

Quoted 2 lines

from 0x0? The driver sees da == 0 as error. May I ask you why do you want it?

unlike DSP that you can load a register with the addres the DSP will boot, IPU core always starts from address 0x00000000, so if you take IPU out of reset it will try to access address 0x0 if not map it, there will be a mmu fault.

Hm. Looks like the iommu should not restrict any da. The valid da range should rely only on pdata.
Michael, what about just update ISP's da_start on omap-iommu.c file? Set it to 0x1000.

Quoted 5 lines

Quoted 2 lines

What about patching the OMAP3 ISP driver to use a non-zero value (maybe -1) as an invalid/freed pointer ?

I wouldn't be comfortable to use 0 (or NULL) value as valid address on ISP driver.

Why not ? The IOMMUs can use 0x00000000 as a valid address. Whether we allow it or not is a software architecture decision, not influenced by the IOMMU hardware. As some peripherals (namely IPU) require mapping memory to 0x00000000, the IOMMU layer must support it and not treat 0x00000000 specially. All da == 0 checks to aim at catching invalid address values must be removed, both from the IOMMU API and the IOMMU internals.

Quoted 4 lines

The 'da' range (da_start and da_end) is defined per VM and specified as platform data. IMO, to set da_start = 0x1000 seems to be> a correct approach for ISP as it's the only client for its IOMMU instance.

We can do that, and then use 0 as an invalid pointer in the ISP driver. As the IOMMU API will use another value (what about 0xffffffff, as for the userspace mmap() call ?) to mean "invalid pointer", it might be better to use the same value in the ISP driver.

--
Regards,

Laurent Pinchart

Hi David,

Quoted 31 lines · On Monday 07 March 2011 22:35:31 David Cohen wrote:

Quoted 30 lines · Laurent Pinchart

Quoted 28 lines · On Monday 07 March 2011 20:41:21 David Cohen wrote:

Quoted 15 lines · Fernando

Quoted 14 lines · David Cohen

Quoted 12 lines · Fernando

Quoted 8 lines · Michael Jones

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001 From: Michael Jones <[email protected]>
Date: Mon, 7 Mar 2011 13:36:15 +0100
Subject: [PATCH] omap: iommu: disallow mapping NULL address

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0.  Force da_start to exclude the first page.

what about devices that uses page 0? ipu after reset always starts from 0x00000000 how could we map that address??

Quoted 7 lines

Quoted 2 lines

from 0x0? The driver sees da == 0 as error. May I ask you why do you want it?

unlike DSP that you can load a register with the addres the DSP will boot, IPU core always starts from address 0x00000000, so if you take IPU out of reset it will try to access address 0x0 if not map it, there will be a mmu fault.

Hm. Looks like the iommu should not restrict any da. The valid da range should rely only on pdata.
Michael, what about just update ISP's da_start on omap-iommu.c file? Set it to 0x1000.

Quoted 5 lines

Quoted 2 lines

What about patching the OMAP3 ISP driver to use a non-zero value (maybe -1) as an invalid/freed pointer ?

I wouldn't be comfortable to use 0 (or NULL) value as valid address on ISP driver.

Why not ? The IOMMUs can use 0x00000000 as a valid address. Whether we allow it or not is a software architecture decision, not influenced by the IOMMU hardware. As some peripherals (namely IPU) require mapping memory to 0x00000000, the IOMMU layer must support it and not treat 0x00000000 specially. All da == 0 checks to aim at catching invalid address values must be removed, both from the IOMMU API and the IOMMU internals.

Quoted 4 lines

The 'da' range (da_start and da_end) is defined per VM and specified as platform data. IMO, to set da_start = 0x1000 seems to be> a correct approach for ISP as it's the only client for its IOMMU instance.

We can do that, and then use 0 as an invalid pointer in the ISP driver. As the IOMMU API will use another value (what about 0xffffffff, as for the userspace mmap() call ?) to mean "invalid pointer", it might be better to use the same value in the ISP driver.

--
Regards,

Laurent Pinchart

Quoted 40 lines · Laurent Pinchart

Hi David,

Quoted 31 lines · On Monday 07 March 2011 22:35:31 David Cohen wrote:

Quoted 30 lines · Laurent Pinchart

Quoted 28 lines · On Monday 07 March 2011 20:41:21 David Cohen wrote:

Quoted 15 lines · Fernando

Quoted 14 lines · David Cohen

Quoted 12 lines · Fernando

Quoted 8 lines · Michael Jones

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001 From: Michael Jones <[email protected]>
Date: Mon, 7 Mar 2011 13:36:15 +0100
Subject: [PATCH] omap: iommu: disallow mapping NULL address

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0. Force da_start to exclude the first page.

what about devices that uses page 0? ipu after reset always starts from 0x00000000 how could we map that address??

Quoted 7 lines

Quoted 2 lines

from 0x0? The driver sees da == 0 as error. May I ask you why do you want it?

unlike DSP that you can load a register with the addres the DSP will boot, IPU core always starts from address 0x00000000, so if you take IPU out of reset it will try to access address 0x0 if not map it, there will be a mmu fault.

Hm. Looks like the iommu should not restrict any da. The valid da range should rely only on pdata.
Michael, what about just update ISP's da_start on omap-iommu.c file? Set it to 0x1000.

Quoted 5 lines

Quoted 2 lines

What about patching the OMAP3 ISP driver to use a non-zero value (maybe -1) as an invalid/freed pointer ?

I wouldn't be comfortable to use 0 (or NULL) value as valid address on ISP driver.

Quoted 6 lines

Why not ? The IOMMUs can use 0x00000000 as a valid address. Whether we allow it or not is a software architecture decision, not influenced by the IOMMU hardware. As some peripherals (namely IPU) require mapping memory to 0x00000000, the IOMMU layer must support it and not treat 0x00000000 specially. All da == 0 checks to aim at catching invalid address values must be removed, both from the IOMMU API and the IOMMU internals.

Yes, it can use and IOMMU should not treat is specially. That's the aim of my patch:
[PATCH v2 3/3] omap: iovmm: don't check 'da' to set IOVMF_DA_FIXED flag I'm not advocating to not allow 0x0, but to not use it when user is not requesting fixed da. In many sw architecture decisions 0x0 address is a special case. To avoid any misuse, IOMMU will not use it unless it's requested. If user is not requesting fixed 'da', it's not a problem to not give 0x0 anyway. IMO that's the safer option for all cases.

Quoted 8 lines

Quoted 3 lines

The 'da' range (da_start and da_end) is defined per VM and specified as platform data. IMO, to set da_start = 0x1000 seems to be> a correct approach for ISP as it's the only client for its IOMMU instance.

We can do that, and then use 0 as an invalid pointer in the ISP driver. As the IOMMU API will use another value (what about 0xffffffff, as for the userspace mmap() call ?) to mean "invalid pointer", it might be better to use the same value in the ISP driver.

That can be done, of course. But the main point is in OMAP3 ISP all initial register values to read/write from/to memory are 0x0. It means sometimes we can catch bugs more easily by not mapping that address. So, IMO, OMAP3 ISP should not allow to map first page. But that's a special case for this driver only.

Quoted 17 lines · Fernando

Quoted 16 lines · David Cohen

Quoted 13 lines · Fernando

Quoted 8 lines · Michael Jones

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Mon, 7 Mar 2011 13:36:15 +0100
Subject: [PATCH] omap: iommu: disallow mapping NULL address

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0.  Force da_start to exclude the first page.

what about devices that uses page 0? ipu after reset always starts from 0x00000000 how could we map that address??

Quoted 6 lines

Quoted 1 line

from 0x0? The driver sees da == 0 as error. May I ask you why do you want it?

unlike DSP that you can load a register with the addres the DSP will boot, IPU core always starts from address 0x00000000, so if you take IPU out of reset it will try to access address 0x0 if not map it, there will be a mmu fault.

Hm. Looks like the iommu should not restrict any da. The valid da range should rely only on pdata.
Michael, what about just update ISP's da_start on omap-iommu.c file? Set it to 0x1000.

Hiroshi, any opinion?

Quoted 16 lines · David Cohen

Quoted 13 lines · Fernando

Quoted 8 lines · Michael Jones

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Mon, 7 Mar 2011 13:36:15 +0100
Subject: [PATCH] omap: iommu: disallow mapping NULL address

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0. Force da_start to exclude the first page.

what about devices that uses page 0? ipu after reset always starts from 0x00000000 how could we map that address??

Quoted 1 line

from 0x0? The driver sees da == 0 as error. May I ask you why do you want it?

unlike DSP that you can load a register with the addres the DSP will boot, IPU core always starts from address 0x00000000, so if you take IPU out of reset it will try to access address 0x0 if not map it, there will be a mmu fault.

Quoted 19 lines · Fernando

Quoted 17 lines · David Cohen

Quoted 7 lines · Fernando

Quoted 5 lines · Michael Jones

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Mon, 7 Mar 2011 13:36:15 +0100
Subject: [PATCH] omap: iommu: disallow mapping NULL address

Quoted 6 lines

Quoted 3 lines

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0.  Force da_start to exclude the first page.

what about devices that uses page 0? ipu after reset always starts from 0x00000000 how could we map that address??

from 0x0? The driver sees da == 0 as error. May I ask you why do you want it?

Quoted 4 lines

unlike DSP that you can load a register with the addres the DSP will boot, IPU core always starts from address 0x00000000, so if you take IPU out of reset it will try to access address 0x0 if not map it, there will be a mmu fault.

I think the driver for IPU (what is it, btw.?) must map the NULL address explicitly. It cannot rely on automatic allocation of the NULL address by the iommu even if it was the first allocation.

--
Sakari Ailus
[email protected]

Hi Fernando,

Quoted 20 lines · Sakari Ailus

Quoted 19 lines · Fernando

Quoted 17 lines · David Cohen

Quoted 7 lines · Fernando

Quoted 5 lines · Michael Jones

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Mon, 7 Mar 2011 13:36:15 +0100
Subject: [PATCH] omap: iommu: disallow mapping NULL address

Quoted 6 lines

Quoted 3 lines

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0.  Force da_start to exclude the first page.

what about devices that uses page 0? ipu after reset always starts from 0x00000000 how could we map that address??

from 0x0? The driver sees da == 0 as error. May I ask you why do you want it?

Quoted 8 lines

Quoted 4 lines

unlike DSP that you can load a register with the addres the DSP will boot, IPU core always starts from address 0x00000000, so if you take IPU out of reset it will try to access address 0x0 if not map it, there will be a mmu fault.

I think the driver for IPU (what is it, btw.?) must map the NULL address explicitly. It cannot rely on automatic allocation of the NULL address by the iommu even if it was the first allocation.

That's an interesting question. My first thought was "it's not automatic allocation", because it seems you know the specific 'da' IPU needs. But then, looking into the driver's API, the automatic allocation is defined whether the argument da == 0 (automatic allocation) or da != 0 (fixed da). So, by default, the IOMMU driver does not see da == 0 as valid address for fixed da. Then, why only automatic allocation should use such address? My second point is: if you're using automatic allocation, you *cannot* rely on specific da to be used, as it would be up to IOMMU driver to choose. So, doesn't matter the option, your driver seems to be wrong, unless I'm missing something. If you were using fixed da passing da = 0, you were just being lucky that it was the first request and automatic allocation returned da == 0.

IMO either first page is not allowed at all or OMAP's IOMMU API should change the way it checks if it's fixed da or not.

Kind regards,

David

Quoted 5 lines

--
Sakari Ailus
[email protected]

Quoted 19 lines · Fernando

Quoted 17 lines · David Cohen

Quoted 7 lines · Fernando

Quoted 5 lines · Michael Jones

From e7dbe4c4b64eb114f9b0804d6af3a3ca0e78acc8 Mon Sep 17 00:00:00 2001
From: Michael Jones <[email protected]>
Date: Mon, 7 Mar 2011 13:36:15 +0100
Subject: [PATCH] omap: iommu: disallow mapping NULL address

Quoted 6 lines

Quoted 3 lines

commit c7f4ab26e3bcdaeb3e19ec658e3ad9092f1a6ceb allowed mapping the NULL address if da_start==0.  Force da_start to exclude the first page.

what about devices that uses page 0? ipu after reset always starts from 0x00000000 how could we map that address??

from 0x0? The driver sees da == 0 as error. May I ask you why do you want it?

Quoted 4 lines

unlike DSP that you can load a register with the addres the DSP will boot, IPU core always starts from address 0x00000000, so if you take IPU out of reset it will try to access address 0x0 if not map it, there will be a mmu fault.

I think the driver for IPU (what is it, btw.?) must map the NULL address explicitly. It cannot rely on automatic allocation of the NULL address by the iommu even if it was the first allocation.

--
Sakari Ailus
[email protected]