On Tue, Oct 15, 2019 at 08:40:12PM +0100, Al Viro wrote: > or this > static void ntb_memcpy_tx(struct ntb_queue_entry *entry, void __iomem *offset) > { > #ifdef ARCH_HAS_NOCACHE_UACCESS > /* > * Using non-temporal mov to improve performance on non-cached > * writes, even though we aren't actually copying from user space. > */ > __copy_from_user_inatomic_nocache(offset, entry->buf, entry->len); > #else > memcpy_toio(offset, entry->buf, entry->len); > #endif > > /* Ensure that the data is fully copied out before setting the flags */ > wmb(); > > ntb_tx_copy_callback(entry, NULL); > } > "user" part is bollocks in both cases; moreover, I really wonder about that > ifdef in ntb one - ARCH_HAS_NOCACHE_UACCESS is x86-only *at* *the* *moment* > and it just so happens that ..._toio() doesn't require anything special on > x86. Have e.g. arm grow nocache stuff and the things will suddenly break, > won't they? Incidentally, there are two callers of __copy_from_user_inatomic_nocache() in generic code: lib/iov_iter.c:792: __copy_from_user_inatomic_nocache((to += v.iov_len) - v.iov_len, lib/iov_iter.c:849: if (__copy_from_user_inatomic_nocache((to += v.iov_len) - v.iov_len, Neither is done under under pagefault_disable(), AFAICS. This one drivers/gpu/drm/qxl/qxl_ioctl.c:189: unwritten = __copy_from_user_inatomic_nocache probably is - it has something called qxl_bo_kmap_atomic_page() called just prior, which would seem to imply kmap_atomic() somewhere in it. The same goes for drivers/gpu/drm/i915/i915_gem.c:500: unwritten = __copy_from_user_inatomic_nocache((void __force *)vaddr + offset, So we have 5 callers anywhere. Two are not "inatomic" in any sense; source is in userspace and we want nocache behaviour. Two _are_ done into a page that had been fed through kmap_atomic(); the source is, again, in userland. And the last one is complete BS - it wants memcpy_toio_nocache() and abuses this thing. Incidentally, in case of fault i915 caller ends up unmapping the page, mapping it non-atomic (with kmap?) and doing plain copy_from_user(), nocache be damned. qxl, OTOH, whines and fails all the way to userland...