linux-kernel - Re: IOMMU Page faults when running DMA transfers from PCIe device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190416153307.GB3254@redhat.com>
Date:   Tue, 16 Apr 2019 11:33:07 -0400
From:   Jerome Glisse <jglisse@...hat.com>
To:     Patrick Brunner <brunner@...ttbacher.ch>
Cc:     linux-kernel@...r.kernel.org
Subject: Re: IOMMU Page faults when running DMA transfers from PCIe device

On Mon, Apr 15, 2019 at 06:04:11PM +0200, Patrick Brunner wrote:
> Dear all,
> 
> I'm encountering very nasty problems regarding DMA transfers from an external 
> PCIe device to the main memory while the IOMMU is enabled, and I'm running out 
> of ideas. I'm not even sure, whether it's a kernel issue or not. But I would 
> highly appreciate any hints from experienced developers how to proceed to 
> solve that issue.
> 
> The problem: An FPGA (see details below) should write a small amount of data 
> (~128 bytes) over a PCIe 2.0 x1 link to an address in the CPU's memory space. 
> The destination address (64 bits) for the Mem Write TLP is written to a BAR-
> mapped register before-hand.
> 
> On the system side, the driver consists of the usual setup code:
> - request PCI regions
> - pci_set_master
> - I/O remapping of BARs
> - setting DMA mask (dma_set_mask_and_coherent), tried both 32/64 bits
> - allocating DMA buffers with dma_alloc_coherent (4096 bytes, but also tried 
> smaller numbers)
> - allocating IRQ lines (MSI) with pci_alloc_irq_vectors and pci_irq_vector
> - writing the DMA buffers' logical address (as returned in dma_handle_t from 
> dma_alloc_coherent) to a BAR-mapped register
> 
> There is also an IRQ handler dumping the first 2 DWs from the DMA buffer when 
> triggered.
> 
> The FPGA part will initiate following transfers at an interval of 2.5ms:
> - Memory write to DMA address
> - Send MSI (to signal that transfer is done)
> - Memory read from DMA address+offset
> 
> And now, the clue: everything works fine with the IOMMU disabled (iommu=off), 
> i.e. the 2 DWs dumped in the ISR handler contain valid data. But if the IOMMU 
> is enabled (iommu=soft or force), I receive an IO page fault (sometimes even 
> more, depending on the payload size) on every transfer, and the data is all 
> zeros:
> 
> [   49.001605] IO_PAGE_FAULT device=00:00.0 domain=0x0000 
> address=0x00000000ffbf8000 flags=0x0070]
> 
> Where the device ID corresponds to the Host bridge, and the address 
> corresponds to the DMA handle I got from dma_alloc_coherent respectively.

I am now expert but i am guessing your FPGA set the request field in the
PCIE TLP write packet to 00:00.0 and this might work when IOMMU is off but
might not work when IOMMU is on ie when IOMMU is on your device should set
the request field to the FPGA PCIE id so that the IOMMU knows for which
device the PCIE write or read packet is and thus against which IOMMU page
table.

Cheers,
Jérôme