linux-kernel - Re: DMA direct mapping fix for 5.4 and earlier stable branches

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 9 Feb 2021 12:45:11 +0000
From:   Robin Murphy <robin.murphy@....com>
To:     Sumit Garg <sumit.garg@...aro.org>, Christoph Hellwig <hch@....de>
Cc:     Greg KH <gregkh@...uxfoundation.org>,
        obayashi.yoshimasa@...ionext.com, m.szyprowski@...sung.com,
        iommu@...ts.linux-foundation.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        stable <stable@...r.kernel.org>,
        Daniel Thompson <daniel.thompson@...aro.org>
Subject: Re: DMA direct mapping fix for 5.4 and earlier stable branches

On 2021-02-09 12:36, Sumit Garg wrote:
> Hi Christoph,
> 
> On Tue, 9 Feb 2021 at 15:06, Christoph Hellwig <hch@....de> wrote:
>>
>> On Tue, Feb 09, 2021 at 10:23:12AM +0100, Greg KH wrote:
>>>>    From the view point of ZeroCopy using DMABUF, is 5.4 not
>>>> mature enough, and is 5.10 enough mature ?
>>>>    This is the most important point for judging migration.
>>>
>>> How do you judge "mature"?
>>>
>>> And again, if a feature isn't present in a specific kernel version, why
>>> would you think that it would be a viable solution for you to use?
>>
>> I'm pretty sure dma_get_sgtable has been around much longer and was
>> supposed to work, but only really did work properly for arm32, and
>> for platforms with coherent DMA.  I bet he is using non-coherent arm64,
> 
> It's an arm64 platform using coherent DMA where device coherent DMA
> memory pool is defined in the DT as follows:
> 
>          reserved-memory {
>                  #address-cells = <2>;
>                  #size-cells = <2>;
>                  ranges;
> 
>                  <snip>
>                  encbuffer: encbuffer@...0000000 {
>                          compatible = "shared-dma-pool";
>                          reg = <0 0xb0000000 0 0x08000000>; // this
> area used with dma-coherent
>                          no-map;
>                  };
>                  <snip>
>          };
> 
> Device is dma-coherent as per following DT property:
> 
>                  codec {
>                          compatible = "socionext,uniphier-pxs3-codec";
>                          <snip>
>                          memory-region = <&encbuffer>;
>                          dma-coherent;
>                          <snip>
>                  };
> 
> And call chain to create device coherent DMA pool is as follows:
> 
> rmem_dma_device_init();
>    dma_init_coherent_memory();
>      memremap();
>        ioremap_wc();
> 
> which simply maps coherent DMA memory into vmalloc space on arm64.
> 
> The thing I am unclear is why this is called a new feature rather than
> a bug in dma_common_get_sgtable() which is failing to handle vmalloc
> addresses? While at the same time DMA debug APIs specifically handle
> vmalloc addresses [1].

It's not a bug, it's a fundamental design failure. dma_get_sgtable() has 
only ever sort-of-worked for DMA buffers that come from CMA or regular 
page allocations. In particular, a "no-map" DMA pool is not backed by 
kernel memory, so does not have any corresponding page structs, so it's 
impossible to generate a *valid* scatterlist to represent memory from 
that pool, regardless of what you might get away with provided you don't 
poke too hard at it.

It is not a good API...

Robin.

> 
> [1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/dma/debug.c?h=linux-5.4.y#n1462
> 
> -Sumit
> 
>> and it would be broken for other drivers there as well if people did
>> test them, which they apparently so far did not.