linux-kernel - Re: [PATCH v2 07/26] dmaengine: dw-edma: Fix invalid interleaved xfers semantics

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Thu, 12 May 2022 20:46:11 +0530
From:   Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
To:     Serge Semin <Sergey.Semin@...kalelectronics.ru>
Cc:     Gustavo Pimentel <gustavo.pimentel@...opsys.com>,
        Vinod Koul <vkoul@...nel.org>,
        Jingoo Han <jingoohan1@...il.com>,
        Bjorn Helgaas <bhelgaas@...gle.com>,
        Lorenzo Pieralisi <lorenzo.pieralisi@....com>,
        Frank Li <Frank.Li@....com>,
        Serge Semin <fancer.lancer@...il.com>,
        Alexey Malahov <Alexey.Malahov@...kalelectronics.ru>,
        Pavel Parkhomenko <Pavel.Parkhomenko@...kalelectronics.ru>,
        Rob Herring <robh@...nel.org>,
        Krzysztof Wilczyński <kw@...ux.com>,
        linux-pci@...r.kernel.org, dmaengine@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 07/26] dmaengine: dw-edma: Fix invalid interleaved
 xfers semantics

On Wed, May 04, 2022 at 01:50:45AM +0300, Serge Semin wrote:
> The interleaved DMA transfer support added in commit 85e7518f42c8
> ("dmaengine: dw-edma: Add device_prep_interleave_dma() support") seems
> contradicting to what the DMA-engine defines. The next conditional
> statements:
> 	if (!xfer->xfer.il->numf)
> 		return NULL;
> 	if (xfer->xfer.il->numf > 0 && xfer->xfer.il->frame_size > 0)
> 		return NULL;
> basically mean that numf can't be zero and frame_size must always be zero,
> otherwise the transfer won't be executed. But further the transfer
> execution method takes the frames size from the
> dma_interleaved_template.sgl[] array for each frame. That array in
> accordance with [1] is supposed to be of
> dma_interleaved_template.frame_size size, which as we discovered before
> the code expects to be zero. So judging by the dw_edma_device_transfer()
> implementation the method implies the dma_interleaved_template.sgl[] array
> being of dma_interleaved_template.numf size, which is wrong. Since the
> dw_edma_device_transfer() method doesn't permit
> dma_interleaved_template.frame_size being non-zero then actual multi-chunk
> interleaved transfer turns to be unsupported even though the code implies
> having it supported.
> 
> Let's fix that by adding a fully functioning support of the interleaved
> DMA transfers. First of all dma_interleaved_template.frame_size is
> supposed to be greater or equal to one thus having at least simple linear
> chunked frames. Secondly we can create a walk-through all over the chunks
> and frames just by initializing the number of the eDMA burst transactios
> as a multiple of dma_interleaved_template.numf and
> dma_interleaved_template.frame_size and getting the frame_size-modulo of
> the iteration step as an index of the dma_interleaved_template.sgl[]
> array. The rest of the dw_edma_device_transfer() method code can be left
> unchanged.
> 
> [1] include/linux/dmaengine.h: doc struct dma_interleaved_template
> 
> Fixes: 85e7518f42c8 ("dmaengine: dw-edma: Add device_prep_interleave_dma() support")
> Signed-off-by: Serge Semin <Sergey.Semin@...kalelectronics.ru>

Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>

Thanks,
Mani

> ---
>  drivers/dma/dw-edma/dw-edma-core.c | 18 +++++++-----------
>  1 file changed, 7 insertions(+), 11 deletions(-)
> 
> diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
> index 225eab58acb7..ef49deb5a7f3 100644
> --- a/drivers/dma/dw-edma/dw-edma-core.c
> +++ b/drivers/dma/dw-edma/dw-edma-core.c
> @@ -333,6 +333,7 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer)
>  	struct dw_edma_chunk *chunk;
>  	struct dw_edma_burst *burst;
>  	struct dw_edma_desc *desc;
> +	size_t fsz = 0;
>  	u32 cnt = 0;
>  	int i;
>  
> @@ -382,9 +383,7 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer)
>  		if (xfer->xfer.sg.len < 1)
>  			return NULL;
>  	} else if (xfer->type == EDMA_XFER_INTERLEAVED) {
> -		if (!xfer->xfer.il->numf)
> -			return NULL;
> -		if (xfer->xfer.il->numf > 0 && xfer->xfer.il->frame_size > 0)
> +		if (!xfer->xfer.il->numf || xfer->xfer.il->frame_size < 1)
>  			return NULL;
>  		if (!xfer->xfer.il->src_inc || !xfer->xfer.il->dst_inc)
>  			return NULL;
> @@ -414,10 +413,8 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer)
>  		cnt = xfer->xfer.sg.len;
>  		sg = xfer->xfer.sg.sgl;
>  	} else if (xfer->type == EDMA_XFER_INTERLEAVED) {
> -		if (xfer->xfer.il->numf > 0)
> -			cnt = xfer->xfer.il->numf;
> -		else
> -			cnt = xfer->xfer.il->frame_size;
> +		cnt = xfer->xfer.il->numf * xfer->xfer.il->frame_size;
> +		fsz = xfer->xfer.il->frame_size;
>  	}
>  
>  	for (i = 0; i < cnt; i++) {
> @@ -439,7 +436,7 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer)
>  		else if (xfer->type == EDMA_XFER_SCATTER_GATHER)
>  			burst->sz = sg_dma_len(sg);
>  		else if (xfer->type == EDMA_XFER_INTERLEAVED)
> -			burst->sz = xfer->xfer.il->sgl[i].size;
> +			burst->sz = xfer->xfer.il->sgl[i % fsz].size;
>  
>  		chunk->ll_region.sz += burst->sz;
>  		desc->alloc_sz += burst->sz;
> @@ -482,10 +479,9 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer)
>  
>  		if (xfer->type == EDMA_XFER_SCATTER_GATHER) {
>  			sg = sg_next(sg);
> -		} else if (xfer->type == EDMA_XFER_INTERLEAVED &&
> -			   xfer->xfer.il->frame_size > 0) {
> +		} else if (xfer->type == EDMA_XFER_INTERLEAVED) {
>  			struct dma_interleaved_template *il = xfer->xfer.il;
> -			struct data_chunk *dc = &il->sgl[i];
> +			struct data_chunk *dc = &il->sgl[i % fsz];
>  
>  			src_addr += burst->sz;
>  			if (il->src_sgl)
> -- 
> 2.35.1
> 

-- 
மணிவண்ணன் சதாசிவம்