linux-kernel - Re: [PATCH] dmaengine: ioat: fixing the wrong chancnt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <148ae07079b42d834a19b100e18070f50acbcc78@linux.dev>
Date:   Sun, 13 Aug 2023 08:59:50 +0000
From:   "Yajun Deng" <yajun.deng@...ux.dev>
To:     "Dave Jiang" <dave.jiang@...el.com>, vkoul@...nel.org,
        bhelgaas@...gle.com
Cc:     dmaengine@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] dmaengine: ioat: fixing the wrong chancnt

August 11, 2023 at 11:40 PM, "Dave Jiang" <dave.jiang@...el.com> wrote:


> 
> On 8/11/23 01:16, Yajun Deng wrote:
> 
> > 
> > The chancnt would be updated in __dma_async_device_channel_register(),
> >  but it was assigned in ioat_enumerate_channels(). Therefore chancnt has
> >  the wrong value.
> >  Clear chancnt before calling dma_async_device_register().
> >  Signed-off-by: Yajun Deng <yajun.deng@...ux.dev>
> > 
> 
> Thank you for the patch Yajun.
> 
> While this may work, it clobbers the chancnt read from the hardware. I think the preferable fix is to move the value read from the hardware in ioat_enumerate_channels() and its current usages to 'struct ioatdma_device' and leave dma->chancnt unchanged in that function so that zeroing it later is not needed.
>
Yes, it's even better. I noticed that chancnt is hardware related in ioat, so I just clear it before calling dma_async_device_register().It would be updated after calling dma_async_device_register(). And it would have
the same value with read in ioat_enumerate_channels().
It doesn't seem clobber the chancnt read from the hardware. 
 
> Also, have you tested this patch or is this just from visual inspection?
> 
Yes, I tested it.

➜  ~ ls /sys/class/dma
dma0chan0  dma1chan0  dma2chan0  dma3chan0

before:
➜  ~ cat /sys/kernel/debug/dmaengine/summary
dma0 (0000:00:04.0): number of channels: 2
dma1 (0000:00:04.1): number of channels: 2
dma2 (0000:00:04.2): number of channels: 2
dma3 (0000:00:04.3): number of channels: 2

after:
➜  ~ cat /sys/kernel/debug/dmaengine/summary
dma0 (0000:00:04.0): number of channels: 1
dma1 (0000:00:04.1): number of channels: 1
dma2 (0000:00:04.2): number of channels: 1
dma3 (0000:00:04.3): number of channels: 1


> And need a fixes tag.
>
I've tried to find the commit introduced, it looks like it was introduced from the source.
The following commits are related to chancnt：

0bbd5f4e97ff ("[I/OAT]: Driver for the Intel(R) I/OAT DMA engine")
device->common.chancnt = ioatdma_read8(device, IOAT_CHANCNT_OFFSET);

e38288117c50 ("ioatdma: Remove the wrappers around read(bwl)/write(bwl) in ioatdma")
device->common.chancnt = readb(device->reg_base + IOAT_CHANCNT_OFFSET);

584ec22759c0 ("ioat: move to drivers/dma/ioat/")
move driver/dma/ioatdma.c to driver/dma/ioat/

f2427e276ffe ("ioat: split ioat_dma_probe into core/version-specific routines")
dma->chancnt = readb(device->reg_base + IOAT_CHANCNT_OFFSET);

55f878ec47e3 ("dmaengine: ioatdma: fixup ioatdma_device namings")
dma->chancnt = readb(ioat_dma->reg_base + IOAT_CHANCNT_OFFSET);

It looks very historic. I'm confused about which one to choose. 
This is a bug, but it only affects /sys/kernel/debug/dmaengine/summary.
So I didn't add a fixes tag.

 
> > 
> > ---
> >  drivers/dma/ioat/init.c | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> >  diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
> >  index c4602bfc9c74..928fc8a83a36 100644
> >  --- a/drivers/dma/ioat/init.c
> >  +++ b/drivers/dma/ioat/init.c
> >  @@ -536,8 +536,11 @@ static int ioat_probe(struct ioatdma_device *ioat_dma)
> >  > static int ioat_register(struct ioatdma_device *ioat_dma)
> >  {
> >  - int err = dma_async_device_register(&ioat_dma->dma_dev);
> >  + int err;
> >  +
> >  + ioat_dma->dma_dev.chancnt = 0;
> >  > + err = dma_async_device_register(&ioat_dma->dma_dev);
> >  if (err) {
> >  ioat_disable_interrupts(ioat_dma);
> >  dma_pool_destroy(ioat_dma->completion_pool);
> >
>