lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <ZddhH_NIP17azp6i@fedora>
Date: Thu, 22 Feb 2024 15:58:39 +0100
From: Niklas Cassel <cassel@...nel.org>
To: Sasha Levin <sashal@...nel.org>
Cc: linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	Lennert Buytenhek <kernel@...tstofly.org>, dlemoal@...nel.org,
	linux-ide@...r.kernel.org
Subject: Re: [PATCH AUTOSEL 6.7 19/23] ahci: add 43-bit DMA address quirk for
 ASMedia ASM1061 controllers

Hello Sasha,

On Fri, Feb 02, 2024 at 01:39:15PM -0500, Sasha Levin wrote:
> From: Lennert Buytenhek <kernel@...tstofly.org>
> 
> [ Upstream commit 20730e9b277873deeb6637339edcba64468f3da3 ]
> 
> With one of the on-board ASM1061 AHCI controllers (1b21:0612) on an
> ASUSTeK Pro WS WRX80E-SAGE SE WIFI mainboard, a controller hang was
> observed that was immediately preceded by the following kernel
> messages:
> 
> ahci 0000:28:00.0: Using 64-bit DMA addresses
> ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00000 flags=0x0000]
> ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00300 flags=0x0000]
> ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00380 flags=0x0000]
> ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00400 flags=0x0000]
> ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00680 flags=0x0000]
> ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00700 flags=0x0000]
> 
> The first message is produced by code in drivers/iommu/dma-iommu.c
> which is accompanied by the following comment that seems to apply:
> 
>         /*
>          * Try to use all the 32-bit PCI addresses first. The original SAC vs.
>          * DAC reasoning loses relevance with PCIe, but enough hardware and
>          * firmware bugs are still lurking out there that it's safest not to
>          * venture into the 64-bit space until necessary.
>          *
>          * If your device goes wrong after seeing the notice then likely either
>          * its driver is not setting DMA masks accurately, the hardware has
>          * some inherent bug in handling >32-bit addresses, or not all the
>          * expected address bits are wired up between the device and the IOMMU.
>          */
> 
> Asking the ASM1061 on a discrete PCIe card to DMA from I/O virtual
> address 0xffffffff00000000 produces the following I/O page faults:
> 
> vfio-pci 0000:07:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0021 address=0x7ff00000000 flags=0x0010]
> vfio-pci 0000:07:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0021 address=0x7ff00000500 flags=0x0010]
> 
> Note that the upper 21 bits of the logged DMA address are zero.  (When
> asking a different PCIe device in the same PCIe slot to DMA to the
> same I/O virtual address, we do see all the upper 32 bits of the DMA
> address as 1, so this is not an issue with the chipset or IOMMU
> configuration on the test system.)
> 
> Also, hacking libahci to always set the upper 21 bits of all DMA
> addresses to 1 produces no discernible effect on the behavior of the
> ASM1061, and mkfs/mount/scrub/etc work as without this hack.
> 
> This all strongly suggests that the ASM1061 has a 43 bit DMA address
> limit, and this commit therefore adds a quirk to deal with this limit.
> 
> This issue probably applies to (some of) the other supported ASMedia
> parts as well, but we limit it to the PCI IDs known to refer to
> ASM1061 parts, as that's the only part we know for sure to be affected
> by this issue at this point.
> 
> Link: https://lore.kernel.org/linux-ide/ZaZ2PIpEId-rl6jv@wantstofly.org/
> Signed-off-by: Lennert Buytenhek <kernel@...tstofly.org>
> [cassel: drop date from error messages in commit log]
> Signed-off-by: Niklas Cassel <cassel@...nel.org>
> Signed-off-by: Sasha Levin <sashal@...nel.org>
> ---

I still don't see this commit in stable/linux-6.7.y branch?

Nor in:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git

What am I missing?

($subject had this patch marked as AUTOSEL, so I would have assumed that
it should have been merged by now, since this was 20 days ago.)


This patch in $subject is needed for another follow up patch which
failed to be backported because $subject patch is not in stable/linux-6.7.y:
https://lore.kernel.org/stable/2024021945-jockey-spending-9e68@gregkh/

(The follup up patch had CC: stable tag, but the patch in $subject
unfortunately forgot to add CC: stable tag.)

Could you please help to get both:
20730e9b2778 ("ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers")
and
51af8f255bda ("ahci: Extend ASM1061 43-bit DMA address quirk to other ASM106x parts")

backported to kernel 6.6 and 6.7.

No need to backport to older kernels, as this problem was first exposed by:
791c2b17fb40 ("iommu: Optimise PCI SAC address trick")
which started to put devices into >4GB DMA address range.


Kind regards,
Niklas

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ