linux-kernel - Re: iwlwifi: Regression after migrating to 6.6.32

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <35750452-e362-4dfa-803a-3360a4e16cd8@quicinc.com>
Date: Thu, 13 Jun 2024 17:51:56 +0800
From: Baochen Qiang <quic_bqiang@...cinc.com>
To: Johannes Berg <johannes@...solutions.net>,
        Fabio Estevam
	<festevam@...il.com>
CC: <miriam.rachel.korenblit@...el.com>, <kvalo@...nel.org>,
        Jakub Kicinski
	<kuba@...nel.org>,
        linux-wireless <linux-wireless@...r.kernel.org>,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: iwlwifi: Regression after migrating to 6.6.32



On 6/13/2024 3:40 PM, Johannes Berg wrote:
> On Thu, 2024-06-13 at 15:10 +0800, Baochen Qiang wrote:
>>
>> On 6/13/2024 3:15 AM, Fabio Estevam wrote:
>>> Hi Johannes,
>>>
>>> On Wed, Jun 12, 2024 at 4:10 PM Johannes Berg <johannes@...solutions.net> wrote:
>>>
>>>> Strange. Is there an IOMMU involved on this platform?
>>>
>>> IOMMU isn't available on i.MX8M as far as I know.
>> If IOMMU not present, likely the buffer is mapped by SWIOTLB.
> 
> Why? The device can do 64-bit DMA, so should be able to just access any
> page in the system. Even older devices can do 36-bit DMA, but this is a
> newer one. And if IOMMU isn't present, you have no protection anyway.
Then no idea :(

> 
>>  The iova 4215433216, aka 0xFB426800, is 2K aligned, which also supports such guessing. See definition of IO_TLB_SIZE.
> 
> Not sure that means anything though, I really would have expected a 4k
> buffer to be 4k aligned - why would you even want to map it across two
> pages?
IMO SWIOTLB manages buffers in a unit of IO_TLB_SIZE, it does not care about whether or not we are crossing page boundaries, no?

> 
> If it is SWIOTLB, shouldn't we get into this condition?
> 
>         /*
>          * Historically, swiotlb allocations >= PAGE_SIZE were guaranteed to be
>          * page-aligned in the absence of any other alignment requirements.
>          * 'alloc_align_mask' was later introduced to specify the alignment
>          * explicitly, however this is passed as zero for streaming mappings
>          * and so we preserve the old behaviour there in case any drivers are
>          * relying on it.
>          */
>         if (!alloc_align_mask && !iotlb_align_mask && alloc_size >= PAGE_SIZE)
>                 alloc_align_mask = PAGE_SIZE - 1;
> 
This is not present in 6.6.32 stable kernel.

> 
> Otherwise, not sure though how we could possibly fix this in the driver,
> we really shouldn't do dma_set_min_align_mask() since on the TX side we
> really have no alignment requirements, and swiotlb_map() uses 0 as
> alignment.
> 
> johannes