Taming DMA: Tales Wrestling Memory Corruption
summary
Real bugs and fixes: DMA masters silently truncate addresses so setting a 40-bit DMA mask prevents adma errors; using raw virt->phys caused the first TFTP transfer to always corrupt until replaced by dma_map_single which does cache maintenance; marking a device as dma-coherent (and barebox rewriting the device tree) fixes speculative-prefetch corruption; unaligned memcpy into strongly-ordered memory crashes without iomem-aware copy; user‑space DMA can overwrite the SD card by reusing channels. Recommended tools: config DMA_API_DEBUG and KASAN poisoning of DMA buffers.
AI-written summary · about
chapters (17)
- 0:00DMA and embedded Linux
- 1:29DMA offloads CPU work
- 3:19Cache coherence challenges
- 8:23DMA API misuse patterns
- 9:07ADMA errors on new RAM
- 10:55TFTP transfer failures
- 13:47DMA buffer ownership issues
- 15:32DMA memory requirements
- 18:26Crypto DMA corruption
- 21:12DMA coherence pitfalls
- 23:21DesignWare USB3 coherence issue
- 24:24RockChip DWC3 driver crashes
- 27:14Barriers and memory ordering
- 29:03Securing DMA masters
- 30:50Neopixel DMA corruption
- 32:55Summary and future
- 36:48Q&A on DMA restrictions
related talks
35mDMA Safety in Buffers for Linux Kernel Device Drivers
30mdrm and cgroup memory management - two great tastes
37mPreventing DMA Attacks from Thunderbolt Devices
26mCooperative DMA in a memory-oversubscribed environment
37mHardware Error Handling Improvement for Reliable KVM Hypervisor
47mLinux on POWER Driver Porting, Optimization, and Test
44mKernel TEE subsystem BoF
34mLCG Lightning Talks