Taming DMA: Tales Wrestling Memory Corruption
summary
DMA misconfiguration repeatedly turns into subtle memory corruption: a 40‑bit PCIe/SD host limitation truncates addresses and crashes unless the driver sets a dma mask; missed cache maintenance (use dma_map_single / dma_sync_single_for_device|cpu) lets stale dirty lines hide device writes and corrupt the first TFTP packet; incorrectly claiming dma coherent in DT breaks A/B boot unless runtime device tree patches match bootloader snoop setup. Fixes include enabling CONFIG_DMA_API_DEBUG, porting that to barebox, using DMA‑engine memcpy or KASAN poisoning of DMA buffers for catches.
AI-written summary · about
chapters (17)
- 0:00DMA and embedded Linux
- 1:29DMA offloads CPU work
- 3:19Cache coherence challenges
- 8:23DMA API misuse patterns
- 9:07ADMA errors on new RAM
- 10:55TFTP transfer failures
- 13:47DMA buffer ownership issues
- 15:32DMA memory requirements
- 18:26Crypto DMA corruption
- 21:12DMA coherence pitfalls
- 23:21DesignWare USB3 coherence issue
- 24:24RockChip DWC3 driver crashes
- 27:14Barriers and memory ordering
- 29:03Securing DMA masters
- 30:50Neopixel DMA corruption
- 32:55Summary and future
- 36:48Q&A on DMA restrictions
related talks
35mDMA Safety in Buffers for Linux Kernel Device Drivers
20mProtected DMAbufs and its dynamic memory assignment woes
34mPreventing DMA Attacks from Thunderbolt Devices
16mTaming the Incoherent Cache Issue in Confidential VMs
37mPreventing DMA Attacks from Thunderbolt Devices
33mAI Accelerated Exploiting: Compromising MTE Enabled Pixel from DSP Coprocessor
22mHunting and Exploiting Recursive MMIO Flaws in QEMU KVM
17mStatus Update on TDX Support