| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 18 Mar 2011 09:10:25 -0400
From: Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
To: Yinghai Lu <yinghai@...nel.org>
Cc: Priyanka Gupta <priyankag@...gle.com>,
Jeremy Fitzhardinge <jeremy@...p.org>,
"xen-devel@...ts.xensource.com" <xen-devel@...ts.xensource.com>,
linux-watchdog@...r.kernel.org,
Stefano Stabellini <stefano.stabellini@...citrix.com>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
Mike Waychison <mikew@...gle.com>,
Wim Van Sebroeck <wim@...ana.be>,
"H. Peter Anvin" <hpa@...or.com>
Subject: Re: [Xen-devel] [PATCH -v3] watchdog, SP5100: Check if firmware
has set correct value in tcobase.
On Wed, Mar 16, 2011 at 08:01:07PM -0700, Yinghai Lu wrote:
>
> Stefano found SP5100 TCO watchdog driver using wrong address.
>
> [ 9.148536] SP5100 TCO timer: SP5100 TCO WatchDog Timer Driver v0.01
> [ 9.148628] DEBUG __ioremap_caller WARNING address=b8fe00 size=8 valid=1 reserved=1
>
> and e820 said that range is RAM.
>
> We should check if we can use that reading out. BIOS could just program wrong address there.
>
> -v2: Mike pointed out one path need one release.
> -v3: corrected logic checking with request_mem_region_exclusive()
> Found by Konrad.
Yinghai:
Not sure what you are using as a base, but I had to modify this patch
to go on top of 2.6.38. Here is the patch that applies cleanly:
diff --git a/drivers/watchdog/sp5100_tco.c b/drivers/watchdog/sp5100_tco.c
index 8083728..9cbca8b 100644
--- a/drivers/watchdog/sp5100_tco.c
+++ b/drivers/watchdog/sp5100_tco.c
@@ -42,6 +42,7 @@
#define PFX TCO_MODULE_NAME ": "
/* internal variables */
+static u32 tcobase_phys;
static void __iomem *tcobase;
static unsigned int pm_iobase;
static DEFINE_SPINLOCK(tco_lock); /* Guards the hardware */
@@ -305,10 +306,16 @@ static unsigned char __devinit sp5100_tco_setupdevice(void)
/* Low three bits of BASE0 are reserved. */
val = val << 8 | (inb(SP5100_IO_PM_DATA_REG) & 0xf8);
+ if (!request_mem_region_exclusive(val, SP5100_WDT_MEM_MAP_SIZE, "SP5100 TCO")) {
+ printk(KERN_ERR PFX "mmio address 0x%04x already in use\n", val);
+ goto unreg_region;
+ }
+ tcobase_phys = val;
+
tcobase = ioremap(val, SP5100_WDT_MEM_MAP_SIZE);
if (tcobase == 0) {
printk(KERN_ERR PFX "failed to get tcobase address\n");
- goto unreg_region;
+ goto unreg_mem_region;
}
/* Enable watchdog decode bit */
@@ -346,7 +353,8 @@ static unsigned char __devinit sp5100_tco_setupdevice(void)
/* Done */
return 1;
- iounmap(tcobase);
+unreg_mem_region:
+ release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
unreg_region:
release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
exit:
@@ -401,6 +409,7 @@ static int __devinit sp5100_tco_init(struct platform_device *dev)
exit:
iounmap(tcobase);
+ release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
return ret;
}
@@ -414,6 +423,7 @@ static void __devexit sp5100_tco_cleanup(void)
/* Deregister */
misc_deregister(&sp5100_tco_miscdev);
iounmap(tcobase);
+ release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
}
>
>
> Reported-by: Stefano Stabellini <stefano.stabellini@...citrix.com>
> Signed-off-by:Yinghai Lu <yinghai@...nel.org>
> Acked-by: Mike Waychison <mikew@...gle.com>
> Tested-by: Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
>
> ---
> drivers/watchdog/sp5100_tco.c | 14 ++++++++++++--
> 1 file changed, 12 insertions(+), 2 deletions(-)
>
> Index: linux-2.6/drivers/watchdog/sp5100_tco.c
> ===================================================================
> --- linux-2.6.orig/drivers/watchdog/sp5100_tco.c
> +++ linux-2.6/drivers/watchdog/sp5100_tco.c
> @@ -42,6 +42,7 @@
> #define PFX TCO_MODULE_NAME ": "
> /* internal variables */
> +static u32 tcobase_phys;
> static void __iomem *tcobase;
> static unsigned int pm_iobase;
> static DEFINE_SPINLOCK(tco_lock); /* Guards the hardware */
> @@ -305,10 +306,16 @@ static unsigned char __devinit sp5100_tc
> /* Low three bits of BASE0 are reserved. */
> val = val << 8 | (inb(SP5100_IO_PM_DATA_REG) & 0xf8);
> + if (!request_mem_region_exclusive(val, SP5100_WDT_MEM_MAP_SIZE, "SP5100 TCO")) {
> + printk(KERN_ERR PFX "mmio address 0x%04x already in use\n", val);
> + goto unreg_region;
> + }
> + tcobase_phys = val;
> +
> tcobase = ioremap(val, SP5100_WDT_MEM_MAP_SIZE);
> if (tcobase == 0) {
> printk(KERN_ERR PFX "failed to get tcobase address\n");
> - goto unreg_region;
> + goto unreg_mem_region;
> }
> /* Enable watchdog decode bit */
> @@ -346,7 +353,8 @@ static unsigned char __devinit sp5100_tc
> /* Done */
> return 1;
> - iounmap(tcobase);
> +unreg_mem_region:
> + release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
> unreg_region:
> release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
> exit:
> @@ -401,6 +409,7 @@ static int __devinit sp5100_tco_init(str
> exit:
> iounmap(tcobase);
> + release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
> release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
> return ret;
> }
> @@ -414,6 +423,7 @@ static void __devexit sp5100_tco_cleanup
> /* Deregister */
> misc_deregister(&sp5100_tco_miscdev);
> iounmap(tcobase);
> + release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
> release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
> }
>
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@...ts.xensource.com
> http://lists.xensource.com/xen-devel
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists