linux-kernel - Re: ARM unaligned MMIO access with attribute((packed))

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 26 Apr 2011 14:51:00 -0400 (EDT)
From:	Alan Stern <stern@...land.harvard.edu>
To:	Rabin Vincent <rabin@....in>
cc:	Arnd Bergmann <arnd@...db.de>,
	<linux-arm-kernel@...ts.infradead.org>,
	<linux-usb@...r.kernel.org>,
	Ulrich Weigand <Ulrich.Weigand@...ibm.com>,
	<linux-kernel@...r.kernel.org>, <gcc@....gnu.org>,
	Peter Maydell <peter.maydell@...aro.org>
Subject: Re: ARM unaligned MMIO access with attribute((packed))

On Tue, 26 Apr 2011, Rabin Vincent wrote:

> On Wed, Feb 2, 2011 at 21:30, Arnd Bergmann <arnd@...db.de> wrote:
> > As noticed by Peter Maydell, the EHCI device driver in Linux gets
> > miscompiled by some versions of arm-gcc (still need to find out which)
> > due to a combination of problems:
> >
> > 1. In include/linux/usb/ehci_def.h, struct ehci_caps is defined
> > with __attribute__((packed)), for no good reason. This is clearly
> > a bug and needs to get fixed, but other drivers have the same bug
> 
> Was a patch submitted for this?  I couldn't find it in the archives.
> U-Boot seems to be fixing this by adding an "aligned(4)" instead
> of removing the packed:
> 
> http://www.mail-archive.com/u-boot@lists.denx.de/msg51418.html

ISTR a patch was submitted,  but apparently it never got picked up.

> > and it used to work. The attribute forces byte access on all members
> > accessed through pointer dereference, which is not allowed on
> > MMIO accesses in general. The specific code triggering the problem
> > in Peter's case is in ehci-omap.c:
> >        omap->ehci->regs = hcd->regs
> >                + HC_LENGTH(readl(&omap->ehci->caps->hc_capbase));
> 
> In my case it's this writel() in ehci-hub.c that gets chopped into
> strbs:
> 
> 	/* force reset to complete */
> 	ehci_writel(ehci, temp & ~(PORT_RWC_BITS | PORT_RESET),
> 				status_reg);

Why would that get messed up?  The status_reg variable doesn't have any 
__atribute__((packed)) associated with it.

Alan Stern

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/