linux-kernel - Re: [PATCH] of/irq: fix bug in computing output requester-id for an msi-map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 8 Feb 2016 15:47:04 -0800
From:	David Daney <ddaney@...iumnetworks.com>
To:	Stuart Yoder <stuart.yoder@....com>
CC:	<robh@...nel.org>, <frowand.list@...il.com>,
	<grant.likely@...aro.org>, <devicetree@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, <marc.zyngier@....com>,
	<david.daney@...ium.com>, <mark.rutland@....com>
Subject: Re: [PATCH] of/irq: fix bug in computing output requester-id for
 an msi-map

On 02/08/2016 02:30 PM, Stuart Yoder wrote:
> From: Stuart Yoder <stuart.yoder@....com>
>
> The binding for msi-map specifies that the output requester id
> should be computed as: (r - rid-base + msi-base)
>
> ...update the code accordingly.

I agree there is a problem  however ...

>
> Signed-off-by: Stuart Yoder <stuart.yoder@....com>
> ---
>   drivers/of/irq.c |    4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/of/irq.c b/drivers/of/irq.c
> index 706e3ff..3f5e5fd 100644
> --- a/drivers/of/irq.c
> +++ b/drivers/of/irq.c
> @@ -589,6 +589,7 @@ static u32 __of_msi_map_rid(struct device *dev, struct device_node **np,
>   	struct device_node *msi_controller_node;
>   	struct device_node *msi_np = *np;
>   	u32 map_mask, masked_rid, rid_base, msi_base, rid_len, phandle;
> +	u32 masked_rid_base;
>   	int msi_map_len;
>   	bool matched;
>   	u32 rid_out = rid_in;
> @@ -654,7 +655,8 @@ static u32 __of_msi_map_rid(struct device *dev, struct device_node **np,
>   	if (!matched)
>   		return rid_out;
>
> -	rid_out = masked_rid + msi_base;
> +	masked_rid_base = map_mask & rid_base;

... The binding document nowhere, that I see, talks about applying the 
mask to the rid-base.

The device tree should already contain the rid-base in the correct range.

If you remove this masking step, I think it may be correct.

If you just do:

diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 7ee21ae..92abe01 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -654,7 +654,7 @@ static u32 __of_msi_map_rid(struct device *dev, 
struct device_node **np,
         if (!matched)
                 return rid_out;

-       rid_out = masked_rid + msi_base;
+       rid_out = msi_base + (masked_rid - rid_base);
         dev_dbg(dev,
                 "msi-map at: %s, using mask %08x, rid-base: %08x, 
msi-base: %08x, length: %08x, rid: %08x -> %08x\n",

It think it will be correct.

I have tested it that way.  If you do that,

Acked-by: David Daney <david.daney@...ium.com>

> +	rid_out = msi_base + (masked_rid - masked_rid_base);
>   	dev_dbg(dev,
>   		"msi-map at: %s, using mask %08x, rid-base: %08x, msi-base: %08x, length: %08x, rid: %08x -> %08x\n",
>   		dev_name(parent_dev), map_mask, rid_base, msi_base,
>