linux-kernel - Re: [PATCH v3 0/4] g_NCR5380: PDMA fixes and cleanup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 27 Jun 2017 08:28:39 +0200
From:   Ondrej Zary <linux@...nbow-software.org>
To:     Finn Thain <fthain@...egraphics.com.au>
Cc:     "James E.J. Bottomley" <jejb@...ux.vnet.ibm.com>,
        "Martin K. Petersen" <martin.petersen@...cle.com>,
        linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org,
        Michael Schmitz <schmitzmic@...il.com>
Subject: Re: [PATCH v3 0/4] g_NCR5380: PDMA fixes and cleanup

On Monday 26 June 2017, Ondrej Zary wrote:
> On Monday 26 June 2017 09:30:33 Finn Thain wrote:
> > Ondrej, would you please test this new series?
> >
> > Changed since v1:
> > - PDMA transfer residual is calculated earlier.
> > - End of DMA flag check is now polled (if there is any residual).
> >
> > Changed since v2:
> > - Bail out of transfer loops when Gated IRQ gets asserted.
> > - Make udelay conditional on board type.
> > - Drop sg_tablesize patch due to performance regression.
> >
> >
> > Finn Thain (1):
> >   g_NCR5380: Cleanup comments and whitespace
> >
> > Ondrej Zary (3):
> >   g_NCR5380: Fix PDMA transfer size
> >   g_NCR5380: End PDMA transfer correctly on target disconnection
> >   g_NCR5380: Re-work PDMA loops
> >
> >  drivers/scsi/g_NCR5380.c | 239
> > +++++++++++++++++++++++------------------------ 1 file changed, 116
> > insertions(+), 123 deletions(-)

BTW. I've probably found the DTC write corruption.
Added the following check (13 is host buffer index register) - and it triggers 
sometimes: the value is 1 instead of 0. As we use only 16-bit writes, I don't 
see how the value could ever be odd. Looks like a bug in the chip.
The index register corrupts during the transfer, not after IRQ or timeout. The 
same check at beginning of pwrite() did not trigger.

The index register is not writable so we must(?) reset the PDMA engine to 
recover. However, this quick attempt to fix does not work, maybe we should 
reload the block count and continue?

--- a/drivers/scsi/g_NCR5380.c
+++ b/drivers/scsi/g_NCR5380.c
@@ -595,7 +603,13 @@ static inline int generic_NCR5380_pwrite(struct 
NCR5380_hostdata *hostdata,
                                goto out_wait;
                        }
                }
-
+               idx = NCR5380_read(13);
+               if (idx != 0) {
+                       printk("host idx=%d, start=%d\n", idx, start);
+                       NCR5380_write(hostdata->c400_ctl_status, CSR_RESET);
+                       NCR5380_write(hostdata->c400_ctl_status, CSR_BASE);
+                       goto out_wait;
+               }
                if (hostdata->io_port && hostdata->io_width == 2)
                        outsw(hostdata->io_port + hostdata->c400_host_buf,
                                                        src + start, 64);


-- 
Ondrej Zary