linux-kernel - Re: [PATCH] edac, i5000, i5400: fix definition of nrecmemb register

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 28 Jun 2017 18:08:51 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     Jérémy Lefaure <jeremy.lefaure@....epita.fr>
Cc:     Mauro Carvalho Chehab <mchehab@...nel.org>,
        linux-edac@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] edac, i5000, i5400: fix definition of nrecmemb register

On Mon, Jun 12, 2017 at 01:47:58PM -0400, Jérémy Lefaure wrote:
> In i5000 and i5400 edac drivers, the register nrecmemb is defined as a
> 16 bits value which result in wrong shifts in the code:
>   CHECK   drivers/edac/i5000_edac.c
> drivers/edac/i5000_edac.c:485:15: warning: right shift by bigger than
> source value
> drivers/edac/i5000_edac.c:580:23: warning: right shift by bigger than
> source value
>   CC      drivers/edac/i5000_edac.o
>   CHECK   drivers/edac/i5400_edac.c
> drivers/edac/i5400_edac.c:391:36: warning: right shift by bigger than
> source value
> drivers/edac/i5400_edac.c:401:37: warning: right shift by bigger than
> source value
>   CC      drivers/edac/i5400_edac.o
> 
> In the datasheets ([1], section 3.9.22.20 and [2], section 3.9.22.21),
> this register is a 32 bits register. A u32 value for the register fixes
> the wrong shifts warnings and matches the datasheet.
> 
> This patch also fixes the mask to access to the CAS bits [16 to 28] in
> the i5000 edac driver.
> 
> [1]: https://www.intel.com/content/dam/doc/datasheet/5000p-5000v-5000z-chipset-memory-controller-hub-datasheet.pdf

Well, the CAS field length here is [27:16], see below.

> [2]: https://www.intel.se/content/dam/doc/datasheet/5400-chipset-memory-controller-hub-datasheet.pdf

Here it is [28:16].

> Signed-off-by: Jérémy Lefaure <jeremy.lefaure@....epita.fr>
> ---
> 
> I have found this error thanks to the sparse tool. Please note that this patch
> hasn't been tested on real hardware.
> 
> 
>  drivers/edac/i5000_edac.c | 6 +++---
>  drivers/edac/i5400_edac.c | 4 ++--
>  2 files changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c
> index f683919981b0..c79016ade51e 100644
> --- a/drivers/edac/i5000_edac.c
> +++ b/drivers/edac/i5000_edac.c
> @@ -227,7 +227,7 @@
>  #define			NREC_RDWR(x)		(((x)>>11) & 1)
>  #define			NREC_RANK(x)		(((x)>>8) & 0x7)
>  #define		NRECMEMB		0xC0
> -#define			NREC_CAS(x)		(((x)>>16) & 0xFFFFFF)
> +#define			NREC_CAS(x)		(((x)>>16) & 0x1FFF)

That is still incorrect. According to the 5000? datasheet above,
NRECMEMB has the CAS field in bits [27:16]. That's 12 bits, so the mask
should be 0xFFF. IOW,

#define			NREC_CAS(x)		(((x)>>16) & 0xFFF)

The 0x1FFF mask is correct for the 5400 driver because the CAS field
there is [28:16].

The fact that no one caught this by now goes to show how many people are
actually using this thing. :-\

-- 
Regards/Gruss,
    Boris.

Good mailing practices for 400: avoid top-posting and trim the reply.