linux-kernel - [RFC PATCH] dmaengine: sh: Correct src_addr_widths/dst_addr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 17 Sep 2017 16:45:39 +0200
From:   Stefan Brüns <stefan.bruens@...h-aachen.de>
To:     <dmaengine@...r.kernel.org>
CC:     Vinod Koul <vinod.koul@...el.com>, <linux-kernel@...r.kernel.org>,
        "Dan Williams" <dan.j.williams@...el.com>,
        Niklas Söderlund 
        <niklas.soderlund+renesas@...natech.se>,
        Kuninori Morimoto <kuninori.morimoto.gx@...esas.com>
Subject: [RFC PATCH] dmaengine: sh: Correct src_addr_widths/dst_addr_widths bitmask setting

Obviously, the current value for the burst widths are wrong, and if this
value is retrieved from some other subsystem using dma_get_slave_caps,
it will wrongly assume burst width of e.g. 3 bytes are supported.

Each bit in the bitmask corresponds to a supported width, but it uses
an encoding of BIT(<widths>), not BIT(log2<widths>), as it must be able
to encode a width of 3 bytes.

The corollary is, it is not possible to encode either a width of 32 or
64 bytes, as the field has a size of 32 bits, and only a subset of the
controller capabilities can be exposed.

Signed-off-by: Stefan Brüns <stefan.bruens@...h-aachen.de>
---
 drivers/dma/sh/rcar-dmac.c | 14 ++++++++++----
 drivers/dma/sh/shdmac.c    | 13 +++++++++----
 drivers/dma/sh/usb-dmac.c  |  9 ++++++---
 3 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
index 2b2c7db3e480..768076caccfd 100644
--- a/drivers/dma/sh/rcar-dmac.c
+++ b/drivers/dma/sh/rcar-dmac.c
@@ -1734,10 +1734,16 @@ static int rcar_dmac_parse_of(struct device *dev, struct rcar_dmac *dmac)
 
 static int rcar_dmac_probe(struct platform_device *pdev)
 {
-	const enum dma_slave_buswidth widths = DMA_SLAVE_BUSWIDTH_1_BYTE |
-		DMA_SLAVE_BUSWIDTH_2_BYTES | DMA_SLAVE_BUSWIDTH_4_BYTES |
-		DMA_SLAVE_BUSWIDTH_8_BYTES | DMA_SLAVE_BUSWIDTH_16_BYTES |
-		DMA_SLAVE_BUSWIDTH_32_BYTES | DMA_SLAVE_BUSWIDTH_64_BYTES;
+	/*
+	 * FIXME: Controller supports DMA_SLAVE_BUSWIDTH_32_BYTES
+	 * and DMA_SLAVE_BUSWIDTH_64_BYTES,
+	 * but this overflows the u32 src/dst_addr_widths fields
+	 */
+	const u32 widths = BIT(DMA_SLAVE_BUSWIDTH_1_BYTE) |
+			   BIT(DMA_SLAVE_BUSWIDTH_2_BYTES) |
+			   BIT(DMA_SLAVE_BUSWIDTH_4_BYTES)  |
+			   BIT(DMA_SLAVE_BUSWIDTH_8_BYTES) |
+			   BIT(DMA_SLAVE_BUSWIDTH_16_BYTES);
 	unsigned int channels_offset = 0;
 	struct dma_device *engine;
 	struct rcar_dmac *dmac;
diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
index c94ffab0d25c..bf35b5588b11 100644
--- a/drivers/dma/sh/shdmac.c
+++ b/drivers/dma/sh/shdmac.c
@@ -679,10 +679,15 @@ MODULE_DEVICE_TABLE(of, sh_dmae_of_match);
 
 static int sh_dmae_probe(struct platform_device *pdev)
 {
-	const enum dma_slave_buswidth widths =
-		DMA_SLAVE_BUSWIDTH_1_BYTE   | DMA_SLAVE_BUSWIDTH_2_BYTES |
-		DMA_SLAVE_BUSWIDTH_4_BYTES  | DMA_SLAVE_BUSWIDTH_8_BYTES |
-		DMA_SLAVE_BUSWIDTH_16_BYTES | DMA_SLAVE_BUSWIDTH_32_BYTES;
+	/*
+	 * FIXME: Controller supports DMA_SLAVE_BUSWIDTH_32_BYTES
+	 * but this overflows the u32 src/dst_addr_widths fields
+	 */
+	const u32 widths = BIT(DMA_SLAVE_BUSWIDTH_1_BYTE) |
+			   BIT(DMA_SLAVE_BUSWIDTH_2_BYTES) |
+			   BIT(DMA_SLAVE_BUSWIDTH_4_BYTES)  |
+			   BIT(DMA_SLAVE_BUSWIDTH_8_BYTES) |
+			   BIT(DMA_SLAVE_BUSWIDTH_16_BYTES);
 	const struct sh_dmae_pdata *pdata;
 	unsigned long chan_flag[SH_DMAE_MAX_CHANNELS] = {};
 	int chan_irq[SH_DMAE_MAX_CHANNELS];
diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
index 31a145154e9f..0ac7e842b70c 100644
--- a/drivers/dma/sh/usb-dmac.c
+++ b/drivers/dma/sh/usb-dmac.c
@@ -768,7 +768,6 @@ static int usb_dmac_parse_of(struct device *dev, struct usb_dmac *dmac)
 
 static int usb_dmac_probe(struct platform_device *pdev)
 {
-	const enum dma_slave_buswidth widths = USB_DMAC_SLAVE_BUSWIDTH;
 	struct dma_device *engine;
 	struct usb_dmac *dmac;
 	struct resource *mem;
@@ -837,8 +836,12 @@ static int usb_dmac_probe(struct platform_device *pdev)
 
 	engine->dev = &pdev->dev;
 
-	engine->src_addr_widths = widths;
-	engine->dst_addr_widths = widths;
+	/*
+	 * FIXME: The controller supports a width of USB_DMAC_SLAVE_BUSWIDTH,
+	 * i.e. 32 bytes, but BIT(32) overflows the u32 bitmask fields.
+	 */
+	engine->src_addr_widths = 0;
+	engine->dst_addr_widths = 0;
 	engine->directions = BIT(DMA_MEM_TO_DEV) | BIT(DMA_DEV_TO_MEM);
 	engine->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
 
-- 
2.14.1