linux-kernel - RE: questions regarding possible violation of AHCI spec in AHCI driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <E18F441196CA634DB8E1F1C56A50A874319FA7E36F@IRVEXCHCCR01.corp.ad.broadcom.com>
Date:	Wed, 8 Dec 2010 11:49:50 -0800
From:	"Jian Peng" <jipeng@...adcom.com>
To:	"Tejun Heo" <tj@...nel.org>
cc:	"Robert Hancock" <hancockrwd@...il.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"jgarzik@...ox.com" <jgarzik@...ox.com>,
	ide <linux-ide@...r.kernel.org>
Subject: RE: questions regarding possible violation of AHCI spec in AHCI
 driver

I agree. I have AHCI based PCI card using HBA from Marvell, Via and Silicon Image, and am going to test my patch. 
Before this patch can be applied universally, I like to use it for specific PCI_VENDOR_ID first. Here is my new patch to limit it to Broadcom's AHCI core

--- libahci.c.orig	2010-12-08 10:42:48.383976763 -0800
+++ libahci.c	2010-12-08 11:44:24.394023128 -0800
@@ -44,6 +44,7 @@
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_cmnd.h>
 #include <linux/libata.h>
+#include <linux/pci.h>
 #include "ahci.h"
 
 static int ahci_skip_host_reset;
@@ -541,8 +542,20 @@
 void ahci_start_engine(struct ata_port *ap)
 {
 	void __iomem *port_mmio = ahci_port_base(ap);
+	struct ata_host *host = ap->host;
+	struct pci_dev *pdev = to_pci_dev(host->dev);
 	u32 tmp;
 
+	/* avoid race condition per spec (end of section 10.1.2) */
+	if (pdev->vendor == PCI_VENDOR_ID_BROADCOM) {
+		u8 status = readl(port_mmio + PORT_TFDATA) & 0xFF;
+
+		if (status & (ATA_BUSY | ATA_DRQ) ||
+		    ahci_scr_read(&ap->link, SCR_STATUS, &tmp) ||
+		    (tmp & 0x0f) != 0x03)
+			return;
+	}
+
 	/* start DMA */
 	tmp = readl(port_mmio + PORT_CMD);
 	tmp |= PORT_CMD_START;

Thanks,
Jian

________________________________________
From: Tejun Heo [tj@...nel.org]
Sent: Wednesday, December 08, 2010 10:52 AM
To: Jian Peng
Cc: Robert Hancock; linux-kernel@...r.kernel.org; jgarzik@...ox.com; ide
Subject: Re: questions regarding possible violation of AHCI spec in AHCI driver

Hello,

On 12/08/2010 07:48 PM, Jian Peng wrote:
> So it is reasonable to add extra check in ahci_start_engine() without returning status of ST bit. If so, here is my patch
>
> --- libahci.c.orig    2010-12-08 10:42:48.383976763 -0800
> +++ libahci.c 2010-12-08 10:45:17.495156944 -0800
> @@ -542,6 +542,13 @@
>  {
>       void __iomem *port_mmio = ahci_port_base(ap);
>       u32 tmp;
> +     u8 status = readl(port_mmio + PORT_TFDATA) & 0xFF;
> +
> +     /* avoid race condition per spec (end of section 10.1.2) */
> +     if (status & (ATA_BUSY | ATA_DRQ) ||
> +         ahci_scr_read(&ap->link, SCR_STATUS, &tmp) ||
> +         (tmp & 0x0f) != 0x03)
> +             return;
>
>       /* start DMA */
>       tmp = readl(port_mmio + PORT_CMD);

Yes, it is reasonable but I want to see that it actually fixes
something.  There are just too many controllers which use this path to
blindly apply the above change and given my previous explanation even
without the above change any ahci controller _should_ work fine.

Thanks.

--
tejun


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/