linux-kernel - Re: [PATCH v6 2/2] memory: pl353: Add driver for arm pl353 static memory controller

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 28 Apr 2015 10:11:38 -0500
From:	Ben Shelton <ben.shelton@...com>
To:	Punnaiah Choudary Kalluri <punnaiah.choudary.kalluri@...inx.com>
Cc:	robh+dt@...nel.org, pawel.moll@....com, mark.rutland@....com,
	ijc+devicetree@...lion.org.uk, galak@...eaurora.org,
	rob@...dley.net, michal.simek@...inx.com, grant.likely@...aro.org,
	gregkh@...uxfoundation.org, jason@...edaemon.net,
	ezequiel.garcia@...e-electrons.com, arnd@...db.de,
	dwmw2@...radead.org, computersforpeace@...il.com,
	artem.bityutskiy@...ux.intel.com, jussi.kivilinna@....fi,
	acourbot@...dia.com, ivan.khoronzhuk@...com, joern@...fs.org,
	devicetree@...r.kernel.org, linux-doc@...r.kernel.org,
	linux-kernel@...r.kernel.org, linux-mtd@...ts.infradead.org,
	kpc528@...il.com, kalluripunnaiahchoudary@...il.com,
	Punnaiah Choudary Kalluri <punnaia@...inx.com>
Subject: Re: [PATCH v6 2/2] memory: pl353: Add driver for arm pl353 static
 memory controller

Hi Punnaiah,

> +/**
> + * pl353_smc_set_cycles - Set memory timing parameters
> + * @dev:	Pointer to the device struct
> + * @t0:	t_rc		read cycle time
> + * @t1:	t_wc		write cycle time
> + * @t2:	t_rea/t_ceoe	output enable assertion delay
> + * @t3:	t_wp		write enable deassertion delay
> + * @t4:	t_clr/t_pc	page cycle time
> + * @t5:	t_ar/t_ta	ID read time/turnaround time
> + * @t6:	t_rr		busy to RE timing
> + *
> + * Sets NAND chip specific timing parameters.
> + */
> +void pl353_smc_set_cycles(struct device *dev, u32 t0, u32 t1, u32 t2, u32 t3,
> +			  u32 t4, u32 t5, u32 t6)
> +{
> +	struct pl353_smc_data *pl353_smc = dev_get_drvdata(dev);
> +
> +	t0 &= PL353_SMC_SET_CYCLES_T0_MASK;
> +	t1 = (t1 & PL353_SMC_SET_CYCLES_T1_MASK) <<
> +			PL353_SMC_SET_CYCLES_T1_SHIFT;
> +	t2 = (t2 & PL353_SMC_SET_CYCLES_T2_MASK) <<
> +			PL353_SMC_SET_CYCLES_T2_SHIFT;
> +	t3 = (t3 & PL353_SMC_SET_CYCLES_T3_MASK) <<
> +			PL353_SMC_SET_CYCLES_T3_SHIFT;
> +	t4 = (t4 & PL353_SMC_SET_CYCLES_T4_MASK) <<
> +			PL353_SMC_SET_CYCLES_T4_SHIFT;
> +	t5 = (t5 & PL353_SMC_SET_CYCLES_T5_MASK) <<
> +			PL353_SMC_SET_CYCLES_T5_SHIFT;
> +	t6 = (t6 & PL353_SMC_SET_CYCLES_T6_MASK) <<
> +			PL353_SMC_SET_CYCLES_T6_SHIFT;

Right now, if the caller (i.e. the PL353 NAND driver) passes in a value for any
of the timing parameters that is too large, it will be truncated with the
corresponding mask and then saved, resulting in unexpected behavior.  I saw
this when the PL353 NAND driver tried to set t_rc and t_wc to 17 cycles, which
does not fit in the 4-bit fields for those values -- it got clipped to 4 bits
and stored as 1 cycle, which made communication with the NAND chip fail and
time out.

It would be good to sanity-check each timing here, and rather than returning
void, return a return code indicating success or failure (e.g. -EINVAL for
invalid timings).

Note also that truncation isn't the only thing to check for here.  The PL350
r2p1 datasheet lists a "Minimum permitted value" for each of these timing
values.

> +
> +	t0 |= t1 | t2 | t3 | t4 | t5 | t6;
> +
> +	writel(t0, pl353_smc->base + PL353_SMC_SET_CYCLES_OFFS);
> +	writel(PL353_SMC_DC_UPT_NAND_REGS, pl353_smc->base +
> +	       PL353_SMC_DIRECT_CMD_OFFS);
> +}
> +EXPORT_SYMBOL_GPL(pl353_smc_set_cycles);
> +

Thanks,
Ben
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/