linux-kernel - Re: [PATCH] Exchange the Assignments of `MEMORYs' and `CFGs/IOs' in Designware PCIe Driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 3 Jul 2016 20:57:33 +0530
From:	Pratyush Anand <pratyush.anand@...il.com>
To:	"dongbo (E)" <dongbo4@...wei.com>
Cc:	"jingoohan1@...il.com" <jingoohan1@...il.com>,
	"bhelgaas@...gle.com" <bhelgaas@...gle.com>,
	Linuxarm <linuxarm@...wei.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-pci@...r.kernel.org" <linux-pci@...r.kernel.org>,
	Zhanweitao <zhanweitao@...ilicon.com>
Subject: Re: [PATCH] Exchange the Assignments of `MEMORYs' and `CFGs/IOs' in
 Designware PCIe Driver

On Tue, Jun 28, 2016 at 1:42 PM, dongbo (E) <dongbo4@...wei.com> wrote:
>
> From: Dong Bo <dongbo4@...wei.com>
>
> In designware PCIe driver, the iatu0 is used for both CFG and IO accesses.
> When sending CFGs to peripherals (e.g. lspci), iatu0 frequently switches
> between CFG and IO alternatively.
>
> A MEMORY probably be sent as an IOs by mistake. Considering the following
> configurations:
> MEMORY          ->      BASE_ADDR: 0xb4100000, LIMIT: 0xb4100FFF, TYPE=mem
> CFG             ->      BASE_ADDR: 0xb4000000, LIMIT: 0xb4000FFF, TYPE=cfg
> IO              ->      BASE_ADDR: 0xFFFFFFFF, LIMIT: 0xFFFFFFFE, TYPE=io
>
> Suppose PCIe has just completed a CFG access, to switch back to IO, it set
> the BASE_ADDR to 0xFFFFFFFF, LIMIT 0xFFFFFFFE and TYPE to io. When another
> CFG comes, the BASE_ADDR is set to 0xb4000000 to switch to CFG. At this
> moment, a MEMORY access shows up, since it matches with iatu0
> (due to 0xb4000000 <= MEMORY BASE_ADDR <= MEMORY LIMIE <= 0xFFFFFFF), it
> is treated as an IO access by mistake, then sent to perpheral.
>
> This patch fixes the problem by exchanging the assignments of `MEMORYs'
> and `CFGs/IOs', which assigning MEMEORYs to iatu0, CFGs and IOs to iatu1.


Had a re-thought on it. While it will fix wrong memory access in your
case, it can still cause issues with IO access for some other
platform.

Can you please test [1] and check it that works for you. You will need
to define num-viewport in your device tree file.

~Pratyush

[1] https://github.com/pratyushanand/linux/commit/131b83ea7db0834d77ee5df65c6696bccbf8a1ce