linux-kernel - Re: [PATCH] Exchange the Assignments of `MEMORYs' and `CFGs/IOs' in Designware PCIe Driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHM4w1nDg=s8XO93MC6BEWORa2HGJue3EVSRzii2_+E=hTWcsQ@mail.gmail.com>
Date:	Mon, 4 Jul 2016 14:30:07 +0530
From:	Pratyush Anand <pratyush.anand@...il.com>
To:	"dongbo (E)" <dongbo4@...wei.com>
Cc:	"jingoohan1@...il.com" <jingoohan1@...il.com>,
	"bhelgaas@...gle.com" <bhelgaas@...gle.com>,
	Linuxarm <linuxarm@...wei.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-pci@...r.kernel.org" <linux-pci@...r.kernel.org>,
	Zhanweitao <zhanweitao@...ilicon.com>
Subject: Re: [PATCH] Exchange the Assignments of `MEMORYs' and `CFGs/IOs' in
 Designware PCIe Driver

On Mon, Jul 4, 2016 at 1:06 PM, dongbo (E) <dongbo4@...wei.com> wrote:
> On 2016/7/3 23:27, Pratyush Anand wrote:
>> On Tue, Jun 28, 2016 at 1:42 PM, dongbo (E) <dongbo4@...wei.com> wrote:
>>>
>>> From: Dong Bo <dongbo4@...wei.com>
>>>
>>> In designware PCIe driver, the iatu0 is used for both CFG and IO accesses.
>>> When sending CFGs to peripherals (e.g. lspci), iatu0 frequently switches
>>> between CFG and IO alternatively.
>>>
>>> A MEMORY probably be sent as an IOs by mistake. Considering the following
>>> configurations:
>>> MEMORY          ->      BASE_ADDR: 0xb4100000, LIMIT: 0xb4100FFF, TYPE=mem
>>> CFG             ->      BASE_ADDR: 0xb4000000, LIMIT: 0xb4000FFF, TYPE=cfg
>>> IO              ->      BASE_ADDR: 0xFFFFFFFF, LIMIT: 0xFFFFFFFE, TYPE=io
>>>
>>> Suppose PCIe has just completed a CFG access, to switch back to IO, it set
>>> the BASE_ADDR to 0xFFFFFFFF, LIMIT 0xFFFFFFFE and TYPE to io. When another
>>> CFG comes, the BASE_ADDR is set to 0xb4000000 to switch to CFG. At this
>>> moment, a MEMORY access shows up, since it matches with iatu0
>>> (due to 0xb4000000 <= MEMORY BASE_ADDR <= MEMORY LIMIE <= 0xFFFFFFF), it
>>> is treated as an IO access by mistake, then sent to perpheral.
>>>
>>> This patch fixes the problem by exchanging the assignments of `MEMORYs'
>>> and `CFGs/IOs', which assigning MEMEORYs to iatu0, CFGs and IOs to iatu1.
>>
>>
>> Had a re-thought on it. While it will fix wrong memory access in your
>> case, it can still cause issues with IO access for some other
>> platform.
>>
>> Can you please test [1] and check it that works for you. You will need
>> to define num-viewport in your device tree file.
>>
>> ~Pratyush
>>
>> [1] https://github.com/pratyushanand/linux/commit/131b83ea7db0834d77ee5df65c6696bccbf8a1ce
>>
>> .
>>
>
> Checked, it works for us.

Thanks for testing.

>
> I think it would be better to exchange the assignments of MEMORYs and
> CFGs/IOs when num_viewports <= 2, cause it fixes wrong memory access.

OK.. I think that can be accommodated. I have rebased your patch on
top of mine with some change in commit log.

https://github.com/pratyushanand/linux/commit/6d3805a5e0fbbbd73beba80c2c9151b26399ea67

Will send both of the patches to the list for review.


>
> As you mentioned, other corner point for failure is still there while
> there are only two viewports. It seems that there is not a perfect
> solution.

Yes, unfortunately we will have to live with either remote possibility
of less frequent IO transfer corruption or we can disable IO transfer
for <=2 viewports. IMHO, former is the better way to go with.

~Pratyush