linux-kernel - Re: [PATCH v3 2/7] iommu/arm-smmu-v3: Do resource size checks based on SMMU

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 8 May 2017 16:20:49 +0530
From:   Linu Cherian <linu.cherian@...ium.com>
To:     Robert Richter <robert.richter@...ium.com>
Cc:     Geetha sowjanya <gakula@...iumnetworks.com>, will.deacon@....com,
        robin.murphy@....com, lorenzo.pieralisi@....com,
        hanjun.guo@...aro.org, sudeep.holla@....com,
        iommu@...ts.linux-foundation.org, jcm@...hat.com,
        linux-kernel@...r.kernel.org, catalin.marinas@....com,
        sgoutham@...ium.com, linux-arm-kernel@...ts.infradead.org,
        linux-acpi@...r.kernel.org, geethasowjanya.akula@...il.com,
        Charles.Garcia-Tobin@....com,
        Geetha Sowjanya <geethasowjanya.akula@...ium.com>
Subject: Re: [PATCH v3 2/7] iommu/arm-smmu-v3: Do resource size checks based
 on SMMU


On Mon May 08, 2017 at 12:09:32PM +0200, Robert Richter wrote:
> On 08.05.17 15:14:37, Linu Cherian wrote:
> > On Sat May 06, 2017 at 12:18:44AM +0200, Robert Richter wrote:
> > > On 05.05.17 17:38:06, Geetha sowjanya wrote:
> > > > From: Linu Cherian <linu.cherian@...ium.com>
> > > > 
> > > > With implementations supporting only page 0 register space,
> > > > resource size can be 64k as well and hence perform size checks
> > > > based on SMMU option PAGE0_REGS_ONLY.
> > > > 
> > > > For this, arm_smmu_device_dt_probe/acpi_probe has been moved before
> > > > platform_get_resource call, so that SMMU options are set beforehand.
> > > > 
> > > > Signed-off-by:  Linu Cherian <linu.cherian@...ium.com>
> > > > Signed-off-by:  Geetha Sowjanya <geethasowjanya.akula@...ium.com>
> > > > ---
> > > >  drivers/iommu/arm-smmu-v3.c | 26 +++++++++++++++++---------
> > > >  1 file changed, 17 insertions(+), 9 deletions(-)
> > > > 
> > > > diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
> > > > index 107b4a6..f027676 100644
> > > > --- a/drivers/iommu/arm-smmu-v3.c
> > > > +++ b/drivers/iommu/arm-smmu-v3.c
> > > > @@ -2672,6 +2672,14 @@ static int arm_smmu_device_dt_probe(struct platform_device *pdev,
> > > >  	return ret;
> > > >  }
> > > >  
> > > > +static unsigned long arm_smmu_resource_size(struct arm_smmu_device *smmu)
> > > > +{
> > > > +	if (ARM_SMMU_PAGE0_REGS_ONLY(smmu))
> > > > +		return SZ_64K;
> > > > +	else
> > > > +		return SZ_128K;
> > > > +}
> > > > +
> > > 
> > > I think this can be dropped. See below.
> > > 
> > > >  static int arm_smmu_device_probe(struct platform_device *pdev)
> > > >  {
> > > >  	int irq, ret;
> > > > @@ -2688,9 +2696,17 @@ static int arm_smmu_device_probe(struct platform_device *pdev)
> > > >  	}
> > > >  	smmu->dev = dev;
> > > >  
> > > > +	if (dev->of_node) {
> > > > +		ret = arm_smmu_device_dt_probe(pdev, smmu);
> > > > +	} else {
> > > > +		ret = arm_smmu_device_acpi_probe(pdev, smmu);
> > > > +		if (ret == -ENODEV)
> > > > +			return ret;
> > > > +	}
> > > > +
> > > >  	/* Base address */
> > > >  	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
> > > > -	if (resource_size(res) + 1 < SZ_128K) {
> > > > +	if (resource_size(res) + 1 < arm_smmu_resource_size(smmu)) {
> > > >  		dev_err(dev, "MMIO region too small (%pr)\n", res);
> > > >  		return -EINVAL;
> > > >  	}
> > > 
> > > Why not just do the follwoing here:
> > > 
> > >  	/* Base address */
> > >  	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
> > >  	if (resource_size(res) + 1 < arm_smmu_resource_size(smmu)) {
> > >  		dev_err(dev, "MMIO region too small (%pr)\n", res);
> > >  		return -EINVAL;
> > >  	}
> > >  	ioaddr = res->start;
> > > 
> > > +	/*
> > > +	 * Override the size, for Cavium ThunderX2 implementation
> > > +	 * which doesn't support the page 1 SMMU register space.
> > > +	 */
> > > +	if (smmu->options & ARM_SMMU_OPT_PAGE0_REGS_ONLY)
> > > +		res->end = res->size + SZ_64K -1;
> > > +
> > >  	smmu->base = devm_ioremap_resource(dev, res);
> > >  	if (IS_ERR(smmu->base))
> > >  		return PTR_ERR(smmu->base);
> > 
> > 
> > This might not work, since platform_device_add is being called from
> > iort.c before the res->end gets fixed up here. 
> 
> It should. You added it with 128k and you get it back with
> platform_get_resource(), but before ioremap you shrink the size to
> 64k.
> 

The smmu devices are located at 64k offsets and not at 128k
offsets and hence this would be result in resource conflict during
platform_add_device ?

Code snippet from platform_add_device:

        for (i = 0; i < pdev->num_resources; i++) {
 	        struct resource *p, *r = &pdev->resource[i];

		if (r->name == NULL)
	                r->name = dev_name(&pdev->dev);

		p = r->parent;
                if (!p) {
                        if (resource_type(r) == IORESOURCE_MEM)
                                p = &iomem_resource;
                        else if (resource_type(r) == IORESOURCE_IO)
                                p = &ioport_resource;
                }

                if (p && insert_resource(p, r)) {
                        dev_err(&pdev->dev, "failed to claim resource %d: %pR\n", i, r);
                        ret = -EBUSY;
                        goto failed;
                }
        }







-- 
Linu cherian