linux-kernel - Re: [PATCH] edac, i5000, i5400: fix definition of nrecmemb register

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 28 Jun 2017 20:54:02 -0400
From:   Jérémy Lefaure <jeremy.lefaure@....epita.fr>
To:     Borislav Petkov <bp@...en8.de>
Cc:     Mauro Carvalho Chehab <mchehab@...nel.org>,
        linux-edac@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] edac, i5000, i5400: fix definition of nrecmemb register

On Wed, 28 Jun 2017 18:08:51 +0200
Borislav Petkov <bp@...en8.de> wrote:

> On Mon, Jun 12, 2017 at 01:47:58PM -0400, Jérémy Lefaure wrote:
> > In i5000 and i5400 edac drivers, the register nrecmemb is defined as a
> > 16 bits value which result in wrong shifts in the code:
> >   CHECK   drivers/edac/i5000_edac.c
> > drivers/edac/i5000_edac.c:485:15: warning: right shift by bigger than
> > source value
> > drivers/edac/i5000_edac.c:580:23: warning: right shift by bigger than
> > source value
> >   CC      drivers/edac/i5000_edac.o
> >   CHECK   drivers/edac/i5400_edac.c
> > drivers/edac/i5400_edac.c:391:36: warning: right shift by bigger than
> > source value
> > drivers/edac/i5400_edac.c:401:37: warning: right shift by bigger than
> > source value
> >   CC      drivers/edac/i5400_edac.o
> > 
> > In the datasheets ([1], section 3.9.22.20 and [2], section 3.9.22.21),
> > this register is a 32 bits register. A u32 value for the register fixes
> > the wrong shifts warnings and matches the datasheet.
> > 
> > This patch also fixes the mask to access to the CAS bits [16 to 28] in
> > the i5000 edac driver.
> > 
> > [1]: https://www.intel.com/content/dam/doc/datasheet/5000p-5000v-5000z-chipset-memory-controller-hub-datasheet.pdf  
> 
> Well, the CAS field length here is [27:16], see below.
> 
> > [2]: https://www.intel.se/content/dam/doc/datasheet/5400-chipset-memory-controller-hub-datasheet.pdf  
> 
> Here it is [28:16].
> 
> > Signed-off-by: Jérémy Lefaure <jeremy.lefaure@....epita.fr>
> > ---
> > 
> > I have found this error thanks to the sparse tool. Please note that this patch
> > hasn't been tested on real hardware.
> > 
> > 
> >  drivers/edac/i5000_edac.c | 6 +++---
> >  drivers/edac/i5400_edac.c | 4 ++--
> >  2 files changed, 5 insertions(+), 5 deletions(-)
> > 
> > diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c
> > index f683919981b0..c79016ade51e 100644
> > --- a/drivers/edac/i5000_edac.c
> > +++ b/drivers/edac/i5000_edac.c
> > @@ -227,7 +227,7 @@
> >  #define			NREC_RDWR(x)		(((x)>>11) & 1)
> >  #define			NREC_RANK(x)		(((x)>>8) & 0x7)
> >  #define		NRECMEMB		0xC0
> > -#define			NREC_CAS(x)		(((x)>>16) & 0xFFFFFF)
> > +#define			NREC_CAS(x)		(((x)>>16) & 0x1FFF)  
> 
> That is still incorrect. According to the 5000? datasheet above,
> NRECMEMB has the CAS field in bits [27:16]. That's 12 bits, so the mask
> should be 0xFFF. IOW,
> 
> #define			NREC_CAS(x)		(((x)>>16) & 0xFFF)
> 
> The 0x1FFF mask is correct for the 5400 driver because the CAS field
> there is [28:16].
> 
> The fact that no one caught this by now goes to show how many people are
> actually using this thing. :-\
> 

You're right. I think that I inverted the 2 datasheets when I reread my
patch before sending it. Sorry about that. I will send a v2.

Jérémy