linux-kernel - Re: [PATCH 2/3] soc: qcom: smem: Support dynamic item limit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 21 Aug 2017 14:27:29 +0530
From:   Arun Kumar Neelakantam <aneela@...eaurora.org>
To:     Chris Lew <clew@...eaurora.org>, bjorn.andersson@...aro.org,
        andy.gross@...aro.org, david.brown@...aro.org
Cc:     linux-arm-msm@...r.kernel.org, linux-soc@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/3] soc: qcom: smem: Support dynamic item limit



On 8/18/2017 6:45 AM, Chris Lew wrote:
> In V12 SMEM, SBL writes SMEM parameter information
> after the TOC. Use the SBL provided item count
> as the max item number.
>
> Signed-off-by: Chris Lew <clew@...eaurora.org>
> ---
>   drivers/soc/qcom/smem.c | 41 +++++++++++++++++++++++++++++++++++++++--
>   1 file changed, 39 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
> index fed2934d6bda..a51f4ba42173 100644
> --- a/drivers/soc/qcom/smem.c
> +++ b/drivers/soc/qcom/smem.c
> @@ -225,6 +225,24 @@ struct smem_private_entry {
>   #define SMEM_PRIVATE_CANARY	0xa5a5
>   
>   /**
> + * struct smem_info - smem region info located after the table of contents
> + * @magic:	magic number, must be SMEM_INFO_MAGIC
> + * @size:	size of the smem region
> + * @base_addr:	base address of the smem region
> + * @reserved: for now reserved entry
> + * @num_items: highest accepted item number
> + */
> +struct smem_info {
> +	u8 magic[4];
> +	__le32 size;
> +	__le32 base_addr;
> +	__le32 reserved;
> +	__le32 num_items;
The num_items is first 16bits of reserved field, we dont have 32bit 
reserved and 32 bit for num_items
> +};
> +
> +static const u8 SMEM_INFO_MAGIC[] = { 0x53, 0x49, 0x49, 0x49 }; /* SIII */
> +
> +/**
>    * struct smem_region - representation of a chunk of memory used for smem
>    * @aux_base:	identifier of aux_mem base
>    * @virt_base:	virtual base address of memory with this aux_mem identifier
> @@ -245,6 +263,7 @@ struct smem_region {
>    * @partitions:	list of pointers to partitions affecting the current
>    *		processor/host
>    * @cacheline:	list of cacheline sizes for each host
> + * @item_count: max accepted item number
>    * @num_regions: number of @regions
>    * @regions:	list of the memory regions defining the shared memory
>    */
> @@ -257,6 +276,7 @@ struct qcom_smem {
>   	size_t global_cacheline;
>   	struct smem_partition_header *partitions[SMEM_HOST_COUNT];
>   	size_t cacheline[SMEM_HOST_COUNT];
> +	u32 item_count;
>   
>   	unsigned num_regions;
>   	struct smem_region regions[0];
> @@ -388,7 +408,7 @@ static int qcom_smem_alloc_global(struct qcom_smem *smem,
>   	struct smem_header *header;
>   	struct smem_global_entry *entry;
>   
> -	if (WARN_ON(item >= SMEM_ITEM_COUNT))
> +	if (WARN_ON(item >= smem->item_count))
can you please add this item_count check from partition alloc/get also 
if avoid any unknown clients usage of smem
>   		return -EINVAL;
>   
>   	header = smem->regions[0].virt_base;
> @@ -473,7 +493,7 @@ static void *qcom_smem_get_global(struct qcom_smem *smem,
>   	u32 aux_base;
>   	unsigned i;
>   
> -	if (WARN_ON(item >= SMEM_ITEM_COUNT))
> +	if (WARN_ON(item >= smem->item_count))
>   		return ERR_PTR(-EINVAL);
>   
>   	header = smem->regions[0].virt_base;
> @@ -640,6 +660,19 @@ static int qcom_smem_get_sbl_version(struct qcom_smem *smem)
>   	return le32_to_cpu(versions[SMEM_MASTER_SBL_VERSION_INDEX]);
>   }
>   
> +static u32 qcom_smem_get_dynamic_item(struct qcom_smem *smem)
> +{
> +	struct smem_ptable *ptable;
> +	struct smem_info *info;
> +
> +	ptable = smem->regions[0].virt_base + smem->regions[0].size - SZ_4K;
> +	info = (struct smem_info *)&ptable->entry[ptable->num_entries];
> +	if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
> +		return SMEM_ITEM_COUNT;
> +
> +	return le32_to_cpu(info->num_items);
> +}
> +
>   static int qcom_smem_set_global_partition(struct qcom_smem *smem,
>   				struct smem_ptable_entry *entry)
>   {
> @@ -857,7 +890,11 @@ static int qcom_smem_probe(struct platform_device *pdev)
>   	version = qcom_smem_get_sbl_version(smem);
>   	switch (version >> 16) {
>   	case SMEM_GLOBAL_PART_VERSION:
> +		smem->item_count = qcom_smem_get_dynamic_item(smem);
> +		break;
>   	case SMEM_GLOBAL_HEAP_VERSION:
> +		smem->item_count = SMEM_ITEM_COUNT;
> +		break;
>   	default:
>   		dev_err(&pdev->dev, "Unsupported SMEM version 0x%x\n", version);
>   		return -EINVAL;