linux-kernel - [PATCH] dell_rbu: make firmware payload memory uncachable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 21 Mar 2018 20:05:52 -0500
From:   Stuart Hayes <stuart.w.hayes@...il.com>
To:     linux-kernel@...r.kernel.org
Subject: [PATCH] dell_rbu: make firmware payload memory uncachable

The dell_rbu driver takes firmware update payloads and puts them in memory so
the system BIOS can find them after a reboot.  This sometimes fails (though
rarely), because the memory containing the payload is in the CPU cache but
never gets written back to main memory before the system is rebooted (CPU
cache contents are lost on reboot).

With this patch, the payload memory will be changed to uncachable to ensure
that the payload is actually in main memory before the system is rebooted.

Signed-off-by: Stuart Hayes <stuart.w.hayes@...il.com>
---
Note that there is no maintainer for this driver, so I'd be grateful if
someone could apply this... thank you!

diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c
index 2f452f1..6b84814 100644
--- a/drivers/firmware/dell_rbu.c
+++ b/drivers/firmware/dell_rbu.c
@@ -180,6 +180,11 @@ static int create_packet(void *data, size_t length)
 			invalid_addr_packet_array[idx++] = packet_data_temp_buf;
 			packet_data_temp_buf = NULL;
 		}
+		/*
+		 * set to uncachable or it may never get written back before
+		 * reboot
+		 */
+		set_memory_uc(packet_data_temp_buf, 1 << (ordernum));
 	}
 	spin_lock(&rbu_data.lock);
 
@@ -349,6 +354,7 @@ static void packet_empty_list(void)
 		 * to make sure there are no stale RBU packets left in memory
 		 */
 		memset(newpacket->data, 0, rbu_data.packetsize);
+		set_memory_wb(newpacket->data, (1 << newpacket->ordernum));
 		free_pages((unsigned long) newpacket->data,
 			newpacket->ordernum);
 		kfree(newpacket);