linux-kernel - Re: [PATCH v3 2/2] PCI: imx6: limit DBI register length

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 20 Nov 2018 18:19:08 +0000
From:   Leonard Crestez <leonard.crestez@....com>
To:     "stefan@...er.ch" <stefan@...er.ch>,
        "l.stach@...gutronix.de" <l.stach@...gutronix.de>,
        "lorenzo.pieralisi@....com" <lorenzo.pieralisi@....com>
CC:     Richard Zhu <hongxing.zhu@....com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "jingoohan1@...il.com" <jingoohan1@...il.com>,
        "gustavo.pimentel@...opsys.com" <gustavo.pimentel@...opsys.com>,
        "andrew.smirnov@...il.com" <andrew.smirnov@...il.com>,
        "tpiepho@...inj.com" <tpiepho@...inj.com>,
        "linux-pci@...r.kernel.org" <linux-pci@...r.kernel.org>,
        "bhelgaas@...gle.com" <bhelgaas@...gle.com>
Subject: Re: [PATCH v3 2/2] PCI: imx6: limit DBI register length

On Tue, 2018-11-20 at 17:56 +0100, Stefan Agner wrote:
> Define the length of the DBI registers. This makes sure that
> the kernel does not access registers beyond that point, avoiding
> the following abort on a i.MX 6Quad:
>   # cat
> /sys/devices/soc0/soc/1ffc000.pcie/pci0000\:00/0000\:00\:00.0/config
>   [  100.021433] Unhandled fault: imprecise external abort (0x1406)
> at 0xb6ea7000
>   ...
>   [  100.056423] PC is at dw_pcie_read+0x50/0x84
>   [  100.060790] LR is at dw_pcie_rd_own_conf+0x44/0x48

I don't know exactly where this limitation comes from, I can indeed
reproduce a stack dump when dumping pci config from /sys/

Unfortunately this seems to block access to registers used for
functionality like interrupts. For example dw_handle_msi_irq does:

	dw_pcie_rd_own_conf(pp, PCIE_MSI_INTR0_STATUS +
			    (i * MSI_REG_CTRL_BLOCK_SIZE),
			    4, &val);

where PCI_MSI_INTR0_STATUS is 0x830. There are more accesses like this.

Testing on 6dl-sabreauto (dts change required) with an ath9k pcie card
with your series I sometimes get "irq 295: nobody cared" on boot. Maybe
I'm missing something?

--
Regards,
Leonard