linux-kernel - Re: [PATCH] esp_scsi: Clear Transfer Count registers before PIO transfers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 18 Nov 2019 10:26:47 +1100 (AEDT)
From:   Finn Thain <fthain@...egraphics.com.au>
To:     Kars de Jong <jongk@...ux-m68k.org>
cc:     "James E.J. Bottomley" <jejb@...ux.ibm.com>,
        "Martin K. Petersen" <martin.petersen@...cle.com>,
        Michael Schmitz <schmitzmic@...il.com>,
        linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] esp_scsi: Clear Transfer Count registers before PIO
 transfers

On Mon, 18 Nov 2019, Finn Thain wrote:

> On Sun, 17 Nov 2019, Kars de Jong wrote:
> 
> > The only [time when] the driver reads these registers is after a data 
> > transfer. These are done using DMA on all Zorro boards, so I don't 
> > think there's a risk of stale values from a PIO transfer there.
> > 
> 
> I'm not entirely sure that the chip is unaffected by stale counter 
> values.
> 
> (Stale transfer counter values are distinct from stale transfer count 
> register values. Both are addressed by the patch.)
> 

Sorry -- I should have said, "both were _intended_ to be addressed by the 
patch". But, as Michael pointed out, the DMA NOP command was missing from 
the v1 patch. Please see revised patch below.


diff --git a/drivers/scsi/esp_scsi.c b/drivers/scsi/esp_scsi.c
index bb88995a12c7..82d49f0f09df 100644
--- a/drivers/scsi/esp_scsi.c
+++ b/drivers/scsi/esp_scsi.c
@@ -2835,6 +2835,10 @@ void esp_send_pio_cmd(struct esp *esp, u32 addr, u32 esp_count,
 	cmd &= ~ESP_CMD_DMA;
 	esp->send_cmd_error = 0;
 
+	esp_write8(0, ESP_TCLOW);
+	esp_write8(0, ESP_TCMED);
+	scsi_esp_cmd(esp, ESP_CMD_NULL | ESP_CMD_DMA);
+
 	if (write) {
 		u8 *dst = (u8 *)addr;
 		u8 mask = ~(phase == ESP_MIP ? ESP_INTR_FDONE : ESP_INTR_BSERV);
diff --git a/drivers/scsi/mac_esp.c b/drivers/scsi/mac_esp.c
index 1c78bc10c790..797579247e47 100644
--- a/drivers/scsi/mac_esp.c
+++ b/drivers/scsi/mac_esp.c
@@ -361,8 +361,6 @@ static int esp_mac_probe(struct platform_device *dev)
 	esp->flags = ESP_FLAG_NO_DMA_MAP;
 	if (mep->pdma_io == NULL) {
 		printk(KERN_INFO PFX "using PIO for controller %d\n", dev->id);
-		esp_write8(0, ESP_TCLOW);
-		esp_write8(0, ESP_TCMED);
 		esp->flags |= ESP_FLAG_DISABLE_SYNC;
 		mac_esp_ops.send_dma_cmd = esp_send_pio_cmd;
 	} else {