linux-kernel - RE: [PATCH v1 2/7] fpga: dfl: check feature type before parse irq info

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BN9PR11MB548399A1D6A4942D9C36B723E33A9@BN9PR11MB5483.namprd11.prod.outlook.com>
Date:   Mon, 21 Feb 2022 07:54:54 +0000
From:   "Zhang, Tianfei" <tianfei.zhang@...el.com>
To:     "Xu, Yilun" <yilun.xu@...el.com>, Tom Rix <trix@...hat.com>
CC:     "Wu, Hao" <hao.wu@...el.com>, "mdf@...nel.org" <mdf@...nel.org>,
        "linux-fpga@...r.kernel.org" <linux-fpga@...r.kernel.org>,
        "linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "corbet@....net" <corbet@....net>
Subject: RE: [PATCH v1 2/7] fpga: dfl: check feature type before parse irq
  info



> -----Original Message-----
> From: Xu, Yilun <yilun.xu@...el.com>
> Sent: Thursday, February 17, 2022 10:38 AM
> To: Tom Rix <trix@...hat.com>
> Cc: Zhang, Tianfei <tianfei.zhang@...el.com>; Wu, Hao <hao.wu@...el.com>;
> mdf@...nel.org; linux-fpga@...r.kernel.org; linux-doc@...r.kernel.org; linux-
> kernel@...r.kernel.org; corbet@....net
> Subject: Re: [PATCH v1 2/7] fpga: dfl: check feature type before parse irq info
> 
> On Tue, Feb 15, 2022 at 06:49:05AM -0800, Tom Rix wrote:
> >
> > On 2/14/22 3:26 AM, Tianfei zhang wrote:
> > > From: Tianfei Zhang <tianfei.zhang@...el.com>
> > >
> > > The feature ID of "Port User Interrupt" and the "PMCI Subsystem" are
> > > identical, 0x12, but one is for FME, other is for Port. It should
> > > check the feature type While parsing the irq info in
> > > parse_feature_irqs().
> >
> > This seems like a bug fix and not part of iofs feature.
> >
> > Split this out of the patchset.
> >
> > This is a workaround a hardware problem, there should be some comments
> > to the effect that you can't trust _this_ or _that_ feature id and
> > some special handling earlier.
> >
> > The ambiguity of feature id is a problem, and this sort of bug will
> > happen
> 
> Actually this is not the feature id definition problem. The identity of the feature
> is determined by the dfl_id_type(FME, PORT) AND feature_id. So the driver
> should match the dfl_id_type & feature_id to know what feature it is.

In this function flow, create_feature_instance() -> parse_feature_irqs(), the DFL driver has not
check the dfl_id_type yet.

> 
> Thanks,
> Yilun
> 
> > again.
> >
> > What can be done to prevent this in the future ?
> >
> > >
> > > Signed-off-by: Tianfei Zhang <tianfei.zhang@...el.com>
> > > ---
> > >   drivers/fpga/dfl.c | 11 +++++++++++
> > >   1 file changed, 11 insertions(+)
> > >
> > > diff --git a/drivers/fpga/dfl.c b/drivers/fpga/dfl.c index
> > > 599bb21d86af..26f8cf890700 100644
> > > --- a/drivers/fpga/dfl.c
> > > +++ b/drivers/fpga/dfl.c
> > > @@ -940,9 +940,14 @@ static int parse_feature_irqs(struct
> build_feature_devs_info *binfo,
> > >   {
> > >   	void __iomem *base = binfo->ioaddr + ofst;
> > >   	unsigned int i, ibase, inr = 0;
> > > +	enum dfl_id_type type;
> > >   	int virq;
> > >   	u64 v;
> > > +	type = feature_dev_id_type(binfo->feature_dev);
> > > +	if (type >= DFL_ID_MAX)
> > > +		return -EINVAL;
> > > +
> > >   	/*
> > >   	 * Ideally DFL framework should only read info from DFL header, but
> > >   	 * current version DFL only provides mmio resources information
> > > for @@ -959,16 +964,22 @@ static int parse_feature_irqs(struct
> build_feature_devs_info *binfo,
> > >   	 */
> > >   	switch (fid) {
> > >   	case PORT_FEATURE_ID_UINT:
> > > +		if (type != PORT_ID)
> > > +			break;
> >
> > Instead of embedding a break in the switch, break the switch into fme
> > switch and port switch
> >
> > if (type == PORT_ID)
> >
> >   port-switch
> >
> > else if (type == FME_ID
> >
> >   fme-switch
> >
> > Tom
> >
> > >   		v = readq(base + PORT_UINT_CAP);
> > >   		ibase = FIELD_GET(PORT_UINT_CAP_FST_VECT, v);
> > >   		inr = FIELD_GET(PORT_UINT_CAP_INT_NUM, v);
> > >   		break;
> > >   	case PORT_FEATURE_ID_ERROR:
> > > +		if (type != PORT_ID)
> > > +			break;
> > >   		v = readq(base + PORT_ERROR_CAP);
> > >   		ibase = FIELD_GET(PORT_ERROR_CAP_INT_VECT, v);
> > >   		inr = FIELD_GET(PORT_ERROR_CAP_SUPP_INT, v);
> > >   		break;
> > >   	case FME_FEATURE_ID_GLOBAL_ERR:
> > > +		if (type != FME_ID)
> > > +			break;
> > >   		v = readq(base + FME_ERROR_CAP);
> > >   		ibase = FIELD_GET(FME_ERROR_CAP_INT_VECT, v);
> > >   		inr = FIELD_GET(FME_ERROR_CAP_SUPP_INT, v);