linux-kernel - RE: [PATCH 1/2] HID: intel-ish-hid: fix cache management mistake

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <DM4PR11MB5995875EEC9ACCFC43D8B86A93F22@DM4PR11MB5995.namprd11.prod.outlook.com>
Date: Wed, 29 May 2024 06:46:49 +0000
From: "Zhang, Lixu" <lixu.zhang@...el.com>
To: Arnd Bergmann <arnd@...nel.org>, Srinivas Pandruvada
	<srinivas.pandruvada@...ux.intel.com>, Jiri Kosina <jikos@...nel.org>,
	Benjamin Tissoires <bentiss@...nel.org>
CC: Arnd Bergmann <arnd@...db.de>, "linux-input@...r.kernel.org"
	<linux-input@...r.kernel.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>
Subject: RE: [PATCH 1/2] HID: intel-ish-hid: fix cache management mistake


>-----Original Message-----
>From: Arnd Bergmann <arnd@...nel.org>
>Sent: Tuesday, May 28, 2024 7:58 PM
>To: Srinivas Pandruvada <srinivas.pandruvada@...ux.intel.com>; Jiri Kosina
><jikos@...nel.org>; Benjamin Tissoires <bentiss@...nel.org>; Zhang, Lixu
><lixu.zhang@...el.com>
>Cc: Arnd Bergmann <arnd@...db.de>; linux-input@...r.kernel.org; linux-
>kernel@...r.kernel.org
>Subject: [PATCH 1/2] HID: intel-ish-hid: fix cache management mistake
>
>From: Arnd Bergmann <arnd@...db.de>
>
>The low-level cache operation on a coherent buffer is incorrect, as coherent
>DMA memory may not actually be cached. Instead, use a DMA barrier that
>ensures that the data is visible to the DMA master before the address is and
>move the memcpy() before the reference.
>
>Fixes: 579a267e4617 ("HID: intel-ish-hid: Implement loading firmware from
>host feature")
>Signed-off-by: Arnd Bergmann <arnd@...db.de>
>---
>I noticed this one while looking at the bug that was fixed in
>236049723826 ("HID: intel-ish-hid: Fix build error for COMPILE_TEST")
>---
> drivers/hid/intel-ish-hid/ishtp/loader.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/drivers/hid/intel-ish-hid/ishtp/loader.c b/drivers/hid/intel-ish-
>hid/ishtp/loader.c
>index 2785b04a2f5a..062d1b25eaa7 100644
>--- a/drivers/hid/intel-ish-hid/ishtp/loader.c
>+++ b/drivers/hid/intel-ish-hid/ishtp/loader.c
>@@ -33,7 +33,6 @@
>
> #define dev_fmt(fmt) "ISH loader: " fmt
>
>-#include <linux/cacheflush.h>
> #include <linux/container_of.h>
> #include <linux/dev_printk.h>
> #include <linux/dma-mapping.h>
>@@ -175,10 +174,11 @@ static int prepare_dma_bufs(struct ishtp_device
>*dev,
> 			return -ENOMEM;
>
> 		fragment->fragment_tbl[i].ddr_adrs =
>cpu_to_le64(dma_addr);
>+
>+		memcpy(dma_bufs[i], ish_fw->data + offset, fragment-
>>fragment_tbl[i].length);
fragment->fragment_tbl[i].length was used before assignment.
 
>+		dma_wmb();
I tested it on the platform, but it didn't wok.

Thanks,
Lixu

> 		fragment->fragment_tbl[i].length = clamp(ish_fw->size -
>offset, 0, fragment_size);
> 		fragment->fragment_tbl[i].fw_off = offset;
>-		memcpy(dma_bufs[i], ish_fw->data + offset, fragment-
>>fragment_tbl[i].length);
>-		clflush_cache_range(dma_bufs[i], fragment_size);
>
> 		offset += fragment->fragment_tbl[i].length;
> 	}
>--
>2.39.2