linux-kernel - PCI VPD checksum ambiguity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250401205544.GA1620308@bhelgaas>
Date: Tue, 1 Apr 2025 15:55:44 -0500
From: Bjorn Helgaas <helgaas@...nel.org>
To: Pavan Chebbi <pavan.chebbi@...adcom.com>,
	Michael Chan <mchan@...adcom.com>,
	Potnuri Bharat Teja <bharat@...lsio.com>,
	Heiner Kallweit <hkallweit1@...il.com>
Cc: netdev@...r.kernel.org, linux-pci@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: PCI VPD checksum ambiguity

Hi,

The PCIe spec is ambiguous about how the VPD checksum should be
computed, and resolving this ambiguity might break drivers.

PCIe r6.0 sec 6.27 says only the VPD-R list should be included in the
checksum:

  One VPD-R (10h) tag is used as a header for the read-only keywords.
  The VPD-R list (including tag and length) must checksum to zero.

But sec 6.27.2.2 says "all bytes in VPD ... up to the checksum byte":

  RV   The first byte of this item is a checksum byte. The checksum is
       correct if the sum of all bytes in VPD (from VPD address 0 up
       to and including this byte) is zero.

These are obviously different unless VPD-R happens to be the first
item in VPD.  But sec 6.27 and 6.27.2.1 suggest that the Identifier
String item should be the first item, preceding the VPD-R list:

  The first VPD tag is the Identifier String (02h) and provides the
  product name of the device. [6.27]

  Large resource type Identifier String (02h)

    This tag is the first item in the VPD storage component. It
    contains the name of the add-in card in alphanumeric characters.
    [6.27.2.1, Table 6-23]

I think pci_vpd_check_csum() follows sec 6.27.2.2: it sums all the
bytes in the buffer up to and including the checksum byte of the RV
keyword.  The range starts at 0, not at the beginning of the VPD-R
read-only list, so it likely includes the Identifier String.

As far as I can tell, only the broadcom/tg3 and chelsio/cxgb4/t4
drivers use pci_vpd_check_csum().  Of course, other drivers might
compute the checksum themselves.

Any thoughts on how this spec ambiguity should be resolved?

Any idea how devices in the field populate their VPD?

Can you share any VPD dumps from devices that include an RV keyword
item?

Bjorn