linux-kernel - Re: [PATCH] i3c: fix big-endian FIFO transfers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ikwkapgsfntog67hwi2aapdadlq2wy7oydjz6i75gbhgxxd6fc@3e3lxh7xkgy6>
Date: Wed, 24 Sep 2025 19:01:13 +0200
From: Jorge Marques <gastmaier@...il.com>
To: Arnd Bergmann <arnd@...nel.org>
Cc: Alexandre Belloni <alexandre.belloni@...tlin.com>, 
	Wolfram Sang <wsa+renesas@...g-engineering.com>, Jorge Marques <jorge.marques@...log.com>, 
	Frank Li <Frank.Li@....com>, Arnd Bergmann <arnd@...db.de>, 
	Manikanta Guntupalli <manikanta.guntupalli@....com>, linux-i3c@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] i3c: fix big-endian FIFO transfers

On Wed, Sep 24, 2025 at 05:02:53PM +0200, Arnd Bergmann wrote:
> From: Arnd Bergmann <arnd@...db.de>
> 
> Short MMIO transfers that are not a multiple of four bytes in size need
> a special case for the final bytes, however the existing implementation
> is not endian-safe and introduces an incorrect byteswap on big-endian
> kernels.
> 
> This usually does not cause problems because most systems are
> little-endian and most transfers are multiple of four bytes long, but
> still needs to be fixed to avoid the extra byteswap.
> 
> Change the special case for both i3c_writel_fifo() and i3c_readl_fifo()
> to use non-byteswapping writesl() and readsl() with a single element
> instead of the byteswapping writel()/readl() that are meant for individual
> MMIO registers.
> 
> The earlier versions in the dw-i3c and i3c-master-cdns had a correct
> implementation, but the generic version that was recently added broke it.
> 
> Fixes: 733b439375b4 ("i3c: master: Add inline i3c_readl_fifo() and i3c_writel_fifo()")
> Cc: Manikanta Guntupalli <manikanta.guntupalli@....com>
> Signed-off-by: Arnd Bergmann <arnd@...db.de>
> ---
> This was a recent regression, the version in 6.16 still works,
> but 6.17-rc is broken.
> ---
>  drivers/i3c/internals.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/i3c/internals.h b/drivers/i3c/internals.h
> index 0d857cc68cc5..0f8a25cb71e7 100644
> --- a/drivers/i3c/internals.h
> +++ b/drivers/i3c/internals.h
> @@ -38,7 +38,7 @@ static inline void i3c_writel_fifo(void __iomem *addr, const void *buf,
>  		u32 tmp = 0;
>  
>  		memcpy(&tmp, buf + (nbytes & ~3), nbytes & 3);
> -		writel(tmp, addr);
> +		writesl(addr, &buf, 1);

Hi Arnd, thanks for catching this,

Indeed, writel and readl are byte-swapping and the patch introduced a
bug. At include/asm-generic/io.h:

  __raw_writel((u32 __force)__cpu_to_le32(value), addr);
  ...
  val = __le32_to_cpu((__le32 __force)__raw_readl(addr));

While the writesl/readsl use the __raw_* methods without the byte
swamping.

Can you fix, as Nuno pointed, to:

   		writesl(addr, &tmp, 1);

as in the original drivers, and adding this information to the cover for
further clarification.

Thanks,
Jorge

>  	}
>  }
>  
> @@ -55,7 +55,7 @@ static inline void i3c_readl_fifo(const void __iomem *addr, void *buf,
>  	if (nbytes & 3) {
>  		u32 tmp;
>  
> -		tmp = readl(addr);
> +		readsl(addr, &tmp, 1);
>  		memcpy(buf + (nbytes & ~3), &tmp, nbytes & 3);
>  	}
>  }
> -- 
> 2.39.5
>