Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1648292 > unrolled thread
| Started by | Bjorn Helgaas <helgaas@kernel.org> |
|---|---|
| First post | 2017-05-23 19:30 +0200 |
| Last post | 2017-05-23 21:40 +0200 |
| Articles | 4 — 2 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Re: [PATCH v4 2/2] PCI: Add tango PCIe host bridge support Bjorn Helgaas <helgaas@kernel.org> - 2017-05-23 19:30 +0200
Re: [PATCH v4 2/2] PCI: Add tango PCIe host bridge support Mason <slash.tmp@free.fr> - 2017-05-23 19:50 +0200
Re: [PATCH v4 2/2] PCI: Add tango PCIe host bridge support Bjorn Helgaas <helgaas@kernel.org> - 2017-05-23 20:40 +0200
Re: [PATCH v4 2/2] PCI: Add tango PCIe host bridge support Mason <slash.tmp@free.fr> - 2017-05-23 21:40 +0200
| From | Bjorn Helgaas <helgaas@kernel.org> |
|---|---|
| Date | 2017-05-23 19:30 +0200 |
| Subject | Re: [PATCH v4 2/2] PCI: Add tango PCIe host bridge support |
| Message-ID | <tKlN8-6g6-7@gated-at.bofh.it> |
On Thu, Apr 20, 2017 at 04:31:25PM +0200, Marc Gonzalez wrote:
> This driver is required to work around several hardware bugs in the
> PCIe controller.
>
> NB: Revision 1 does not support legacy interrupts, or IO space.
>
> Signed-off-by: Marc Gonzalez <marc_gonzalez@sigmadesigns.com>
> ---
> Documentation/devicetree/bindings/pci/tango-pcie.txt | 32 ++++++++
> drivers/pci/host/Kconfig | 8 ++
> drivers/pci/host/Makefile | 1 +
> drivers/pci/host/pcie-tango.c | 161 +++++++++++++++++++++++++++++++++++++++
> include/linux/pci_ids.h | 2 +
> 5 files changed, 204 insertions(+)
> ...
> +static int smp8759_config_read(struct pci_bus *bus,
> + unsigned int devfn, int where, int size, u32 *val)
> +{
> + int ret;
> + struct pci_config_window *cfg = bus->sysdata;
> + struct tango_pcie *pcie = dev_get_drvdata(cfg->parent);
> +
> + /*
> + * QUIRK #1
> + * Reads in configuration space outside devfn 0 return garbage.
> + */
> + if (devfn != 0)
> + return PCIBIOS_FUNC_NOT_SUPPORTED;
> +
> + /*
> + * QUIRK #2
> + * Unfortunately, config and mem spaces are muxed.
> + * Linux does not support such a setting, since drivers are free
> + * to access mem space directly, at any time.
> + * Therefore, we can only PRAY that config and mem space accesses
> + * NEVER occur concurrently.
> + */
> + writel_relaxed(1, pcie->mux);
> + ret = pci_generic_config_read(bus, devfn, where, size, val);
> + writel_relaxed(0, pcie->mux);
This is a major issue and possibly even a security problem.
Unprivileged users can cause config accesses via lspci/setpci.
I don't have a good suggestion for addressing it, but if you can't
make this work reliably, you need at least a dev_err() in the probe
function and probably a taint of the kernel (see add_taint()).
> + return ret;
> +}
> +
> +static int smp8759_config_write(struct pci_bus *bus,
> + unsigned int devfn, int where, int size, u32 val)
> +{
> + int ret;
> + struct pci_config_window *cfg = bus->sysdata;
> + struct tango_pcie *pcie = dev_get_drvdata(cfg->parent);
> +
> + writel_relaxed(1, pcie->mux);
> + ret = pci_generic_config_write(bus, devfn, where, size, val);
> + writel_relaxed(0, pcie->mux);
> +
> + return ret;
> +}
> +
> +static struct pci_ecam_ops smp8759_ecam_ops = {
> + .bus_shift = 20,
> + .pci_ops = {
> + .map_bus = pci_ecam_map_bus,
> + .read = smp8759_config_read,
> + .write = smp8759_config_write,
> + }
> +};
[toc] | [next] | [standalone]
| From | Mason <slash.tmp@free.fr> |
|---|---|
| Date | 2017-05-23 19:50 +0200 |
| Message-ID | <tKm6t-6oT-1@gated-at.bofh.it> |
| In reply to | #1648292 |
On 23/05/2017 19:24, Bjorn Helgaas wrote:
> On Thu, Apr 20, 2017 at 04:31:25PM +0200, Marc Gonzalez wrote:
>> This driver is required to work around several hardware bugs in the
>> PCIe controller.
>>
>> NB: Revision 1 does not support legacy interrupts, or IO space.
>>
>> Signed-off-by: Marc Gonzalez <marc_gonzalez@sigmadesigns.com>
>> ---
>> Documentation/devicetree/bindings/pci/tango-pcie.txt | 32 ++++++++
>> drivers/pci/host/Kconfig | 8 ++
>> drivers/pci/host/Makefile | 1 +
>> drivers/pci/host/pcie-tango.c | 161 +++++++++++++++++++++++++++++++++++++++
>> include/linux/pci_ids.h | 2 +
>> 5 files changed, 204 insertions(+)
>> ...
>
>> +static int smp8759_config_read(struct pci_bus *bus,
>> + unsigned int devfn, int where, int size, u32 *val)
>> +{
>> + int ret;
>> + struct pci_config_window *cfg = bus->sysdata;
>> + struct tango_pcie *pcie = dev_get_drvdata(cfg->parent);
>> +
>> + /*
>> + * QUIRK #1
>> + * Reads in configuration space outside devfn 0 return garbage.
>> + */
>> + if (devfn != 0)
>> + return PCIBIOS_FUNC_NOT_SUPPORTED;
>> +
>> + /*
>> + * QUIRK #2
>> + * Unfortunately, config and mem spaces are muxed.
>> + * Linux does not support such a setting, since drivers are free
>> + * to access mem space directly, at any time.
>> + * Therefore, we can only PRAY that config and mem space accesses
>> + * NEVER occur concurrently.
>> + */
>> + writel_relaxed(1, pcie->mux);
>> + ret = pci_generic_config_read(bus, devfn, where, size, val);
>> + writel_relaxed(0, pcie->mux);
>
> This is a major issue and possibly even a security problem.
> Unprivileged users can cause config accesses via lspci/setpci.
Since the host bridge doesn't support hotplug in any way,
how about setting a flag once enumeration is complete,
to prevent all future config accesses?
> I don't have a good suggestion for addressing it, but if you can't
> make this work reliably, you need at least a dev_err() in the probe
> function and probably a taint of the kernel (see add_taint()).
There is a chance that the issue will get fixed in rev2
of the bridge. But obviously, that won't help for rev1
already in the wild.
Regards.
[toc] | [prev] | [next] | [standalone]
| From | Bjorn Helgaas <helgaas@kernel.org> |
|---|---|
| Date | 2017-05-23 20:40 +0200 |
| Message-ID | <tKmSS-6YY-19@gated-at.bofh.it> |
| In reply to | #1648304 |
On Tue, May 23, 2017 at 07:43:16PM +0200, Mason wrote:
> On 23/05/2017 19:24, Bjorn Helgaas wrote:
> > On Thu, Apr 20, 2017 at 04:31:25PM +0200, Marc Gonzalez wrote:
> >> This driver is required to work around several hardware bugs in the
> >> PCIe controller.
> >>
> >> NB: Revision 1 does not support legacy interrupts, or IO space.
> >>
> >> Signed-off-by: Marc Gonzalez <marc_gonzalez@sigmadesigns.com>
> >> ---
> >> Documentation/devicetree/bindings/pci/tango-pcie.txt | 32 ++++++++
> >> drivers/pci/host/Kconfig | 8 ++
> >> drivers/pci/host/Makefile | 1 +
> >> drivers/pci/host/pcie-tango.c | 161 +++++++++++++++++++++++++++++++++++++++
> >> include/linux/pci_ids.h | 2 +
> >> 5 files changed, 204 insertions(+)
> >> ...
> >
> >> +static int smp8759_config_read(struct pci_bus *bus,
> >> + unsigned int devfn, int where, int size, u32 *val)
> >> +{
> >> + int ret;
> >> + struct pci_config_window *cfg = bus->sysdata;
> >> + struct tango_pcie *pcie = dev_get_drvdata(cfg->parent);
> >> +
> >> + /*
> >> + * QUIRK #1
> >> + * Reads in configuration space outside devfn 0 return garbage.
> >> + */
> >> + if (devfn != 0)
> >> + return PCIBIOS_FUNC_NOT_SUPPORTED;
> >> +
> >> + /*
> >> + * QUIRK #2
> >> + * Unfortunately, config and mem spaces are muxed.
> >> + * Linux does not support such a setting, since drivers are free
> >> + * to access mem space directly, at any time.
> >> + * Therefore, we can only PRAY that config and mem space accesses
> >> + * NEVER occur concurrently.
> >> + */
> >> + writel_relaxed(1, pcie->mux);
> >> + ret = pci_generic_config_read(bus, devfn, where, size, val);
> >> + writel_relaxed(0, pcie->mux);
> >
> > This is a major issue and possibly even a security problem.
> > Unprivileged users can cause config accesses via lspci/setpci.
>
> Since the host bridge doesn't support hotplug in any way,
> how about setting a flag once enumeration is complete,
> to prevent all future config accesses?
I thought about that, too, but I'm not sure it will work becuase I
think drivers will need to do at least a few config accesses, e.g.,
pci_enable_device() may write PCI_COMMAND to set PCI_COMMAND_MEMORY,
it may read PCI_INTERRUPT_PIN, etc. And MSI setup requires config
access, too.
> > I don't have a good suggestion for addressing it, but if you can't
> > make this work reliably, you need at least a dev_err() in the probe
> > function and probably a taint of the kernel (see add_taint()).
>
> There is a chance that the issue will get fixed in rev2
> of the bridge. But obviously, that won't help for rev1
> already in the wild.
Hopefully there will be a way to distinguish rev2 from rev1.
Bjorn
[toc] | [prev] | [next] | [standalone]
| From | Mason <slash.tmp@free.fr> |
|---|---|
| Date | 2017-05-23 21:40 +0200 |
| Message-ID | <tKnOW-7FB-11@gated-at.bofh.it> |
| In reply to | #1648334 |
On 23/05/2017 20:35, Bjorn Helgaas wrote:
> On Tue, May 23, 2017 at 07:43:16PM +0200, Mason wrote:
>> On 23/05/2017 19:24, Bjorn Helgaas wrote:
>>> On Thu, Apr 20, 2017 at 04:31:25PM +0200, Marc Gonzalez wrote:
>>>> This driver is required to work around several hardware bugs in the
>>>> PCIe controller.
>>>>
>>>> NB: Revision 1 does not support legacy interrupts, or IO space.
>>>>
>>>> Signed-off-by: Marc Gonzalez <marc_gonzalez@sigmadesigns.com>
>>>> ---
>>>> Documentation/devicetree/bindings/pci/tango-pcie.txt | 32 ++++++++
>>>> drivers/pci/host/Kconfig | 8 ++
>>>> drivers/pci/host/Makefile | 1 +
>>>> drivers/pci/host/pcie-tango.c | 161 +++++++++++++++++++++++++++++++++++++++
>>>> include/linux/pci_ids.h | 2 +
>>>> 5 files changed, 204 insertions(+)
>>>> ...
>>>
>>>> +static int smp8759_config_read(struct pci_bus *bus,
>>>> + unsigned int devfn, int where, int size, u32 *val)
>>>> +{
>>>> + int ret;
>>>> + struct pci_config_window *cfg = bus->sysdata;
>>>> + struct tango_pcie *pcie = dev_get_drvdata(cfg->parent);
>>>> +
>>>> + /*
>>>> + * QUIRK #1
>>>> + * Reads in configuration space outside devfn 0 return garbage.
>>>> + */
>>>> + if (devfn != 0)
>>>> + return PCIBIOS_FUNC_NOT_SUPPORTED;
>>>> +
>>>> + /*
>>>> + * QUIRK #2
>>>> + * Unfortunately, config and mem spaces are muxed.
>>>> + * Linux does not support such a setting, since drivers are free
>>>> + * to access mem space directly, at any time.
>>>> + * Therefore, we can only PRAY that config and mem space accesses
>>>> + * NEVER occur concurrently.
>>>> + */
>>>> + writel_relaxed(1, pcie->mux);
>>>> + ret = pci_generic_config_read(bus, devfn, where, size, val);
>>>> + writel_relaxed(0, pcie->mux);
>>>
>>> This is a major issue and possibly even a security problem.
>>> Unprivileged users can cause config accesses via lspci/setpci.
>>
>> Since the host bridge doesn't support hotplug in any way,
>> how about setting a flag once enumeration is complete,
>> to prevent all future config accesses?
>
> I thought about that, too, but I'm not sure it will work becuase I
> think drivers will need to do at least a few config accesses, e.g.,
> pci_enable_device() may write PCI_COMMAND to set PCI_COMMAND_MEMORY,
> it may read PCI_INTERRUPT_PIN, etc. And MSI setup requires config
> access, too.
>
>>> I don't have a good suggestion for addressing it, but if you can't
>>> make this work reliably, you need at least a dev_err() in the probe
>>> function and probably a taint of the kernel (see add_taint()).
>>
>> There is a chance that the issue will get fixed in rev2
>> of the bridge. But obviously, that won't help for rev1
>> already in the wild.
>
> Hopefully there will be a way to distinguish rev2 from rev1.
rev2 is embedded in a new SoC, so the DT node will specify a
different compatible string. A "preview" of the intent was
given in an older patch:
"[RFC PATCH v0.2] PCI: Add support for tango PCIe host bridge"
Regards.
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web