From nobody Tue Sep 29 07:39:18 2026 Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D5F0D2EBB8D for ; Tue, 11 Aug 2026 04:47:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786423662; cv=none; b=i6Lm20c6jH1nyEq+GxbMrxGdMauHSn6vH1ntyaOfH0sVTfi9dM8dHELim/ecBoCExiKNRTStw7S6BXPgrOcjQ/+d4v0JQUL7l92dW4393AMswiTNUcJ+nxEhK9VTQz3KibUApGDTis5Ru/nEt2oAvVPscAxl0SylC9uMcY5CclY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786423662; c=relaxed/simple; bh=5Z0oAUxEu5WEOb0dsLBPx4r248ISJ+rPQrMc9DRkcgY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Z4UmIWKlLl4SIt1f2Od7j630oIsvBhEPnYbIxt1vuoMwVfnptqfV1kR1xidB/fI7OU3AqMH0s8zRHDBjdCe1LJDVmowm6+saT1K2+pjTuDxd7/VClS1a+w2ZmfAtns+NKtoeYWhbQ6D7LZS1CIw/pVfdwPRSHOXpcU3Jr8n8Bvo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=YfSL6dwx; arc=none smtp.client-ip=209.85.216.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="YfSL6dwx" Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-38e08baf860so2616472a91.2 for ; Mon, 10 Aug 2026 21:47:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786423660; x=1787028460; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=TG1xomO85u+aFoUYBWNHKdAe0OaR11ngRHj1PJcG3LI=; b=YfSL6dwxpGKDiEMvX1tzu0R4CdKTq4lSx4Lfr5g7yo/VjfM7b+h04uswHYGb81Nx0u rZyTnDY0VQRc9LAyrUctruqc0gYclLwBaKfdmX5rq0X5p2txyKGK5eNEBFyAd2kfacns OzFub3nG1CSXEenBda7XpWinBTa2bQ48EzpF05mIUxeDTpsOYjlKDpnnpfRo672PQvaQ ADWLpjpN17U5eRowY1OlBmCjWjuScRSlOB7rtKwW+2ltViAwL5yZzcIZkPOZh9jNJ0pA QS8OBfBTDagPwHu5Epo6c9vUdJ5Bp0FO53srsTjz3E0ASJp1gboK+AShcg0wnqSZfH2q Wn+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786423660; x=1787028460; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=TG1xomO85u+aFoUYBWNHKdAe0OaR11ngRHj1PJcG3LI=; b=rH+zx9KVzEOrs9vYn3ttDYIg2lqXi5CFXvaI5gVnJ+sxlMbUK8m3Afz9LhFzOnb34m UFCkf078ZRxmXNg3E1B37O5su7/J8cFrNgF7Jkd4vK7+5MdvHVI9VGk4axkG4ifmVdka 1aqy+II/ZR8wqRT0zVmxyzibOV2vfE1nGvpiBQvde4uXSvyZq06kZfKn0/EZMAQQug1d 9JA0vgWBAu9Vz+vep81xSsDKRoYTR1w04AQ4xmxf4YdywVQFtc0Ir08VWxTaDMsFa14k fkvoGLOKqV3vdcVxHDSMcMMaIS7V9LHZx3F4K3l5EtySjFOxW2NEHxjTeBoYCd3AEEFc 7sJA== X-Forwarded-Encrypted: i=1; AHgh+Rq+pUTJtvIoQ2BK9GOksC0uzOV8ekQYVvD6sxtKeu/ntc89xZX5Uw6vpIq5baWEA2TiVEk+tU2BY7tvxwY=@vger.kernel.org X-Gm-Message-State: AOJu0YxkKCA7HAhYMaUzX8grUKq22G0aALaRJDOXNm2E1ZF+1DShGoCe cuNjg7M8Rvi5P1SoXSEGL/FRCbMMQ2nPfXo3B0RYyGgA/E6HDSse+YLiQS1emg== X-Gm-Gg: AR+sD11u7XHQJ3gxkIYysMwXkvNgoX4/QRqd2YnSMAAxqWBiOrCWsLBBzTZynzM0GRt YwXKUFn6xwh9URXnHmlpmp8jgg0dU86zhqeLy7tQ/Fiw1Ns3mfXGzzaju2AYjaBvEFzX6sBC0Nw 2VrqLsw3ocY8kMLwkm+etPRFBYCAN6hRYoKD8tH8TcSLS9mIl2TUpByK8Zy8w7NlPH6NE+y7/PN SowbWHR0vWVJhOAlkhfuvJ/kn2y6rNJQLIhhxyapY8W3wTD9MedGxPZM9j2i4mJf98e70FADeeh BKQ2o+atHqPJyacic7tXUHGgrsiuoVYiWHnJZpwzWR+IV8ijs3OsYnNpWCLyuwyeI2IRqYKiOka dJFStc7xIS2KBJrP7cvCAJqoVqK/WtudDbuFg6OWxThdRGHJP9UomThpmJNWiprcqKbVbKOrDH3 mlaWaVxBV4ggG8QK2cFt6yDpj1WTQtDxJAdIFky4hJ5z5PjrA46S/TdjW0KvHefjEHt8M4Igh4/ kCCZpK6BzEdET73DN3KW8B2NS1lHTKZ7DcMa/LES7jFh3lQFGoTF23e7TQlvsFWnaygo71PZu3f aOl8BkRr9XRZCJBEKJFIs0IZrlW2Gzw9KPm5YA== X-Received: by 2002:a17:90b:2dca:b0:381:a766:efc9 with SMTP id 98e67ed59e1d1-392ec34642fmr719027a91.7.1786423660262; Mon, 10 Aug 2026 21:47:40 -0700 (PDT) Received: from ryzen.lan ([2601:644:8000:7a86::e35]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-392d537d905sm1864029a91.14.2026.08.10.21.47.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 10 Aug 2026 21:47:39 -0700 (PDT) From: Rosen Penev To: linux-crypto@vger.kernel.org Cc: Herbert Xu , "David S. Miller" , linux-kernel@vger.kernel.org (open list) Subject: [PATCHv2] crypto: amcc - fix missing DMA memory barriers in descriptor handling Date: Mon, 10 Aug 2026 21:47:38 -0700 Message-ID: <20260811044738.160653-1-rosenp@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Fix two memory ordering bugs in the AMCC crypto driver: 1. In crypto4xx_bh_tasklet_cb(), add a dma_rmb() between reading the PD_CTL_PE_DONE bit (with READ_ONCE) and reading the descriptor and DMA buffer data in crypto4xx_pd_done(). Without it, the CPU on a weakly-ordered architecture could read stale descriptor data before the hardware's writes are globally visible. 2. In crypto4xx_build_pd(), add a dma_wmb() before writing PD_CTL_HOST_READY to ensure all descriptor and SA data is visible to the device before the ownership handover bit. Also fix the descriptor field ordering: pd_ctl_len.w must be written before pd_ctl.w (which contains HOST_READY), not after, to prevent the hardware from fetching uninitialized length data. Fixes: f6c48b76daa6 (crypto: amcc - Add crypto4xx-aead cryptographic AEAD accelerator driver) Cc: stable@vger.kernel.org Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev --- v2: add descriptions for write barriers. drivers/crypto/amcc/crypto4xx_core.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/cry= pto4xx_core.c index fd010bfb7020..4b0ce165c198 100644 --- a/drivers/crypto/amcc/crypto4xx_core.c +++ b/drivers/crypto/amcc/crypto4xx_core.c @@ -876,11 +876,17 @@ int crypto4xx_build_pd(struct crypto_async_request *r= eq, } } =20 + pd->pd_ctl_len.w =3D 0x00400000 | (assoclen + datalen); + pd_uinfo->state =3D PD_ENTRY_INUSE | (is_busy ? PD_ENTRY_BUSY : 0); + + /* make the pd_ctl_len and pd_uinfo->state writes above visible to + * the device before the HOST_READY handover write below, so the + * device never fetches a descriptor with stale length/state bits + */ + dma_wmb(); pd->pd_ctl.w =3D PD_CTL_HOST_READY | ((crypto_tfm_alg_type(req->tfm) =3D=3D CRYPTO_ALG_TYPE_AEAD) ? PD_CTL_HASH_FINAL : 0); - pd->pd_ctl_len.w =3D 0x00400000 | (assoclen + datalen); - pd_uinfo->state =3D PD_ENTRY_INUSE | (is_busy ? PD_ENTRY_BUSY : 0); =20 wmb(); /* write any value to push engine to read a pd */ @@ -1031,6 +1037,11 @@ static void crypto4xx_bh_tasklet_cb(unsigned long da= ta) ((READ_ONCE(pd->pd_ctl.w) & (PD_CTL_PE_DONE | PD_CTL_HOST_READY)) =3D=3D PD_CTL_PE_DONE)) { + /* order the PE_DONE flag read above before reading + * the descriptor status and output data written by + * the device + */ + dma_rmb(); crypto4xx_pd_done(core_dev->dev, tail); tail =3D crypto4xx_put_pd_to_pdr(core_dev->dev, tail); } else { --=20 2.55.0