Re: [PATCH 11/24] serial: 8250: cap OxSemi Tornado UART count against BAR size

[Maciej W. Rozycki]

On Tue, 27 Oct 2026, Andy Shevchenko wrote:

> >  Hmm, what is "a malicious device" supposed to be, a broken chip?
> 
> Carefully reconstructed malicious device in FPGA that gets connected via
> Thunderbolt. This is real vector of attacks (assuming the Thunderbolt side is
> misconfigured to automatically authorise anything connected to it).

 Hmm, yeah, or ExpressCard.  I've thought someone could program an FPGA 
this way, but what would be the purpose?  They'd still have to persuade 
someone to plug such a EC/TB device in to their system and if you have 
physical access, you can do all kinds of stuff of less finesse anyway.

> IRL I don't believe it would ever happen as the result of this attack most
> likely would be minor if any.

 Nod.

> > 	if (!pci_oxsemi_tornado_p(dev) || pci_resource_len(dev, 0) < 8)
> > 		return -ENXIO;
> > 
> > 	p = pci_iomap(dev, 0, 5);
> 
> Why not 8 instead of 5?

 This code only accesses offsets 4:0 while BAR sizes come in powers of 2.  
I think the checks can be considered equivalent.  No strong opinion either 
way.

> > 	if (p == NULL)
> > 		return -ENOMEM;
> 
> This is so interesting... For MMIO it gives a page, I don't see how it can go
> outside the boundaries.

 I've double-checked the minimum memory space bus allocation size for PCI 
and it is 16, so indeed the check for the size isn't needed (beyond 16 
you'd have to validate so as not access another adjacent bus allocation, 
possibly for another device).

> For port based IO I think it can't be less than 4 for
> sure (due to PCI bits to interpret) and most likely can't be less than 8. But
> I have a weak memory of PCI specifications.

 Port space allocation can't happen with legitimate OxSemi configurations 
as this code is only ever reached with the native UART chip configuration. 
With the legacy UART configuration BAR0 only maps 8 conventional 8250 UART 
registers, but this is handled elsewhere.  Perhaps we need to assert that 
BAR0 is MMIO here before proceeding.

 NB it can go down to 4 for sure, no need to look far:

07:00.0 Parallel controller: Oxford Semiconductor Ltd OXPCIe952 Parallel Port (prog-if 02 [ECP])
	Subsystem: Oxford Semiconductor Ltd OXPCIe952 Parallel Port
	Flags: fast devsel, IRQ 35
	I/O ports at 1000 [size=8]
	I/O ports at 1008 [size=4]

 Overall it seems to me a lot of noise for a highly unlikely corner case.  
Most drivers have been written with an assumption that the device is 
legitimate and don't make any sanity checks.  Do we want to review them 
all now?

  Maciej