linux-kernel - Re: Qemu Guest kernel 4.20-rc1 PCIe hotplug issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 14 Nov 2018 11:52:25 +0200
From:   "mika.westerberg@...ux.intel.com" <mika.westerberg@...ux.intel.com>
To:     Shameerali Kolothum Thodi <shameerali.kolothum.thodi@...wei.com>
Cc:     "linux-pci@...r.kernel.org" <linux-pci@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "Wangzhou (B)" <wangzhou1@...ilicon.com>,
        Linuxarm <linuxarm@...wei.com>, Lukas Wunner <lukas@...ner.de>
Subject: Re: Qemu Guest kernel 4.20-rc1 PCIe hotplug issue

On Tue, Nov 13, 2018 at 03:57:47PM +0000, Shameerali Kolothum Thodi wrote:
> > The smb_mb() thing is not that clear (at least to me) because it is used
> > in two places in the driver and both seem to be making write to
> > ctrl->cmd_busy visible to other CPUs but I don't see where we deal with
> > the read part.
> > 
> > I may be missing something, though.
> 
> I think the read part is in wait_event_timeout() which evaluates the condition.
> The wake_up is called from the pciehp_isr().  Since the flag is being updated
> in both process level and interrupt handler context, smp_mb() is used. I think
> the same now applies to  ctrl->slot_ctrl now as this being used in process
> context and interrupt context as well.

Right, but that would require to use another read/general barrier in the
pciehp_isr() before we read the variable in case interrupt happens
immediately on another CPU (at least that's my understanding). Since I'm
not too comfortable with all these barriers to be honest I would prefer
reading the slot control register directly in pciehp_isr() :-)

I wonder if the below works in your case? I think it is still easier to
understand than adding another barrier there.

diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 7dd443aea5a5..575da1005836 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -518,11 +518,9 @@ static irqreturn_t pciehp_isr(int irq, void *dev_id)
 	u16 status, events;
 
 	/*
-	 * Interrupts only occur in D3hot or shallower and only if enabled
-	 * in the Slot Control register (PCIe r4.0, sec 6.7.3.4).
+	 * Interrupts only occur in D3hot or shallower (PCIe r4.0, sec 6.7.3.4).
 	 */
-	if (pdev->current_state == PCI_D3cold ||
-	    (!(ctrl->slot_ctrl & PCI_EXP_SLTCTL_HPIE) && !pciehp_poll_mode))
+	if (pdev->current_state == PCI_D3cold)
 		return IRQ_NONE;
 
 	/*
@@ -548,6 +546,22 @@ static irqreturn_t pciehp_isr(int irq, void *dev_id)
 		return IRQ_NONE;
 	}
 
+	if (!pciehp_poll_mode) {
+		u16 ctrl;
+
+		/*
+		 * Check that the hotplug interrupt was enabled. It may
+		 * be that the interrupt was meant for PME instead as
+		 * they share the MSI vector.
+		 */
+		pcie_capability_read_word(pdev, PCI_EXP_SLTCTL, &ctrl);
+		if (ctrl == (u16) ~0 || !(ctrl & PCI_EXP_SLTCTL_HPIE)) {
+			if (parent)
+				pm_runtime_put(parent);
+			return IRQ_NONE;
+		}
+	}
+
 	/*
 	 * Slot Status contains plain status bits as well as event
 	 * notification bits; right now we only want the event bits.