linux-kernel - Re: Maybe a bug in kernel/irq/chip.c unmask_irq(), device IRQ masked unexpectedly. (re-formated the mail body, sorry)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20191009174500.GM5610@atomide.com>
Date:   Wed, 9 Oct 2019 10:45:00 -0700
From:   Tony Lindgren <tony@...mide.com>
To:     Yi Zheng <goodmenzy@...il.com>
Cc:     Thomas Gleixner <tglx@...utronix.de>, linux-kernel@...r.kernel.org,
        Jason Cooper <jason@...edaemon.net>,
        Sekhar Nori <nsekhar@...com>, Zheng Yi <yzheng@...hyauld.com>
Subject: Re: Maybe a bug in kernel/irq/chip.c unmask_irq(), device IRQ masked
 unexpectedly. (re-formated the mail body, sorry)

Hi,

* Yi Zheng <goodmenzy@...il.com> [191008 13:06]:
>       NOTE: (1) My SoC is a single core ARM chip: TI-AM3352, so the raw
>          spin-lock irq_desc->lock will be optimized to
>          nothing. handle_level_irq() has no spin-lock protection, right?

Well not always, With CONFIG_SMP we modify only some of the SMP code on boot,
see arch/arm/kernel/head.S for smp_on_up and then the related macro usage.

>          (2) In AM3352, INTC driver ACK the IRQ by write 0x01 into INTC Control
>              Register(offset 0x48).  The chip doc seems that bit[0] of
>              INTC-Control Reg is only an enable/disable flag.  The IRQ may
>              generated even if no ACK action done. Any one can give me an
>              clarification?

The TI INTC is probably better documented in dm3630 trm, it's the same
controller but with a different revision.

>          (3) My analysis is not verified on the real machine. After some code
>              change for debug(add counter to indicates the iteration level, save
>              the IRQ mask status etc.), the device IRQ wrongly masked problem
>              vanished. In fact, the original code can not re-produce the
>              phenomena easily. In tens of machine, only one can get the bug. I
>              have try my best to hacking the code, but the only verified result
>              is here: when bug occur, the HW IRQ is masked, but the
>              IRQD_IRQ_MASKED flag is cleared.
> 
>       My fixup is in the attachment, which remove the unexpected time window of
>       IRQ iteration.

Let's see what Thomas has to say for that. Meanwhile, please take a
look at Documentation/process/submitting-patches.rst for getting things
right for sending out patches that can be applied without manual
editing :)

Cheers,

Tony

> --- kernel/irq/chip.c	2019-07-13 09:28:23.683787367 +0800
> +++ /tmp/chip.c	2019-10-08 11:32:35.082258572 +0800
> @@ -432,8 +432,8 @@ void unmask_irq(struct irq_desc *desc)
>  		return;
>  
>  	if (desc->irq_data.chip->irq_unmask) {
> -		desc->irq_data.chip->irq_unmask(&desc->irq_data);
>  		irq_state_clr_masked(desc);
> +		desc->irq_data.chip->irq_unmask(&desc->irq_data);
>  	}
>  }
>