linux-kernel - [PATCH] irqchip/gic-v3: avoid reading typer2 if GICv3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200307233442.958122-1-msalter@redhat.com>
Date:   Sat,  7 Mar 2020 18:34:42 -0500
From:   Mark Salter <msalter@...hat.com>
To:     Marc Zyngier <maz@...nel.org>
Cc:     linux-kernel@...r.kernel.org
Subject: [PATCH] irqchip/gic-v3: avoid reading typer2 if GICv3

Trying to boot v5.6-rc1 on a ThunderX platform leads to
a SEA splat when trying to read the GICv4 TYPER2 register:

[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] Internal error: synchronous external abort: 96000210 [#1] SMP
[    0.000000] Modules linked in:
[    0.000000] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.5.0-rc4+ #11
[    0.000000] Hardware name: Cavium ThunderX CN88XX board (DT)
[    0.000000] pstate: 60400085 (nZCv daIf +PAN -UAO)
[    0.000000] pc : __raw_readl+0x0/0x8
[    0.000000] lr : gic_init_bases+0x110/0x4b0
[    0.000000] sp : ffff800011973dd0
[    0.000000] x29: ffff800011973dd0 x28: 0000000002150018
[    0.000000] x27: 0000000000000018 x26: 0000000000000000
[    0.000000] x25: 0000000000000002 x24: ffff010fe7ef6700
[    0.000000] x23: 0000000000000000 x22: ffff800010dc3b90
[    0.000000] x21: ffff010fef138020 x20: 00000000009b0404
[    0.000000] x19: ffff80001198c508 x18: 0000000000000005
[    0.000000] x17: 000000006fc20c07 x16: 0000000000000001
[    0.000000] x15: 0000000000000010 x14: ffffffffffffffff
[    0.000000] x13: ffff800091973b4f x12: ffff800011973b5c
[    0.000000] x11: ffff800011989000 x10: 0000000000000080
[    0.000000] x9 : ffff8000101991e4 x8 : 0000000000040000
[    0.000000] x7 : 000000000000413d x6 : 0000000000000000
[    0.000000] x5 : 0000000000000000 x4 : 0000000000000000
[    0.000000] x3 : 0000000000000080 x2 : ffff8000119c1f10
[    0.000000] x1 : ffff800011991a40 x0 : ffff800013c9000c
[    0.000000] Call trace:
[    0.000000]  __raw_readl+0x0/0x8
[    0.000000]  gic_of_init+0x170/0x1f8
[    0.000000]  of_irq_init+0x1e4/0x3c4
[    0.000000]  irqchip_init+0x1c/0x40
[    0.000000]  init_IRQ+0x164/0x194
[    0.000000]  start_kernel+0x334/0x4cc

So avoid reading TYPER2 on GICv3.

Fixes: f2d834092ee2 ("irqchip/gic-v3: Add GICv4.1 VPEID size discovery")
Signed-off-by: Mark Salter <msalter@...hat.com>
---
 drivers/irqchip/irq-gic-v3.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index c1f7af9d9ae7..cd9a6c8fe68a 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -1550,7 +1550,7 @@ static int __init gic_init_bases(void __iomem *dist_base,
 				 u64 redist_stride,
 				 struct fwnode_handle *handle)
 {
-	u32 typer;
+	u32 typer, pidr2;
 	int err;
 
 	if (!is_hyp_mode_available())
@@ -1577,7 +1577,9 @@ static int __init gic_init_bases(void __iomem *dist_base,
 	pr_info("%d SPIs implemented\n", GIC_LINE_NR - 32);
 	pr_info("%d Extended SPIs implemented\n", GIC_ESPI_NR);
 
-	gic_data.rdists.gicd_typer2 = readl_relaxed(gic_data.dist_base + GICD_TYPER2);
+	pidr2 = readl_relaxed(dist_base + GICD_PIDR2) & GIC_PIDR2_ARCH_MASK;
+	if (pidr2 != GIC_PIDR2_ARCH_GICv3)
+		gic_data.rdists.gicd_typer2 = readl_relaxed(gic_data.dist_base + GICD_TYPER2);
 
 	gic_data.domain = irq_domain_create_tree(handle, &gic_irq_domain_ops,
 						 &gic_data);
-- 
2.24.1