linux-kernel - Re: [PATCH] irqchip/gic-v3: Fix IPRIORITYR can't perform byte operations in GIC-600

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210330110546.GA24881@lpieralisi>
Date:   Tue, 30 Mar 2021 12:05:46 +0100
From:   Lorenzo Pieralisi <lorenzo.pieralisi@....com>
To:     Marc Zyngier <maz@...nel.org>
Cc:     Lecopzer Chen <lecopzer.chen@...iatek.com>,
        linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        tglx@...utronix.de, lecopzer@...il.com, yj.chiang@...iatek.com,
        Julien Thierry <julien.thierry.kdev@...il.com>
Subject: Re: [PATCH] irqchip/gic-v3: Fix IPRIORITYR can't perform byte
 operations in GIC-600

On Tue, Mar 30, 2021 at 11:33:13AM +0100, Marc Zyngier wrote:
> [+Lorenzo, +Julien on an actual email address]
> 
> On Tue, 30 Mar 2021 11:06:19 +0100,
> Lecopzer Chen <lecopzer.chen@...iatek.com> wrote:
> > 
> > When pseudo-NMI enabled, register_nmi() set priority of specific IRQ
> > by byte ops, and this doesn't work in GIC-600.
> > 
> > We have asked ARM Support [1]:
> > > Please refer to following description in
> > > "2.1.2 Distributor ACE-Lite slave interface" of GIC-600 TRM for
> > > the GIC600 ACE-lite slave interface supported sizes:
> > >   "The GIC-600 only accepts single beat accesses of the sizes for
> > >   each register that are shown in the Programmers model,
> > >   see Chapter 4 Programmer's model on page 4-102.
> > >   All other accesses are rejected and given either an
> > >   OKAY or SLVERR response that is based on the GICT_ERR0CTLR.UE bit.".
> > 
> > Thus the register needs to be written by double word operation and
> > the step will be: read 32bit, set byte and write it back.
> > 
> > [1] https://services.arm.com/support/s/case/5003t00001L4Pba
> 
> You do realise that this link:
> 
> - is unusable for most people as it is behind a registration interface
> - discloses confidential information to other people
> 
> I strongly suggest you stop posting such links.
> 
> > 
> > Signed-off-by: Lecopzer Chen <lecopzer.chen@...iatek.com>
> > ---
> >  drivers/irqchip/irq-gic-v3.c | 13 ++++++++++++-
> >  1 file changed, 12 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
> > index eb0ee356a629..cfc5a6ad30dc 100644
> > --- a/drivers/irqchip/irq-gic-v3.c
> > +++ b/drivers/irqchip/irq-gic-v3.c
> > @@ -440,10 +440,21 @@ static void gic_irq_set_prio(struct irq_data *d, u8 prio)
> >  {
> >  	void __iomem *base = gic_dist_base(d);
> >  	u32 offset, index;
> > +	u32 val, prio_offset_mask, prio_offset_shift;
> >  
> >  	offset = convert_offset_index(d, GICD_IPRIORITYR, &index);
> >  
> > -	writeb_relaxed(prio, base + offset + index);
> > +	/*
> > +	 * GIC-600 memory mapping register doesn't support byte opteration,
> > +	 * thus read 32-bits from register, set bytes and wtire back to it.
> > +	 */
> > +	prio_offset_shift = (index & 0x3) * 8;
> > +	prio_offset_mask = GENMASK(prio_offset_shift + 7, prio_offset_shift);
> > +	index &= ~0x3;
> > +	val = readl_relaxed(base + offset + index);
> > +	val &= ~prio_offset_mask;
> > +	val |= prio << prio_offset_shift;
> > +	writel_relaxed(val, base + offset + index);
> >  }
> >  
> >  static u32 gic_get_ppi_index(struct irq_data *d)
> 
> From the architecture spec:
> 
> <quote>
> 11.1.3 GIC memory-mapped register access
> 
> In any system, access to the following registers must be supported:
> 
> [...]
> * Byte accesses to:
> 	- GICD_IPRIORITYR<n>.
> 	- GICD_ITARGETSR<n>.
> 	- GICD_SPENDSGIR<n>.
> 	- GICD_CPENDSGIR<n>.
> 	- GICR_IPRIORITYR<n>.
> </quote>
> 
> So if GIC600 doesn't follow this architectural requirement, this is a
> HW erratum, and I want an actual description of the HW issue together
> with an erratum number.
> 
> Lorenzo, can you please investigate on your side?

Sure - I will look into it and report back.

Thanks,
Lorenzo