linux-kernel - Re: [PATCH 2/2] clocksource/drivers/fttmr010: Be stricter on IRQs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <567a65a8-077b-7394-c8e2-dbd9f063e02c@kaod.org>
Date:   Sat, 28 Aug 2021 10:08:27 +0200
From:   Cédric Le Goater <clg@...d.org>
To:     Guenter Roeck <linux@...ck-us.net>,
        Linus Walleij <linus.walleij@...aro.org>,
        Andrew Jeffery <andrew@...id.au>
CC:     Daniel Lezcano <daniel.lezcano@...aro.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Joel Stanley <joel@....id.au>
Subject: Re: [PATCH 2/2] clocksource/drivers/fttmr010: Be stricter on IRQs

Hello,

On 8/28/21 5:37 AM, Guenter Roeck wrote:
> On 8/27/21 3:01 PM, Linus Walleij wrote:
>> On Sat, Aug 21, 2021 at 6:20 AM Guenter Roeck <linux@...ck-us.net> wrote:
>>> On Sun, Jul 25, 2021 at 12:44:24AM +0200, Linus Walleij wrote:
>>
>>>> Make sure we check that the right interrupt occurred before
>>>> calling the event handler for timer 1. Report spurious IRQs
>>>> as IRQ_NONE.
>>>>
>>>> Cc: Cédric Le Goater <clg@...d.org>
>>>> Cc: Joel Stanley <joel@....id.au>
>>>> Signed-off-by: Linus Walleij <linus.walleij@...aro.org>
>>>
>>> This patch results in boot stalls with several qemu aspeed emulations
>>> (quanta-q71l-bmc, palmetto-bmc, witherspoon-bmc, ast2500-evb,
>>> romulus-bmc, g220a-bmc). Reverting this patch together with
>>> "clocksource/drivers/fttmr010: Clear also overflow bit on AST2600"
>>> fixes the problem. Bisect log is attached.
>>
>> Has it been tested on real hardware?

It breaks the AST2500 EVB.
 
>>
>> We are reading register 0x34 TIMER_INTR_STATE for this.
>> So this should reflect the state of raw interrupts from the timers.
>>
>> I looked in qemu/hw/timer/aspeed_timer.c
>> and the aspeed_timer_read() looks dubious.
>> It rather looks like this falls down to returning whatever
>> was written to this register and not reflect which IRQ
>> was fired at all.
>>
> 
> Actually, no. Turns out the qemu code is just a bit difficult to understand.
> The code in question is:
> 
>     default:
>         value = ASPEED_TIMER_GET_CLASS(s)->read(s, offset);
>         break;
> 
> For ast2500-evb, that translates to a call to aspeed_2500_timer_read().
> Here is a trace example (after adding some more tracing):
> 
> aspeed_2500_timer_read From 0x34: 0x0
> aspeed_timer_read From 0x34: of size 4: 0x0
> 
> Problem is that - at least in qemu - only the 2600 uses register 0x34
> for the interrupt status. On the 2500, 0x34 is the ctrl2 register.
> 
> Indeed, the patch works fine on, for example, ast2600-evb.
> It only fails on ast2400 and ast2500 boards.

The QEMU modelling is doing a good job ! I agree that the timer model 
is not the most obvious one to read. 

> I don't have the manuals, so I can't say what the correct behavior is,
> but at least there is some evidence that TIMER_INTR_STATE may not exist
> on ast2400 and ast2500 SOCs. 

On Aspeed SoCs AST2400 and AST2500, the TMC[34] register is a
"control register #2" whereas on the AST2600 it is an "interrupt
status register" with bits [0-7] holding the timers status.

I would say that the patch simply should handle the "is_aspeed" case.  

> From drivers/clocksource/timer-fttmr010.c:

yes. See commit 86fe57fc47b1 ("clocksource/drivers/fttmr010: Fix 
invalid interrupt register access")

AFAICT, the ast2600 does not use a fttmr010 clocksource. Something to 
clarify may be Joel ? 

Thanks,

C.

> 
> /*
>  * Interrupt status/mask register definitions for fttmr010/gemini/moxart
>  * timers.
>  * The registers don't exist and they are not needed on aspeed timers
>    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>  * because:
>  *   - aspeed timer overflow interrupt is controlled by bits in Control
>  *     Register (TMC30).
>  *   - aspeed timers always generate interrupt when either one of the
>  *     Match registers equals to Status register.
>  */
> 
> Guenter