linux-kernel - Re: [PATCH 2/2] clocksource/drivers/fttmr010: Be stricter on IRQs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 27 Aug 2021 20:37:56 -0700
From:   Guenter Roeck <linux@...ck-us.net>
To:     Linus Walleij <linus.walleij@...aro.org>,
        Andrew Jeffery <andrew@...id.au>
Cc:     Daniel Lezcano <daniel.lezcano@...aro.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Cédric Le Goater <clg@...d.org>,
        Joel Stanley <joel@....id.au>
Subject: Re: [PATCH 2/2] clocksource/drivers/fttmr010: Be stricter on IRQs

On 8/27/21 3:01 PM, Linus Walleij wrote:
> On Sat, Aug 21, 2021 at 6:20 AM Guenter Roeck <linux@...ck-us.net> wrote:
>> On Sun, Jul 25, 2021 at 12:44:24AM +0200, Linus Walleij wrote:
> 
>>> Make sure we check that the right interrupt occurred before
>>> calling the event handler for timer 1. Report spurious IRQs
>>> as IRQ_NONE.
>>>
>>> Cc: Cédric Le Goater <clg@...d.org>
>>> Cc: Joel Stanley <joel@....id.au>
>>> Signed-off-by: Linus Walleij <linus.walleij@...aro.org>
>>
>> This patch results in boot stalls with several qemu aspeed emulations
>> (quanta-q71l-bmc, palmetto-bmc, witherspoon-bmc, ast2500-evb,
>> romulus-bmc, g220a-bmc). Reverting this patch together with
>> "clocksource/drivers/fttmr010: Clear also overflow bit on AST2600"
>> fixes the problem. Bisect log is attached.
> 
> Has it been tested on real hardware?
> 
> We are reading register 0x34 TIMER_INTR_STATE for this.
> So this should reflect the state of raw interrupts from the timers.
> 
> I looked in qemu/hw/timer/aspeed_timer.c
> and the aspeed_timer_read() looks dubious.
> It rather looks like this falls down to returning whatever
> was written to this register and not reflect which IRQ
> was fired at all.
> 

Actually, no. Turns out the qemu code is just a bit difficult to understand.
The code in question is:

     default:
         value = ASPEED_TIMER_GET_CLASS(s)->read(s, offset);
         break;

For ast2500-evb, that translates to a call to aspeed_2500_timer_read().
Here is a trace example (after adding some more tracing):

aspeed_2500_timer_read From 0x34: 0x0
aspeed_timer_read From 0x34: of size 4: 0x0

Problem is that - at least in qemu - only the 2600 uses register 0x34
for the interrupt status. On the 2500, 0x34 is the ctrl2 register.

Indeed, the patch works fine on, for example, ast2600-evb.
It only fails on ast2400 and ast2500 boards.

I don't have the manuals, so I can't say what the correct behavior is,
but at least there is some evidence that TIMER_INTR_STATE may not exist
on ast2400 and ast2500 SOCs. From drivers/clocksource/timer-fttmr010.c:

/*
  * Interrupt status/mask register definitions for fttmr010/gemini/moxart
  * timers.
  * The registers don't exist and they are not needed on aspeed timers
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  * because:
  *   - aspeed timer overflow interrupt is controlled by bits in Control
  *     Register (TMC30).
  *   - aspeed timers always generate interrupt when either one of the
  *     Match registers equals to Status register.
  */

Guenter