linux-kernel - Re: [PATCH 2/2] clocksource/drivers/fttmr010: Be stricter on IRQs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 30 Aug 2021 13:46:16 +0930
From:   "Andrew Jeffery" <andrew@...id.au>
To:     Cédric Le Goater <clg@...d.org>,
        "Guenter Roeck" <linux@...ck-us.net>,
        "Linus Walleij" <linus.walleij@...aro.org>
Cc:     "Daniel Lezcano" <daniel.lezcano@...aro.org>,
        "Thomas Gleixner" <tglx@...utronix.de>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        "Joel Stanley" <joel@....id.au>
Subject: Re: [PATCH 2/2] clocksource/drivers/fttmr010: Be stricter on IRQs



On Sat, 28 Aug 2021, at 17:38, Cédric Le Goater wrote:
> Hello,
> 
> On 8/28/21 5:37 AM, Guenter Roeck wrote:
> > On 8/27/21 3:01 PM, Linus Walleij wrote:
> >> On Sat, Aug 21, 2021 at 6:20 AM Guenter Roeck <linux@...ck-us.net> wrote:
> >>> On Sun, Jul 25, 2021 at 12:44:24AM +0200, Linus Walleij wrote:
> >>
> >>>> Make sure we check that the right interrupt occurred before
> >>>> calling the event handler for timer 1. Report spurious IRQs
> >>>> as IRQ_NONE.
> >>>>
> >>>> Cc: Cédric Le Goater <clg@...d.org>
> >>>> Cc: Joel Stanley <joel@....id.au>
> >>>> Signed-off-by: Linus Walleij <linus.walleij@...aro.org>
> >>>
> >>> This patch results in boot stalls with several qemu aspeed emulations
> >>> (quanta-q71l-bmc, palmetto-bmc, witherspoon-bmc, ast2500-evb,
> >>> romulus-bmc, g220a-bmc). Reverting this patch together with
> >>> "clocksource/drivers/fttmr010: Clear also overflow bit on AST2600"
> >>> fixes the problem. Bisect log is attached.
> >>
> >> Has it been tested on real hardware?
> 
> It breaks the AST2500 EVB.
>  
> >>
> >> We are reading register 0x34 TIMER_INTR_STATE for this.
> >> So this should reflect the state of raw interrupts from the timers.
> >>
> >> I looked in qemu/hw/timer/aspeed_timer.c
> >> and the aspeed_timer_read() looks dubious.
> >> It rather looks like this falls down to returning whatever
> >> was written to this register and not reflect which IRQ
> >> was fired at all.
> >>
> > 
> > Actually, no. Turns out the qemu code is just a bit difficult to understand.
> > The code in question is:
> > 
> >     default:
> >         value = ASPEED_TIMER_GET_CLASS(s)->read(s, offset);
> >         break;
> > 
> > For ast2500-evb, that translates to a call to aspeed_2500_timer_read().
> > Here is a trace example (after adding some more tracing):
> > 
> > aspeed_2500_timer_read From 0x34: 0x0
> > aspeed_timer_read From 0x34: of size 4: 0x0
> > 
> > Problem is that - at least in qemu - only the 2600 uses register 0x34
> > for the interrupt status. On the 2500, 0x34 is the ctrl2 register.
> > 
> > Indeed, the patch works fine on, for example, ast2600-evb.
> > It only fails on ast2400 and ast2500 boards.
> 
> The QEMU modelling is doing a good job ! I agree that the timer model 
> is not the most obvious one to read. 

I'll buy a drink for whoever refactors it and improves readability :)

> 
> > I don't have the manuals, so I can't say what the correct behavior is,
> > but at least there is some evidence that TIMER_INTR_STATE may not exist
> > on ast2400 and ast2500 SOCs. 
> 
> On Aspeed SoCs AST2400 and AST2500, the TMC[34] register is a
> "control register #2" whereas on the AST2600 it is an "interrupt
> status register" with bits [0-7] holding the timers status.
> 
> I would say that the patch simply should handle the "is_aspeed" case.  

Well, is_aspeed is set true in the driver for all of the 2400, 2500 and 
2600. 0x34 behaves the way this patch expects on the 2600. So I think 
we need something less coarse than is_aspeed?

Andrew