linux-kernel - Re: [PATCH] clockevents/drivers/i8253: Do not zero timer counter in shutdown

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b781a3f94e7ff1c2b49101255d382ab9d8d74035.camel@infradead.org>
Date: Thu, 01 Aug 2024 19:25:56 +0100
From: David Woodhouse <dwmw2@...radead.org>
To: Thomas Gleixner <tglx@...utronix.de>, lirongqing@...du.com, 
 seanjc@...gle.com, kys@...rosoft.com, haiyangz@...rosoft.com,
 wei.liu@...nel.org,  decui@...rosoft.com, mingo@...hat.com, bp@...en8.de,
 dave.hansen@...ux.intel.com,  x86@...nel.org, linux-hyperv@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] clockevents/drivers/i8253: Do not zero timer counter in
 shutdown

On Thu, 2024-08-01 at 18:49 +0100, David Woodhouse wrote:
> On Thu, 2024-08-01 at 16:21 +0200, Thomas Gleixner wrote:
> > On Tue, Feb 07 2023 at 09:14, lirongqing@...du.com wrote:
> > > @@ -117,11 +110,6 @@ static int pit_shutdown(struct clock_event_device *evt)
> > >  
> > >         outb_p(0x30, PIT_MODE);
> > >  
> > > -       if (i8253_clear_counter_on_shutdown) {
> > > -               outb_p(0, PIT_CH0);
> > > -               outb_p(0, PIT_CH0);
> > > -       }
> > > -
> > 
> > The stop sequence is wrong:
> > 
> >     When there is a count in progress, writing a new LSB before the
> >     counter has counted down to 0 and rolled over to FFFFh, WILL stop
> >     the counter.  However, if the LSB is loaded AFTER the counter has
> >     rolled over to FFFFh, so that an MSB now exists in the counter, then
> >     the counter WILL NOT stop.
> > 
> > The original i8253 datasheet says:
> > 
> >     1) Write 1st byte stops the current counting
> >     2) Write 2nd byte starts the new count
> 

It also prefixes that with "Rewriting a counter register during
counting results in the following:".

But after you write the MODE register, is it actually supposed to be
counting? Just a little further up, under 'Counter Loading', it says:

"The count register is not loaded until the count value is written (one
or two bytes, depending on the mode selected by the RL bits), followed
by a rising edge and a falling edge of the clock. Any read of the
counter prior to that falling clock edge may yield invalid data".

OK, but what *triggers* that invalid state? Given that it explicitly
says that a one-byte counter write ends that state, it isn't the first
of two bytes. Surely that means that from the time the MODE register is
written, any read of the counter may yield invalid data, until the
counter is written?

I suspect there are as many implementations (virt and hardware) as
there are reasonable interpretations of the spec... and then some.

Download attachment "smime.p7s" of type "application/pkcs7-signature" (5965 bytes)