Christoffer reports that on some implementations, writing to GICR_ISACTIVER0 (and similar GICD registers) can race badly with a guest issuing a deactivation of that interrupt via the system register interface.
There are multiple reasons to this:
- we use an early write-acknoledgement memory type (nGnRE), meaning that the write may only have made it as far as some interconnect by the time the store is considered "done"
- the GIC itself is allowed to buffer the write until it decides to take it into account (as long as it is in finite time)
The effects are that the activation may not have taken effect by the time we enter the guest, forcing an immediate exit, or that a guest deactivation occurs before the interrupt is active, doing nothing.
In order to guarantee that the write to the ISACTIVER register has taken effect, read back from it, forcing the interconnect to propagate the write, and the GIC to process the write before returning the read.
Reported-by: Christoffer Dall christoffer.dall@arm.com Acked-by: Christoffer Dall christoffer.dall@arm.com Signed-off-by: Marc Zyngier maz@kernel.org Cc: stable@vger.kernel.org --- drivers/irqchip/irq-gic-v3.c | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c index ce87205e3e823..8b6159f4cdafa 100644 --- a/drivers/irqchip/irq-gic-v3.c +++ b/drivers/irqchip/irq-gic-v3.c @@ -524,6 +524,13 @@ static int gic_irq_set_irqchip_state(struct irq_data *d, }
gic_poke_irq(d, reg); + + /* + * Force read-back to guarantee that the active state has taken + * effect, and won't race with a guest-driven deactivation. + */ + if (reg == GICD_ISACTIVER) + gic_peek_irq(d, reg); return 0; }
The following commit has been merged into the irq/urgent branch of tip:
Commit-ID: 464cb98f1c07298c4c10e714ae0c36338d18d316 Gitweb: https://git.kernel.org/tip/464cb98f1c07298c4c10e714ae0c36338d18d316 Author: Marc Zyngier maz@kernel.org AuthorDate: Wed, 06 Nov 2024 08:44:18 Committer: Thomas Gleixner tglx@linutronix.de CommitterDate: Thu, 07 Nov 2024 00:22:44 +01:00
irqchip/gic-v3: Force propagation of the active state with a read-back
Christoffer reports that on some implementations, writing to GICR_ISACTIVER0 (and similar GICD registers) can race badly with a guest issuing a deactivation of that interrupt via the system register interface.
There are multiple reasons to this:
- this uses an early write-acknoledgement memory type (nGnRE), meaning that the write may only have made it as far as some interconnect by the time the store is considered "done"
- the GIC itself is allowed to buffer the write until it decides to take it into account (as long as it is in finite time)
The effects are that the activation may not have taken effect by the time the kernel enters the guest, forcing an immediate exit, or that a guest deactivation occurs before the interrupt is active, doing nothing.
In order to guarantee that the write to the ISACTIVER register has taken effect, read back from it, forcing the interconnect to propagate the write, and the GIC to process the write before returning the read.
Reported-by: Christoffer Dall christoffer.dall@arm.com Signed-off-by: Marc Zyngier maz@kernel.org Signed-off-by: Thomas Gleixner tglx@linutronix.de Acked-by: Christoffer Dall christoffer.dall@arm.com Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20241106084418.3794612-1-maz@kernel.org
--- drivers/irqchip/irq-gic-v3.c | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c index ce87205..8b6159f 100644 --- a/drivers/irqchip/irq-gic-v3.c +++ b/drivers/irqchip/irq-gic-v3.c @@ -524,6 +524,13 @@ static int gic_irq_set_irqchip_state(struct irq_data *d, }
gic_poke_irq(d, reg); + + /* + * Force read-back to guarantee that the active state has taken + * effect, and won't race with a guest-driven deactivation. + */ + if (reg == GICD_ISACTIVER) + gic_peek_irq(d, reg); return 0; }
linux-stable-mirror@lists.linaro.org
-
Marc Zyngier -
tip-bot2 for Marc Zyngier