linux.git/kernel/irq/resend.c, branch v5.13

genirq: Fix typos and misspellings in comments

2021-03-16T14:08:29+00:00

No functional change.

Signed-off-by: Krzysztof Kozlowski 
Signed-off-by: Thomas Gleixner 
Link: https://lore.kernel.org/r/20210316100205.23492-1-krzysztof.kozlowski@canonical.com

genirq: Use new tasklet API for resend_tasklet

2021-01-28T10:18:04+00:00

This converts the resend_tasklet to use the new API in
commit 12cc923f1ccc ("tasklet: Introduce new initialization API")

The new API changes the argument passed to the callback function, but
fortunately the argument isn't used so it is straight forward to use
DECLARE_TASKLET() rather than DECLARE_TASKLET_OLD().

Signed-off-by: Emil Renner Berthing 
Signed-off-by: Thomas Gleixner 
Link: https://lore.kernel.org/r/20210123182456.6521-1-esmil@mailme.dk

genirq: Walk the irq_data hierarchy when resending an interrupt

2020-09-06T17:25:23+00:00

On resending an interrupt, we only check the outermost irqchip for
a irq_retrigger callback. However, this callback could be implemented
at an inner level. Use irq_chip_retrigger_hierarchy() in this case.

Reviewed-by: Valentin Schneider 
Signed-off-by: Marc Zyngier

treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()

2020-07-30T18:15:58+00:00

This converts all the existing DECLARE_TASKLET() (and ...DISABLED)
macros with DECLARE_TASKLET_OLD() in preparation for refactoring the
tasklet callback type. All existing DECLARE_TASKLET() users had a "0"
data argument, it has been removed here as well.

Reviewed-by: Greg Kroah-Hartman 
Acked-by: Thomas Gleixner 
Signed-off-by: Kees Cook

genirq: Provide interrupt injection mechanism

2020-03-08T10:06:42+00:00

Error injection mechanisms need a half ways safe way to inject interrupts as
invoking generic_handle_irq() or the actual device interrupt handler
directly from e.g. a debugfs write is not guaranteed to be safe.

On x86 generic_handle_irq() is unsafe due to the hardware trainwreck which
is the base of x86 interrupt delivery and affinity management.

Move the irq debugfs injection code into a separate function which can be
used by error injection code as well.

The implementation prevents at least that state is corrupted, but it cannot
close a very tiny race window on x86 which might result in a stale and not
serviced device interrupt under very unlikely circumstances.

This is explicitly for debugging and testing and not for production use or
abuse in random driver code.

Signed-off-by: Thomas Gleixner 
Tested-by: Kuppuswamy Sathyanarayanan 
Reviewed-by: Kuppuswamy Sathyanarayanan 
Acked-by: Marc Zyngier 
Link: https://lkml.kernel.org/r/20200306130623.990928309@linutronix.de

genirq: Sanitize state handling in check_irq_resend()

2020-03-08T10:06:41+00:00

The code sets IRQS_REPLAY unconditionally whether the resend happens or
not. That doesn't have bad side effects right now, but inconsistent state
is always a latent source of problems.

Signed-off-by: Thomas Gleixner 
Acked-by: Marc Zyngier 
Link: https://lkml.kernel.org/r/20200306130623.882129117@linutronix.de

genirq: Add return value to check_irq_resend()

2020-03-08T10:06:41+00:00

In preparation for an interrupt injection interface which can be used
safely by error injection mechanisms. e.g. PCI-E/ AER, add a return value
to check_irq_resend() so errors can be propagated to the caller.

Split out the software resend code so the ugly #ifdef in check_irq_resend()
goes away and the whole thing becomes readable.

Fix up the caller in debugfs. The caller in irq_startup() does not care
about the return value as this is unconditionally invoked for all
interrupts and the resend is best effort anyway.

Signed-off-by: Thomas Gleixner 
Acked-by: Marc Zyngier 
Link: https://lkml.kernel.org/r/20200306130623.775200917@linutronix.de

genirq: Add protection against unsafe usage of generic_handle_irq()

2020-03-08T10:06:40+00:00

In general calling generic_handle_irq() with interrupts disabled from non
interrupt context is harmless. For some interrupt controllers like the x86
trainwrecks this is outright dangerous as it might corrupt state if an
interrupt affinity change is pending.

Add infrastructure which allows to mark interrupts as unsafe and catch such
usage in generic_handle_irq().

Reported-by: sathyanarayanan.kuppuswamy@linux.intel.com
Signed-off-by: Thomas Gleixner 
Acked-by: Marc Zyngier 
Link: https://lkml.kernel.org/r/20200306130623.590923677@linutronix.de

genirq: Prevent NULL pointer dereference in resend_irqs()

2019-09-05T19:31:14+00:00

The following crash was observed:

  Unable to handle kernel NULL pointer dereference at 0000000000000158
  Internal error: Oops: 96000004 [#1] SMP
  pc : resend_irqs+0x68/0xb0
  lr : resend_irqs+0x64/0xb0
  ...
  Call trace:
   resend_irqs+0x68/0xb0
   tasklet_action_common.isra.6+0x84/0x138
   tasklet_action+0x2c/0x38
   __do_softirq+0x120/0x324
   run_ksoftirqd+0x44/0x60
   smpboot_thread_fn+0x1ac/0x1e8
   kthread+0x134/0x138
   ret_from_fork+0x10/0x18

The reason for this is that the interrupt resend mechanism happens in soft
interrupt context, which is a asynchronous mechanism versus other
operations on interrupts. free_irq() does not take resend handling into
account. Thus, the irq descriptor might be already freed before the resend
tasklet is executed. resend_irqs() does not check the return value of the
interrupt descriptor lookup and derefences the return value
unconditionally.

  1):
  __setup_irq
    irq_startup
      check_irq_resend  // activate softirq to handle resend irq
  2):
  irq_domain_free_irqs
    irq_free_descs
      free_desc
        call_rcu(&desc->rcu, delayed_free_desc)
  3):
  __do_softirq
    tasklet_action
      resend_irqs
        desc = irq_to_desc(irq)
        desc->handle_irq(desc)  // desc is NULL --> Ooops

Fix this by adding a NULL pointer check in resend_irqs() before derefencing
the irq descriptor.

Fixes: a4633adcdbc1 ("[PATCH] genirq: add genirq sw IRQ-retrigger")
Signed-off-by: Yunfeng Ye 
Signed-off-by: Thomas Gleixner 
Reviewed-by: Zhiqiang Liu 
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/1630ae13-5c8e-901e-de09-e740b6a426a7@huawei.com

genirq: Cleanup top of file comments

2018-03-20T13:23:27+00:00

Remove pointless references to the file name itself and condense the
information so it wastes less space.

Signed-off-by: Thomas Gleixner 
Acked-by: Marc Zyngier 
Cc: Kate Stewart 
Cc: Greg Kroah-Hartman 
Cc: Philippe Ombredanne 
Link: https://lkml.kernel.org/r/20180314212030.412095827@linutronix.de