Re: [PATCH] irqchip/gic-v3: Work around insecure GIC integrations

[Marc Zyngier <maz@kernel.org>]

On Fri, 13 Dec 2024 15:10:11 +0000,
Chen-Yu Tsai <wens@kernel.org> wrote:
> 
> On Fri, Dec 13, 2024 at 10:34 PM Marc Zyngier <maz@kernel.org> wrote:
> >
> > It appears that the relatively popular RK3399 SoC has been put together
> > using a large amount of illicit substances, as experiments reveal
> > that its integration of GIC500 exposes the *secure* programming
> > interface to non-secure.
> >
> > This has some pretty bad effects on the way priorities are handled,
> > and results in a dead machine if booting with pseudo-NMI enabled
> > (irqchip.gicv3_pseudo_nmi=1) if the kernel contains 18fdb6348c480
> > ("arm64: irqchip/gic-v3: Select priorities at boot time"), which
> > relies on the priorities being programmed using the NS view.
> >
> > Let's restore some sanity by going one step further and disable
> > security altogether in this case. This is not any worse, and
> > puts us in a mode where priorities actually make some sense.
> >
> > Huge thanks to Mark Kettenis who initially identified this issue
> > on OpenBSD, and to Chen-Yu Tsai who reported the problem in
> > Linux.
> >
> > Fixes: 18fdb6348c480 ("arm64: irqchip/gic-v3: Select priorities at boot time")
> > Reported-by: Mark Kettenis <mark.kettenis@xs4all.nl>
> > Reported-by: Chen-Yu Tsai <wenst@chromium.org>
> 
> Should be
> 
> Reported-by: Chen-Yu Tsai <wens@csie.org>
> 
> (I know it's confusing, I even mix up inboxes at work.)

Ah, fair enough. Given that the report was on IRC, I had just used the
first address git log gave me.

> > Signed-off-by: Marc Zyngier <maz@kernel.org>
> > Cc: stable@vger.kernel.org
> 
> Tested-by: Chen-Yu Tsai <wens@csie.org>
> 
> My RK3399 boots normally with pseudo NMI enabled with this patch now.
> Also tried NMI backtraces through sysrq, though I'm not sure that
> always goes through the pseudo NMI path?

Should do, according to arch/arm64/kernel/smp::ipi_setup().

Thanks for having tested it.

	M.

-- 
Without deviation from the norm, progress is not possible.