DF-5527 — gpio_cherryview: unmap_intr never masks the IRQ line; free-without-teardown leaves an armed orphaned interrupt

What this pack contains

A production-code harness that runs on the DF-5518 planted-ACPI rig (stock DragonFly kernel + stock gpio_intel/gpio_acpi drivers brought up by planted ACPI tables, fake Cherry-View register image at 0xD0000+0x8000). It demonstrates that gpio_cherryview_unmap_intr() (sys/bus/gpio/gpio_intel/gpio_cherryview.c:380) never clears the community interrupt MASK bit, so releasing a mapped GPIO interrupt via GPIO_FREE_INTR without a preceding GPIO_TEARDOWN_INTR leaves the IRQ line armed while its pin_intr_map is destroyed — the exact precondition for an endless interrupt storm (gpio_cherryview_intr takes the is_level==0 edge-clear path on a level source that re-asserts immediately).

The harness does an A/B experiment in one kldload:

• A (defect path): pin 8 / INTSEL line 5 — GPIO_ALLOC_INTR → GPIO_SETUP_INTR → GPIO_FREE_INTR (teardown skipped)
• B (control): pin 15 / INTSEL line 6 — GPIO_ALLOC_INTR → GPIO_SETUP_INTR → GPIO_TEARDOWN_INTR → GPIO_FREE_INTR

Build

sh build.sh     # uploads gpiofree.c + gpio_intel_var.h, builds kmod on guest
                # (expects the rig to be booted: gpio_intel0 present)

Run

sh run.sh       # boots the DF-5518 rig chain, builds + loads the harness,
                # dumps MASK/IS via the kernel DMAP and /dev/mem

Expected output (stock kernel — defect present)

gpiofree[A-setup]: IS=00000020 MASK=00000020 (bit5=1 ...) map5{pin=8,intidx=5,...}
gpiofree[A-free]:  IS=00000020 MASK=00000020 (bit5=1 ...) map5{pin=-1,intidx=-1,...}
                            ^^^^ LINE STILL ARMED, MAPPING DESTROYED
gpiofree: SUMMARY ... line5 armed-with-no-mapping=1 (DEFECT if 1), line6 left-armed=0

With fix.diff applied (kernel rebuilt), the same run shows:

gpiofree[A-free]:  IS=00000020 MASK=00000000 (bit5=0 ...) map5{pin=-1,intidx=-1,...}
gpiofree: SUMMARY ... line5 armed-with-no-mapping=0 ...

run.log = stock baseline (full rig boot + harness), run.fixed.log = patched kernel, fix_build.log = full untrimmed patched-kernel build.

Notes

• The QEMU rig cannot inject a real ISA IRQ 5, so the storm itself is argued from the ISR logic (gpio_cherryview.c:221-235) on top of the reproduced armed-line state; see VERDICT.md.
• In-tree caller gpio_acpi_unmap_aei (gpio_acpi.c:450-451) always teardowns before freeing, so the defect is currently latent — it is a provider API-contract hazard (defense in depth), hence severity Info.

DF-5527 Verification Verdict

Target: sys/bus/gpio/gpio_intel/gpio_cherryview.c Class: interrupt-lifecycle defect (missing hardware mask-clear on free) → latent interrupt-storm DoS / hard lockup Severity: Info (latent — no in-tree caller misuses the order today) Verification: reproduced on the QEMU guest with the stock kernel and the DF-5518 planted-ACPI rig (production-code harness; no kernel modifications for the baseline); fix validated on a rebuilt kernel.

Verdict: REPRODUCED (state-level), FIX VALIDATED

gpio_cherryview_unmap_intr (gpio_cherryview.c:380-414) destroys the mapping (map->pin = -1 at :393, map->intidx = -1 at :394, map->is_level = 0 at :395) and restores the pad's INTCFG/GPIOCFG, but never touches CHV_GPIO_REG_MASK (0x380). The only code that ever clears a MASK bit is gpio_cherryview_disable_intr (:441-444), reached solely via GPIO_TEARDOWN_INTR. The gpio_if.m contract does not require teardown-before-free, and gpio_intel_free_intr (gpio_intel.c:250-263) calls unmap_intr directly with no disable.

Consequence for a caller that frees without teardown: the community IRQ line stays unmasked with no mapping. If the pad then asserts (level source), gpio_cherryview_intr (:219-235) reads GPIIS, sees the bit, reads mapping->is_level — which unmap_intr just zeroed — takes the edge clear path (W1C at :225), the level source re-asserts GPIIS immediately, the IRQ re-fires: endless interrupt storm → hard lockup / DoS. (The QEMU rig cannot inject ISA IRQ 5, so the storm loop itself is argued from the ISR code; the armed-line state — MASK bit set while intrmaps[i].pin == -1 — is what was reproduced live.)

Harness

gpiofree.c (kmod, stock kernel, DF-5518 rig): finds gpio_intel0 (devclass unit 0), plants two pads in the RAM register image (pin 8 → INTSEL line 5, pin 15 → INTSEL line 6; CTL0 = INTSEL<<28 | GPIOEN, GPIOCFG=0; CTL1 = INTCFG 2 = edge/rising to satisfy map_intr's sanity checks at :260-329), then:

• A (defect path): GPIO_ALLOC_INTR(8) → GPIO_SETUP_INTR → GPIO_FREE_INTR — teardown deliberately skipped.
• B (control): GPIO_ALLOC_INTR(15) → GPIO_SETUP_INTR → GPIO_TEARDOWN_INTR → GPIO_FREE_INTR.

State is dumped after every step from inside the kernel (PHYS_TO_DMAP reads of IS/MASK + sc->intrmaps[]) and cross-checked from userland with /dev/mem reads at 0xD0300/0xD0380.

Baseline run (stock kernel, run.log)

gpiofree[A-setup]: IS=00000020 MASK=00000020 (bit5=1 bit6=0) map5{pin=8,intidx=5,is_level=0}
gpiofree[A-free]:  IS=00000020 MASK=00000020 (bit5=1 bit6=0) map5{pin=-1,intidx=-1,is_level=0}
gpiofree[B-done]:  IS=00000040 MASK=00000020 (bit5=1 bit6=0) map6{pin=-1,...}
gpiofree: SUMMARY MASK=00000020: line5 armed-with-no-mapping=1 (DEFECT if 1), line6 left-armed=0

Userland cross-check: /dev/mem @0xD0380 = 20 00 00 00.

After GPIO_FREE_INTR on line 5 the MASK bit is still set while intrmaps[5].pin == -1 — the orphaned armed line, verbatim. Control arm B (teardown first) never leaves its bit set.

Fix validation (run.fixed.log, fix_build.log)

fix.diff makes unmap_intr capture map->intidx before destroying the mapping and, after destroying it, clear the MASK bit and W1C the IS bit for that line. Applied to the guest's /usr/src copy (patch -p1, 2/2 hunks), kernel rebuilt (make -j6 nativekernel KERNCONF=X86_64_GENERIC && make installkernel, RC=0, kern.version #1: Tue Oct 6 23:06:02), rig rebooted, identical harness re-run:

gpiofree[A-setup]: IS=00000020 MASK=00000020 (bit5=1 bit6=0) map5{pin=8,intidx=5,is_level=0}
gpiofree[A-free]:  IS=00000020 MASK=00000000 (bit5=0 bit6=0) map5{pin=-1,intidx=-1,is_level=0}
gpiofree: SUMMARY MASK=00000000: line5 armed-with-no-mapping=0 (DEFECT if 1), line6 left-armed=0

Userland cross-check: /dev/mem @0xD0380 = 00 00 00 00.

The only variable between the two runs is fix.diff: baseline armed-with-no-mapping=1 → patched 0. Guest healthy after both runs.

Why Info

The sole in-tree free path, gpio_acpi_unmap_aei (gpio_acpi.c:447-454), always does GPIO_TEARDOWN_INTR before GPIO_FREE_INTR, so nothing in the tree triggers the storm today; the provider's gpio_if contract simply doesn't defend against the natural misuse. Defense-in-depth fix, one hunk, validated.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.