From: Marc Zyngier <marc.zyngier@arm.com>
To: Julien Thierry <julien.thierry@arm.com>,
Christoffer Dall <christoffer.dall@arm.com>
Cc: James Morse <james.morse@arm.com>,
linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org, daniel.thompson@linaro.org,
joel@joelfernandes.org, catalin.marinas@arm.com,
will.deacon@arm.com, mark.rutland@arm.com,
Arnd Bergmann <arnd@arndb.de>,
linux-arch@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH v9 01/26] arm64: Fix HCR.TGE status for NMI contexts
Date: Thu, 31 Jan 2019 09:53:40 +0000 [thread overview]
Message-ID: <3814b7ff-8d78-5f47-6eef-1b4e9bd7fd46@arm.com> (raw)
In-Reply-To: <7a2c92ca-f0eb-1391-4dc4-005e1dbadc30@arm.com>
On 31/01/2019 09:40, Julien Thierry wrote:
>
>
> On 31/01/2019 09:27, Christoffer Dall wrote:
>> On Thu, Jan 31, 2019 at 08:56:04AM +0000, Julien Thierry wrote:
>>>
>>>
>>> On 31/01/2019 08:19, Christoffer Dall wrote:
>>>> On Mon, Jan 28, 2019 at 03:42:42PM +0000, Julien Thierry wrote:
>>>>> Hi James,
>>>>>
>>>>> On 28/01/2019 11:48, James Morse wrote:
>>>>>> Hi Julien,
>>>>>>
>>>>>> On 21/01/2019 15:33, Julien Thierry wrote:
>>>>>>> When using VHE, the host needs to clear HCR_EL2.TGE bit in order
>>>>>>> to interract with guest TLBs, switching from EL2&0 translation regime
>>>>>>
>>>>>> (interact)
>>>>>>
>>>>>>
>>>>>>> to EL1&0.
>>>>>>>
>>>>>>> However, some non-maskable asynchronous event could happen while TGE is
>>>>>>> cleared like SDEI. Because of this address translation operations
>>>>>>> relying on EL2&0 translation regime could fail (tlb invalidation,
>>>>>>> userspace access, ...).
>>>>>>>
>>>>>>> Fix this by properly setting HCR_EL2.TGE when entering NMI context and
>>>>>>> clear it if necessary when returning to the interrupted context.
>>>>>>
>>>>>> Yes please. This would not have been fun to debug!
>>>>>>
>>>>>> Reviewed-by: James Morse <james.morse@arm.com>
>>>>>>
>>>>>>
>>>>>
>>>>> Thanks.
>>>>>
>>>>>>
>>>>>> I was looking for why we need core code to do this, instead of updating the
>>>>>> arch's call sites. Your 'irqdesc: Add domain handlers for NMIs' patch (pointed
>>>>>> to from the cover letter) is the reason: core-code calls nmi_enter()/nmi_exit()
>>>>>> itself.
>>>>>>
>>>>>
>>>>> Yes, that's the main reason.
>>>>>
>>>> I wondered the same thing, but I don't understand the explanation :(
>>>>
>>>> Why can't we do a local_daif_mask() around the (very small) calls that
>>>> clear TGE instead?
>>>>
>>>
>>> That would protect against the pseudo-NMIs, but you can still get an
>>> SDEI at that point even with all daif bits set. Or did I misunderstand
>>> how SDEI works?
>>>
>>
>> I don't know the details of SDEI. From looking at this patch, the
>> logical conclusion would be that SDEIs can then only be delivered once
>> we've called nmi_enter, but since we don't call this directly from the
>> code that clears TGE for doing guest TLB invalidation (or do we?) then
>> masking interrupts at the PSTATE level should be sufficient.
>>
>> Surely I'm missing some part of the bigger picture here.
>>
>
> I'm not sure I understand. SDEI uses the NMI context and AFAIU, it is an
> interrupt that the firmware sends to the OS, and it is sent regardless
> of the PSTATE at the OS EL.
I don't think we can describe SDEI as an interrupt. It is not even an
exception. It is just EL3 ERET-ing to a pre-defined location. And yes,
it will completely ignore any form of mask bit.
>
> So, the worrying part is:
> - Hyp clears TGE
> - Exception/interrupt taken to EL3
> - Firmware decides it's a good time to send an SDEI to the OS
> - SDEI handler (at EL2 for VHE) does nmi_enter()
> - SDEI handler needs to do cache invalidation or something with the
> EL2&0 translation regime but TGE is cleared
>
> We don't expect the code that clears TGE to call nmi_enter().
Indeed. Without this patch, SDEI is already broken. Pseudo-NMIs only
make the bug easier to trigger.
Thanks,
M.
--
Jazz is not dead. It just smells funny...
next prev parent reply other threads:[~2019-01-31 9:53 UTC|newest]
Thread overview: 81+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-21 15:33 [PATCH v9 00/26] arm64: provide pseudo NMI with GICv3 Julien Thierry
2019-01-21 15:33 ` [PATCH v9 01/26] arm64: Fix HCR.TGE status for NMI contexts Julien Thierry
2019-01-28 11:48 ` James Morse
2019-01-28 15:42 ` Julien Thierry
2019-01-31 8:19 ` Christoffer Dall
2019-01-31 8:56 ` Julien Thierry
2019-01-31 9:27 ` Christoffer Dall
2019-01-31 9:40 ` Julien Thierry
2019-01-31 9:48 ` Christoffer Dall
2019-01-31 9:53 ` Marc Zyngier [this message]
2019-01-21 15:33 ` [PATCH v9 02/26] arm64: Remove unused daif related functions/macros Julien Thierry
2019-01-28 9:21 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 03/26] arm64: cpufeature: Set SYSREG_GIC_CPUIF as a boot system feature Julien Thierry
2019-01-28 9:22 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 04/26] arm64: cpufeature: Add cpufeature for IRQ priority masking Julien Thierry
2019-01-28 9:24 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 05/26] arm/arm64: gic-v3: Add PMR and RPR accessors Julien Thierry
2019-01-28 9:25 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 06/26] irqchip/gic-v3: Switch to PMR masking before calling IRQ handler Julien Thierry
2019-01-28 9:30 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 07/26] arm64: ptrace: Provide definitions for PMR values Julien Thierry
2019-01-28 9:37 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 08/26] arm64: Make PMR part of task context Julien Thierry
2019-01-28 9:42 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 09/26] arm64: Unmask PMR before going idle Julien Thierry
2019-01-22 15:23 ` Catalin Marinas
2019-01-22 20:18 ` Ard Biesheuvel
2019-01-23 8:56 ` Julien Thierry
2019-01-23 9:38 ` Ard Biesheuvel
2019-01-28 9:44 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 10/26] arm64: kvm: Unmask PMR before entering guest Julien Thierry
2019-01-28 9:58 ` Marc Zyngier
2019-01-30 12:07 ` Christoffer Dall
2019-01-30 14:58 ` Julien Thierry
2019-01-21 15:33 ` [PATCH v9 11/26] efi: Let architectures decide the flags that should be saved/restored Julien Thierry
2019-01-21 15:42 ` Ard Biesheuvel
2019-01-23 9:04 ` Julien Thierry
2019-01-28 10:00 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 12/26] arm64: irqflags: Use ICC_PMR_EL1 for interrupt masking Julien Thierry
2019-01-21 15:45 ` Ard Biesheuvel
2019-01-21 18:05 ` Julien Thierry
2019-01-22 15:21 ` Catalin Marinas
2019-01-23 10:44 ` Julien Thierry
2019-01-30 11:52 ` Julien Thierry
2019-01-21 15:33 ` [PATCH v9 13/26] arm64: daifflags: Include PMR in daifflags restore operations Julien Thierry
2019-01-28 10:37 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 14/26] arm64: alternative: Allow alternative status checking per cpufeature Julien Thierry
2019-01-28 11:00 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 15/26] arm64: alternative: Apply alternatives early in boot process Julien Thierry
2019-01-28 11:17 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 16/26] irqchip/gic-v3: Factor group0 detection into functions Julien Thierry
2019-01-28 11:19 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 17/26] arm64: Switch to PMR masking when starting CPUs Julien Thierry
2019-01-28 11:21 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 18/26] arm64: gic-v3: Implement arch support for priority masking Julien Thierry
2019-01-28 11:23 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 19/26] irqchip/gic-v3: Detect if GIC can support pseudo-NMIs Julien Thierry
2019-01-28 11:39 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 20/26] irqchip/gic-v3: Handle pseudo-NMIs Julien Thierry
2019-01-28 11:59 ` Marc Zyngier
2019-01-29 11:33 ` Julien Thierry
2019-01-29 12:31 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 21/26] irqchip/gic: Add functions to access irq priorities Julien Thierry
2019-01-28 12:04 ` Marc Zyngier
2019-01-29 11:36 ` Julien Thierry
2019-01-21 15:33 ` [PATCH v9 22/26] irqchip/gic-v3: Allow interrupts to be set as pseudo-NMI Julien Thierry
2019-01-26 10:19 ` liwei (GF)
2019-01-26 10:41 ` Marc Zyngier
2019-01-28 8:57 ` Julien Thierry
2019-01-28 13:59 ` liwei (GF)
2019-01-28 14:49 ` Julien Thierry
2019-01-28 12:08 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 23/26] arm64: Handle serror in NMI context Julien Thierry
2019-01-28 12:26 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 24/26] arm64: Skip preemption when exiting an NMI Julien Thierry
2019-01-28 12:34 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 25/26] arm64: Skip irqflags tracing for NMI in IRQs disabled context Julien Thierry
2019-01-28 12:40 ` Marc Zyngier
2019-01-21 15:33 ` [PATCH v9 26/26] arm64: Enable the support of pseudo-NMIs Julien Thierry
2019-01-28 12:47 ` Marc Zyngier
2019-01-30 13:46 ` Julien Thierry
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3814b7ff-8d78-5f47-6eef-1b4e9bd7fd46@arm.com \
--to=marc.zyngier@arm.com \
--cc=arnd@arndb.de \
--cc=catalin.marinas@arm.com \
--cc=christoffer.dall@arm.com \
--cc=daniel.thompson@linaro.org \
--cc=james.morse@arm.com \
--cc=joel@joelfernandes.org \
--cc=julien.thierry@arm.com \
--cc=linux-arch@vger.kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=stable@vger.kernel.org \
--cc=will.deacon@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).