Re: [PATCH 06/17] arm64/booting: Document boot requirements for FEAT_NMI

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `isb()` after writing to the `MDSCR_EL1` control-plane system register.
--

commit 46ea647f84f4a1084bfe385f4fadb172648a5a6f
Author: Mark Brown <broonie@kernel.org>

arm64/booting: Document boot requirements for FEAT_NMI
    
In order to use FEAT_NMI we must be able to use ALLINT, require that it
behave as though not trapped when it is present.

Link: https://lore.kernel.org/r/20221112151708.175147-2-broonie@kernel.org

> diff --git a/Documentation/arch/arm64/booting.rst b/Documentation/arch/arm64/booting.rst
> index 13ef311dace83..aaabe8fa4cdd7 100644
> --- a/Documentation/arch/arm64/booting.rst
> +++ b/Documentation/arch/arm64/booting.rst
> @@ -419,6 +419,12 @@ Before jumping into the kernel, the following conditions must be met:
>  
>      - HCR_EL2.ATA (bit 56) must be initialised to 0b1.
>  
> +  For CPUs with Non-maskable Interrupts (FEAT_NMI):
> +
> +  - If the kernel is entered at EL1 and EL2 is present:
> +
> +    - HCRX_EL2.TALLINT must be initialised to 0b0.
> +
>    For CPUs with the Scalable Matrix Extension version 2 (FEAT_SME2):
>  
>    - If EL3 is present:

[Severity: High]
This isn't a bug introduced by this patch, but there is a pre-existing issue
in arch/arm64/kernel/debug-monitors.c:

arch/arm64/kernel/debug-monitors.c:mdscr_write() {
	struct exception_mask mask;

	mask = local_exception_save_and_mask();
	write_sysreg(mdscr, mdscr_el1);
	local_exception_restore(mask);
}

Is an isb() missing after writing to the MDSCR_EL1 control-plane system
register?

The write_sysreg(mdscr, mdscr_el1) call is not immediately followed by an isb()
instruction. Instead, local_exception_restore() executes multiple instructions
against architecturally undefined pipeline state.

Can this missing context synchronization cause the CPU to operate under a stale
configuration for several cycles?

Because this path is reachable by unprivileged userspace via the ptrace system
call, could this lead to unexpected traps or violations of architectural
invariants?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703100135.2512312-1-ruanjinjie@huawei.com?part=6