From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 04F95CD11C2 for ; Tue, 19 Mar 2024 15:48:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=TWm1QUXZq9XDDDWiHNO2v0BCYjdudBrNPR0hHezeHFQ=; b=hIeuWF1LJDAHua VzTqq6igoiRckA4RT+Ht93Nrv0Yt7Jt9tFTkMk99k0kdAk26fQLO/0f9WXrcf9yPG/k5zUfoquIEh EiKFV0zR1BD7bzJjBdRuQXe2ilmmlzOq3spQCUJEVvFQML7QgApH/Ftbku9doGzhDqPUSN/BnZ1sd s8bl0vbrCmpwEXqOOft0CPnjpO1SGQkcF/3sklIYNfRFSlOurvk3I8i+ZsVqof4BiwnFlDHCcw4iW LMNi+KD0roCDCKSfPq5M3YJNVUQT35fruA0DUA4GxBP3obIAoHNoEMGmyNH3cbabQ9s9y6EjNe+ZI cXkpuwEr+ErogPapsdAQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rmbhB-0000000DDbZ-2gh5; Tue, 19 Mar 2024 15:48:09 +0000 Received: from sin.source.kernel.org ([145.40.73.55]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1rmbh7-0000000DDYe-2aIm for linux-arm-kernel@lists.infradead.org; Tue, 19 Mar 2024 15:48:08 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id 957A9CE018A; Tue, 19 Mar 2024 15:48:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 11012C433F1; Tue, 19 Mar 2024 15:47:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1710863281; bh=eHlATGPtHi4Dvca5jjoXEJntrvdbTpLgFF3K6HWMAzY=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=VsE+Dgj7KK5X9edOigr2E9e0soVH+z1IP9FfEPEuF2WC5aZzxXt8QUODUToTIwdWA TSPeAV/m5dgZiwVBZy90MnQQ2RNSdiLA9yaPtSRLQQzU/AEWAjcxcwKcbbDoyGTlZK GlXC/lllWrTuWCvXbilzgE3r129QA0y2Ob7DGXN6uNylVU3NeQXDJG0X0KfRK+QUb6 aMnjD5FMNGWA6xhWtzJTEi1l6tzWDhvUgfNzAuh8dwlu7zkFCLYRQxJgBxm+aQSzgZ M+2Zsx5jNwi40c3wns11IgtOBLZK93TYDsR5ys30AHgc6wbRIscvljvw1d+riJF9Kh oCF7zuBJr3/Yw== Date: Tue, 19 Mar 2024 15:47:56 +0000 From: Will Deacon To: Robin Murphy Cc: Tyler Hicks , Jason Gunthorpe , Jerry Snitselaar , linux-arm-kernel@lists.infradead.org, iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Dexuan Cui , Easwar Hariharan Subject: Re: Why is the ARM SMMU v1/v2 put into bypass mode on kexec? Message-ID: <20240319154756.GB2901@willie-the-truck> References: <120d0dec-450f-41f8-9e05-fd763e84f6dd@arm.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <120d0dec-450f-41f8-9e05-fd763e84f6dd@arm.com> User-Agent: Mutt/1.10.1 (2018-07-13) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240319_084806_082418_02EBAF64 X-CRM114-Status: GOOD ( 40.83 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Tue, Mar 19, 2024 at 12:57:52PM +0000, Robin Murphy wrote: > On 2024-03-14 7:06 pm, Tyler Hicks wrote: > > On 2024-03-14 09:55:46, Tyler Hicks wrote: > > > Given that drivers are only optionally asked to implement the .shutdown > > > hook, which is required to properly quiesce devices before a kexec, why > > > is it that we put the ARM SMMU v1/v2 into bypass mode in the arm-smmu > > > driver's own .shutdown hook? > > > > > > arm_smmu_device_shutdown() -> set SMMU_sCR0.CLIENTPD bit to 1 > > > > > > Driver authors often forget to even implement a .shutdown hook, which > > > results in some hard-to-debug memory corruption issues in the kexec'ed > > > target kernel due to pending DMA operations happening on untranslated > > > addresses. Why not leave the SMMU in translate mode but clear the stream > > > mapping table (or maybe even call arm_smmu_device_reset()) in the SMMU's > > > .shutdown hook to prevent the memory corruption from happening in the > > > first place? > > > > > > Fully acknowledging that the proper fix is to quiesce the devices, I > > > feel like resetting the SMMU and leaving it in translate mode across > > > kexec would be more consistent with the intent behind v5.2 commit > > > 954a03be033c ("iommu/arm-smmu: Break insecure users by disabling bypass > > > by default"). The incoming transactions of devices, that weren't > > > properly quiesced during a kexec, would be blocked until their drivers > > > have a chance to reinitialize the devices in the new kernel. > > > > > > I appreciate any help understanding why bypass mode is utilized here as > > > I'm sure there are nuances that I haven't considered. Thank you! > > > > I now see that Will has previously mentioned that he'd be open to such a > > change: > > > > One thing I would be in favour of is changing the ->shutdown() code to > > honour disable_bypass=1 so that we put the SMMU in an aborting state > > instead of passthrough. Would that help at all? It would at least > > avoid the memory corruption on missing shutdown callback. > > > > - https://lore.kernel.org/linux-arm-kernel/20200608113852.GA3108@willie-the-truck/ > > > > Robin mentions the need to support kexec into a non-SMMU-aware OS. I > > hadn't considered that bit of complexity: > > > > ... consider if the first kernel *did* leave it enabled with whatever > > left-over translations in place, and kexec'ed into another OS that > > wasn't SMMU-aware... > > > > - https://lore.kernel.org/linux-arm-kernel/e072f61a-d6cf-2e34-efd5-c1db38c5c622@arm.com/ > > > > Now that we're 3-4 years removed from that conversation, has anything > > changed? Will, is there anything we'd need to watch out for if we were > > to prototype this sort of change? For example, would it be wise to > > disable fault interrupts when putting the SMMU in an aborting state > > before kexec'ing? I've grown older and wiser in those four years and no longer think that's a good idea :) Well, older maybe, but the reality is that the code around the driver has evolved and 'disable_bypass' is even more of a hack now than it used to be. > Fundamentally, we expect the SMMU to be disabled at initial boot, so per the > intent of kexec we put it back in that state. That also seems the most > likely expectation of anything we could kexec into, given that it is the > natural state of an untouched SMMU after a hard reset, and thus comes out as > the least-worst option. Heh, that sounded too good to be true when I read it so I went and looked at the code: SMMUv3: arm_smmu_device_shutdown() -> clears CR0 but doesn't touch GBPA SMMUv2: arm_smmu_device_shutdown() -> writes CLIENTPD to CR0 So it's a bit of a muddle afaict; SMMUv2 explicitly goes into bypass whereas SMMUv3 probably does honour disable_bypass=false! Did I miss something? As discussed elsewhere, if we remove disable_bypass from SMMUv3, then we should be able to be consistent here. The question is, what's the right behaviour? > Beyond properly quiescing and resetting the system back to a boot-time > state, the outgoing kernel in a kexec can only really do things which affect > itself. Sure, we *could* configure the SMMU to block all traffic and disable > the interrupt to avoid getting stuck in a storm of faults on the way out, > but what does that mean for the incoming kexec payload? That it can have the > pleasure of discovering the SMMU, innocently enabling the interrupt and > getting stuck in an unexpected storm of faults. Or perhaps just resetting > the SMMU into a disabled state and thus still unwittingly allowing its > memory to be corrupted by the previous kernel not supporting kexec properly. Right, it's hard to win if DMA-active devices weren't quiesced properly by the outgoing kernel. Either the SMMU was left in abort (leading to the problems you list above) or the SMMU is left in bypass (leading to possible data corruption). Which is better? The best solution is obviously to implement those missing ->shutdown() callbacks. Will _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel