linux-kernel - Re: [PATCH] iommu: arm-smmu: Set SCTLR.HUPCF bit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAF6AEGuV2zh97iq+TgkRw0bK3VNSxJieD1N2KMW3N28h07M+0w@mail.gmail.com>
Date:   Tue, 13 Nov 2018 08:12:35 -0500
From:   Rob Clark <robdclark@...il.com>
To:     Will Deacon <will.deacon@....com>
Cc:     "list@....net:IOMMU DRIVERS <iommu@...ts.linux-foundation.org>, Joerg
        Roedel <joro@...tes.org>," <iommu@...ts.linux-foundation.org>,
        Robin Murphy <robin.murphy@....com>,
        "moderated list:ARM/FREESCALE IMX / MXC ARM ARCHITECTURE" 
        <linux-arm-kernel@...ts.infradead.org>,
        freedreno <freedreno@...ts.freedesktop.org>,
        linux-arm-msm <linux-arm-msm@...r.kernel.org>,
        "list@....net:IOMMU DRIVERS <iommu@...ts.linux-foundation.org>, Joerg
        Roedel <joro@...tes.org>," <joro@...tes.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] iommu: arm-smmu: Set SCTLR.HUPCF bit

On Tue, Nov 13, 2018 at 1:32 AM Will Deacon <will.deacon@....com> wrote:
>
> On Fri, Nov 09, 2018 at 01:01:55PM -0500, Rob Clark wrote:
> > On Mon, Oct 29, 2018 at 3:09 PM Will Deacon <will.deacon@....com> wrote:
> > > On Thu, Sep 27, 2018 at 06:46:07PM -0400, Rob Clark wrote:
> > > > We seem to need to set either this or CFCFG (stall), otherwise gpu
> > > > faults trigger problems with other in-flight transactions from the
> > > > GPU causing CP errors, etc.
> > > >
> > > > In the ARM SMMU spec, the 'Hit under previous context fault' bit is
> > > > described as:
> > > >
> > > >  '0' - Stall or terminate subsequent transactions in the presence
> > > >        of an outstanding context fault
> > > >  '1' - Process all subsequent transactions independently of any
> > > >        outstanding context fault.
> > > >
> > > > Since we don't enable CFCFG (stall) the behavior of terminating
> > > > other transactions makes sense.  And is probably not what we want
> > > > (and definately not what we want for GPU).
> > > >
> > > > Signed-off-by: Rob Clark <robdclark@...il.com>
> > > > ---
> > > > So I hit this issue a long time back on 820 (msm8996) and at the
> > > > time I solved it with a patch that enabled CFCFG.  And it resurfaced
> > > > more recently on sdm845.  But at the time CFCFG was rejected, iirc
> > > > because of concern that it would cause problems on other non-qcom
> > > > arm smmu implementations.  And I think I forgot to send this version
> > > > of the solution.
> > > >
> > > > If enabling HUPCF is anticipated to cause problems on other ARM
> > > > SMMU implementations, I think I can come up with a variant of this
> > > > patch which conditionally enables it for snapdragon.
> > > >
> > > > Either way, I'd really like to get some variant of this fix merged
> > > > (and probably it would be a good idea for stable kernel branches
> > > > too), since current behaviour with the GPU means faults turn into
> > > > a fantastic cascade of fail.
> > >
> > > Can you describe how this fantastic cascade of fail improves with this
> > > patch, please? If you're getting context faults then something has already
> > > gone horribly wrong, so I'm trying to work out how this improves things.
> > >
> >
> > There are plenty of cases where getting iommu faults with a GPU is
> > "normal", or at least not something the kernel or even GL driver can
> > control.
>
> Such as? All the mainline driver does is print a diagnostic and clear the
> fault, which doesn't seem generally useful.

it is useful to debug the fault ;-)

Although eventually we'll want to be able to do more than that, like
have the fault trigger bringing in pages of a mmap'd file and that
sort of thing.

> > With this patch, you still get the iommu fault, but it doesn't cause
> > the gpu to crash.  But without it, other memory accesses in flight
> > while the fault occurs, like the GPU command-processor reading further
> > ahead in the cmdstream to setup next draw, would return zero's,
> > causing the GPU to crash or get into a bad state.
>
> I get that part, but I don't understand why we're seeing faults in the first
> place and I worry that this patch is just the tip of the iceberg. It's also
> not clear that processing subsequent transactions is always the right thing
> to do in a world where we actually want to report (and handle) synchronous
> faults from devices.

Sure, it is a bug.. but it can be an application bug that is not
something the userspace GL driver or kernel could do anything about.
We shouldn't let this kill the GPU.  If the application didn't have
this much control, we wouldn't need an IOMMU in the first place[1].
With opencl compute, the userspace controlled shader has full blown
pointers to GPU memory.

And even in cases where it is a userspace GL driver bug, having some
robustness to not completely kill the GPU makes debugging much easier.
Something I do a lot when bringing up support for a new generation of
GPU.

I'm having a hard time understanding your objection to this.
Returning zero's for non-faulting transactions is a *really bad idea*.

BR,
-R


[1] yes, vc4 did without an IOMMU.. but it also had to do some fairly
complex shader analysis in the kernel, and it was restricted to gles2
feature set, so no real flow control, and no memory access beyond
texture fetch.