| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAD=FV=WJzdhqnztNtj7p5S365wVPcgs2Kya_4bVwqeDWFojUrQ@mail.gmail.com>
Date: Fri, 14 Aug 2020 07:57:29 -0700
From: Doug Anderson <dianders@...omium.org>
To: Sumit Garg <sumit.garg@...aro.org>
Cc: Peter Zijlstra <peterz@...radead.org>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Daniel Thompson <daniel.thompson@...aro.org>,
linux-serial@...r.kernel.org, kgdb-bugreport@...ts.sourceforge.net,
Jiri Slaby <jslaby@...e.com>,
Russell King - ARM Linux <linux@...linux.org.uk>,
Jason Wessel <jason.wessel@...driver.com>,
LKML <linux-kernel@...r.kernel.org>,
Linux ARM <linux-arm-kernel@...ts.infradead.org>
Subject: Re: [RFC 1/5] tty/sysrq: Make sysrq handler NMI aware
Hi,
On Fri, Aug 14, 2020 at 12:24 AM Sumit Garg <sumit.garg@...aro.org> wrote:
>
> + Peter (author of irq_work.c)
>
> On Thu, 13 Aug 2020 at 05:30, Doug Anderson <dianders@...omium.org> wrote:
> >
> > Hi,
> >
> > On Tue, Jul 21, 2020 at 5:10 AM Sumit Garg <sumit.garg@...aro.org> wrote:
> > >
> > > In a future patch we will add support to the serial core to make it
> > > possible to trigger a magic sysrq from an NMI context. Prepare for this
> > > by marking some sysrq actions as NMI safe. Safe actions will be allowed
> > > to run from NMI context whilst that cannot run from an NMI will be queued
> > > as irq_work for later processing.
> > >
> > > A particular sysrq handler is only marked as NMI safe in case the handler
> > > isn't contending for any synchronization primitives as in NMI context
> > > they are expected to cause deadlocks. Note that the debug sysrq do not
> > > contend for any synchronization primitives. It does call kgdb_breakpoint()
> > > to provoke a trap but that trap handler should be NMI safe on
> > > architectures that implement an NMI.
> > >
> > > Signed-off-by: Sumit Garg <sumit.garg@...aro.org>
> > > ---
> > > drivers/tty/sysrq.c | 33 ++++++++++++++++++++++++++++++++-
> > > include/linux/sysrq.h | 1 +
> > > kernel/debug/debug_core.c | 1 +
> > > 3 files changed, 34 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
> > > index 7c95afa9..8017e33 100644
> > > --- a/drivers/tty/sysrq.c
> > > +++ b/drivers/tty/sysrq.c
> > > @@ -50,6 +50,8 @@
> > > #include <linux/syscalls.h>
> > > #include <linux/of.h>
> > > #include <linux/rcupdate.h>
> > > +#include <linux/irq_work.h>
> > > +#include <linux/kfifo.h>
> > >
> > > #include <asm/ptrace.h>
> > > #include <asm/irq_regs.h>
> > > @@ -111,6 +113,7 @@ static const struct sysrq_key_op sysrq_loglevel_op = {
> > > .help_msg = "loglevel(0-9)",
> > > .action_msg = "Changing Loglevel",
> > > .enable_mask = SYSRQ_ENABLE_LOG,
> > > + .nmi_safe = true,
> > > };
> > >
> > > #ifdef CONFIG_VT
> > > @@ -157,6 +160,7 @@ static const struct sysrq_key_op sysrq_crash_op = {
> > > .help_msg = "crash(c)",
> > > .action_msg = "Trigger a crash",
> > > .enable_mask = SYSRQ_ENABLE_DUMP,
> > > + .nmi_safe = true,
> > > };
> > >
> > > static void sysrq_handle_reboot(int key)
> > > @@ -170,6 +174,7 @@ static const struct sysrq_key_op sysrq_reboot_op = {
> > > .help_msg = "reboot(b)",
> > > .action_msg = "Resetting",
> > > .enable_mask = SYSRQ_ENABLE_BOOT,
> > > + .nmi_safe = true,
> > > };
> > >
> > > const struct sysrq_key_op *__sysrq_reboot_op = &sysrq_reboot_op;
> > > @@ -217,6 +222,7 @@ static const struct sysrq_key_op sysrq_showlocks_op = {
> > > .handler = sysrq_handle_showlocks,
> > > .help_msg = "show-all-locks(d)",
> > > .action_msg = "Show Locks Held",
> > > + .nmi_safe = true,
> > > };
> > > #else
> > > #define sysrq_showlocks_op (*(const struct sysrq_key_op *)NULL)
> > > @@ -289,6 +295,7 @@ static const struct sysrq_key_op sysrq_showregs_op = {
> > > .help_msg = "show-registers(p)",
> > > .action_msg = "Show Regs",
> > > .enable_mask = SYSRQ_ENABLE_DUMP,
> > > + .nmi_safe = true,
> > > };
> > >
> > > static void sysrq_handle_showstate(int key)
> > > @@ -326,6 +333,7 @@ static const struct sysrq_key_op sysrq_ftrace_dump_op = {
> > > .help_msg = "dump-ftrace-buffer(z)",
> > > .action_msg = "Dump ftrace buffer",
> > > .enable_mask = SYSRQ_ENABLE_DUMP,
> > > + .nmi_safe = true,
> > > };
> > > #else
> > > #define sysrq_ftrace_dump_op (*(const struct sysrq_key_op *)NULL)
> > > @@ -538,6 +546,23 @@ static void __sysrq_put_key_op(int key, const struct sysrq_key_op *op_p)
> > > sysrq_key_table[i] = op_p;
> > > }
> > >
> > > +#define SYSRQ_NMI_FIFO_SIZE 64
> > > +static DEFINE_KFIFO(sysrq_nmi_fifo, int, SYSRQ_NMI_FIFO_SIZE);
> >
> > A 64-entry FIFO seems excessive. Quite honestly even a FIFO seems a
> > bit excessive and it feels like if two sysrqs were received in super
> > quick succession that it would be OK to just process the first one. I
> > guess if it simplifies the processing to have a FIFO then it shouldn't
> > hurt, but no need for 64 entries.
> >
>
> Okay, would a 2-entry FIFO work here? As here we need a FIFO to pass
> on the key parameter.
...or even a 1-entry FIFO if that makes sense?
> > > +static void sysrq_do_nmi_work(struct irq_work *work)
> > > +{
> > > + const struct sysrq_key_op *op_p;
> > > + int key;
> > > +
> > > + while (kfifo_out(&sysrq_nmi_fifo, &key, 1)) {
> > > + op_p = __sysrq_get_key_op(key);
> > > + if (op_p)
> > > + op_p->handler(key);
> > > + }
> >
> > Do you need to manage "suppress_printk" in this function? Do you need
> > to call rcu_sysrq_start() and rcu_read_lock()?
>
> Ah I missed those. Will add them here instead.
>
> >
> > If so, how do you prevent racing between the mucking we're doing with
> > these things and the mucking that the NMI does with them?
>
> IIUC, here you meant to highlight the race while scheduled sysrq is
> executing in IRQ context and we receive a new sysrq in NMI context,
> correct? If yes, this seems to be a trickier situation. I think the
> appropriate way to handle it would be to deny any further sysrq
> handling until the prior sysrq handling is complete, your views?
The problem is that in some cases you're running NMIs directly at FIQ
time and other cases you're running them at IRQ time. So you
definitely can't just move it to NMI.
Skipping looking for other SYSRQs until the old one is complete sounds
good to me. Again my ignorance will make me sound like a fool,
probably, but can you use the kfifo as a form of mutual exclusion? If
you have a 1-entry kfifo, maybe:
1. First try to add to the "FIFO". If it fails (out of space) then a
sysrq is in progress. Ignore this one.
2. Decide if you're NMI-safe or not.
3. If NMI safe, modify "suppress_printk", call rcu functions, then
call the handler. Restore suppress_printk and then dequeue from FIFO.
4. If not-NMI safe, the irq worker would "peek" into the FIFO, do its
work (wrapped with "suppress_printk" and the like), and not dequeue
until it's done.
In the above you'd use the FIFO as a locking mechanism. I don't know
if that's a valid use of it or if there is a better NMI-safe mechanism
for this. I think the kfifo docs talk about only one reader and one
writer and here we have two readers, so maybe it's illegal. It also
seems weird to have a 1-entry "FIFO" and feels like there's probably a
better data structure for this.
Powered by blists - more mailing lists