RE: aarch64 curr_el_sp0_irq/_AArch64_Exception_interrupt_nest use Incorrect sp
Kinsey Moore <kinsey.moore-lGxtRh3/[email protected]> Mon, 28 Oct 2024 18:20:51 +0000
| Newsgroups | gmane.os.rtems.user |
|---|---|
| Message-ID | <LV3PR19MB82784E5208B5B4B9D952239D904A2@LV3PR19MB8278.namprd19.prod.outlook.com> |
--===============8838732748329534300==
Content-Language: en-US
Content-Type: multipart/alternative;
boundary="_000_LV3PR19MB82784E5208B5B4B9D952239D904A2LV3PR19MB8278namp_"
--_000_LV3PR19MB82784E5208B5B4B9D952239D904A2LV3PR19MB8278namp_
Content-Type: text/plain; charset="iso-2022-jp"
Content-Transfer-Encoding: quoted-printable
Thanks for bringing this up. I couldn=1B$B!G=1B(Bt find the exact wording y=
ou mentioned, but I think this is what you=1B$B!G=1B(Bre referring to in th=
e current (K.a) revision of the ARM Architecture reference manual for ARMv8=
:
D1.3.2 Exception entry
When an exception is taken to an Exception level, ELx, that is using AArch6=
4 state, all the following occur:
* The contents of PSTATE immediately before the exception was taken is writ=
ten to SPSR_ELx.
* The preferred exception return address is written to ELR_ELx.
* The contents of PSTATE immediately after the exception is taken is as des=
cribed in rule RWTXBY.
* For synchronous exceptions and SError interrupts, exception syndrome info=
rmation is written to ESR_ELx.
* Execution starts from the exception vector at the target Exception level.
When an exception is taken to an Exception level, ELx, that is using AArch6=
4 state, after recording the previous
values in SPSR_ELx, the following PSTATE bits are set:
* PSTATE.EL is set to the target Exception level.
* All of PSTATE.{D, A, I, F, SP, TCO, PM} are set to 1.
=1B$B!D=1B(B
It=1B$B!G=1B(Bs likely that this is transparently working by accident since=
nested interrupts occur and any stack usage is unrolled/undone before any =
dispatching can occur. The one place where this might actually show up as a=
n issue is when the thread stack pointer is corrupted/misaligned, but that =
would trigger a non-irq exception which follows a different code path and l=
ikely does not allow for nested interrupts. This has been written up as an =
issue on the RTEMS GitLab instance: https://gitlab.rtems.org/rtems/rtos/rte=
ms/-/issues/5140
Thanks,
Kinsey
From: users <[email protected]> On Behalf Of [email protected]
Sent: Sunday, October 27, 2024 22:09
To: [email protected]
Subject: aarch64 curr_el_sp0_irq/_AArch64_Exception_interrupt_nest use Inco=
rrect sp
Hi=1B$B!'=1B(B
curr_el_sp0_irq/_AArch64_Exception_interrupt_nest may use Incorrect sp.=
ARM-ARM described "on exception entry to Elx, SP_ELx is automatically sel=
ected. so when curr_el_sp0_irq/_AArch64_Exception_interrupt_nest will use s=
p_el1(this is task sp not interrupt sp) . Use gdb to verify curr_el_sp0_ir=
q/_AArch64_Exception_interrupt_nest really use Incorrect sp.
--_000_LV3PR19MB82784E5208B5B4B9D952239D904A2LV3PR19MB8278namp_
Content-Type: text/html; charset="iso-2022-jp"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-2022-=
jp">
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Aptos;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:SimSun;
mso-fareast-language:ZH-CN;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"#467886" vlink=3D"#96607D" style=3D"word-wrap:=
break-word">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US">Thanks for bringing this u=
p. I couldn=1B$B!G=1B(Bt find the exact wording you mentioned, but I think =
this is what you=1B$B!G=1B(Bre referring to in the current (K.a) revision
of the ARM Architecture reference manual for ARMv8:<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></=
p>
<p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:"=
;Aptos",sans-serif;mso-fareast-language:EN-US">D1.3.2 Exception entry<=
o:p></o:p></span></b></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US">When an exception is taken=
to an Exception level, ELx, that is using AArch64 state, all the following=
occur:<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US">• The contents of PS=
TATE immediately before the exception was taken is written to SPSR_ELx.<o:p=
></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US">• The preferred exce=
ption return address is written to ELR_ELx.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US">• The contents of PS=
TATE immediately after the exception is taken is as described in rule RWTXB=
Y.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US">• For synchronous ex=
ceptions and SError interrupts, exception syndrome information is written t=
o ESR_ELx.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US">• Execution starts f=
rom the exception vector at the target Exception level.<o:p></o:p></span></=
p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US">When an exception is taken=
to an Exception level, ELx, that is using AArch64 state, after recording t=
he previous<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US">values in SPSR_ELx, the fo=
llowing PSTATE bits are set:<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US">• PSTATE.EL is set t=
o the target Exception level.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:"=
;Aptos",sans-serif;mso-fareast-language:EN-US">• All of PSTATE.{=
D, A, I, F, SP, TCO, PM} are set to 1.<o:p></o:p></span></b></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US">=1B$B!D=1B(B<o:p></o:p></s=
pan></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></=
p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US">It=1B$B!G=1B(Bs likely tha=
t this is transparently working by accident since nested interrupts occur a=
nd any stack usage is unrolled/undone before any dispatching
can occur. The one place where this might actually show up as an issue is =
when the thread stack pointer is corrupted/misaligned, but that would trigg=
er a non-irq exception which follows a different code path and likely does =
not allow for nested interrupts.
This has been written up as an issue on the RTEMS GitLab instance: <a href=
=3D"https://gitlab.rtems.org/rtems/rtos/rtems/-/issues/5140">
https://gitlab.rtems.org/rtems/rtos/rtems/-/issues/5140</a><o:p></o:p></spa=
n></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></=
p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US">Thanks,<o:p></o:p></span><=
/p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US">Kinsey<o:p></o:p></span></=
p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap=
tos",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></=
p>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in =
0in 0in">
<p class=3D"MsoNormal" style=3D"margin-left:.5in"><b><span style=3D"font-si=
ze:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span=
style=3D"font-size:11.0pt;font-family:"Calibri",sans-serif"> use=
rs <[email protected]>
<b>On Behalf Of </b>[email protected]<br>
<b>Sent:</b> Sunday, October 27, 2024 22:09<br>
<b>To:</b> [email protected]<br>
<b>Subject:</b> aarch64 curr_el_sp0_irq/_AArch64_Exception_interrupt_nest u=
se Incorrect sp<o:p></o:p></span></p>
</div>
<p class=3D"MsoNormal" style=3D"margin-left:.5in"><o:p> </o:p></p>
<p class=3D"MsoNormal" style=3D"margin-left:.5in"><span style=3D"font-size:=
10.0pt;font-family:"Verdana",sans-serif">Hi</span><span lang=3D"Z=
H-CN" style=3D"font-size:10.0pt">=1B$B!'=1B(B</span><span style=3D"font-siz=
e:10.0pt;font-family:"Verdana",sans-serif"><o:p></o:p></span></p>
<div>
<p class=3D"MsoNormal" style=3D"margin-left:.5in"><span style=3D"font-size:=
10.0pt;font-family:"Verdana",sans-serif"> curr_=
el_sp0_irq/_AArch64_Exception_interrupt_nest may use Incorrect sp.&nbs=
p; ARM-ARM described "on exception entry to Elx, SP_ELx is automatical=
ly
selected. so when curr_el_sp0_irq/_AArch64_Exception_interrupt_nest w=
ill use sp_el1(this is task sp not interrupt sp) . Use gdb to verify =
curr_el_sp0_irq/_AArch64_Exception_interrupt_nest really use Incorrect sp.<=
o:p></o:p></span></p>
</div>
</div>
</body>
</html>
--_000_LV3PR19MB82784E5208B5B4B9D952239D904A2LV3PR19MB8278namp_--
--===============8838732748329534300==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
users mailing list
[email protected]
http://lists.rtems.org/mailman/listinfo/users
--===============8838732748329534300==--