Re: [Xen-devel] [for-4.7] xen/arm64: correctly emulate the {w, x}zr registers

["Jan Beulich" <JBeulich@xxxxxxxx>]

>>> On 07.04.16 at 12:53, <julien.grall@xxxxxxx> wrote:
> On AArch64, encoding 31 for an R<n> in the HSR is used to represent
> either {w,x}sp or {w,x}zr (See C1.2.4 in ARM DDI 0486A.d) depending on
> how the register field is interpreted by the instruction.
> 
> All the instructions trapped by Xen (either via a sysreg access or
> data abort) interpret encoding 31 as {w,x}zr. Therefore we don't have
> to worry about the possibility that a trap could refer to sp or about
> decoding the instruction.
> 
> For example AArch64 LDR and STR can have zr in the source/target
> register <Xt>, but never sp. sp can be present in the destination
> pointer( i.e.  "[sp]"), but that would be represented by the value of
> FAR_EL2, not in the HSR.
> 
> For AArch32 it is possible for a LDR to target the PC, but this would
> not result in a valid ISS in the HSR register. However this could only
> occur if loading or storing the PC to MMIO, which we simply choose not
> to support for now.
> 
> Finally, features such as xenaccess can lead to us trapping on
> arbitrary instructions accessing RAM and not just for MMIO. However in
> many such cases HSR.ISS is not valid and in general features such as
> xenaccess do not rely on the nature of the specific instruction, they
> resolve the fault (via information found elsewhere e.g. FAR_EL2)
> without needing to know anything about the instruction which triggered
> the trap.
> 
> The register zr represents the zero register, i.e it will always
> return 0 and write to it is ignored. To properly handle this property,
> 2 new helpers have been introduced {get,set}_user_reg to read/write a
> value from/to a register. All the calls to select_user_reg have been
> replaced by these 2 helpers.
> 
> Furthermore, the code to emulate encoding 31 in select_user_reg has been
> dropped because it was invalid. For Aarch64 context, the encoding is
> used for sp or zr. For AArch32 context, the ISS won't be valid for data
> abort from AArch32 using r15 (i.e pc) as source/destination (See D7-1881
> ARM DDI 0487A.d, note the validity is more restrictive than on ARMv7).
> It's also not possible to use r15 in co-processor instructions.
> 
> This patch fixes setting MMIO register and sysreg to a random value
> (actually PC) instead of zero by something like:
> 
> *((volatile int*)reg) = 0;
> 
> compilers tend to generate "str wzr, [xx]" here.
> 
> [ian: added BUG_ON to select_user_reg and clarified bits of the commit 
> message]
> Reported-by: Marc Zyngier <Marc.Zyngier@xxxxxxx>
> Signed-off-by: Julien Grall <julien.grall@xxxxxxx>
> Signed-off-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
> Reviewed-by: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
> 
> ---
> 
> Stefano, let me know the new helper corresponds to change you requested
> (see [1])
> 
> This patch is a bug fix for Xen 4.7. Without it, a MMIO register and
> sysreg will be set to a random value (actually PC) when the zero
> register is used.
> 
> I'm not sure if we should consider this patch to be backported to Xen
> 4.6 and Xen 4.5. It depends on other patches and it would require some
> rework to backport it alone.
> 
> [1] 
> http://lists.xenproject.org/archives/html/xen-devel/2016-02/msg03100.html 

So the tags and alike would suggest this is ready to be committed,
but the lack of a version number or version history don't really
help support this. Could you please clarify the state of this patch?

Jan


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel