Re: [PATCH v2] xen/arm64: correctly emulate the {w, x}zr registers

[Stefano Stabellini <stefano.stabellini@eu.citrix.com>]

On Fri, 15 Jan 2016, Ian Campbell wrote:
> From: Julien Grall <julien.grall@citrix.com>
> 
> On AArch64, encoding 31 for an R<n> in the HSR is used to represent
> either {w,x}sp or {w,x}zr (See C1.2.4 in ARM DDI 0486A.d) depending on
> how the register field is interpreted by the instruction.
> 
> All the instructions trapped by Xen (either via a sysreg access or
> data abort) interpret encoding 31 as {w,x}zr. Therefore we don't have
> to worry about the possibility that a trap could refer to sp or about
> decoding the instruction.
> 
> For example AArch64 LDR and STR can have zr in the source/target
> register <Xt>, but never sp. sp can be present in the destination
> pointer( i.e.  "[sp]"), but that would be represented by the value of
> FAR_EL2, not in the HSR.
> 
> For AArch32 it is possible for a LDR to target the PC, but this would
> not result in a valid ISS in the HSR register. However this could only
> occur if loading or storing the PC to MMIO, which we simply choose not
> to support for now.
> 
> Finally, features such as xenaccess can lead to us trapping on
> arbitrary instructions accessing RAM and not just for MMIO. However in
> many such cases HSR.ISS is not valid and in general features such as
> xenaccess do not rely on the nature of the specific instruction, they
> resolve the fault (via information found elsewhere e.g. FAR_EL2)
> without needing to know anything about the instruction which triggered
> the trap.
> 
> The register zr represents the zero register, i.e it will always
> return 0 and write to it is ignored. To properly handle this property,
> 2 new helpers have been introduced {get,set}_user_reg to read/write a
> value from/to a register. All the calls to select_user_reg have been
> replaced by these 2 helpers.
> 
> Furthermore, the code to emulate encoding 31 in select_user_reg has been
> dropped because it was invalid. For Aarch64 context, the encoding is
> used for sp or zr. For AArch32 context, the ISS won't be valid for data
> abort from AArch32 using r15 (i.e pc) as source/destination (See D7-1881
> ARM DDI 0487A.d, note the validity is more restrictive than on ARMv7).
> It's also not possible to use r15 in co-processor instructions.
> 
> This patch fixes setting MMIO register and sysreg to a random value
> (actually PC) instead of zero by something like:
> 
> *((volatile int*)reg) = 0;
> 
> compilers tend to generate "str wzr, [xx]" here.
> 
> Reported-by: Marc Zyngier <Marc.Zyngier@arm.com>
> Signed-off-by: Julien Grall <julien.grall@citrix.com>
> 
> Added BUG_ON to select_user_reg for {w,x}zr case.
> 
> Clarified bits of the commit message by attempting to enumerate some
> of the cases which might be a concern in order to show why they are
> not.
> 
> Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
> ---
> v2: ijc: Took over the series, changes above.

I read the patch and looks good to me. You can add my

Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

I have a couple of minor comments, which you can ignore or address as
you commit the patch.


> +register_t get_user_reg(struct cpu_user_regs *regs, int reg)
> +{
> +#ifdef CONFIG_ARM_64
> +    /*
> +     * For store/load and sysreg instruction, the encoding 31 always
> +     * correspond to {w,x}zr which is the zero register.
> +     */
> +    if ( reg == 31 )
> +        return 0;
> +#endif
> +
> +    return *select_user_reg(regs, reg);
> +}
> +
> +void set_user_reg(struct cpu_user_regs *regs, int reg, register_t value)
> +{
> +#ifdef CONFIG_ARM_64
> +    /*
> +     * For store/load and sysreg instruction, the encoding 31 always
> +     * correspond to {w,x}zr which is the zero register.
> +     */
> +    if ( reg == 31 )
> +        return;
> +#endif

Couldn't we call a static inline function which is implemented
differently on CONFIG_ARM_64 and CONFIG_ARM_32 to do the reg == 31
check?



> +    *select_user_reg(regs, reg) = value;
> +}
> +
>  static const char *decode_fsc(uint32_t fsc, int *level)
>  {
>      const char *msg = NULL;
> @@ -1803,6 +1834,7 @@ static void do_cp15_32(struct cpu_user_regs *regs,
>          inject_undef_exception(regs, hsr);
>          return;
>      }
> +
>      advance_pc(regs, hsr);
>  }

Spurious change