From patchwork Thu Jul 28 14:51:29 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Julien Grall X-Patchwork-Id: 72989 Delivered-To: patch@linaro.org Received: by 10.140.29.52 with SMTP id a49csp895055qga; Thu, 28 Jul 2016 07:55:14 -0700 (PDT) X-Received: by 10.36.225.78 with SMTP id n75mr10414762ith.30.1469717708569; Thu, 28 Jul 2016 07:55:08 -0700 (PDT) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org. [192.237.175.120]) by mx.google.com with ESMTPS id k27si13492755ioo.50.2016.07.28.07.55.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 28 Jul 2016 07:55:08 -0700 (PDT) Received-SPF: neutral (google.com: 192.237.175.120 is neither permitted nor denied by best guess record for domain of xen-devel-bounces@lists.xen.org) client-ip=192.237.175.120; Authentication-Results: mx.google.com; spf=neutral (google.com: 192.237.175.120 is neither permitted nor denied by best guess record for domain of xen-devel-bounces@lists.xen.org) smtp.mailfrom=xen-devel-bounces@lists.xen.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1bSmfM-0002tQ-FL; Thu, 28 Jul 2016 14:52:04 +0000 Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1bSmfK-0002r6-S1 for xen-devel@lists.xen.org; Thu, 28 Jul 2016 14:52:02 +0000 Received: from [85.158.137.68] by server-9.bemta-3.messagelabs.com id 6E/1F-27233-21C1A975; Thu, 28 Jul 2016 14:52:02 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrOLMWRWlGSWpSXmKPExsVysyfVTVdQZla 4QcchZYslHxezODB6HN39mymAMYo1My8pvyKBNWNC4yXGgutyFac+fWJqYPwm2sXIxSEksIlR 4tqdN0wQzmlGiUftS1m7GDk52AQ0Je58/sQEYosISEtc+3yZEaSIWaCdUWJtfy8zSEJYIEbi3 d4lLCA2i4CqxNXFU8BsXgFnialrvzOC2BICchInj00GGsrBwSngIvG6WwgkLARUMn3mUsYJjN wLGBlWMWoUpxaVpRbpGpnpJRVlpmeU5CZm5ugaGhjr5aYWFyemp+YkJhXrJefnbmIEeriegYF xB2PDXr9DjJIcTEqivGGhM8OF+JLyUyozEosz4otKc1KLDzHKcHAoSfDekpoVLiRYlJqeWpGW mQMMNZi0BAePkgjvQ5A0b3FBYm5xZjpE6hSjopQ4L680UEIAJJFRmgfXBgvvS4yyUsK8jAwMD EI8BalFuZklqPKvGMU5GJWEeZtBxvNk5pXATX8FtJgJaHFx7AyQxSWJCCmpBsbF/ceStp98oH dBN1qa8ciWPex6p+YVSlWWpDA9ltd6+/PiJj0GrfOSO2d94rnKWS2eOXcv++r+MO8r851Crxg G5W3kvly2tv71QU599sbVpxaLb1jz5rmYfHrNh2xeCxnLVaKzjS/u3CPk+Kc9S8Yl4SVPqu+9 17EbHjC2829MeMJ37KxhrKoSS3FGoqEWc1FxIgBK0tzhagIAAA== X-Env-Sender: julien.grall@arm.com X-Msg-Ref: server-7.tower-31.messagelabs.com!1469717520!45359517!1 X-Originating-IP: [217.140.101.70] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 8.77; banners=-,-,- X-VirusChecked: Checked Received: (qmail 23809 invoked from network); 28 Jul 2016 14:52:01 -0000 Received: from foss.arm.com (HELO foss.arm.com) (217.140.101.70) by server-7.tower-31.messagelabs.com with SMTP; 28 Jul 2016 14:52:01 -0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id BD0FABB0; Thu, 28 Jul 2016 07:53:17 -0700 (PDT) Received: from e108454-lin.cambridge.arm.com (e108454-lin.cambridge.arm.com [10.1.218.32]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 88E413F21A; Thu, 28 Jul 2016 07:51:59 -0700 (PDT) From: Julien Grall To: xen-devel@lists.xen.org Date: Thu, 28 Jul 2016 15:51:29 +0100 Message-Id: <1469717505-8026-7-git-send-email-julien.grall@arm.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1469717505-8026-1-git-send-email-julien.grall@arm.com> References: <1469717505-8026-1-git-send-email-julien.grall@arm.com> Cc: proskurin@sec.in.tum.de, Julien Grall , sstabellini@kernel.org, steve.capper@arm.com, wei.chen@linaro.org Subject: [Xen-devel] [RFC 06/22] xen/arm: traps: Check the P2M before injecting a data/instruction abort X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" A data/instruction abort may have occurred if another CPU was playing with the stage-2 page table when following the break-before-make sequence (see D4.7.1 in ARM DDI 0487A.j). Rather than injecting directly the fault to the guest, we need to check whether the mapping exists. If it exists, return to the guest to replay the instruction. Signed-off-by: Julien Grall --- xen/arch/arm/traps.c | 40 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 38 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c index b46284c..da56cc0 100644 --- a/xen/arch/arm/traps.c +++ b/xen/arch/arm/traps.c @@ -2404,6 +2404,7 @@ static void do_trap_instr_abort_guest(struct cpu_user_regs *regs, register_t gva = READ_SYSREG(FAR_EL2); uint8_t fsc = hsr.iabt.ifsc & ~FSC_LL_MASK; paddr_t gpa; + mfn_t mfn; if ( hpfar_is_valid(hsr.iabt.s1ptw, fsc) ) gpa = get_faulting_ipa(gva); @@ -2417,6 +2418,11 @@ static void do_trap_instr_abort_guest(struct cpu_user_regs *regs, */ flush_tlb_local(); + /* + * We may not be able to translate because someone is + * playing with the Stage-2 page table of the domain. + * Return to the guest. + */ rc = gva_to_ipa(gva, &gpa, GV2M_READ); if ( rc == -EFAULT ) return; /* Try again */ @@ -2437,8 +2443,17 @@ static void do_trap_instr_abort_guest(struct cpu_user_regs *regs, /* Trap was triggered by mem_access, work here is done */ if ( !rc ) return; + break; } - break; + case FSC_FLT_TRANS: + /* + * The PT walk may have failed because someone was playing + * with the Stage-2 page table. Walk the Stage-2 PT to check + * if the entry exists. If it's the case, return to the guest + */ + mfn = p2m_lookup(current->domain, _gfn(paddr_to_pfn(gpa)), NULL); + if ( !mfn_eq(mfn, INVALID_MFN) ) + return; } inject_iabt_exception(regs, gva, hsr.len); @@ -2455,7 +2470,7 @@ static bool_t try_handle_mmio(struct cpu_user_regs *regs, return 0; /* All the instructions used on emulated MMIO region should be valid */ - if ( !dabt.valid ) + if ( !info->dabt.valid ) return 0; /* @@ -2483,6 +2498,7 @@ static void do_trap_data_abort_guest(struct cpu_user_regs *regs, int rc; mmio_info_t info; uint8_t fsc = hsr.dabt.dfsc & ~FSC_LL_MASK; + mfn_t mfn; info.dabt = dabt; #ifdef CONFIG_ARM_32 @@ -2496,6 +2512,11 @@ static void do_trap_data_abort_guest(struct cpu_user_regs *regs, else { rc = gva_to_ipa(info.gva, &info.gpa, GV2M_READ); + /* + * We may not be able to translate because someone is + * playing with the Stage-2 page table of the domain. + * Return to the guest. + */ if ( rc == -EFAULT ) return; /* Try again */ } @@ -2519,11 +2540,26 @@ static void do_trap_data_abort_guest(struct cpu_user_regs *regs, break; } case FSC_FLT_TRANS: + /* + * Attempt first to emulate the MMIO has the data abort will + * likely happen an emulated region. + */ if ( try_handle_mmio(regs, &info) ) { advance_pc(regs, hsr); return; } + + /* + * The PT walk may have failed because someone was playing + * with the Stage-2 page table. Walk the Stage-2 PT to check + * if the entry exists. If it's the case, return to the guest + */ + mfn = p2m_lookup(current->domain, _gfn(paddr_to_pfn(info.gpa)), NULL); + if ( !mfn_eq(mfn, INVALID_MFN) ) + return; + + break; default: gprintk(XENLOG_WARNING, "Unsupported DFSC: HSR=%#x DFSC=%#x\n", hsr.bits, dabt.dfsc);