From patchwork Thu May 11 17:53:19 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andre Przywara X-Patchwork-Id: 9722671 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 864F660236 for ; Thu, 11 May 2017 17:54:06 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 85C3B286D0 for ; Thu, 11 May 2017 17:54:06 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7A325286E6; Thu, 11 May 2017 17:54:06 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id D862E286E5 for ; Thu, 11 May 2017 17:54:05 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d8sFV-0000MG-JT; Thu, 11 May 2017 17:51:37 +0000 Received: from mail6.bemta6.messagelabs.com ([193.109.254.103]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d8sFU-0000Jh-LP for xen-devel@lists.xenproject.org; Thu, 11 May 2017 17:51:36 +0000 Received: from [85.158.143.35] by server-5.bemta-6.messagelabs.com id 47/C4-03371-7A4A4195; Thu, 11 May 2017 17:51:35 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrOLMWRWlGSWpSXmKPExsVysyfVTXf5EpF Ig/U3BS2+b5nM5MDocfjDFZYAxijWzLyk/IoE1owF9w8wFaxwqZjUtIa9gfGGQRcjF4eQwGZG iR+rNjJCOMsZJVYf/8PcxcjJwSagK7Hj5mswW0QgVOLpgu/MIEXMAmsYJc4t+skGkhAGSjxru 8UOYrMIqErsencYzOYVsJLYMOUgK4gtISAn0XD+PtggTgFriSXTZ7GA2EJANbt2n2adwMi9gJ FhFaN6cWpRWWqRrpFeUlFmekZJbmJmjq6hgZlebmpxcWJ6ak5iUrFecn7uJkaghxmAYAfjsr9 OhxglOZiURHkZJ4pECvEl5adUZiQWZ8QXleakFh9ilOHgUJLgjVwMlBMsSk1PrUjLzAGGGkxa goNHSYR38yKgNG9xQWJucWY6ROoUo6KUOC8PSJ8ASCKjNA+uDRbelxhlpYR5GYEOEeIpSC3Kz SxBlX/FKM7BqCTMuxNkCk9mXgnc9FdAi5mAFvf/EQZZXJKIkJJqYJz56viBtvOaT/8eKoj6fb rVMVP3fX3NrofNZjUJbxexT/l6X0rQu8DHlt3nEfOPDY93P9q64sTB6XM4r3CbvDk1fenukxP O++5sEzDtzKvYtsJwueMB16/LRcSqniXoHCqxXl/cdL3WMlaldeW35IBXVW/nZ67c9t/7RKXs Dpaj6lcnXZYv2VWkxFKckWioxVxUnAgA4JPzpWoCAAA= X-Env-Sender: andre.przywara@arm.com X-Msg-Ref: server-4.tower-21.messagelabs.com!1494525094!61812654!1 X-Originating-IP: [217.140.101.70] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 9.4.12; banners=-,-,- X-VirusChecked: Checked Received: (qmail 18291 invoked from network); 11 May 2017 17:51:35 -0000 Received: from foss.arm.com (HELO foss.arm.com) (217.140.101.70) by server-4.tower-21.messagelabs.com with SMTP; 11 May 2017 17:51:35 -0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 72BFF168F; Thu, 11 May 2017 10:51:34 -0700 (PDT) Received: from e104803-lin.lan (unknown [10.1.207.46]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 4B40B3F4FF; Thu, 11 May 2017 10:51:33 -0700 (PDT) From: Andre Przywara To: Julien Grall , Stefano Stabellini Date: Thu, 11 May 2017 18:53:19 +0100 Message-Id: <20170511175340.8448-8-andre.przywara@arm.com> X-Mailer: git-send-email 2.9.0 In-Reply-To: <20170511175340.8448-1-andre.przywara@arm.com> References: <20170511175340.8448-1-andre.przywara@arm.com> Cc: xen-devel@lists.xenproject.org, Vijaya Kumar K , Vijay Kilari , Shanker Donthineni Subject: [Xen-devel] [PATCH v9 07/28] ARM: vGICv3: handle virtual LPI pending and property tables X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP Allow a guest to provide the address and size for the memory regions it has reserved for the GICv3 pending and property tables. We sanitise the various fields of the respective redistributor registers. The MMIO read and write accesses are protected by locks, to avoid any changing of the property or pending table address while a redistributor is live and also to protect the non-atomic vgic_reg64_extract() function on the MMIO read side. Signed-off-by: Andre Przywara Reviewed-by: Julien Grall --- xen/arch/arm/vgic-v3.c | 164 +++++++++++++++++++++++++++++++++++++++---- xen/include/asm-arm/domain.h | 5 ++ 2 files changed, 157 insertions(+), 12 deletions(-) diff --git a/xen/arch/arm/vgic-v3.c b/xen/arch/arm/vgic-v3.c index 87f58f6..5166f9c 100644 --- a/xen/arch/arm/vgic-v3.c +++ b/xen/arch/arm/vgic-v3.c @@ -233,12 +233,29 @@ static int __vgic_v3_rdistr_rd_mmio_read(struct vcpu *v, mmio_info_t *info, goto read_reserved; case VREG64(GICR_PROPBASER): - /* LPI's not implemented */ - goto read_as_zero_64; + if ( !v->domain->arch.vgic.has_its ) + goto read_as_zero_64; + if ( !vgic_reg64_check_access(dabt) ) goto bad_width; + + vgic_lock(v); + *r = vgic_reg64_extract(v->domain->arch.vgic.rdist_propbase, info); + vgic_unlock(v); + return 1; case VREG64(GICR_PENDBASER): - /* LPI's not implemented */ - goto read_as_zero_64; + { + unsigned long flags; + + if ( !v->domain->arch.vgic.has_its ) + goto read_as_zero_64; + if ( !vgic_reg64_check_access(dabt) ) goto bad_width; + + spin_lock_irqsave(&v->arch.vgic.lock, flags); + *r = vgic_reg64_extract(v->arch.vgic.rdist_pendbase, info); + *r &= ~GICR_PENDBASER_PTZ; /* WO, reads as 0 */ + spin_unlock_irqrestore(&v->arch.vgic.lock, flags); + return 1; + } case 0x0080: goto read_reserved; @@ -335,11 +352,95 @@ read_unknown: return 1; } +static uint64_t vgic_sanitise_field(uint64_t reg, uint64_t field_mask, + int field_shift, + uint64_t (*sanitise_fn)(uint64_t)) +{ + uint64_t field = (reg & field_mask) >> field_shift; + + field = sanitise_fn(field) << field_shift; + + return (reg & ~field_mask) | field; +} + +/* We want to avoid outer shareable. */ +static uint64_t vgic_sanitise_shareability(uint64_t field) +{ + switch ( field ) + { + case GIC_BASER_OuterShareable: + return GIC_BASER_InnerShareable; + default: + return field; + } +} + +/* Avoid any inner non-cacheable mapping. */ +static uint64_t vgic_sanitise_inner_cacheability(uint64_t field) +{ + switch ( field ) + { + case GIC_BASER_CACHE_nCnB: + case GIC_BASER_CACHE_nC: + return GIC_BASER_CACHE_RaWb; + default: + return field; + } +} + +/* Non-cacheable or same-as-inner are OK. */ +static uint64_t vgic_sanitise_outer_cacheability(uint64_t field) +{ + switch ( field ) + { + case GIC_BASER_CACHE_SameAsInner: + case GIC_BASER_CACHE_nC: + return field; + default: + return GIC_BASER_CACHE_nC; + } +} + +static uint64_t sanitize_propbaser(uint64_t reg) +{ + reg = vgic_sanitise_field(reg, GICR_PROPBASER_SHAREABILITY_MASK, + GICR_PROPBASER_SHAREABILITY_SHIFT, + vgic_sanitise_shareability); + reg = vgic_sanitise_field(reg, GICR_PROPBASER_INNER_CACHEABILITY_MASK, + GICR_PROPBASER_INNER_CACHEABILITY_SHIFT, + vgic_sanitise_inner_cacheability); + reg = vgic_sanitise_field(reg, GICR_PROPBASER_OUTER_CACHEABILITY_MASK, + GICR_PROPBASER_OUTER_CACHEABILITY_SHIFT, + vgic_sanitise_outer_cacheability); + + reg &= ~GICR_PROPBASER_RES0_MASK; + + return reg; +} + +static uint64_t sanitize_pendbaser(uint64_t reg) +{ + reg = vgic_sanitise_field(reg, GICR_PENDBASER_SHAREABILITY_MASK, + GICR_PENDBASER_SHAREABILITY_SHIFT, + vgic_sanitise_shareability); + reg = vgic_sanitise_field(reg, GICR_PENDBASER_INNER_CACHEABILITY_MASK, + GICR_PENDBASER_INNER_CACHEABILITY_SHIFT, + vgic_sanitise_inner_cacheability); + reg = vgic_sanitise_field(reg, GICR_PENDBASER_OUTER_CACHEABILITY_MASK, + GICR_PENDBASER_OUTER_CACHEABILITY_SHIFT, + vgic_sanitise_outer_cacheability); + + reg &= ~GICR_PENDBASER_RES0_MASK; + + return reg; +} + static int __vgic_v3_rdistr_rd_mmio_write(struct vcpu *v, mmio_info_t *info, uint32_t gicr_reg, register_t r) { struct hsr_dabt dabt = info->dabt; + uint64_t reg; switch ( gicr_reg ) { @@ -370,36 +471,75 @@ static int __vgic_v3_rdistr_rd_mmio_write(struct vcpu *v, mmio_info_t *info, goto write_impl_defined; case VREG64(GICR_SETLPIR): - /* LPI is not implemented */ + /* LPIs without an ITS are not implemented */ goto write_ignore_64; case VREG64(GICR_CLRLPIR): - /* LPI is not implemented */ + /* LPIs without an ITS are not implemented */ goto write_ignore_64; case 0x0050: goto write_reserved; case VREG64(GICR_PROPBASER): - /* LPI is not implemented */ - goto write_ignore_64; + if ( !v->domain->arch.vgic.has_its ) + goto write_ignore_64; + if ( !vgic_reg64_check_access(dabt) ) goto bad_width; + + vgic_lock(v); + + /* + * Writing PROPBASER with any redistributor having LPIs enabled + * is UNPREDICTABLE. + */ + if ( !(v->domain->arch.vgic.rdists_enabled) ) + { + reg = v->domain->arch.vgic.rdist_propbase; + vgic_reg64_update(®, r, info); + reg = sanitize_propbaser(reg); + v->domain->arch.vgic.rdist_propbase = reg; + } + + vgic_unlock(v); + + return 1; case VREG64(GICR_PENDBASER): - /* LPI is not implemented */ - goto write_ignore_64; + { + unsigned long flags; + + if ( !v->domain->arch.vgic.has_its ) + goto write_ignore_64; + if ( !vgic_reg64_check_access(dabt) ) goto bad_width; + + spin_lock_irqsave(&v->arch.vgic.lock, flags); + + /* Writing PENDBASER with LPIs enabled is UNPREDICTABLE. */ + if ( !(v->arch.vgic.flags & VGIC_V3_LPIS_ENABLED) ) + { + reg = v->arch.vgic.rdist_pendbase; + vgic_reg64_update(®, r, info); + reg = sanitize_pendbaser(reg); + v->arch.vgic.rdist_pendbase = reg; + } + + spin_unlock_irqrestore(&v->arch.vgic.lock, false); + + return 1; + } case 0x0080: goto write_reserved; case VREG64(GICR_INVLPIR): - /* LPI is not implemented */ + /* LPIs without an ITS are not implemented */ goto write_ignore_64; case 0x00A8: goto write_reserved; case VREG64(GICR_INVALLR): - /* LPI is not implemented */ + /* LPIs without an ITS are not implemented */ goto write_ignore_64; case 0x00B8: diff --git a/xen/include/asm-arm/domain.h b/xen/include/asm-arm/domain.h index ebaea35..b2d98bb 100644 --- a/xen/include/asm-arm/domain.h +++ b/xen/include/asm-arm/domain.h @@ -109,11 +109,15 @@ struct arch_domain } *rdist_regions; int nr_regions; /* Number of rdist regions */ uint32_t rdist_stride; /* Re-Distributor stride */ + unsigned long int nr_lpis; + uint64_t rdist_propbase; struct rb_root its_devices; /* Devices mapped to an ITS */ spinlock_t its_devices_lock; /* Protects the its_devices tree */ struct radix_tree_root pend_lpi_tree; /* Stores struct pending_irq's */ rwlock_t pend_lpi_tree_lock; /* Protects the pend_lpi_tree */ unsigned int intid_bits; + bool rdists_enabled; /* Is any redistributor enabled? */ + bool has_its; #endif } vgic; @@ -260,6 +264,7 @@ struct arch_vcpu /* GICv3: redistributor base and flags for this vCPU */ paddr_t rdist_base; + uint64_t rdist_pendbase; #define VGIC_V3_RDIST_LAST (1 << 0) /* last vCPU of the rdist */ #define VGIC_V3_LPIS_ENABLED (1 << 1) uint8_t flags;