Re: [PATCH] xen/arm64: ensure that the correct SP is used for exceptions

[Wei Liu <wei.liu2@citrix.com>]

On Tue, May 03, 2016 at 11:43:34AM +0100, Julien Grall wrote:
> (CC Wei for release-ack)
> 
> Hello Kyle,
> 
> On 28/04/16 18:14, Kyle Temkin wrote:
> >From: "Kyle J. Temkin" <temkink@ainfosec.com>
> >
> >The ARMv8 architecture has a SPSel ("stack pointer selection") machine
> >register that allows us to determine which exception level's stack
> >pointer is loaded when an exception occurs. As we don't want to
> >use the non-priveleged SP_EL0 stack pointer -- or even assume that SP_EL0
> 
> NIT: s/priveleged/privileged/
> 
> >points to a valid address in the hypervisor context--  we'll need to ensure
> >that our EL2 code sets the SPSel to SP_ELn mode, so exceptions that trap
> >to EL2 use the EL2 stack pointer.
> >
> >This corrects an issue that can manifest as a hang-on-IRQ on some
> >arm64 cores if the firmware/bootloader has previously initialized SPSel
> >to 0; in which case Xen's exceptions will incorrectly use an invalid SP_EL0,
> >and will endlessly spin on the synchronous abort handler.
> >
> >Signed-off-by: Kyle Temkin <temkink@ainfosec.com>
> 
> Reviewed-by: Julien Grall <julien.grall@arm.com>
> 
> Wei, this is a bug-fix and I think it should go to Xen 4.7.
> 

Release-acked-by: Wei Liu <wei.liu2@citrix.com>

> We would also need to backport this patch on Xen 4.4 -> Xen 4.6.
> 
> Regards,
> 
> >---
> >  xen/arch/arm/arm64/head.S | 5 +++++
> >  1 file changed, 5 insertions(+)
> >
> >diff --git a/xen/arch/arm/arm64/head.S b/xen/arch/arm/arm64/head.S
> >index 946e2c9..d5831f2 100644
> >--- a/xen/arch/arm/arm64/head.S
> >+++ b/xen/arch/arm/arm64/head.S
> >@@ -361,6 +361,11 @@ skip_bss:
> >          ldr   x0, =(HSCTLR_BASE)
> >          msr   SCTLR_EL2, x0
> >
> >+        /* Ensure that any exceptions encountered at EL2
> >+         * are handled using the EL2 stack pointer, rather
> >+         * than SP_EL0. */
> >+        msr spsel, #1
> >+
> >          /* Rebuild the boot pagetable's first-level entries. The structure
> >           * is described in mm.c.
> >           *
> >
> 
> -- 
> Julien Grall

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel