Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 14 Sep 2017 17:29:51 +0000 (UTC)
From:      Andrew Turner <andrew@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r323593 - in head/sys: arm64/arm64 arm64/include conf
Message-ID:  <201709141729.v8EHTpM0019776@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: andrew
Date: Thu Sep 14 17:29:51 2017
New Revision: 323593
URL: https://svnweb.freebsd.org/changeset/base/323593

Log:
  Add support for handling undefined instructions in userspace and the
  kernel. We can register callbacks to perform the required operation on the
  saved registers before returning.
  
  This is initially used to work around a bug in old versions of QEMU that
  trigger such an exception when reading from an ID register when it should
  load z zero value.
  
  I expect this could be used with other exception types, e.g. to emulate
  special register access from userland.
  
  Sponsored by:	DARPA, AFRL

Added:
  head/sys/arm64/arm64/undefined.c   (contents, props changed)
  head/sys/arm64/include/undefined.h   (contents, props changed)
Modified:
  head/sys/arm64/arm64/identcpu.c
  head/sys/arm64/arm64/machdep.c
  head/sys/arm64/arm64/trap.c
  head/sys/conf/files.arm64

Modified: head/sys/arm64/arm64/identcpu.c
==============================================================================
--- head/sys/arm64/arm64/identcpu.c	Thu Sep 14 16:58:26 2017	(r323592)
+++ head/sys/arm64/arm64/identcpu.c	Thu Sep 14 17:29:51 2017	(r323593)
@@ -897,11 +897,7 @@ identify_cpu(void)
 	cpu_desc[cpu].id_aa64isar1 = READ_SPECIALREG(ID_AA64ISAR1_EL1);
 	cpu_desc[cpu].id_aa64mmfr0 = READ_SPECIALREG(ID_AA64MMFR0_EL1);
 	cpu_desc[cpu].id_aa64mmfr1 = READ_SPECIALREG(ID_AA64MMFR1_EL1);
-#ifdef NOTYET
 	cpu_desc[cpu].id_aa64mmfr2 = READ_SPECIALREG(ID_AA64MMFR2_EL1);
-#else
-	cpu_desc[cpu].id_aa64mmfr2 = 0;
-#endif
 	cpu_desc[cpu].id_aa64pfr0 = READ_SPECIALREG(ID_AA64PFR0_EL1);
 	cpu_desc[cpu].id_aa64pfr1 = READ_SPECIALREG(ID_AA64PFR1_EL1);
 

Modified: head/sys/arm64/arm64/machdep.c
==============================================================================
--- head/sys/arm64/arm64/machdep.c	Thu Sep 14 16:58:26 2017	(r323592)
+++ head/sys/arm64/arm64/machdep.c	Thu Sep 14 17:29:51 2017	(r323593)
@@ -77,6 +77,7 @@ __FBSDID("$FreeBSD$");
 #include <machine/md_var.h>
 #include <machine/pcb.h>
 #include <machine/reg.h>
+#include <machine/undefined.h>
 #include <machine/vmparam.h>
 
 #ifdef VFP
@@ -162,6 +163,7 @@ static void
 cpu_startup(void *dummy)
 {
 
+	undef_init();
 	identify_cpu();
 
 	vm_ksubmap_init(&kmi);

Modified: head/sys/arm64/arm64/trap.c
==============================================================================
--- head/sys/arm64/arm64/trap.c	Thu Sep 14 16:58:26 2017	(r323592)
+++ head/sys/arm64/arm64/trap.c	Thu Sep 14 17:29:51 2017	(r323593)
@@ -52,6 +52,7 @@ __FBSDID("$FreeBSD$");
 #include <machine/frame.h>
 #include <machine/pcb.h>
 #include <machine/pcpu.h>
+#include <machine/undefined.h>
 
 #ifdef KDTRACE_HOOKS
 #include <sys/dtrace_bsd.h>
@@ -332,6 +333,10 @@ do_el1h_sync(struct thread *td, struct trapframe *fram
 		panic("No debugger in kernel.\n");
 #endif
 		break;
+	case EXCP_UNKNOWN:
+		if (undef_insn(1, frame))
+			break;
+		/* FALLTHROUGH */
 	default:
 		print_registers(frame);
 		panic("Unknown kernel exception %x esr_el1 %lx\n", exception,
@@ -341,20 +346,6 @@ do_el1h_sync(struct thread *td, struct trapframe *fram
 	td->td_frame = oframe;
 }
 
-/*
- * The attempted execution of an instruction bit pattern that has no allocated
- * instruction results in an exception with an unknown reason.
- */
-static void
-el0_excp_unknown(struct trapframe *frame, uint64_t far)
-{
-	struct thread *td;
-
-	td = curthread;
-	call_trapsignal(td, SIGILL, ILL_ILLTRP, (void *)far);
-	userret(td, frame);
-}
-
 void
 do_el0_sync(struct thread *td, struct trapframe *frame)
 {
@@ -399,7 +390,9 @@ do_el0_sync(struct thread *td, struct trapframe *frame
 		data_abort(td, frame, esr, far, 1);
 		break;
 	case EXCP_UNKNOWN:
-		el0_excp_unknown(frame, far);
+		if (!undef_insn(0, frame))
+			call_trapsignal(td, SIGILL, ILL_ILLTRP, (void *)far);
+		userret(td, frame);
 		break;
 	case EXCP_SP_ALIGN:
 		call_trapsignal(td, SIGBUS, BUS_ADRALN, (void *)frame->tf_sp);

Added: head/sys/arm64/arm64/undefined.c
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/sys/arm64/arm64/undefined.c	Thu Sep 14 17:29:51 2017	(r323593)
@@ -0,0 +1,145 @@
+/*-
+ * Copyright (c) 2017 Andrew Turner
+ * All rights reserved.
+ *
+ * This software was developed by SRI International and the University of
+ * Cambridge Computer Laboratory under DARPA/AFRL contract FA8750-10-C-0237
+ * ("CTSRD"), as part of the DARPA CRASH research programme.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/malloc.h>
+#include <sys/queue.h>
+
+#include <machine/frame.h>
+#include <machine/undefined.h>
+
+MALLOC_DEFINE(M_UNDEF, "undefhandler", "Undefined instruction handler data");
+
+struct undef_handler {
+	LIST_ENTRY(undef_handler) uh_link;
+	undef_handler_t		uh_handler;
+};
+
+/*
+ * Create two undefined instruction handler lists, one for userspace, one for
+ * the kernel. This allows us to handle instructions that will trap
+ */
+LIST_HEAD(, undef_handler) undef_handlers[2];
+
+/*
+ * Work around a bug in QEMU prior to 2.5.1 where reading unknown ID
+ * registers would raise an exception when they should return 0.
+ */
+static int
+id_aa64mmfr2_handler(vm_offset_t va, uint32_t insn, struct trapframe *frame,
+    uint32_t esr)
+{
+	int reg;
+
+#define	MRS_MASK			0xfff00000
+#define	MRS_VALUE			0xd5300000
+#define	MRS_REGISTER(insn)		((insn) & 0x1f)
+#define	 MRS_ID_AA64MMFR2_EL0_MASK	(MRS_MASK | 0x000fffe0)
+#define	 MRS_ID_AA64MMFR2_EL0_VALUE	(MRS_VALUE | 0x00080740)
+
+	/* mrs xn, id_aa64mfr2_el1 */
+	if ((insn & MRS_ID_AA64MMFR2_EL0_MASK) == MRS_ID_AA64MMFR2_EL0_VALUE) {
+		reg = MRS_REGISTER(insn);
+
+		frame->tf_elr += INSN_SIZE;
+		if (reg < nitems(frame->tf_x)) {
+			frame->tf_x[reg] = 0;
+		} else if (reg == 30) {
+			frame->tf_lr = 0;
+		}
+		/* If reg is 32 then write to xzr, i.e. do nothing */
+
+		return (1);
+	}
+	return (0);
+}
+
+void
+undef_init(void)
+{
+
+	LIST_INIT(&undef_handlers[0]);
+	LIST_INIT(&undef_handlers[1]);
+
+	install_undef_handler(false, id_aa64mmfr2_handler);
+}
+
+void *
+install_undef_handler(bool user, undef_handler_t func)
+{
+	struct undef_handler *uh;
+
+	uh = malloc(sizeof(*uh), M_UNDEF, M_WAITOK);
+	uh->uh_handler = func;
+	LIST_INSERT_HEAD(&undef_handlers[user ? 0 : 1], uh, uh_link);
+
+	return (uh);
+}
+
+void
+remove_undef_handler(void *handle)
+{
+	struct undef_handler *uh;
+
+	uh = handle;
+	LIST_REMOVE(uh, uh_link);
+	free(handle, M_UNDEF);
+}
+
+int
+undef_insn(u_int el, struct trapframe *frame)
+{
+	struct undef_handler *uh;
+	uint32_t insn;
+	int ret;
+
+	KASSERT(el < 2, ("Invalid exception level %u", el));
+
+	if (el == 0) {
+		ret = fueword32((uint32_t *)frame->tf_elr, &insn);
+		if (ret != 0)
+			panic("Unable to read userspace faulting instruction");
+	} else {
+		insn = *(uint32_t *)frame->tf_elr;
+	}
+
+	LIST_FOREACH(uh, &undef_handlers[el], uh_link) {
+		ret = uh->uh_handler(frame->tf_elr, insn, frame, frame->tf_esr);
+		if (ret)
+			return (1);
+	}
+
+	return (0);
+}

Added: head/sys/arm64/include/undefined.h
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/sys/arm64/include/undefined.h	Thu Sep 14 17:29:51 2017	(r323593)
@@ -0,0 +1,44 @@
+/*-
+ * Copyright (c) 2017 Andrew Turner
+ * All rights reserved.
+ *
+ * This software was developed by SRI International and the University of
+ * Cambridge Computer Laboratory under DARPA/AFRL contract FA8750-10-C-0237
+ * ("CTSRD"), as part of the DARPA CRASH research programme.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _MACHINE__UNDEFINED_H_
+#define	_MACHINE__UNDEFINED_H_
+
+typedef int (*undef_handler_t)(vm_offset_t, uint32_t, struct trapframe *,
+    uint32_t);
+
+void undef_init(void);
+void *install_undef_handler(bool, undef_handler_t);
+void remove_undef_handler(void *);
+int undef_insn(u_int, struct trapframe *);
+
+#endif

Modified: head/sys/conf/files.arm64
==============================================================================
--- head/sys/conf/files.arm64	Thu Sep 14 16:58:26 2017	(r323592)
+++ head/sys/conf/files.arm64	Thu Sep 14 17:29:51 2017	(r323593)
@@ -118,6 +118,7 @@ arm64/arm64/sys_machdep.c	standard
 arm64/arm64/trap.c		standard
 arm64/arm64/uio_machdep.c	standard
 arm64/arm64/uma_machdep.c	standard
+arm64/arm64/undefined.c		standard
 arm64/arm64/unwind.c		optional	ddb | kdtrace_hooks | stack
 arm64/arm64/vfp.c		standard
 arm64/arm64/vm_machdep.c	standard



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201709141729.v8EHTpM0019776>