ARMv8-A Virtual-to-Physical Translation Failure Under Heavy Interrupt Load

ARMv8-A Virtual-to-Physical Translation Inconsistencies Under High Interrupt Load

In ARMv8-A architectures, the translation of virtual addresses to physical addresses is a critical operation, especially in systems with a 1:1 mapping between virtual and physical memory spaces. The Address Translation (AT) instruction, combined with the Physical Address Register (PAR_EL1), is commonly used to perform this translation. However, under heavy interrupt loads, inconsistencies can arise, leading to incorrect values being read from PAR_EL1. This issue is particularly perplexing when the MMU (Memory Management Unit) is configured with a static 1:1 mapping, and no changes are made to the page tables or ASID (Address Space Identifier) after the initial boot setup. The problem manifests in 64-bit mode at Exception Level 1 (EL1), where the translation should ideally return the same value as the input virtual address due to the 1:1 mapping.

The core of the problem lies in the non-atomic nature of the sequence involving the AT instruction and the subsequent read from PAR_EL1. When interrupts are not disabled during this sequence, the heavy interrupt load can cause the translation process to be interrupted, leading to incorrect values being stored in PAR_EL1. This issue is further compounded by the fact that the MMU is not being reconfigured, suggesting that the problem is not due to changes in the translation tables but rather due to the timing and atomicity of the translation process itself.

Non-Atomic AT Instruction Execution and Interrupt Interference

The primary cause of the virtual-to-physical translation failure under heavy interrupt load is the non-atomic execution of the AT instruction and the subsequent read from PAR_EL1. The AT instruction is used to perform an address translation and store the result in PAR_EL1. However, this operation is not inherently atomic, meaning that it can be interrupted by other processes or interrupts. When an interrupt occurs between the execution of the AT instruction and the read from PAR_EL1, the value in PAR_EL1 may be corrupted or overwritten, leading to an incorrect physical address being returned.

Another potential cause is the lack of proper synchronization barriers. The ISB (Instruction Synchronization Barrier) instruction is used to ensure that all previous instructions are completed before proceeding. However, in this scenario, the ISB is placed after the AT instruction but before the read from PAR_EL1. While this ensures that the AT instruction is completed before reading PAR_EL1, it does not prevent interrupts from occurring between these two operations. This lack of atomicity can lead to race conditions where the value in PAR_EL1 is modified by an interrupt before it is read, resulting in an incorrect translation.

Additionally, the 1:1 mapping between virtual and physical addresses adds another layer of complexity. In a 1:1 mapping scenario, the virtual address should directly correspond to the physical address, and the translation process should be straightforward. However, the presence of interrupts can disrupt this process, especially if the translation is not performed atomically. This disruption can lead to situations where the translation fails, even though the MMU is correctly configured and the page tables are static.

Ensuring Atomicity with Interrupt Disabling and Proper Synchronization

To address the issue of virtual-to-physical translation failures under heavy interrupt load, it is essential to ensure that the sequence involving the AT instruction and the read from PAR_EL1 is executed atomically. This can be achieved by disabling interrupts during the critical section of code where the translation is performed. By disabling interrupts, the processor ensures that no other processes or interrupts can interfere with the translation process, thereby preventing the corruption of the value in PAR_EL1.

The following steps outline the necessary modifications to the code to ensure atomicity:

1. Disable Interrupts Before the AT Instruction: Before executing the AT instruction, interrupts should be disabled to prevent any interference during the translation process. This can be done using the appropriate interrupt disable instructions for the specific ARM core being used.

2. Execute the AT Instruction: With interrupts disabled, the AT instruction can be executed safely, ensuring that the translation process is not interrupted. The ISB instruction should still be used after the AT instruction to ensure that the translation is completed before proceeding.

3. Read from PAR_EL1: After the ISB instruction, the value in PAR_EL1 can be read without the risk of it being corrupted by an interrupt. This ensures that the correct physical address is obtained from the translation.

4. Re-enable Interrupts: Once the translation is complete and the value in PAR_EL1 has been read, interrupts can be re-enabled to allow the system to resume normal operation.

The modified code would look as follows:

    // Disable interrupts
    msr DAIFSet, #0xF

    // Perform the address translation
    mov x3, x0 // for debug
    at S1E1W, x0
    isb
    mrs x1, PAR_EL1
    mov x4, x1 // for debug

    // Re-enable interrupts
    msr DAIFClr, #0xF

    // Continue with the rest of the code
    tst x1, #1
    bfi x1, x0, #0, #12
    bic x0, x1, #0xff00000000000000
    mov x2, #SC_NIL & 0xffff
    movk x2, #(SC_NIL>>16) & 0xffff, lsl #16
    csel x0, x0, x2, EQ // on error return SC_NIL
1:
    cmp x3, x0
    b.ne 1b
    ret

In addition to disabling interrupts, it is also important to ensure that the MMU and page tables are correctly configured and that no changes are made to them during the translation process. This includes verifying that the ASID is not being modified and that the page tables remain static after the initial boot setup. By ensuring that the translation environment is stable and that the translation process is performed atomically, the issue of incorrect virtual-to-physical translation under heavy interrupt load can be effectively mitigated.

Conclusion

The failure of virtual-to-physical translation under heavy interrupt load in ARMv8-A architectures is a complex issue that arises from the non-atomic execution of the AT instruction and the subsequent read from PAR_EL1. By understanding the underlying causes and implementing the necessary fixes, such as disabling interrupts during the critical section of code and ensuring proper synchronization, this issue can be resolved. The key takeaway is that in systems with heavy interrupt loads, special care must be taken to ensure that critical operations, such as address translation, are performed atomically to prevent race conditions and ensure the correct functioning of the system.