From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marc Zyngier Subject: Re: [PATCH v2] kvm: arm64: vgic: fix hyp panic with 64k pages on juno platform Date: Wed, 30 Jul 2014 11:47:40 +0100 Message-ID: <87oaw7jf77.fsf@approximate.cambridge.arm.com> References: <1406302152-32335-1-git-send-email-will.deacon@arm.com> Mime-Version: 1.0 Content-Type: text/plain Cc: "pbonzini\@redhat.com" , "gleb\@kernel.org" , "peter.maydell\@linaro.org" , "kvmarm\@lists.cs.columbia.edu" , "kvm\@vger.kernel.org" , Christoffer Dall , Joel Schopp , Don Dutile To: Will Deacon Return-path: Received: from fw-tnat.austin.arm.com ([217.140.110.23]:45498 "EHLO collaborate-mta1.arm.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751138AbaG3Krt (ORCPT ); Wed, 30 Jul 2014 06:47:49 -0400 In-Reply-To: <1406302152-32335-1-git-send-email-will.deacon@arm.com> (Will Deacon's message of "Fri, 25 Jul 2014 16:29:12 +0100") Sender: kvm-owner@vger.kernel.org List-ID: On Fri, Jul 25 2014 at 4:29:12 pm BST, Will Deacon wrote: > If the physical address of GICV isn't page-aligned, then we end up > creating a stage-2 mapping of the page containing it, which causes us to > map neighbouring memory locations directly into the guest. > > As an example, consider a platform with GICV at physical 0x2c02f000 > running a 64k-page host kernel. If qemu maps this into the guest at > 0x80010000, then guest physical addresses 0x80010000 - 0x8001efff will > map host physical region 0x2c020000 - 0x2c02efff. Accesses to these > physical regions may cause UNPREDICTABLE behaviour, for example, on the > Juno platform this will cause an SError exception to EL3, which brings > down the entire physical CPU resulting in RCU stalls / HYP panics / host > crashing / wasted weeks of debugging. > > SBSA recommends that systems alias the 4k GICV across the bounding 64k > region, in which case GICV physical could be described as 0x2c020000 in > the above scenario. > > This patch fixes the problem by failing the vgic probe if the physical > base address or the size of GICV aren't page-aligned. Note that this > generated a warning in dmesg about freeing enabled IRQs, so I had to > move the IRQ enabling later in the probe. > > Cc: Christoffer Dall > Cc: Marc Zyngier > Cc: Gleb Natapov > Cc: Paolo Bonzini > Cc: Joel Schopp > Cc: Don Dutile > Acked-by: Peter Maydell > Signed-off-by: Will Deacon Looks good to me: Acked-by: Marc Zyngier Christoffer, can you please take this as an urgent fix? Thanks, M. -- Jazz is not dead. It just smells funny.