* [PATCH] target/arm: Fix ISR_EL1 tracking when executing at EL2
@ 2019-11-22 13:58 Marc Zyngier
2019-11-22 14:16 ` Peter Maydell
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Marc Zyngier @ 2019-11-22 13:58 UTC (permalink / raw)
To: qemu-devel; +Cc: Peter Maydell, Will Deacon, kvmarm, Quentin Perret
The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
SError interrupts.
Unfortunately, QEMU's implementation only considers the HCR_EL2
bits, and ignores the current exception level. This means a hypervisor
trying to look at its own interrupt state actually sees the guest
state, which is unexpected and breaks KVM as of Linux 5.3.
Instead, check for the running EL and return the physical bits
if not running in a virtualized context.
Fixes: 636540e9c40b
Reported-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
---
target/arm/helper.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index a089fb5a69..027fffbff6 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1934,8 +1934,11 @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
CPUState *cs = env_cpu(env);
uint64_t hcr_el2 = arm_hcr_el2_eff(env);
uint64_t ret = 0;
+ bool allow_virt = (arm_current_el(env) == 1 &&
+ (!arm_is_secure_below_el3(env) ||
+ (env->cp15.scr_el3 & SCR_EEL2)));
- if (hcr_el2 & HCR_IMO) {
+ if (allow_virt && (hcr_el2 & HCR_IMO)) {
if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
ret |= CPSR_I;
}
@@ -1945,7 +1948,7 @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
}
}
- if (hcr_el2 & HCR_FMO) {
+ if (allow_virt && (hcr_el2 & HCR_FMO)) {
if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
ret |= CPSR_F;
}
--
2.17.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] target/arm: Fix ISR_EL1 tracking when executing at EL2
2019-11-22 13:58 [PATCH] target/arm: Fix ISR_EL1 tracking when executing at EL2 Marc Zyngier
@ 2019-11-22 14:16 ` Peter Maydell
2019-11-22 15:34 ` Philippe Mathieu-Daudé
2019-11-22 16:17 ` Richard Henderson
2019-11-22 14:24 ` Edgar E. Iglesias
2019-11-22 15:38 ` Quentin Perret
2 siblings, 2 replies; 6+ messages in thread
From: Peter Maydell @ 2019-11-22 14:16 UTC (permalink / raw)
To: Marc Zyngier
Cc: Richard Henderson, Quentin Perret, Will Deacon, QEMU Developers,
kvmarm
On Fri, 22 Nov 2019 at 13:59, Marc Zyngier <maz@kernel.org> wrote:
>
> The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
> ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
> SError interrupts.
>
> Unfortunately, QEMU's implementation only considers the HCR_EL2
> bits, and ignores the current exception level. This means a hypervisor
> trying to look at its own interrupt state actually sees the guest
> state, which is unexpected and breaks KVM as of Linux 5.3.
>
> Instead, check for the running EL and return the physical bits
> if not running in a virtualized context.
>
> Fixes: 636540e9c40b
> Reported-by: Quentin Perret <qperret@google.com>
> Signed-off-by: Marc Zyngier <maz@kernel.org>
Congratulations on your first QEMU patch :-)
I've applied this to target-arm.next and will get it into
rc3 ("fixes running newer kernels" seems like an rc-ish
kind of bug).
RTH: vaguely wondering if this might be related to the
bug you ran into trying to test your VHE emulation
patchset...
thanks
-- PMM
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] target/arm: Fix ISR_EL1 tracking when executing at EL2
2019-11-22 14:16 ` Peter Maydell
@ 2019-11-22 15:34 ` Philippe Mathieu-Daudé
2019-11-22 16:17 ` Richard Henderson
1 sibling, 0 replies; 6+ messages in thread
From: Philippe Mathieu-Daudé @ 2019-11-22 15:34 UTC (permalink / raw)
To: Peter Maydell, Marc Zyngier
Cc: Will Deacon, Richard Henderson, QEMU Developers, kvmarm,
Quentin Perret
On 11/22/19 3:16 PM, Peter Maydell wrote:
> On Fri, 22 Nov 2019 at 13:59, Marc Zyngier <maz@kernel.org> wrote:
>>
>> The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
>> ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
>> SError interrupts.
>>
>> Unfortunately, QEMU's implementation only considers the HCR_EL2
>> bits, and ignores the current exception level. This means a hypervisor
>> trying to look at its own interrupt state actually sees the guest
>> state, which is unexpected and breaks KVM as of Linux 5.3.
>>
>> Instead, check for the running EL and return the physical bits
>> if not running in a virtualized context.
>>
>> Fixes: 636540e9c40b
>> Reported-by: Quentin Perret <qperret@google.com>
>> Signed-off-by: Marc Zyngier <maz@kernel.org>
>
> Congratulations on your first QEMU patch :-)
:))
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] target/arm: Fix ISR_EL1 tracking when executing at EL2
2019-11-22 14:16 ` Peter Maydell
2019-11-22 15:34 ` Philippe Mathieu-Daudé
@ 2019-11-22 16:17 ` Richard Henderson
1 sibling, 0 replies; 6+ messages in thread
From: Richard Henderson @ 2019-11-22 16:17 UTC (permalink / raw)
To: Peter Maydell, Marc Zyngier
Cc: Quentin Perret, Will Deacon, QEMU Developers, kvmarm
On 11/22/19 2:16 PM, Peter Maydell wrote:
> RTH: vaguely wondering if this might be related to the
> bug you ran into trying to test your VHE emulation
> patchset...
Thanks for the thought. It might be related, but it isn't the final cause:
the inner guest does not yet succeed including this patch.
r~
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] target/arm: Fix ISR_EL1 tracking when executing at EL2
2019-11-22 13:58 [PATCH] target/arm: Fix ISR_EL1 tracking when executing at EL2 Marc Zyngier
2019-11-22 14:16 ` Peter Maydell
@ 2019-11-22 14:24 ` Edgar E. Iglesias
2019-11-22 15:38 ` Quentin Perret
2 siblings, 0 replies; 6+ messages in thread
From: Edgar E. Iglesias @ 2019-11-22 14:24 UTC (permalink / raw)
To: Marc Zyngier
Cc: Peter Maydell, Quentin Perret, Will Deacon, qemu-devel, kvmarm
On Fri, Nov 22, 2019 at 01:58:33PM +0000, Marc Zyngier wrote:
> The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
> ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
> SError interrupts.
>
> Unfortunately, QEMU's implementation only considers the HCR_EL2
> bits, and ignores the current exception level. This means a hypervisor
> trying to look at its own interrupt state actually sees the guest
> state, which is unexpected and breaks KVM as of Linux 5.3.
>
> Instead, check for the running EL and return the physical bits
> if not running in a virtualized context.
>
> Fixes: 636540e9c40b
> Reported-by: Quentin Perret <qperret@google.com>
> Signed-off-by: Marc Zyngier <maz@kernel.org>
Looks good to me:
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
> ---
> target/arm/helper.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index a089fb5a69..027fffbff6 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -1934,8 +1934,11 @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
> CPUState *cs = env_cpu(env);
> uint64_t hcr_el2 = arm_hcr_el2_eff(env);
> uint64_t ret = 0;
> + bool allow_virt = (arm_current_el(env) == 1 &&
> + (!arm_is_secure_below_el3(env) ||
> + (env->cp15.scr_el3 & SCR_EEL2)));
>
> - if (hcr_el2 & HCR_IMO) {
> + if (allow_virt && (hcr_el2 & HCR_IMO)) {
> if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
> ret |= CPSR_I;
> }
> @@ -1945,7 +1948,7 @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
> }
> }
>
> - if (hcr_el2 & HCR_FMO) {
> + if (allow_virt && (hcr_el2 & HCR_FMO)) {
> if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
> ret |= CPSR_F;
> }
> --
> 2.17.1
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] target/arm: Fix ISR_EL1 tracking when executing at EL2
2019-11-22 13:58 [PATCH] target/arm: Fix ISR_EL1 tracking when executing at EL2 Marc Zyngier
2019-11-22 14:16 ` Peter Maydell
2019-11-22 14:24 ` Edgar E. Iglesias
@ 2019-11-22 15:38 ` Quentin Perret
2 siblings, 0 replies; 6+ messages in thread
From: Quentin Perret @ 2019-11-22 15:38 UTC (permalink / raw)
To: Marc Zyngier; +Cc: qemu-devel, kvmarm, Will Deacon, Peter Maydell
On Friday 22 Nov 2019 at 13:58:33 (+0000), Marc Zyngier wrote:
> The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
> ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
> SError interrupts.
>
> Unfortunately, QEMU's implementation only considers the HCR_EL2
> bits, and ignores the current exception level. This means a hypervisor
> trying to look at its own interrupt state actually sees the guest
> state, which is unexpected and breaks KVM as of Linux 5.3.
>
> Instead, check for the running EL and return the physical bits
> if not running in a virtualized context.
>
> Fixes: 636540e9c40b
> Reported-by: Quentin Perret <qperret@google.com>
And FWIW, Tested-by: Quentin Perret <qperret@google.com>
Thanks Marc :)
Quentin
> Signed-off-by: Marc Zyngier <maz@kernel.org>
> ---
> target/arm/helper.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index a089fb5a69..027fffbff6 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -1934,8 +1934,11 @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
> CPUState *cs = env_cpu(env);
> uint64_t hcr_el2 = arm_hcr_el2_eff(env);
> uint64_t ret = 0;
> + bool allow_virt = (arm_current_el(env) == 1 &&
> + (!arm_is_secure_below_el3(env) ||
> + (env->cp15.scr_el3 & SCR_EEL2)));
>
> - if (hcr_el2 & HCR_IMO) {
> + if (allow_virt && (hcr_el2 & HCR_IMO)) {
> if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
> ret |= CPSR_I;
> }
> @@ -1945,7 +1948,7 @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
> }
> }
>
> - if (hcr_el2 & HCR_FMO) {
> + if (allow_virt && (hcr_el2 & HCR_FMO)) {
> if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
> ret |= CPSR_F;
> }
> --
> 2.17.1
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-11-22 16:40 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-11-22 13:58 [PATCH] target/arm: Fix ISR_EL1 tracking when executing at EL2 Marc Zyngier
2019-11-22 14:16 ` Peter Maydell
2019-11-22 15:34 ` Philippe Mathieu-Daudé
2019-11-22 16:17 ` Richard Henderson
2019-11-22 14:24 ` Edgar E. Iglesias
2019-11-22 15:38 ` Quentin Perret
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).