| Message ID | 20210604130352.1887560-1-jean-philippe@linaro.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] hw/intc/arm_gicv3_cpuif: Tolerate spurious EOIR writes | expand |
On 6/4/21 3:03 PM, Jean-Philippe Brucker wrote: > Commit 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access > check logic") added an assert_not_reached() if the guest writes the EOIR > register while no interrupt is active. > > It turns out some software does this: EDK2, in > GicV3ExitBootServicesEvent(), unconditionally write EOIR for all > interrupts that it manages. This now causes QEMU to abort when running > UEFI on a VM with GICv3. Although it is UNPREDICTABLE behavior and EDK2 > does need fixing, the punishment seems a little harsh, especially since > icc_eoir_write() already tolerates writes of nonexistent interrupt > numbers. Display a guest error and tolerate spurious EOIR writes. > > Fixes: 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access check logic") > Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> > --- > v2: Added qemu_log_mask() (so I didn't keep the Reviewed-by tag) > v1: https://lore.kernel.org/qemu-devel/20210603110012.1182530-1-jean-philippe@linaro.org/ > > --- > hw/intc/arm_gicv3_cpuif.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Jean-Philippe Brucker <jean-philippe@linaro.org> writes: > Commit 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access > check logic") added an assert_not_reached() if the guest writes the EOIR > register while no interrupt is active. > > It turns out some software does this: EDK2, in > GicV3ExitBootServicesEvent(), unconditionally write EOIR for all > interrupts that it manages. This now causes QEMU to abort when running > UEFI on a VM with GICv3. Although it is UNPREDICTABLE behavior and EDK2 > does need fixing, the punishment seems a little harsh, especially since > icc_eoir_write() already tolerates writes of nonexistent interrupt > numbers. Display a guest error and tolerate spurious EOIR writes. > > Fixes: 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access check logic") > Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Xen seems good at triggering this as well... Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org>
On Fri, 4 Jun 2021 at 14:07, Jean-Philippe Brucker <jean-philippe@linaro.org> wrote: > > Commit 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access > check logic") added an assert_not_reached() if the guest writes the EOIR > register while no interrupt is active. > > It turns out some software does this: EDK2, in > GicV3ExitBootServicesEvent(), unconditionally write EOIR for all > interrupts that it manages. This now causes QEMU to abort when running > UEFI on a VM with GICv3. Although it is UNPREDICTABLE behavior and EDK2 > does need fixing, the punishment seems a little harsh, especially since > icc_eoir_write() already tolerates writes of nonexistent interrupt > numbers. Display a guest error and tolerate spurious EOIR writes. > > Fixes: 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access check logic") > Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> > --- > v2: Added qemu_log_mask() (so I didn't keep the Reviewed-by tag) > v1: https://lore.kernel.org/qemu-devel/20210603110012.1182530-1-jean-philippe@linaro.org/ Applied to target-arm.next, thanks. -- PMM
diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c index 81f94c7f4a..3e0641aff9 100644 --- a/hw/intc/arm_gicv3_cpuif.c +++ b/hw/intc/arm_gicv3_cpuif.c @@ -14,6 +14,7 @@ #include "qemu/osdep.h" #include "qemu/bitops.h" +#include "qemu/log.h" #include "qemu/main-loop.h" #include "trace.h" #include "gicv3_internal.h" @@ -1357,7 +1358,9 @@ static void icc_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri, } break; default: - g_assert_not_reached(); + qemu_log_mask(LOG_GUEST_ERROR, + "%s: IRQ %d isn't active\n", __func__, irq); + return; } icc_drop_prio(cs, grp);
Commit 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access check logic") added an assert_not_reached() if the guest writes the EOIR register while no interrupt is active. It turns out some software does this: EDK2, in GicV3ExitBootServicesEvent(), unconditionally write EOIR for all interrupts that it manages. This now causes QEMU to abort when running UEFI on a VM with GICv3. Although it is UNPREDICTABLE behavior and EDK2 does need fixing, the punishment seems a little harsh, especially since icc_eoir_write() already tolerates writes of nonexistent interrupt numbers. Display a guest error and tolerate spurious EOIR writes. Fixes: 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access check logic") Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> --- v2: Added qemu_log_mask() (so I didn't keep the Reviewed-by tag) v1: https://lore.kernel.org/qemu-devel/20210603110012.1182530-1-jean-philippe@linaro.org/ --- hw/intc/arm_gicv3_cpuif.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)