On Fri, 3 Apr 2020 at 09:44, Andrew Jones <drjo...@redhat.com> wrote: > > On Mon, Mar 23, 2020 at 11:32:27AM +0000, Beata Michalska wrote: > > Injecting external data abort through KVM might trigger > > an issue on kernels that do not get updated to include the KVM fix. > > For those and aarch32 guests, the injected abort gets misconfigured > > to be an implementation defined exception. This leads to the guest > > repeatedly re-running the faulting instruction. > > > > Add support for handling that case. > > [ > > Fixed-by: 018f22f95e8a > > ('KVM: arm: Fix DFSR setting for non-LPAE aarch32 guests') > > Fixed-by: 21aecdbd7f3a > > ('KVM: arm: Make inject_abt32() inject an external abort instead') > > ] > > > > Signed-off-by: Beata Michalska <beata.michal...@linaro.org> > > --- > > target/arm/cpu.h | 1 + > > target/arm/kvm.c | 30 +++++++++++++++++++++++++++++- > > target/arm/kvm32.c | 25 +++++++++++++++++++++++++ > > target/arm/kvm64.c | 34 ++++++++++++++++++++++++++++++++++ > > target/arm/kvm_arm.h | 10 ++++++++++ > > 5 files changed, 99 insertions(+), 1 deletion(-) > > > > diff --git a/target/arm/cpu.h b/target/arm/cpu.h > > index 4f834c1..868afc6 100644 > > --- a/target/arm/cpu.h > > +++ b/target/arm/cpu.h > > @@ -561,6 +561,7 @@ typedef struct CPUARMState { > > } serror; > > > > uint8_t ext_dabt_pending; /* Request for injecting ext DABT */ > > + uint8_t ext_dabt_raised; /* Tracking/verifying injection of ext DABT */ > > > > /* State of our input IRQ/FIQ/VIRQ/VFIQ lines */ > > uint32_t irq_line_state; > > diff --git a/target/arm/kvm.c b/target/arm/kvm.c > > index c088589..58ad734 100644 > > --- a/target/arm/kvm.c > > +++ b/target/arm/kvm.c > > @@ -721,7 +721,12 @@ int kvm_put_vcpu_events(ARMCPU *cpu) > > ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_VCPU_EVENTS, &events); > > if (ret) { > > error_report("failed to put vcpu events"); > > - } else { > > + } else if (env->ext_dabt_pending) { > > + /* > > + * Mark that the external DABT has been injected, > > + * if one has been requested > > + */ > > + env->ext_dabt_raised = env->ext_dabt_pending; > > /* Clear instantly if the call was successful */ > > env->ext_dabt_pending = 0; > > } > > @@ -755,6 +760,29 @@ int kvm_get_vcpu_events(ARMCPU *cpu) > > > > void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run) > > { > > + ARMCPU *cpu = ARM_CPU(cs); > > + CPUARMState *env = &cpu->env; > > + > > + if (unlikely(env->ext_dabt_raised)) { > > + /* > > + * Verifying that the ext DABT has been properly injected, > > + * otherwise risking indefinitely re-running the faulting instruction > > + * Covering a very narrow case for kernels 5.5..5.5.4 > > + * when injected abort was misconfigured to be > > + * an IMPLEMENTATION DEFINED exception (for 32-bit EL1) > > + */ > > + if (!arm_feature(env, ARM_FEATURE_AARCH64) && > > + unlikely(!kvm_arm_verify_ext_dabt_pending(cs))) { > > + > > + error_report("Data abort exception with no valid ISS generated by " > > + "guest memory access. KVM unable to emulate faulting " > > + "instruction. Failed to inject an external data abort " > > + "into the guest."); > > + abort(); > > + } > > + /* Clear the status */ > > + env->ext_dabt_raised = 0; > > + } > > } > > > > MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run) > > diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c > > index f271181..86c4fe7 100644 > > --- a/target/arm/kvm32.c > > +++ b/target/arm/kvm32.c > > @@ -564,3 +564,28 @@ void kvm_arm_pmu_init(CPUState *cs) > > { > > qemu_log_mask(LOG_UNIMP, "%s: not implemented\n", __func__); > > } > > + > > +#define ARM_REG_DFSR ARM_CP15_REG32(0, 5, 0, 0) > > +#define ARM_REG_TTBCR ARM_CP15_REG32(0, 2, 0, 2) > > + > > +#define DFSR_FSC(v) (((v) >> 6 | (v)) & 0x1F) > > +#define DFSC_EXTABT(lpae) (lpae) ? 0x10 : 0x08 > > We should put () around the whole ?: expression when it's in a macro > > > + > > +bool kvm_arm_verify_ext_dabt_pending(CPUState *cs) > > +{ > > + uint32_t dfsr_val; > > + > > + if (!kvm_get_one_reg(cs, ARM_REG_DFSR, &dfsr_val)) { > > + ARMCPU *cpu = ARM_CPU(cs); > > + CPUARMState *env = &cpu->env; > > + uint32_t ttbcr; > > + int lpae = 0; > > + > > + if (!kvm_get_one_reg(cs, ARM_REG_TTBCR, &ttbcr)) { > > + lpae = arm_feature(env, ARM_FEATURE_LPAE) && (ttbcr & TTBCR_EAE); > > + } > > + return !(DFSR_FSC(dfsr_val) != DFSC_EXTABT(lpae)); > > !(a != b) is a convoluted way to write a == b > > > + } > > + return false; > > +} > > + > > diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c > > index be5b31c..18594e9 100644 > > --- a/target/arm/kvm64.c > > +++ b/target/arm/kvm64.c > > @@ -1430,3 +1430,37 @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit) > > > > return false; > > } > > + > > +#define ARM64_REG_ESR_EL1 ARM64_SYS_REG(3, 0, 5, 2, 0) > > +#define ARM64_REG_TCR_EL1 ARM64_SYS_REG(3, 0, 2, 0, 2) > > + > > +#define ESR_DFSC(aarch64, v) \ > > + ((aarch64) ? ((v) & 0x3F) \ > > + : (((v) >> 6 | (v)) & 0x1F)) > > + > > +#define ESR_DFSC_EXTABT(aarch64, lpae) \ > > + ((aarch64) ? 0x10 : (lpae) ? 0x10 : 0x8) > > + > > +bool kvm_arm_verify_ext_dabt_pending(CPUState *cs) > > +{ > > + uint64_t dfsr_val; > > + > > + if (!kvm_get_one_reg(cs, ARM64_REG_ESR_EL1, &dfsr_val)) { > > + ARMCPU *cpu = ARM_CPU(cs); > > + CPUARMState *env = &cpu->env; > > + int aarch64_mode = arm_feature(env, ARM_FEATURE_AARCH64); > > + int lpae = 0; > > + > > + if (!aarch64_mode) { > > + uint64_t ttbcr; > > + > > + if (!kvm_get_one_reg(cs, ARM64_REG_TCR_EL1, &ttbcr)) { > > + lpae = arm_feature(env, ARM_FEATURE_LPAE) > > + && (ttbcr & TTBCR_EAE); > > + } > > + } > > + return !(ESR_DFSC(aarch64_mode, dfsr_val) != > > + ESR_DFSC_EXTABT(aarch64_mode, lpae)); > > a == b, please > > > + } > > + return false; > > +} > > diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h > > index 39472d5..f2dc6a2 100644 > > --- a/target/arm/kvm_arm.h > > +++ b/target/arm/kvm_arm.h > > @@ -461,6 +461,16 @@ void kvm_arm_copy_hw_debug_data(struct kvm_guest_debug_arch *ptr); > > int kvm_arm_handle_dabt_nisv(CPUState *cs, uint64_t esr_iss, > > uint64_t fault_ipa); > > /** > > + * kvm_arm_verify_ext_dabt_pending: > > + * @cs: CPUState > > + * > > + * Verify the fault status code wrt the Ext DABT injection > > + * > > + * Returns: true if the fault status code is as expected, false otherwise > > + */ > > +bool kvm_arm_verify_ext_dabt_pending(CPUState *cs); > > + > > +/** > > * its_class_name: > > * > > * Return the ITS class name to use depending on whether KVM acceleration > > -- > > 2.7.4 > > > > > > I'll leave the decision to take this KVM bug workaround patch at all to Peter, > and I didn't actually review whether or not kvm_arm_verify_ext_dabt_pending > is doing what it claims it's doing, so I'm reluctant to give an r-b on > this patch. But, as far as the code goes, besides the comments above, it > looks fine to me. > Thanks for the feedback. Will apply the changes for the next version.
BR Beata > Thanks, > drew >