diff mbox series

[v2] hw/intc/arm_gicv3_cpuif: Tolerate spurious EOIR writes

Message ID 20210604130352.1887560-1-jean-philippe@linaro.org
State Superseded
Headers show
Series [v2] hw/intc/arm_gicv3_cpuif: Tolerate spurious EOIR writes | expand

Commit Message

Jean-Philippe Brucker June 4, 2021, 1:03 p.m. UTC
Commit 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access
check logic") added an assert_not_reached() if the guest writes the EOIR
register while no interrupt is active.

It turns out some software does this: EDK2, in
GicV3ExitBootServicesEvent(), unconditionally write EOIR for all
interrupts that it manages. This now causes QEMU to abort when running
UEFI on a VM with GICv3. Although it is UNPREDICTABLE behavior and EDK2
does need fixing, the punishment seems a little harsh, especially since
icc_eoir_write() already tolerates writes of nonexistent interrupt
numbers. Display a guest error and tolerate spurious EOIR writes.

Fixes: 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access check logic")
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>

---
v2: Added qemu_log_mask() (so I didn't keep the Reviewed-by tag)
v1: https://lore.kernel.org/qemu-devel/20210603110012.1182530-1-jean-philippe@linaro.org/

---
 hw/intc/arm_gicv3_cpuif.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

-- 
2.31.1

Comments

Philippe Mathieu-Daudé June 4, 2021, 1:09 p.m. UTC | #1
On 6/4/21 3:03 PM, Jean-Philippe Brucker wrote:
> Commit 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access

> check logic") added an assert_not_reached() if the guest writes the EOIR

> register while no interrupt is active.

> 

> It turns out some software does this: EDK2, in

> GicV3ExitBootServicesEvent(), unconditionally write EOIR for all

> interrupts that it manages. This now causes QEMU to abort when running

> UEFI on a VM with GICv3. Although it is UNPREDICTABLE behavior and EDK2

> does need fixing, the punishment seems a little harsh, especially since

> icc_eoir_write() already tolerates writes of nonexistent interrupt

> numbers. Display a guest error and tolerate spurious EOIR writes.

> 

> Fixes: 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access check logic")

> Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>

> ---

> v2: Added qemu_log_mask() (so I didn't keep the Reviewed-by tag)

> v1: https://lore.kernel.org/qemu-devel/20210603110012.1182530-1-jean-philippe@linaro.org/

> 

> ---

>  hw/intc/arm_gicv3_cpuif.c | 5 ++++-

>  1 file changed, 4 insertions(+), 1 deletion(-)


Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Alex Bennée June 7, 2021, 10:23 a.m. UTC | #2
Jean-Philippe Brucker <jean-philippe@linaro.org> writes:

> Commit 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access

> check logic") added an assert_not_reached() if the guest writes the EOIR

> register while no interrupt is active.

>

> It turns out some software does this: EDK2, in

> GicV3ExitBootServicesEvent(), unconditionally write EOIR for all

> interrupts that it manages. This now causes QEMU to abort when running

> UEFI on a VM with GICv3. Although it is UNPREDICTABLE behavior and EDK2

> does need fixing, the punishment seems a little harsh, especially since

> icc_eoir_write() already tolerates writes of nonexistent interrupt

> numbers. Display a guest error and tolerate spurious EOIR writes.

>

> Fixes: 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access check logic")

> Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>


Xen seems good at triggering this as well...

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Tested-by: Alex Bennée <alex.bennee@linaro.org>


-- 
Alex Bennée
Peter Maydell June 8, 2021, 8:53 a.m. UTC | #3
On Fri, 4 Jun 2021 at 14:07, Jean-Philippe Brucker
<jean-philippe@linaro.org> wrote:
>

> Commit 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access

> check logic") added an assert_not_reached() if the guest writes the EOIR

> register while no interrupt is active.

>

> It turns out some software does this: EDK2, in

> GicV3ExitBootServicesEvent(), unconditionally write EOIR for all

> interrupts that it manages. This now causes QEMU to abort when running

> UEFI on a VM with GICv3. Although it is UNPREDICTABLE behavior and EDK2

> does need fixing, the punishment seems a little harsh, especially since

> icc_eoir_write() already tolerates writes of nonexistent interrupt

> numbers. Display a guest error and tolerate spurious EOIR writes.

>

> Fixes: 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access check logic")

> Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>

> ---

> v2: Added qemu_log_mask() (so I didn't keep the Reviewed-by tag)

> v1: https://lore.kernel.org/qemu-devel/20210603110012.1182530-1-jean-philippe@linaro.org/




Applied to target-arm.next, thanks.

-- PMM
diff mbox series

Patch

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index 81f94c7f4a..3e0641aff9 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -14,6 +14,7 @@ 
 
 #include "qemu/osdep.h"
 #include "qemu/bitops.h"
+#include "qemu/log.h"
 #include "qemu/main-loop.h"
 #include "trace.h"
 #include "gicv3_internal.h"
@@ -1357,7 +1358,9 @@  static void icc_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
         }
         break;
     default:
-        g_assert_not_reached();
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: IRQ %d isn't active\n", __func__, irq);
+        return;
     }
 
     icc_drop_prio(cs, grp);