Re: [PATCH 1/1] KVM: inject data abort if instruction cannot be decoded

[Alexander Graf <graf@amazon.com>]

On 06.09.19 15:31, Peter Maydell wrote:
> On Fri, 6 Sep 2019 at 14:13, Christoffer Dall <christoffer.dall@arm.com> wrote:
>> I'd prefer leaving it to userspace to worry about, but I thought Peter
>> said that had been problematic historically, which I took at face value,
>> but I could have misunderstood.
>>
>> If QEMU, kvmtool, and whatever the crazy^H cool kids are using in
>> userspace these days are happy emulating the exception, then that's a
>> viable approach.  The main concern I have with that is whether they'll
>> all get it right, and since we already have the code in the kernel to do
>> this, it might make sense to re-use the kernel logic for it.
> 
> Well, for QEMU we've had code that in theory might do this but
> in practice it's never been tested. Essentially the problem is
> that nobody ever wants to inject an exception from userspace
> except in incredibly rare cases like "trying to use h/w breakpoints
> simultaneously inside the VM and also to debug the VM from outside"
> or "we're running on RAS hardware that just told us that the VM's
> RAM was faulty". There's no even vaguely commonly-used usecase
> for it today; and this ABI suggestion adds another "this is in
> practice almost never going to happen" case to the pile. The
> codepath is unreliable in QEMU because (a) it requires getting
> syncing of sysreg values to and from the kernel right -- this is
> about the only situation where userspace wants to modify sysregs
> during execution of the VM, as opposed to just reading them -- and
> (b) we try to reuse the code we already have that does TCG exception
> injection, which might or might not be a design mistake, and

That's probably a design mistake, correct :)

> (c) as noted above it's a never-actually-used untested codepath...

Sounds like an easy thing to resolve using kvm-unit-tests?

> So I think if I were you I wouldn't commit to the kernel ABI until
> somebody had at least written some RFC-quality patches for QEMU and
> tested that they work and the ABI is OK in that sense. (For the
> avoidance of doubt, I'm not volunteering to do that myself.)
> I don't object to the idea in principle, though.
> 
> PS: the other "injecting exceptions to the guest" oddity is that
> if the kernel *does* find the ISV information and returns to userspace
> for it to handle the MMIO, there's no way for userspace to say
> "actually that address is supposed to generate a data abort".

I think we're converging here. My proposal is that "inject a fault" 
should not be something special cased for the "I can't decode the 
instruction" case, but rather that we need a more generic mechanism.

Whether that's a new ioctl, a flag we set on entry or something else is 
an implementation detail I'll be happy to leave for discussion.

The only thing I'd like to avoid seeing is that we create a new user 
space ABI that makes it easy to inject a single, particular exception, 
but not solve all of the other cases while creating extra work to just 
implement instruction decoding in user space.


Alex



Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Ralf Herbrich
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879