* kvm: WARNING In kvm_apic_accept_events
@ 2016-11-12 1:56 Dmitry Vyukov
2017-01-22 8:52 ` Dmitry Vyukov
0 siblings, 1 reply; 11+ messages in thread
From: Dmitry Vyukov @ 2016-11-12 1:56 UTC (permalink / raw)
To: Paolo Bonzini, rkrcmar, Thomas Gleixner, Ingo Molnar,
H. Peter Anvin, x86@kernel.org, KVM list, LKML, Steve Rutherford
Cc: syzkaller
Hello,
The following program triggers WARNING in kvm_apic_accept_events:
https://gist.githubusercontent.com/dvyukov/95b845a2e637485568ea1ef181a72370/raw/d90717dd67128b21715c5e794568a1600f613d97/gistfile1.txt
On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).
------------[ cut here ]------------
WARNING: CPU: 1 PID: 23523 at arch/x86/kvm/lapic.c:2330
kvm_apic_accept_events+0x3f6/0x460
Modules linked in:[ 55.632648] CPU: 1 PID: 2812 Comm: a.out Not
tainted 4.9.0-rc4+ #41
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
ffff88006be77978 ffffffff81c2f79b 0000000000000000 0000000000000000
ffffffff8322d6a0 ffffffff81127426 ffff88006be779c0 ffffffff8123ffef
ffffffff811acc46 ffffffff0000091a ffffffff8322d6a0 000000000000091a
Call Trace:
[< inline >] __dump_stack lib/dump_stack.c:15
[<ffffffff81c2f79b>] dump_stack+0xb3/0x118 lib/dump_stack.c:51
[<ffffffff8123ffef>] __warn+0x19f/0x1e0 kernel/panic.c:550
[<ffffffff812401fc>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
[<ffffffff81127426>] kvm_apic_accept_events+0x3f6/0x460
arch/x86/kvm/lapic.c:2330
[< inline >] vcpu_block arch/x86/kvm/x86.c:6793
[< inline >] vcpu_run arch/x86/kvm/x86.c:6828
[<ffffffff810b8f20>] kvm_arch_vcpu_ioctl_run+0x1580/0x5a90
arch/x86/kvm/x86.c:6984
[<ffffffff8106091e>] kvm_vcpu_ioctl+0x61e/0xdd0
arch/x86/kvm/../../../virt/kvm/kvm_main.c:2557
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff816b16fc>] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
[< inline >] SYSC_ioctl fs/ioctl.c:694
[<ffffffff816b263f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
[<ffffffff831ebd01>] entry_SYSCALL_64_fastpath+0x1f/0xc2
arch/x86/entry/entry_64.S:209
---[ end trace b2415ddd1b26dce6 ]---
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: kvm: WARNING In kvm_apic_accept_events
2016-11-12 1:56 kvm: WARNING In kvm_apic_accept_events Dmitry Vyukov
@ 2017-01-22 8:52 ` Dmitry Vyukov
2017-01-23 16:03 ` David Hildenbrand
0 siblings, 1 reply; 11+ messages in thread
From: Dmitry Vyukov @ 2017-01-22 8:52 UTC (permalink / raw)
To: Paolo Bonzini, Radim Krčmář, Thomas Gleixner,
Ingo Molnar, H. Peter Anvin, x86@kernel.org, KVM list, LKML,
Steve Rutherford
Cc: syzkaller
On Sat, Nov 12, 2016 at 2:56 AM, Dmitry Vyukov <dvyukov@google.com> wrote:
> Hello,
>
> The following program triggers WARNING in kvm_apic_accept_events:
> https://gist.githubusercontent.com/dvyukov/95b845a2e637485568ea1ef181a72370/raw/d90717dd67128b21715c5e794568a1600f613d97/gistfile1.txt
>
> On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).
>
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 23523 at arch/x86/kvm/lapic.c:2330
> kvm_apic_accept_events+0x3f6/0x460
> Modules linked in:[ 55.632648] CPU: 1 PID: 2812 Comm: a.out Not
> tainted 4.9.0-rc4+ #41
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> ffff88006be77978 ffffffff81c2f79b 0000000000000000 0000000000000000
> ffffffff8322d6a0 ffffffff81127426 ffff88006be779c0 ffffffff8123ffef
> ffffffff811acc46 ffffffff0000091a ffffffff8322d6a0 000000000000091a
> Call Trace:
> [< inline >] __dump_stack lib/dump_stack.c:15
> [<ffffffff81c2f79b>] dump_stack+0xb3/0x118 lib/dump_stack.c:51
> [<ffffffff8123ffef>] __warn+0x19f/0x1e0 kernel/panic.c:550
> [<ffffffff812401fc>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
> [<ffffffff81127426>] kvm_apic_accept_events+0x3f6/0x460
> arch/x86/kvm/lapic.c:2330
> [< inline >] vcpu_block arch/x86/kvm/x86.c:6793
> [< inline >] vcpu_run arch/x86/kvm/x86.c:6828
> [<ffffffff810b8f20>] kvm_arch_vcpu_ioctl_run+0x1580/0x5a90
> arch/x86/kvm/x86.c:6984
> [<ffffffff8106091e>] kvm_vcpu_ioctl+0x61e/0xdd0
> arch/x86/kvm/../../../virt/kvm/kvm_main.c:2557
> [< inline >] vfs_ioctl fs/ioctl.c:43
> [<ffffffff816b16fc>] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
> [< inline >] SYSC_ioctl fs/ioctl.c:694
> [<ffffffff816b263f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
> [<ffffffff831ebd01>] entry_SYSCALL_64_fastpath+0x1f/0xc2
> arch/x86/entry/entry_64.S:209
> ---[ end trace b2415ddd1b26dce6 ]---
ping
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: kvm: WARNING In kvm_apic_accept_events
2017-01-22 8:52 ` Dmitry Vyukov
@ 2017-01-23 16:03 ` David Hildenbrand
2017-01-23 16:29 ` Paolo Bonzini
0 siblings, 1 reply; 11+ messages in thread
From: David Hildenbrand @ 2017-01-23 16:03 UTC (permalink / raw)
To: Dmitry Vyukov, Paolo Bonzini, Radim Krčmář,
Thomas Gleixner, Ingo Molnar, H. Peter Anvin, x86@kernel.org,
KVM list, LKML, Steve Rutherford
Cc: syzkaller
Am 22.01.2017 um 09:52 schrieb Dmitry Vyukov:
> On Sat, Nov 12, 2016 at 2:56 AM, Dmitry Vyukov <dvyukov@google.com> wrote:
>> Hello,
>>
>> The following program triggers WARNING in kvm_apic_accept_events:
>> https://gist.githubusercontent.com/dvyukov/95b845a2e637485568ea1ef181a72370/raw/d90717dd67128b21715c5e794568a1600f613d97/gistfile1.txt
>>
>> On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).
>>
>> ------------[ cut here ]------------
>> WARNING: CPU: 1 PID: 23523 at arch/x86/kvm/lapic.c:2330
>> kvm_apic_accept_events+0x3f6/0x460
>> Modules linked in:[ 55.632648] CPU: 1 PID: 2812 Comm: a.out Not
>> tainted 4.9.0-rc4+ #41
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>> ffff88006be77978 ffffffff81c2f79b 0000000000000000 0000000000000000
>> ffffffff8322d6a0 ffffffff81127426 ffff88006be779c0 ffffffff8123ffef
>> ffffffff811acc46 ffffffff0000091a ffffffff8322d6a0 000000000000091a
>> Call Trace:
>> [< inline >] __dump_stack lib/dump_stack.c:15
>> [<ffffffff81c2f79b>] dump_stack+0xb3/0x118 lib/dump_stack.c:51
>> [<ffffffff8123ffef>] __warn+0x19f/0x1e0 kernel/panic.c:550
>> [<ffffffff812401fc>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
>> [<ffffffff81127426>] kvm_apic_accept_events+0x3f6/0x460
>> arch/x86/kvm/lapic.c:2330
>> [< inline >] vcpu_block arch/x86/kvm/x86.c:6793
>> [< inline >] vcpu_run arch/x86/kvm/x86.c:6828
>> [<ffffffff810b8f20>] kvm_arch_vcpu_ioctl_run+0x1580/0x5a90
>> arch/x86/kvm/x86.c:6984
>> [<ffffffff8106091e>] kvm_vcpu_ioctl+0x61e/0xdd0
>> arch/x86/kvm/../../../virt/kvm/kvm_main.c:2557
>> [< inline >] vfs_ioctl fs/ioctl.c:43
>> [<ffffffff816b16fc>] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
>> [< inline >] SYSC_ioctl fs/ioctl.c:694
>> [<ffffffff816b263f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
>> [<ffffffff831ebd01>] entry_SYSCALL_64_fastpath+0x1f/0xc2
>> arch/x86/entry/entry_64.S:209
>> ---[ end trace b2415ddd1b26dce6 ]---
>
>
> ping
>
Our VCPU is in SMM mode but is switched into KVM_MP_STATE_INIT_RECEIVED.
The relevant warning is (arch/x86/kvm/lapic.c:kvm_apic_accept_events())
if (is_smm(vcpu)) {
WARN_ON_ONCE(vcpu->arch.mp_state == KVM_MP_STATE_INIT_RECEIVED);
....
Something like that might help (untested):
From: David Hildenbrand <david@redhat.com>
Date: Mon, 23 Jan 2017 16:42:23 +0100
Subject: [PATCH] KVM: x86: fix illegal MP_STATE when in/entering SMM
If we already entered/are about to enter SMM, don't allow
switching to INIT/SIPI_RECEIVED, otherwise the next call to
kvm_apic_accept_events() will report a warning.
Fixes: cd7764fe9f73 ("KVM: x86: latch INITs while in system management mode")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
arch/x86/kvm/x86.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 57d8a85..06ffc91 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7247,6 +7247,12 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
mp_state->mp_state != KVM_MP_STATE_RUNNABLE)
return -EINVAL;
+ /* INITs are latched while in SMM */
+ if ((is_smm(vcpu) || vcpu->arch.smi_pending) &&
+ (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED ||
+ mp_state->mp_state == KVM_MP_STATE_INIT_RECEIVED))
+ return -EINVAL;
+
if (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED) {
vcpu->arch.mp_state = KVM_MP_STATE_INIT_RECEIVED;
set_bit(KVM_APIC_SIPI, &vcpu->arch.apic->pending_events);
--
2.9.3
--
David
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: kvm: WARNING In kvm_apic_accept_events
2017-01-23 16:03 ` David Hildenbrand
@ 2017-01-23 16:29 ` Paolo Bonzini
2017-02-14 20:31 ` Dmitry Vyukov
0 siblings, 1 reply; 11+ messages in thread
From: Paolo Bonzini @ 2017-01-23 16:29 UTC (permalink / raw)
To: David Hildenbrand, Dmitry Vyukov, Radim Krčmář,
Thomas Gleixner, Ingo Molnar, H. Peter Anvin, x86@kernel.org,
KVM list, LKML, Steve Rutherford
Cc: syzkaller
On 23/01/2017 17:03, David Hildenbrand wrote:
> Am 22.01.2017 um 09:52 schrieb Dmitry Vyukov:
>> On Sat, Nov 12, 2016 at 2:56 AM, Dmitry Vyukov <dvyukov@google.com> wrote:
>>> Hello,
>>>
>>> The following program triggers WARNING in kvm_apic_accept_events:
>>> https://gist.githubusercontent.com/dvyukov/95b845a2e637485568ea1ef181a72370/raw/d90717dd67128b21715c5e794568a1600f613d97/gistfile1.txt
>>>
>>> On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).
>>>
>>> ------------[ cut here ]------------
>>> WARNING: CPU: 1 PID: 23523 at arch/x86/kvm/lapic.c:2330
>>> kvm_apic_accept_events+0x3f6/0x460
>>> Modules linked in:[ 55.632648] CPU: 1 PID: 2812 Comm: a.out Not
>>> tainted 4.9.0-rc4+ #41
>>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>>> ffff88006be77978 ffffffff81c2f79b 0000000000000000 0000000000000000
>>> ffffffff8322d6a0 ffffffff81127426 ffff88006be779c0 ffffffff8123ffef
>>> ffffffff811acc46 ffffffff0000091a ffffffff8322d6a0 000000000000091a
>>> Call Trace:
>>> [< inline >] __dump_stack lib/dump_stack.c:15
>>> [<ffffffff81c2f79b>] dump_stack+0xb3/0x118 lib/dump_stack.c:51
>>> [<ffffffff8123ffef>] __warn+0x19f/0x1e0 kernel/panic.c:550
>>> [<ffffffff812401fc>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
>>> [<ffffffff81127426>] kvm_apic_accept_events+0x3f6/0x460
>>> arch/x86/kvm/lapic.c:2330
>>> [< inline >] vcpu_block arch/x86/kvm/x86.c:6793
>>> [< inline >] vcpu_run arch/x86/kvm/x86.c:6828
>>> [<ffffffff810b8f20>] kvm_arch_vcpu_ioctl_run+0x1580/0x5a90
>>> arch/x86/kvm/x86.c:6984
>>> [<ffffffff8106091e>] kvm_vcpu_ioctl+0x61e/0xdd0
>>> arch/x86/kvm/../../../virt/kvm/kvm_main.c:2557
>>> [< inline >] vfs_ioctl fs/ioctl.c:43
>>> [<ffffffff816b16fc>] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
>>> [< inline >] SYSC_ioctl fs/ioctl.c:694
>>> [<ffffffff816b263f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
>>> [<ffffffff831ebd01>] entry_SYSCALL_64_fastpath+0x1f/0xc2
>>> arch/x86/entry/entry_64.S:209
>>> ---[ end trace b2415ddd1b26dce6 ]---
>>
>>
>> ping
>>
>
> Our VCPU is in SMM mode but is switched into KVM_MP_STATE_INIT_RECEIVED.
>
> The relevant warning is (arch/x86/kvm/lapic.c:kvm_apic_accept_events())
>
> if (is_smm(vcpu)) {
> WARN_ON_ONCE(vcpu->arch.mp_state == KVM_MP_STATE_INIT_RECEIVED);
> ....
>
> Something like that might help (untested):
>
>
> From: David Hildenbrand <david@redhat.com>
> Date: Mon, 23 Jan 2017 16:42:23 +0100
> Subject: [PATCH] KVM: x86: fix illegal MP_STATE when in/entering SMM
>
> If we already entered/are about to enter SMM, don't allow
> switching to INIT/SIPI_RECEIVED, otherwise the next call to
> kvm_apic_accept_events() will report a warning.
>
> Fixes: cd7764fe9f73 ("KVM: x86: latch INITs while in system management mode")
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> Signed-off-by: David Hildenbrand <david@redhat.com>
> ---
> arch/x86/kvm/x86.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 57d8a85..06ffc91 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -7247,6 +7247,12 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
> mp_state->mp_state != KVM_MP_STATE_RUNNABLE)
> return -EINVAL;
>
> + /* INITs are latched while in SMM */
> + if ((is_smm(vcpu) || vcpu->arch.smi_pending) &&
> + (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED ||
> + mp_state->mp_state == KVM_MP_STATE_INIT_RECEIVED))
> + return -EINVAL;
> +
> if (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED) {
> vcpu->arch.mp_state = KVM_MP_STATE_INIT_RECEIVED;
> set_bit(KVM_APIC_SIPI, &vcpu->arch.apic->pending_events);
>
Looks good, thanks for analyzing it. I'll try making a minimal testcase...
Paolo
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: kvm: WARNING In kvm_apic_accept_events
2017-01-23 16:29 ` Paolo Bonzini
@ 2017-02-14 20:31 ` Dmitry Vyukov
2017-02-15 9:26 ` David Hildenbrand
0 siblings, 1 reply; 11+ messages in thread
From: Dmitry Vyukov @ 2017-02-14 20:31 UTC (permalink / raw)
To: Paolo Bonzini
Cc: David Hildenbrand, Radim Krčmář, Thomas Gleixner,
Ingo Molnar, H. Peter Anvin, x86@kernel.org, KVM list, LKML,
Steve Rutherford, syzkaller
On Mon, Jan 23, 2017 at 5:29 PM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>
> On 23/01/2017 17:03, David Hildenbrand wrote:
>> Am 22.01.2017 um 09:52 schrieb Dmitry Vyukov:
>>> On Sat, Nov 12, 2016 at 2:56 AM, Dmitry Vyukov <dvyukov@google.com> wrote:
>>>> Hello,
>>>>
>>>> The following program triggers WARNING in kvm_apic_accept_events:
>>>> https://gist.githubusercontent.com/dvyukov/95b845a2e637485568ea1ef181a72370/raw/d90717dd67128b21715c5e794568a1600f613d97/gistfile1.txt
>>>>
>>>> On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).
>>>>
>>>> ------------[ cut here ]------------
>>>> WARNING: CPU: 1 PID: 23523 at arch/x86/kvm/lapic.c:2330
>>>> kvm_apic_accept_events+0x3f6/0x460
>>>> Modules linked in:[ 55.632648] CPU: 1 PID: 2812 Comm: a.out Not
>>>> tainted 4.9.0-rc4+ #41
>>>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>>>> ffff88006be77978 ffffffff81c2f79b 0000000000000000 0000000000000000
>>>> ffffffff8322d6a0 ffffffff81127426 ffff88006be779c0 ffffffff8123ffef
>>>> ffffffff811acc46 ffffffff0000091a ffffffff8322d6a0 000000000000091a
>>>> Call Trace:
>>>> [< inline >] __dump_stack lib/dump_stack.c:15
>>>> [<ffffffff81c2f79b>] dump_stack+0xb3/0x118 lib/dump_stack.c:51
>>>> [<ffffffff8123ffef>] __warn+0x19f/0x1e0 kernel/panic.c:550
>>>> [<ffffffff812401fc>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
>>>> [<ffffffff81127426>] kvm_apic_accept_events+0x3f6/0x460
>>>> arch/x86/kvm/lapic.c:2330
>>>> [< inline >] vcpu_block arch/x86/kvm/x86.c:6793
>>>> [< inline >] vcpu_run arch/x86/kvm/x86.c:6828
>>>> [<ffffffff810b8f20>] kvm_arch_vcpu_ioctl_run+0x1580/0x5a90
>>>> arch/x86/kvm/x86.c:6984
>>>> [<ffffffff8106091e>] kvm_vcpu_ioctl+0x61e/0xdd0
>>>> arch/x86/kvm/../../../virt/kvm/kvm_main.c:2557
>>>> [< inline >] vfs_ioctl fs/ioctl.c:43
>>>> [<ffffffff816b16fc>] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
>>>> [< inline >] SYSC_ioctl fs/ioctl.c:694
>>>> [<ffffffff816b263f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
>>>> [<ffffffff831ebd01>] entry_SYSCALL_64_fastpath+0x1f/0xc2
>>>> arch/x86/entry/entry_64.S:209
>>>> ---[ end trace b2415ddd1b26dce6 ]---
>>>
>>>
>>> ping
>>>
>>
>> Our VCPU is in SMM mode but is switched into KVM_MP_STATE_INIT_RECEIVED.
>>
>> The relevant warning is (arch/x86/kvm/lapic.c:kvm_apic_accept_events())
>>
>> if (is_smm(vcpu)) {
>> WARN_ON_ONCE(vcpu->arch.mp_state == KVM_MP_STATE_INIT_RECEIVED);
>> ....
>>
>> Something like that might help (untested):
>>
>>
>> From: David Hildenbrand <david@redhat.com>
>> Date: Mon, 23 Jan 2017 16:42:23 +0100
>> Subject: [PATCH] KVM: x86: fix illegal MP_STATE when in/entering SMM
>>
>> If we already entered/are about to enter SMM, don't allow
>> switching to INIT/SIPI_RECEIVED, otherwise the next call to
>> kvm_apic_accept_events() will report a warning.
>>
>> Fixes: cd7764fe9f73 ("KVM: x86: latch INITs while in system management mode")
>> Reported-by: Dmitry Vyukov <dvyukov@google.com>
>> Signed-off-by: David Hildenbrand <david@redhat.com>
>> ---
>> arch/x86/kvm/x86.c | 6 ++++++
>> 1 file changed, 6 insertions(+)
>>
>> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
>> index 57d8a85..06ffc91 100644
>> --- a/arch/x86/kvm/x86.c
>> +++ b/arch/x86/kvm/x86.c
>> @@ -7247,6 +7247,12 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
>> mp_state->mp_state != KVM_MP_STATE_RUNNABLE)
>> return -EINVAL;
>>
>> + /* INITs are latched while in SMM */
>> + if ((is_smm(vcpu) || vcpu->arch.smi_pending) &&
>> + (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED ||
>> + mp_state->mp_state == KVM_MP_STATE_INIT_RECEIVED))
>> + return -EINVAL;
>> +
>> if (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED) {
>> vcpu->arch.mp_state = KVM_MP_STATE_INIT_RECEIVED;
>> set_bit(KVM_APIC_SIPI, &vcpu->arch.apic->pending_events);
>>
>
> Looks good, thanks for analyzing it. I'll try making a minimal testcase...
Any progress with this? Should we commit this as is?
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: kvm: WARNING In kvm_apic_accept_events
2017-02-14 20:31 ` Dmitry Vyukov
@ 2017-02-15 9:26 ` David Hildenbrand
2017-02-15 10:10 ` Paolo Bonzini
0 siblings, 1 reply; 11+ messages in thread
From: David Hildenbrand @ 2017-02-15 9:26 UTC (permalink / raw)
To: Dmitry Vyukov, Paolo Bonzini
Cc: Radim Krčmář, Thomas Gleixner, Ingo Molnar,
H. Peter Anvin, x86@kernel.org, KVM list, LKML, Steve Rutherford,
syzkaller
>>> From: David Hildenbrand <david@redhat.com>
>>> Date: Mon, 23 Jan 2017 16:42:23 +0100
>>> Subject: [PATCH] KVM: x86: fix illegal MP_STATE when in/entering SMM
>>>
>>> If we already entered/are about to enter SMM, don't allow
>>> switching to INIT/SIPI_RECEIVED, otherwise the next call to
>>> kvm_apic_accept_events() will report a warning.
>>>
>>> Fixes: cd7764fe9f73 ("KVM: x86: latch INITs while in system management mode")
>>> Reported-by: Dmitry Vyukov <dvyukov@google.com>
>>> Signed-off-by: David Hildenbrand <david@redhat.com>
>>> ---
>>> arch/x86/kvm/x86.c | 6 ++++++
>>> 1 file changed, 6 insertions(+)
>>>
>>> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
>>> index 57d8a85..06ffc91 100644
>>> --- a/arch/x86/kvm/x86.c
>>> +++ b/arch/x86/kvm/x86.c
>>> @@ -7247,6 +7247,12 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
>>> mp_state->mp_state != KVM_MP_STATE_RUNNABLE)
>>> return -EINVAL;
>>>
>>> + /* INITs are latched while in SMM */
>>> + if ((is_smm(vcpu) || vcpu->arch.smi_pending) &&
>>> + (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED ||
>>> + mp_state->mp_state == KVM_MP_STATE_INIT_RECEIVED))
>>> + return -EINVAL;
>>> +
>>> if (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED) {
>>> vcpu->arch.mp_state = KVM_MP_STATE_INIT_RECEIVED;
>>> set_bit(KVM_APIC_SIPI, &vcpu->arch.apic->pending_events);
>>>
>>
>> Looks good, thanks for analyzing it. I'll try making a minimal testcase...
>
>
> Any progress with this? Should we commit this as is?
>
Paolo, should I resend as a proper notcopieddiff mail?
--
Thanks,
David
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: kvm: WARNING In kvm_apic_accept_events
2017-02-15 9:26 ` David Hildenbrand
@ 2017-02-15 10:10 ` Paolo Bonzini
2017-03-22 15:34 ` Dmitry Vyukov
0 siblings, 1 reply; 11+ messages in thread
From: Paolo Bonzini @ 2017-02-15 10:10 UTC (permalink / raw)
To: David Hildenbrand, Dmitry Vyukov
Cc: Radim Krčmář, Thomas Gleixner, Ingo Molnar,
H. Peter Anvin, x86@kernel.org, KVM list, LKML, Steve Rutherford,
syzkaller
On 15/02/2017 10:26, David Hildenbrand wrote:
>>
>> Any progress with this? Should we commit this as is?
>>
> Paolo, should I resend as a proper notcopieddiff mail?
Yes, please do (CCing stable@vger.kernel.org too).
Paolo
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: kvm: WARNING In kvm_apic_accept_events
2017-02-15 10:10 ` Paolo Bonzini
@ 2017-03-22 15:34 ` Dmitry Vyukov
2017-03-22 15:35 ` David Hildenbrand
0 siblings, 1 reply; 11+ messages in thread
From: Dmitry Vyukov @ 2017-03-22 15:34 UTC (permalink / raw)
To: Paolo Bonzini
Cc: David Hildenbrand, Radim Krčmář, Thomas Gleixner,
Ingo Molnar, H. Peter Anvin, x86@kernel.org, KVM list, LKML,
Steve Rutherford, syzkaller
On Wed, Feb 15, 2017 at 11:10 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>
>
> On 15/02/2017 10:26, David Hildenbrand wrote:
>>>
>>> Any progress with this? Should we commit this as is?
>>>
>> Paolo, should I resend as a proper notcopieddiff mail?
>
> Yes, please do (CCing stable@vger.kernel.org too).
>
> Paolo
Has this reached any tree? I don't see this in kvm/master.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: kvm: WARNING In kvm_apic_accept_events
2017-03-22 15:34 ` Dmitry Vyukov
@ 2017-03-22 15:35 ` David Hildenbrand
0 siblings, 0 replies; 11+ messages in thread
From: David Hildenbrand @ 2017-03-22 15:35 UTC (permalink / raw)
To: Dmitry Vyukov, Paolo Bonzini
Cc: Radim Krčmář, Thomas Gleixner, Ingo Molnar,
H. Peter Anvin, x86@kernel.org, KVM list, LKML, Steve Rutherford,
syzkaller
On 22.03.2017 16:34, Dmitry Vyukov wrote:
> On Wed, Feb 15, 2017 at 11:10 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>>
>>
>> On 15/02/2017 10:26, David Hildenbrand wrote:
>>>>
>>>> Any progress with this? Should we commit this as is?
>>>>
>>> Paolo, should I resend as a proper notcopieddiff mail?
>>
>> Yes, please do (CCing stable@vger.kernel.org too).
>>
>> Paolo
>
> Has this reached any tree? I don't see this in kvm/master.
>
Whops, seems like I missed Paolo's mail. Will send out the patch in a
minute.
--
Thanks,
David
^ permalink raw reply [flat|nested] 11+ messages in thread
* kvm: WARNING in kvm_apic_accept_events
@ 2016-01-08 17:16 Dmitry Vyukov
2016-01-15 17:13 ` Dmitry Vyukov
0 siblings, 1 reply; 11+ messages in thread
From: Dmitry Vyukov @ 2016-01-08 17:16 UTC (permalink / raw)
To: Gleb Natapov, Paolo Bonzini, Thomas Gleixner, Ingo Molnar,
H. Peter Anvin, x86@kernel.org, kvm, LKML
Cc: syzkaller, Kostya Serebryany, Alexander Potapenko, Eric Dumazet,
Sasha Levin
Hello,
The following program triggers WARNING in kvm_apic_accept_events:
// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <stdint.h>
long r[32];
int main()
{
memset(r, -1, sizeof(r));
r[0] = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul,
0x32ul, 0xfffffffffffffffful, 0x0ul);
memcpy((void*)0x20007000, "\x2f\x64\x65\x76\x2f\x6b\x76\x6d", 8);
r[2] = syscall(SYS_open, 0x20007000ul, 0x801ul, 0x0ul, 0, 0, 0);
r[3] = syscall(SYS_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0);
*(uint64_t*)0x2000cbe8 = (uint64_t)0x2cf6;
r[5] = syscall(SYS_ioctl, r[3], 0xae78ul, 0x2000cbe8ul, 0, 0, 0);
r[6] = syscall(SYS_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0);
r[7] = syscall(SYS_ioctl, r[6], 0xae60ul, 0, 0, 0, 0);
r[8] = syscall(SYS_ioctl, r[6], 0xae41ul, 0x0ul, 0, 0, 0);
*(uint8_t*)0x20001f89 = (uint8_t)0xff5b;
*(uint8_t*)0x20001f8a = (uint8_t)0x8;
*(uint8_t*)0x20001f8b = (uint8_t)0x7;
*(uint8_t*)0x20001f8c = (uint8_t)0x8;
*(uint32_t*)0x20001f8d = (uint32_t)0x2;
*(uint8_t*)0x20001f91 = (uint8_t)0xfffffffffffffff7;
*(uint8_t*)0x20001f92 = (uint8_t)0x8;
*(uint8_t*)0x20001f93 = (uint8_t)0x6;
*(uint8_t*)0x20001f94 = (uint8_t)0x4e399187;
*(uint8_t*)0x20001f95 = (uint8_t)0x28;
*(uint8_t*)0x20001f96 = (uint8_t)0x5;
*(uint8_t*)0x20001f97 = (uint8_t)0x7;
*(uint8_t*)0x20001f98 = (uint8_t)0x4;
*(uint32_t*)0x20001f99 = (uint32_t)0x4;
*(uint32_t*)0x20001f9d = (uint32_t)0x8;
*(uint8_t*)0x20001fa1 = (uint8_t)0x1;
*(uint8_t*)0x20001fa2 = (uint8_t)0x4;
*(uint8_t*)0x20001fa3 = (uint8_t)0x2;
*(uint8_t*)0x20001fa4 = (uint8_t)0x5;
r[28] = syscall(SYS_ioctl, r[8], 0x4040aea0ul, 0x20001f89ul, 0, 0, 0);
*(uint32_t*)0x2000c000 = (uint32_t)0x2;
r[30] = syscall(SYS_ioctl, r[8], 0x4004ae99ul, 0x2000c000ul, 0, 0, 0);
r[31] = syscall(SYS_ioctl, r[8], 0xae80ul, 0, 0, 0, 0);
return 0;
}
------------[ cut here ]------------
WARNING: CPU: 1 PID: 6658 at arch/x86/kvm/lapic.c:2157
kvm_apic_accept_events+0x3dd/0x440()
Modules linked in:
CPU: 1 PID: 6658 Comm: a.out Tainted: G W 4.4.0-rc8+ #216
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
00000000ffffffff ffff88006c8bf990 ffffffff82904c8d 0000000000000000
ffff8800624eaf00 ffffffff85ee24a0 ffff88006c8bf9d0 ffffffff8133e979
ffffffff810d4f0d ffffffff85ee24a0 000000000000086d ffff88006571b608
Call Trace:
[< inline >] __dump_stack lib/dump_stack.c:15
[<ffffffff82904c8d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
[<ffffffff8133e979>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:460
[<ffffffff8133eba9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:493
[<ffffffff810d4f0d>] kvm_apic_accept_events+0x3dd/0x440
arch/x86/kvm/lapic.c:2157
[< inline >] vcpu_block arch/x86/kvm/x86.c:6627
[< inline >] vcpu_run arch/x86/kvm/x86.c:6662
[<ffffffff81068822>] kvm_arch_vcpu_ioctl_run+0xc32/0x5820
arch/x86/kvm/x86.c:6818
[<ffffffff8101cf61>] kvm_vcpu_ioctl+0x5f1/0xd00
arch/x86/kvm/../../../virt/kvm/kvm_main.c:2375
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff817b36b1>] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:607
[< inline >] SYSC_ioctl fs/ioctl.c:622
[<ffffffff817b3eff>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613
[<ffffffff85e745b6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
---[ end trace 231a97373e5bf4b0 ]---
On commit b06f3a168cdcd80026276898fd1fee443ef25743 (Jan 6).
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: kvm: WARNING in kvm_apic_accept_events
2016-01-08 17:16 kvm: WARNING in kvm_apic_accept_events Dmitry Vyukov
@ 2016-01-15 17:13 ` Dmitry Vyukov
0 siblings, 0 replies; 11+ messages in thread
From: Dmitry Vyukov @ 2016-01-15 17:13 UTC (permalink / raw)
To: Gleb Natapov, Paolo Bonzini, Thomas Gleixner, Ingo Molnar,
H. Peter Anvin, x86@kernel.org, kvm, LKML, mtosatti,
yoshikawa_takuya_b1, guangrong.xiao
Cc: syzkaller, Kostya Serebryany, Alexander Potapenko, Eric Dumazet,
Sasha Levin
On Fri, Jan 8, 2016 at 6:16 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
> Hello,
>
> The following program triggers WARNING in kvm_apic_accept_events:
>
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #include <unistd.h>
> #include <sys/syscall.h>
> #include <string.h>
> #include <stdint.h>
>
> long r[32];
>
> int main()
> {
> memset(r, -1, sizeof(r));
> r[0] = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul,
> 0x32ul, 0xfffffffffffffffful, 0x0ul);
> memcpy((void*)0x20007000, "\x2f\x64\x65\x76\x2f\x6b\x76\x6d", 8);
> r[2] = syscall(SYS_open, 0x20007000ul, 0x801ul, 0x0ul, 0, 0, 0);
> r[3] = syscall(SYS_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0);
> *(uint64_t*)0x2000cbe8 = (uint64_t)0x2cf6;
> r[5] = syscall(SYS_ioctl, r[3], 0xae78ul, 0x2000cbe8ul, 0, 0, 0);
> r[6] = syscall(SYS_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0);
> r[7] = syscall(SYS_ioctl, r[6], 0xae60ul, 0, 0, 0, 0);
> r[8] = syscall(SYS_ioctl, r[6], 0xae41ul, 0x0ul, 0, 0, 0);
> *(uint8_t*)0x20001f89 = (uint8_t)0xff5b;
> *(uint8_t*)0x20001f8a = (uint8_t)0x8;
> *(uint8_t*)0x20001f8b = (uint8_t)0x7;
> *(uint8_t*)0x20001f8c = (uint8_t)0x8;
> *(uint32_t*)0x20001f8d = (uint32_t)0x2;
> *(uint8_t*)0x20001f91 = (uint8_t)0xfffffffffffffff7;
> *(uint8_t*)0x20001f92 = (uint8_t)0x8;
> *(uint8_t*)0x20001f93 = (uint8_t)0x6;
> *(uint8_t*)0x20001f94 = (uint8_t)0x4e399187;
> *(uint8_t*)0x20001f95 = (uint8_t)0x28;
> *(uint8_t*)0x20001f96 = (uint8_t)0x5;
> *(uint8_t*)0x20001f97 = (uint8_t)0x7;
> *(uint8_t*)0x20001f98 = (uint8_t)0x4;
> *(uint32_t*)0x20001f99 = (uint32_t)0x4;
> *(uint32_t*)0x20001f9d = (uint32_t)0x8;
> *(uint8_t*)0x20001fa1 = (uint8_t)0x1;
> *(uint8_t*)0x20001fa2 = (uint8_t)0x4;
> *(uint8_t*)0x20001fa3 = (uint8_t)0x2;
> *(uint8_t*)0x20001fa4 = (uint8_t)0x5;
> r[28] = syscall(SYS_ioctl, r[8], 0x4040aea0ul, 0x20001f89ul, 0, 0, 0);
> *(uint32_t*)0x2000c000 = (uint32_t)0x2;
> r[30] = syscall(SYS_ioctl, r[8], 0x4004ae99ul, 0x2000c000ul, 0, 0, 0);
> r[31] = syscall(SYS_ioctl, r[8], 0xae80ul, 0, 0, 0, 0);
> return 0;
> }
>
>
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 6658 at arch/x86/kvm/lapic.c:2157
> kvm_apic_accept_events+0x3dd/0x440()
> Modules linked in:
> CPU: 1 PID: 6658 Comm: a.out Tainted: G W 4.4.0-rc8+ #216
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> 00000000ffffffff ffff88006c8bf990 ffffffff82904c8d 0000000000000000
> ffff8800624eaf00 ffffffff85ee24a0 ffff88006c8bf9d0 ffffffff8133e979
> ffffffff810d4f0d ffffffff85ee24a0 000000000000086d ffff88006571b608
> Call Trace:
> [< inline >] __dump_stack lib/dump_stack.c:15
> [<ffffffff82904c8d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
> [<ffffffff8133e979>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:460
> [<ffffffff8133eba9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:493
> [<ffffffff810d4f0d>] kvm_apic_accept_events+0x3dd/0x440
> arch/x86/kvm/lapic.c:2157
> [< inline >] vcpu_block arch/x86/kvm/x86.c:6627
> [< inline >] vcpu_run arch/x86/kvm/x86.c:6662
> [<ffffffff81068822>] kvm_arch_vcpu_ioctl_run+0xc32/0x5820
> arch/x86/kvm/x86.c:6818
> [<ffffffff8101cf61>] kvm_vcpu_ioctl+0x5f1/0xd00
> arch/x86/kvm/../../../virt/kvm/kvm_main.c:2375
> [< inline >] vfs_ioctl fs/ioctl.c:43
> [<ffffffff817b36b1>] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:607
> [< inline >] SYSC_ioctl fs/ioctl.c:622
> [<ffffffff817b3eff>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613
> [<ffffffff85e745b6>] entry_SYSCALL_64_fastpath+0x16/0x7a
> arch/x86/entry/entry_64.S:185
> ---[ end trace 231a97373e5bf4b0 ]---
>
>
> On commit b06f3a168cdcd80026276898fd1fee443ef25743 (Jan 6).
+ more kvm people
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2017-03-22 15:35 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-11-12 1:56 kvm: WARNING In kvm_apic_accept_events Dmitry Vyukov
2017-01-22 8:52 ` Dmitry Vyukov
2017-01-23 16:03 ` David Hildenbrand
2017-01-23 16:29 ` Paolo Bonzini
2017-02-14 20:31 ` Dmitry Vyukov
2017-02-15 9:26 ` David Hildenbrand
2017-02-15 10:10 ` Paolo Bonzini
2017-03-22 15:34 ` Dmitry Vyukov
2017-03-22 15:35 ` David Hildenbrand
-- strict thread matches above, loose matches on Subject: below --
2016-01-08 17:16 kvm: WARNING in kvm_apic_accept_events Dmitry Vyukov
2016-01-15 17:13 ` Dmitry Vyukov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox