* Forwarded: [PATCH] KVM: x86: Add debug traces to investigate irq == -1
2026-07-09 16:33 [syzbot] [kvm-x86?] WARNING in kvm_check_and_inject_events syzbot
@ 2026-07-12 2:09 ` syzbot
2026-07-12 4:36 ` Forwarded: [PATCH] KVM: x86: Add debug traces (KERN_WARNING) to investigate irq syzbot
1 sibling, 0 replies; 3+ messages in thread
From: syzbot @ 2026-07-12 2:09 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] KVM: x86: Add debug traces to investigate irq == -1
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Reported-by: syzbot+9dcd0a11dc9703a49511@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=9dcd0a11dc9703a49511
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
arch/x86/kvm/i8259.c | 37 ++++++++++++++++++++++++++++++++---
arch/x86/kvm/irq.c | 46 +++++++++++++++++++++++++++++++++++++++++---
2 files changed, 77 insertions(+), 6 deletions(-)
diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
index 6a942ac622d5..4360ed7cc319 100644
--- a/arch/x86/kvm/i8259.c
+++ b/arch/x86/kvm/i8259.c
@@ -233,13 +233,33 @@ int kvm_pic_read_irq(struct kvm *kvm)
{
int irq, irq2, intno;
struct kvm_pic *s = kvm->arch.vpic;
-
- s->output = 0;
-
pic_lock(s);
+ printk(KERN_DEBUG
+ "KVM_DEBUG: pic_read_irq START "
+ "output=%d "
+ "IRR0=%02x IMR0=%02x "
+ "ISR0=%02x\n",
+ s->output,
+ s->pics[0].irr,
+ s->pics[0].imr,
+ s->pics[0].isr);
+ s->output = 0;
+ printk(KERN_DEBUG
+ "KVM_DEBUG: output set to 0!\n");
irq = pic_get_irq(&s->pics[0]);
+ printk(KERN_DEBUG
+ "KVM_DEBUG: pic_get_irq returned %d\n",
+ irq);
if (irq >= 0) {
pic_intack(&s->pics[0], irq);
+ printk(KERN_DEBUG
+ "KVM_DEBUG: after pic_intack "
+ "IRR0=%02x "
+ "ISR0=%02x "
+ "auto_eoi=%d\n",
+ s->pics[0].irr,
+ s->pics[0].isr,
+ s->pics[0].auto_eoi);
if (irq == 2) {
irq2 = pic_get_irq(&s->pics[1]);
if (irq2 >= 0)
@@ -253,6 +273,9 @@ int kvm_pic_read_irq(struct kvm *kvm)
} else
intno = s->pics[0].irq_base + irq;
} else {
+ printk(KERN_DEBUG
+ "KVM_DEBUG: spurious IRQ! "
+ "no irq found in IRR!\n");
/*
* spurious IRQ on host controller
*/
@@ -260,6 +283,14 @@ int kvm_pic_read_irq(struct kvm *kvm)
intno = s->pics[0].irq_base + irq;
}
pic_update_irq(s);
+ printk(KERN_DEBUG
+ "KVM_DEBUG: pic_read_irq END "
+ "intno=%d "
+ "output=%d "
+ "IRR0=%02x\n",
+ intno,
+ s->output,
+ s->pics[0].irr);
pic_unlock(s);
return intno;
diff --git a/arch/x86/kvm/irq.c b/arch/x86/kvm/irq.c
index 8c62c6d4d5c1..1c7541e01d4a 100644
--- a/arch/x86/kvm/irq.c
+++ b/arch/x86/kvm/irq.c
@@ -79,8 +79,19 @@ int kvm_cpu_has_extint(struct kvm_vcpu *v)
return 0;
#ifdef CONFIG_KVM_IOAPIC
- if (pic_in_kernel(v->kvm))
+ if (pic_in_kernel(v->kvm)) {
+ printk(KERN_DEBUG
+ "KVM_DEBUG: has_extint called "
+ "output=%d "
+ "IRR0=%02x IRR1=%02x "
+ "IMR0=%02x IMR1=%02x\n",
+ v->kvm->arch.vpic->output,
+ v->kvm->arch.vpic->pics[0].irr,
+ v->kvm->arch.vpic->pics[1].irr,
+ v->kvm->arch.vpic->pics[0].imr,
+ v->kvm->arch.vpic->pics[1].imr);
return v->kvm->arch.vpic->output;
+ }
#endif
WARN_ON_ONCE(!irqchip_split(v->kvm));
@@ -127,7 +138,24 @@ EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_cpu_has_interrupt);
*/
int kvm_cpu_get_extint(struct kvm_vcpu *v)
{
+ int result;
+ if (pic_in_kernel(v->kvm))
+ printk(KERN_DEBUG
+ "KVM_DEBUG: get_extint called "
+ "output=%d\n",
+ v->kvm->arch.vpic->output);
if (!kvm_cpu_has_extint(v)) {
+ if (pic_in_kernel(v->kvm)) {
+ printk(KERN_DEBUG
+ "KVM_DEBUG: has_extint=FALSE "
+ "returning -1! "
+ "output=%d\n",
+ v->kvm->arch.vpic->output);
+ }
+ else
+ printk(KERN_DEBUG
+ "KVM_DEBUG: has_extint=FALSE "
+ "no pic in kernel!\n");
WARN_ON(!lapic_in_kernel(v));
return -1;
}
@@ -141,8 +169,20 @@ int kvm_cpu_get_extint(struct kvm_vcpu *v)
#endif
#ifdef CONFIG_KVM_IOAPIC
- if (pic_in_kernel(v->kvm))
- return kvm_pic_read_irq(v->kvm); /* PIC */
+ if (pic_in_kernel(v->kvm)) {
+ printk(KERN_DEBUG
+ "KVM_DEBUG: calling pic_read_irq "
+ "output=%d\n",
+ v->kvm->arch.vpic->output);
+ result = kvm_pic_read_irq(v->kvm);
+ printk(KERN_DEBUG
+ "KVM_DEBUG: pic_read_irq returned "
+ "intno=%d "
+ "output=%d\n",
+ result,
+ v->kvm->arch.vpic->output);
+ return result; /* PIC */
+ }
#endif
WARN_ON_ONCE(!irqchip_split(v->kvm));
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Forwarded: [PATCH] KVM: x86: Add debug traces (KERN_WARNING) to investigate irq
2026-07-09 16:33 [syzbot] [kvm-x86?] WARNING in kvm_check_and_inject_events syzbot
2026-07-12 2:09 ` Forwarded: [PATCH] KVM: x86: Add debug traces to investigate irq == -1 syzbot
@ 2026-07-12 4:36 ` syzbot
1 sibling, 0 replies; 3+ messages in thread
From: syzbot @ 2026-07-12 4:36 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] KVM: x86: Add debug traces (KERN_WARNING) to investigate irq
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Reported-by: syzbot+9dcd0a11dc9703a49511@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=9dcd0a11dc9703a49511
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
arch/x86/kvm/i8259.c | 37 ++++++++++++++++++++++++++++++++---
arch/x86/kvm/irq.c | 46 +++++++++++++++++++++++++++++++++++++++++---
2 files changed, 77 insertions(+), 6 deletions(-)
diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
index 6a942ac622d5..20b3b4855974 100644
--- a/arch/x86/kvm/i8259.c
+++ b/arch/x86/kvm/i8259.c
@@ -233,13 +233,33 @@ int kvm_pic_read_irq(struct kvm *kvm)
{
int irq, irq2, intno;
struct kvm_pic *s = kvm->arch.vpic;
-
- s->output = 0;
-
pic_lock(s);
+ printk(KERN_WARNING
+ "KVM_DEBUG: pic_read_irq START "
+ "output=%d "
+ "IRR0=%02x IMR0=%02x "
+ "ISR0=%02x\n",
+ s->output,
+ s->pics[0].irr,
+ s->pics[0].imr,
+ s->pics[0].isr);
+ s->output = 0;
+ printk(KERN_WARNING
+ "KVM_DEBUG: output set to 0!\n");
irq = pic_get_irq(&s->pics[0]);
+ printk(KERN_WARNING
+ "KVM_DEBUG: pic_get_irq returned %d\n",
+ irq);
if (irq >= 0) {
pic_intack(&s->pics[0], irq);
+ printk(KERN_WARNING
+ "KVM_DEBUG: after pic_intack "
+ "IRR0=%02x "
+ "ISR0=%02x "
+ "auto_eoi=%d\n",
+ s->pics[0].irr,
+ s->pics[0].isr,
+ s->pics[0].auto_eoi);
if (irq == 2) {
irq2 = pic_get_irq(&s->pics[1]);
if (irq2 >= 0)
@@ -253,6 +273,9 @@ int kvm_pic_read_irq(struct kvm *kvm)
} else
intno = s->pics[0].irq_base + irq;
} else {
+ printk(KERN_WARNING
+ "KVM_DEBUG: spurious IRQ! "
+ "no irq found in IRR!\n");
/*
* spurious IRQ on host controller
*/
@@ -260,6 +283,14 @@ int kvm_pic_read_irq(struct kvm *kvm)
intno = s->pics[0].irq_base + irq;
}
pic_update_irq(s);
+ printk(KERN_WARNING
+ "KVM_DEBUG: pic_read_irq END "
+ "intno=%d "
+ "output=%d "
+ "IRR0=%02x\n",
+ intno,
+ s->output,
+ s->pics[0].irr);
pic_unlock(s);
return intno;
diff --git a/arch/x86/kvm/irq.c b/arch/x86/kvm/irq.c
index 8c62c6d4d5c1..0dad5d3c5413 100644
--- a/arch/x86/kvm/irq.c
+++ b/arch/x86/kvm/irq.c
@@ -79,8 +79,19 @@ int kvm_cpu_has_extint(struct kvm_vcpu *v)
return 0;
#ifdef CONFIG_KVM_IOAPIC
- if (pic_in_kernel(v->kvm))
+ if (pic_in_kernel(v->kvm)) {
+ printk(KERN_WARNING
+ "KVM_DEBUG: has_extint called "
+ "output=%d "
+ "IRR0=%02x IRR1=%02x "
+ "IMR0=%02x IMR1=%02x\n",
+ v->kvm->arch.vpic->output,
+ v->kvm->arch.vpic->pics[0].irr,
+ v->kvm->arch.vpic->pics[1].irr,
+ v->kvm->arch.vpic->pics[0].imr,
+ v->kvm->arch.vpic->pics[1].imr);
return v->kvm->arch.vpic->output;
+ }
#endif
WARN_ON_ONCE(!irqchip_split(v->kvm));
@@ -127,7 +138,24 @@ EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_cpu_has_interrupt);
*/
int kvm_cpu_get_extint(struct kvm_vcpu *v)
{
+ int result;
+ if (pic_in_kernel(v->kvm))
+ printk(KERN_WARNING
+ "KVM_DEBUG: get_extint called "
+ "output=%d\n",
+ v->kvm->arch.vpic->output);
if (!kvm_cpu_has_extint(v)) {
+ if (pic_in_kernel(v->kvm)) {
+ printk(KERN_WARNING
+ "KVM_DEBUG: has_extint=FALSE "
+ "returning -1! "
+ "output=%d\n",
+ v->kvm->arch.vpic->output);
+ }
+ else
+ printk(KERN_WARNING
+ "KVM_DEBUG: has_extint=FALSE "
+ "no pic in kernel!\n");
WARN_ON(!lapic_in_kernel(v));
return -1;
}
@@ -141,8 +169,20 @@ int kvm_cpu_get_extint(struct kvm_vcpu *v)
#endif
#ifdef CONFIG_KVM_IOAPIC
- if (pic_in_kernel(v->kvm))
- return kvm_pic_read_irq(v->kvm); /* PIC */
+ if (pic_in_kernel(v->kvm)) {
+ printk(KERN_WARNING
+ "KVM_DEBUG: calling pic_read_irq "
+ "output=%d\n",
+ v->kvm->arch.vpic->output);
+ result = kvm_pic_read_irq(v->kvm);
+ printk(KERN_WARNING
+ "KVM_DEBUG: pic_read_irq returned "
+ "intno=%d "
+ "output=%d\n",
+ result,
+ v->kvm->arch.vpic->output);
+ return result; /* PIC */
+ }
#endif
WARN_ON_ONCE(!irqchip_split(v->kvm));
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread