linux-kernel - Re: GPF in intel_pmu_lbr_reset() with qemu -cpu host

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <19dca85e-1557-4696-aaf1-89222ef70cfc@email.android.com>
Date:	Sat, 22 Mar 2014 14:46:49 -0700
From:	"H. Peter Anvin" <hpa@...or.com>
To:	Gleb Natapov <gleb@...nel.org>, Peter Wu <peter@...ensteyn.nl>
CC:	Venkatesh Srinivas <venkateshs@...gle.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Ingo Molnar <mingo@...nel.org>,
	Andi Kleen <ak@...ux.intel.com>,
	Linux Kernel Developers List <linux-kernel@...r.kernel.org>,
	kvm@...r.kernel.org, Paolo Bonzini <pbonzini@...hat.com>
Subject: Re: GPF in intel_pmu_lbr_reset() with qemu -cpu host

Using _safe has it's own issues if noone checks the errors.

On March 22, 2014 5:27:59 AM PDT, Gleb Natapov <gleb@...nel.org> wrote:
>On Sat, Mar 22, 2014 at 11:05:03AM +0100, Peter Wu wrote:
>> On Saturday 22 March 2014 10:50:45 Gleb Natapov wrote:
>> > On Fri, Mar 21, 2014 at 12:04:32PM -0700, Venkatesh Srinivas wrote:
>> > > On Fri, Mar 21, 2014 at 10:46 AM, Peter Wu <peter@...ensteyn.nl>
>wrote:
>> > [skip]
>> > 
>> > > When -cpu host is used, qemu/kvm passed the host CPUID F/M/S to
>the
>> > > guest. intel_pmu_cpu_*() -> intel_pmu_lbr_reset() uses rdmsr() /
>> > > wrmsr(), rather than the safe variants; if KVM does not support
>the
>> > > particular MSRs in question, you will see a #GP(0) there. See
>> > > https://lkml.org/lkml/2014/3/13/453 for a similar bug other PMU
>code.
>> > > 
>> > When kernel is compiled with guest support all rdmsr()/wrmsr()
>become _safe(),
>> > so the question for Peter is if his guest kernel has guest support
>enabled?
>> 
>> Linux guest support (CONFIG_HYPERVISOR_GUEST) was not enabled, see
>> .config in the first mail[1]. Enabling that option does not change
>the
>> situation.
>> 
>> With CONFIG_PARAVIRT and CONFIG_KVM_GUEST enabled, the PMU GPF is
>gone,
>Yeah, it should be PARAVIRT indeed since rdmsr()/wrmsr() is substituted
>by _safe()
>using paravirt calls.
>
>> but now I have a NULL dereference (in rapl_pmu_init). Previously,
>when
>> `-cpu SandyBridge` was passed to qemu, it would show this:
>> 
>>     [    0.016995] Performance Events: unsupported p6 CPU model 42 no
>PMU driver, software events only.
>> 
>> The same NULL pointer deref would be visible (slightly different
>> addresses, but the Code lines are equal). With `-host`, the NULL
>deref
>> with `-cpu host` contains:
>> 
>>     [    0.016445] Performance Events: 16-deep LBR, IvyBridge events,
>Intel PMU driver.
>> 
>> Full dmesg below.
>> 
>I am confused. Do you see crash now with -cpu SandyBridge and -cpu
>host, or -cpu host only?
>
>--
>			Gleb.

-- 
Sent from my mobile phone.  Please pardon brevity and lack of formatting.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/