| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20200527120918.ly5vuhvxzqesdt6j@liuwe-devbox-debian-v2.j3c5onc20sse1dnehy4noqpfcg.zx.internal.cloudapp.net>
Date: Wed, 27 May 2020 12:09:18 +0000
From: Wei Liu <wei.liu@...nel.org>
To: Boqun Feng <boqun.feng@...il.com>,
Thomas Gleixner <tglx@...utronix.de>
Cc: Thomas Gleixner <tglx@...utronix.de>,
LKML <linux-kernel@...r.kernel.org>,
Andy Lutomirski <luto@...nel.org>,
Andrew Cooper <andrew.cooper3@...rix.com>,
X86 ML <x86@...nel.org>,
"Paul E. McKenney" <paulmck@...nel.org>,
Alexandre Chartre <alexandre.chartre@...cle.com>,
Frederic Weisbecker <frederic@...nel.org>,
Paolo Bonzini <pbonzini@...hat.com>,
Sean Christopherson <sean.j.christopherson@...el.com>,
Masami Hiramatsu <mhiramat@...nel.org>,
Petr Mladek <pmladek@...e.com>,
Steven Rostedt <rostedt@...dmis.org>,
Joel Fernandes <joel@...lfernandes.org>,
Boris Ostrovsky <boris.ostrovsky@...cle.com>,
Juergen Gross <jgross@...e.com>,
Brian Gerst <brgerst@...il.com>,
Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
Josh Poimboeuf <jpoimboe@...hat.com>,
Will Deacon <will@...nel.org>,
Tom Lendacky <thomas.lendacky@....com>,
Wei Liu <wei.liu@...nel.org>,
Michael Kelley <mikelley@...rosoft.com>,
Jason Chen CJ <jason.cj.chen@...el.com>,
Zhao Yakui <yakui.zhao@...el.com>,
"Peter Zijlstra (Intel)" <peterz@...radead.org>
Subject: Re: [patch V9 30/39] x86/entry: Convert various hypervisor vectors
to IDTENTRY_SYSVEC
On Wed, May 27, 2020 at 09:38:03AM +0100, Wei Liu wrote:
> On Wed, May 27, 2020 at 09:46:16AM +0800, Boqun Feng wrote:
> > Hi Thomas,
> >
> > On Thu, May 21, 2020 at 10:05:43PM +0200, Thomas Gleixner wrote:
> > > From: Thomas Gleixner <tglx@...utronix.de>
> > >
> > > Convert various hypervisor vectors to IDTENTRY_SYSVEC
> > > - Implement the C entry point with DEFINE_IDTENTRY_SYSVEC
> > > - Emit the ASM stub with DECLARE_IDTENTRY_SYSVEC
> > > - Remove the ASM idtentries in 64bit
> > > - Remove the BUILD_INTERRUPT entries in 32bit
> > > - Remove the old prototypes
> > >
> > > No functional change.
> > >
> > > Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> > > Acked-by: Andy Lutomirski <luto@...nel.org>
> >
> > I hit the following while trying to test the whole patchset on a Hyper-V
> > guest, and git bisect told me this patch introduced the problem, the
> > config file is in the attachment.
> >
> > Regards,
> > Boqun
> >
>
> Hi Boqun,
>
> Thanks for testing and reporting.
>
> This patch modifies Hyper-V's entry point so no wonder you pin down this
> patch.
>
> > [ 3.366637] BUG: kernel NULL pointer dereference, address: 0000000000000010
> > [ 3.369959] #PF: supervisor instruction fetch in kernel mode
> > [ 3.369959] #PF: error_code(0x0010) - not-present page
> > [ 3.369959] PGD 0 P4D 0
> > [ 3.369959] Oops: 0010 [#1] PREEMPT SMP PTI
> > [ 3.369959] CPU: 27 PID: 0 Comm: swapper/27 Not tainted 5.7.0-rc5-00374-ge2d215d23d72 #23
> > [ 3.369959] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.0 05/16/2019
> > [ 3.369959] RIP: 0010:0x10
>
> Hmmm... NULL pointer here.
>
> > [ 3.369959] Code: Bad RIP value.
> > [ 3.369959] RSP: 0000:ffffbf444018beb8 EFLAGS: 00010086
> > [ 3.369959] RAX: 000000000000001b RBX: ffffa04620900000 RCX: 00000000c8aab6dc
> > [ 3.369959] RDX: 0000000000000001 RSI: ffffffffb390feaf RDI: ffffffffb3919e60
> > [ 3.369959] RBP: 000000000000001b R08: 0000000000000000 R09: 0000000000000101
> > [ 3.369959] R10: 0000000000dda899 R11: 0000000001d417ad R12: 0000000000000000
> > [ 3.369959] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> > [ 3.369959] FS: 0000000000000000(0000) GS:ffffa04627ac0000(0000) knlGS:0000000000000000
> > [ 3.369959] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > [ 3.369959] CR2: ffffffffffffffe6 CR3: 000000101bcba002 CR4: 00000000003606e0
> > [ 3.369959] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > [ 3.369959] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > [ 3.369959] Call Trace:
> > [ 3.369959] ? default_idle+0x1c/0x190
> > [ 3.369959] ? do_idle+0x1cd/0x230
> > [ 3.369959] ? cpu_startup_entry+0x19/0x20
> > [ 3.369959] ? secondary_startup_64+0xa4/0xb0
>
> And I certainly didn't expect this.
>
> > [ 3.369959] Modules linked in: crc32c_intel hv_vmbus(+)
>
> VMBus is being loaded. That gives me some clue.
>
> I notice a hunk in the patch:
>
> @@ -331,17 +327,19 @@ static void __init ms_hyperv_init_platfo
> x86_platform.apic_post_init = hyperv_init;
> hyperv_setup_mmu_ops();
> /* Setup the IDT for hypervisor callback */
> - alloc_intr_gate(HYPERVISOR_CALLBACK_VECTOR, hyperv_callback_vector);
> + alloc_intr_gate(HYPERVISOR_CALLBACK_VECTOR, sysvec_hyperv_callback);
>
> It is not using the asm variant.
>
> Could this be the culprit? Thomas?
>
I'm able to reproduce the issue locally. And after applying the
following diff I'm able to get a VM booting again on Hyper-V.
diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
index a103e1c0b90e..af94f05a5c66 100644
--- a/arch/x86/kernel/cpu/mshyperv.c
+++ b/arch/x86/kernel/cpu/mshyperv.c
@@ -327,7 +327,7 @@ static void __init ms_hyperv_init_platform(void)
x86_platform.apic_post_init = hyperv_init;
hyperv_setup_mmu_ops();
/* Setup the IDT for hypervisor callback */
- alloc_intr_gate(HYPERVISOR_CALLBACK_VECTOR, sysvec_hyperv_callback);
+ alloc_intr_gate(HYPERVISOR_CALLBACK_VECTOR, asm_sysvec_hyperv_callback);
/* Setup the IDT for reenlightenment notifications */
if (ms_hyperv.features & HV_X64_ACCESS_REENLIGHTENMENT) {
Boqun, can you give this a try?
Thomas, feel free to fold this in.
Wei.
Powered by blists - more mailing lists