linux-kernel - Re: Linux 5.13+ as Xen dom0 crashes on Ryzen CPU (ucode loading related?)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YUA3l0gnTh0gDJ4d@linux.ibm.com>
Date:   Tue, 14 Sep 2021 08:48:07 +0300
From:   Mike Rapoport <rppt@...ux.ibm.com>
To:     Marek Marczykowski-Górecki 
        <marmarek@...isiblethingslab.com>
Cc:     Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...e.de>,
        Thomas Gleixner <tglx@...utronix.de>, x86@...nel.org,
        linux-kernel@...r.kernel.org,
        xen-devel <xen-devel@...ts.xenproject.org>
Subject: Re: Linux 5.13+ as Xen dom0 crashes on Ryzen CPU (ucode loading
 related?)

Hi Marek,

On Mon, Sep 13, 2021 at 02:50:00PM +0200, Marek Marczykowski-Górecki wrote:
> Hi,
> 
> Since 5.13, the Xen (PV) dom0 crashes on boot, before even printing the
> kernel version.
> Test environment:
>  - Xen 4.14.2
>  - AMD Ryzen 5 4500U (reported also on AMD Ryzen 7 4750U)
>  - Linux 5.13.13, confirmed also on 5.14
> 
> The crash happens only if the initramfs has earlycpio with microcode.

Does the crash happen if you boot the same kernel and initrd directly
without Xen?

> I don't have a serial console, but I've got a photo with crash message
> (from Xen, Linux doesn't managed to print anything):
> https://user-images.githubusercontent.com/726704/133084966-5038f37e-001b-4688-9f90-83d09be3dc2d.jpg
> 
> Transcription of some of it:
> 
>     mapping kernel into physical memory
>     about to get started
>     (XEN) Pagetable walk from ffffffff82810888:
>     (XEN)  L4[0x1ff] = 0000000332815067 0000000000002815
>     (XEN)  L3[0x1fe] = 0000000332816067 0000000000002816
>     (XEN)  L2[0x014] = 0000000334018067 0000000000004018
>     (XEN)  L1[0x010] = 0000000332810067 0000000000002810
>     (XEN) domain_crash_sync called from entry.S: fault at ffff82d04033e790 x86_64/entry.S#domain_crash_page_fault
>     (XEN) Domain 0 (vcpu#0) crashed on cpu#0:
>     (XEN) ----[ Xen-4.14.2  x86_64  debug=n  Not tainted ]----
>     (XEN) CPU:    0
>     (XEN) RIP:    e033:[<0000000000000000>]

Is it possible to get the actual RIP of the instruction that faulted? 
Feeding that to scripts/faddr2line would be just lovely.
 
> I've bisected it down to the commit a799c2bd29d19c565f37fa038b31a0a1d44d0e4d
> 
>     x86/setup: Consolidate early memory reservations
> 
> Since this seems to affect Xen boot only, I'm copying xen-devel too.
> 
> Any ideas?

The only thing I can suggest for now is to move the reservations from
early_reserve_memory() back to where they were before this commit one by
one to see which move caused the crash.

-- 
Sincerely yours,
Mike.