linux-kernel - Re: [syzbot] WARNING in kvm_mmu_uninit_tdp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8f21a9d4b4ceb7c515f776b1a981c801e439c5f0.camel@redhat.com>
Date:   Thu, 28 Apr 2022 20:16:47 +0300
From:   Maxim Levitsky <mlevitsk@...hat.com>
To:     Sean Christopherson <seanjc@...gle.com>
Cc:     syzbot <syzbot+a8ad3ee1525a0c4b40ec@...kaller.appspotmail.com>,
        bp@...en8.de, dave.hansen@...ux.intel.com, hpa@...or.com,
        jmattson@...gle.com, joro@...tes.org, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org, mingo@...hat.com,
        pbonzini@...hat.com, syzkaller-bugs@...glegroups.com,
        tglx@...utronix.de, vkuznets@...hat.com, wanpengli@...cent.com,
        x86@...nel.org
Subject: Re: [syzbot] WARNING in kvm_mmu_uninit_tdp_mmu (2)

On Thu, 2022-04-28 at 15:32 +0000, Sean Christopherson wrote:
> On Tue, Apr 26, 2022, Maxim Levitsky wrote:
> > I can reproduce this in a VM, by running and CTRL+C'in my ipi_stress test,
> 
> Can you post your ipi_stress test?  I'm curious to see if I can repro, and also
> very curious as to what might be unique about your test.  I haven't been able to
> repro the syzbot test, nor have I been able to repro by killing VMs/tests.
> 

This is the patch series (mostly attempt to turn svm to mini library,
but I don't know if this is worth it.
It was done so that ipi_stress could use  nesting itself to wait for IPI
from within a nested guest. I usually don't use it.

This is more or less how I was running it lately (I have a wrapper script)


./x86/run x86/ipi_stress.flat \
        -global kvm-pit.lost_tick_policy=discard \
	        -machine kernel-irqchip=on -name debug-threads=on  \
	        \
	        -smp 8 \
	        -cpu host,x2apic=off,svm=off,-hypervisor \
	        -overcommit cpu-pm=on \
	        -m 4g -append "0 10000"


Its not fully finised for upstream, I will get to it soon.

'cpu-pm=on' won't work for you as this fails due to non atomic memslot
update bug for which I have a small hack in qemu, and it is on my
backlog to fix it correctly.

Mostly likely cpu_pm=off will also reproduce it.


Test was run in a guest, natively this doesn't seem to reproduce.
tdp mmu was used for both L0 and L1.

Best regards,
	Maxim levitsky

View attachment "0001-svm-move-svm-spec-definitions-to-lib-x86-svm.h.patch" of type "text/x-patch" (21762 bytes)

View attachment "0002-move-some-svm-support-functions-into-lib-x86-svm_lib.patch" of type "text/x-patch" (4460 bytes)

View attachment "0003-svm-add-svm_suported.patch" of type "text/x-patch" (997 bytes)

View attachment "0004-svm-move-setup_svm-to-svm_lib.c.patch" of type "text/x-patch" (10826 bytes)

View attachment "0005-svm-move-vmcb_ident-to-svm_lib.c.patch" of type "text/x-patch" (6163 bytes)

View attachment "0006-svm-move-svm-entry-macros-to-svm_lib.h.patch" of type "text/x-patch" (8860 bytes)

View attachment "0007-add-unit-test-for-avic-ipi.patch" of type "text/x-patch" (7221 bytes)