All of
 help / color / mirror / Atom feed
From: "Richard W.M. Jones" <>
To: Chuck Ebbert <>
	Thomas Gleixner <>,
	Ingo Molnar <>, "H. Peter Anvin" <>
Subject: Re: [BUG 4.2-rc8] Interrupt occurs while apply_alternatives() is patching the handler
Date: Tue, 1 Sep 2015 07:20:23 +0100	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <20150830223757.6e4c5c02@as>

On Sun, Aug 30, 2015 at 10:37:57PM -0400, Chuck Ebbert wrote:
> This is from
> [    0.036000] BUG: unable to handle kernel paging request at 55501e06
> [    0.036000]  [<c0409c80>] ? add_nops+0x90/0xa0
> [    0.036000]  [<c040a054>] apply_alternatives+0x274/0x630
> [    0.036000]  [<c07f1cf0>] ? wait_for_xmitr+0xa0/0xa0
> [    0.036000]  [<c071a6fc>] ? sprintf+0x1c/0x20
> [    0.036000]  [<c0aae480>] ? irq_entries_start+0x698/0x698
> [    0.036000]  [<c071be4b>] ? memcpy+0xb/0x30
> [    0.036000]  [<c07f3950>] ? serial8250_set_termios+0x20/0x20
> Interrupt 0x30 occurred while the alternatives code was replacing the
> initial 0x90,0x90,0x90 NOPs (from the ASM_CLAC macro) with the optimized
> version, 0x8d,0x76,0x00. Only the first byte has been replaced so far,
> and it makes a mess out of the insn decoding.

Chuck, thanks for reporting this.

I have only been able to reproduce this so far using qemu and TCG (not
KVM) which of course raises a range of questions: could it be a qemu
bug or a TCG bug?  Could it be that an atomic op is not correctly
implemented by qemu?  I will keep trying on KVM.  Because I don't have
a convenient server with 32 bit kernel and a serial port that I can
reboot thousands of times, I have not tried to reproduce on baremetal yet.

Here's how to reproduce it.  (The host can be x86-64)

(1) Grab the 32 bit Fedora kernel we are using from

(2) Unpack it to extract vmlinuz:

cd /tmp
rpm2cpio /mnt/scratch/kernel-core-4.2.0-1.fc24.i686.rpm | cpio -id
cp ./lib/modules/4.2.0-1.fc24.i686/vmlinuz .

(3) Boot the kernel under qemu/KVM.  The following single line command
repeatedly boots the kernel until the bug is hit:

while qemu-system-x86_64 -nographic -no-reboot -M accel=kvm:tcg -kernel vmlinuz -append 'console=ttyS0 panic=1' -serial stdio -monitor none >& log; ! grep add_nops log; do echo -n .; done

It takes many iterations (100s with TCG) to hit the bug.


Richard Jones, Virtualization Group, Red Hat
Read my programming and virtualization blog:
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into KVM guests.

  reply	other threads:[~2015-09-01  6:20 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-08-31  2:37 Chuck Ebbert
2015-09-01  6:20 ` Richard W.M. Jones [this message]
2015-09-02  9:11   ` Thomas Gleixner
2015-09-02 19:05     ` Richard W.M. Jones
2015-09-03  7:53       ` Richard W.M. Jones
2015-09-03  8:50     ` Borislav Petkov
2015-09-03 10:41       ` Thomas Gleixner
2015-09-03 12:43         ` Josh Boyer
2015-09-03 13:01           ` Thomas Gleixner
2015-09-03 15:48         ` Richard W.M. Jones
2015-09-03 19:30         ` [tip:x86/urgent] x86/alternatives: Make optimize_nops() interrupt safe and synced tip-bot for Thomas Gleixner
2015-09-04  7:40         ` [BUG 4.2-rc8] Interrupt occurs while apply_alternatives() is patching the handler Richard W.M. Jones
2015-09-04 12:02         ` Borislav Petkov
2015-09-04 13:37           ` Thomas Gleixner
2015-09-05 15:25             ` Borislav Petkov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \
    --subject='Re: [BUG 4.2-rc8] Interrupt occurs while apply_alternatives() is patching the handler' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.