From: Dmitry Vyukov <dvyukov@google.com>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: "David Hildenbrand" <david@redhat.com>,
"Radim Krčmář" <rkrcmar@redhat.com>,
"Thomas Gleixner" <tglx@linutronix.de>,
"Ingo Molnar" <mingo@redhat.com>,
"H. Peter Anvin" <hpa@zytor.com>,
"x86@kernel.org" <x86@kernel.org>,
"KVM list" <kvm@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
"Steve Rutherford" <srutherford@google.com>,
syzkaller <syzkaller@googlegroups.com>
Subject: Re: kvm: WARNING In kvm_apic_accept_events
Date: Tue, 14 Feb 2017 21:31:53 +0100 [thread overview]
Message-ID: <CACT4Y+Z1wWiQQik3P13LQZ6_3DC4Do-W50pLK1WDJe5bsr5S2w@mail.gmail.com> (raw)
In-Reply-To: <04b94434-50af-766d-0248-e999bdf80655@redhat.com>
On Mon, Jan 23, 2017 at 5:29 PM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>
> On 23/01/2017 17:03, David Hildenbrand wrote:
>> Am 22.01.2017 um 09:52 schrieb Dmitry Vyukov:
>>> On Sat, Nov 12, 2016 at 2:56 AM, Dmitry Vyukov <dvyukov@google.com> wrote:
>>>> Hello,
>>>>
>>>> The following program triggers WARNING in kvm_apic_accept_events:
>>>> https://gist.githubusercontent.com/dvyukov/95b845a2e637485568ea1ef181a72370/raw/d90717dd67128b21715c5e794568a1600f613d97/gistfile1.txt
>>>>
>>>> On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).
>>>>
>>>> ------------[ cut here ]------------
>>>> WARNING: CPU: 1 PID: 23523 at arch/x86/kvm/lapic.c:2330
>>>> kvm_apic_accept_events+0x3f6/0x460
>>>> Modules linked in:[ 55.632648] CPU: 1 PID: 2812 Comm: a.out Not
>>>> tainted 4.9.0-rc4+ #41
>>>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>>>> ffff88006be77978 ffffffff81c2f79b 0000000000000000 0000000000000000
>>>> ffffffff8322d6a0 ffffffff81127426 ffff88006be779c0 ffffffff8123ffef
>>>> ffffffff811acc46 ffffffff0000091a ffffffff8322d6a0 000000000000091a
>>>> Call Trace:
>>>> [< inline >] __dump_stack lib/dump_stack.c:15
>>>> [<ffffffff81c2f79b>] dump_stack+0xb3/0x118 lib/dump_stack.c:51
>>>> [<ffffffff8123ffef>] __warn+0x19f/0x1e0 kernel/panic.c:550
>>>> [<ffffffff812401fc>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
>>>> [<ffffffff81127426>] kvm_apic_accept_events+0x3f6/0x460
>>>> arch/x86/kvm/lapic.c:2330
>>>> [< inline >] vcpu_block arch/x86/kvm/x86.c:6793
>>>> [< inline >] vcpu_run arch/x86/kvm/x86.c:6828
>>>> [<ffffffff810b8f20>] kvm_arch_vcpu_ioctl_run+0x1580/0x5a90
>>>> arch/x86/kvm/x86.c:6984
>>>> [<ffffffff8106091e>] kvm_vcpu_ioctl+0x61e/0xdd0
>>>> arch/x86/kvm/../../../virt/kvm/kvm_main.c:2557
>>>> [< inline >] vfs_ioctl fs/ioctl.c:43
>>>> [<ffffffff816b16fc>] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
>>>> [< inline >] SYSC_ioctl fs/ioctl.c:694
>>>> [<ffffffff816b263f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
>>>> [<ffffffff831ebd01>] entry_SYSCALL_64_fastpath+0x1f/0xc2
>>>> arch/x86/entry/entry_64.S:209
>>>> ---[ end trace b2415ddd1b26dce6 ]---
>>>
>>>
>>> ping
>>>
>>
>> Our VCPU is in SMM mode but is switched into KVM_MP_STATE_INIT_RECEIVED.
>>
>> The relevant warning is (arch/x86/kvm/lapic.c:kvm_apic_accept_events())
>>
>> if (is_smm(vcpu)) {
>> WARN_ON_ONCE(vcpu->arch.mp_state == KVM_MP_STATE_INIT_RECEIVED);
>> ....
>>
>> Something like that might help (untested):
>>
>>
>> From: David Hildenbrand <david@redhat.com>
>> Date: Mon, 23 Jan 2017 16:42:23 +0100
>> Subject: [PATCH] KVM: x86: fix illegal MP_STATE when in/entering SMM
>>
>> If we already entered/are about to enter SMM, don't allow
>> switching to INIT/SIPI_RECEIVED, otherwise the next call to
>> kvm_apic_accept_events() will report a warning.
>>
>> Fixes: cd7764fe9f73 ("KVM: x86: latch INITs while in system management mode")
>> Reported-by: Dmitry Vyukov <dvyukov@google.com>
>> Signed-off-by: David Hildenbrand <david@redhat.com>
>> ---
>> arch/x86/kvm/x86.c | 6 ++++++
>> 1 file changed, 6 insertions(+)
>>
>> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
>> index 57d8a85..06ffc91 100644
>> --- a/arch/x86/kvm/x86.c
>> +++ b/arch/x86/kvm/x86.c
>> @@ -7247,6 +7247,12 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
>> mp_state->mp_state != KVM_MP_STATE_RUNNABLE)
>> return -EINVAL;
>>
>> + /* INITs are latched while in SMM */
>> + if ((is_smm(vcpu) || vcpu->arch.smi_pending) &&
>> + (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED ||
>> + mp_state->mp_state == KVM_MP_STATE_INIT_RECEIVED))
>> + return -EINVAL;
>> +
>> if (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED) {
>> vcpu->arch.mp_state = KVM_MP_STATE_INIT_RECEIVED;
>> set_bit(KVM_APIC_SIPI, &vcpu->arch.apic->pending_events);
>>
>
> Looks good, thanks for analyzing it. I'll try making a minimal testcase...
Any progress with this? Should we commit this as is?
next prev parent reply other threads:[~2017-02-14 20:32 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-12 1:56 kvm: WARNING In kvm_apic_accept_events Dmitry Vyukov
2017-01-22 8:52 ` Dmitry Vyukov
2017-01-23 16:03 ` David Hildenbrand
2017-01-23 16:29 ` Paolo Bonzini
2017-02-14 20:31 ` Dmitry Vyukov [this message]
2017-02-15 9:26 ` David Hildenbrand
2017-02-15 10:10 ` Paolo Bonzini
2017-03-22 15:34 ` Dmitry Vyukov
2017-03-22 15:35 ` David Hildenbrand
-- strict thread matches above, loose matches on Subject: below --
2016-01-08 17:16 kvm: WARNING in kvm_apic_accept_events Dmitry Vyukov
2016-01-15 17:13 ` Dmitry Vyukov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CACT4Y+Z1wWiQQik3P13LQZ6_3DC4Do-W50pLK1WDJe5bsr5S2w@mail.gmail.com \
--to=dvyukov@google.com \
--cc=david@redhat.com \
--cc=hpa@zytor.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=pbonzini@redhat.com \
--cc=rkrcmar@redhat.com \
--cc=srutherford@google.com \
--cc=syzkaller@googlegroups.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).