From: Dmitry Vyukov <dvyukov@google.com>
To: Arnd Bergmann <arnd@arndb.de>
Cc: "Mark Rutland" <mark.rutland@arm.com>,
"Marc Zyngier" <maz@kernel.org>, "Will Deacon" <will@kernel.org>,
"Ard Biesheuvel" <ardb@kernel.org>,
"Linux ARM" <linux-arm-kernel@lists.infradead.org>,
syzkaller <syzkaller@googlegroups.com>,
LKML <linux-kernel@vger.kernel.org>,
"John Garry" <john.garry@huawei.com>,
"Peter Maydell" <peter.maydell@linaro.org>,
"Alex Bennée" <alex.bennee@linaro.org>
Subject: Re: arm64 syzbot instances
Date: Fri, 12 Mar 2021 10:21:41 +0100 [thread overview]
Message-ID: <CACT4Y+bLdCw+nWndwnv6W9=0EhNNxi=n5Zp032hZE1j0QBMkaA@mail.gmail.com> (raw)
In-Reply-To: <CAK8P3a2NEcHG+nOUCc6-DPeFKkc-GF-LEOkynhNdgxiXBHdQaw@mail.gmail.com>
On Fri, Mar 12, 2021 at 10:16 AM Arnd Bergmann <arnd@arndb.de> wrote:
>
> On Fri, Mar 12, 2021 at 9:46 AM Dmitry Vyukov <dvyukov@google.com> wrote:
> > On Fri, Mar 12, 2021 at 9:40 AM Arnd Bergmann <arnd@arndb.de> wrote:
> > > On Thu, Mar 11, 2021 at 6:57 PM Dmitry Vyukov <dvyukov@google.com> wrote:
> > > a) accessing a legacy ISA/LPC port should not result in an oops,
> > > but should instead return values with all bits set. There could
> > > be a ratelimited console warning about broken drivers, but we
> > > can't assume that all drivers work correctly, as some ancient
> > > PC style drivers still rely on this.
> > > John Garry has recently worked on a related bugfix, so maybe
> > > either this is the same bug he encountered (and hasn't merged
> > > yet), or if his fix got merged there is still a remaining problem.
>
> > > b) It should not be possible to open /dev/ttyS3 if the device is
> > > not initialized. What is the output of 'cat /proc/tty/driver/serial'
> > > on this machine? Do you see any messages from the serial
> > > driver in the boot log?
> > > Unfortunately there are so many different ways to probe devices
> > > in the 8250 driver that I don't know where this comes from.
> > > Your config file has
> > > CONFIG_SERIAL_8250_PNP=y
> > > CONFIG_SERIAL_8250_NR_UARTS=32
> > > CONFIG_SERIAL_8250_RUNTIME_UARTS=4
> > > CONFIG_SERIAL_8250_EXTENDED=y
> > > I guess it's probably the preconfigured uarts that somehow
> > > become probed without initialization, but it could also be
> > > an explicit device incorrectly described by qemu.
> >
> >
> > Here is fool boot log, /proc/tty/driver/serial and the crash:
> > https://gist.githubusercontent.com/dvyukov/084890d9b4aa7cd54f468e652a9b5881/raw/54c12248ff6a4885ba6c530d56b3adad59bc6187/gistfile1.txt
>
> Ok, so there are four 8250 ports, and none of them are initialized,
> while the console is on /dev/ttyAMA0 using a different driver.
>
> I'm fairly sure this is a bug in the kernel then, not in qemu.
>
>
> I also see that the PCI I/O space gets mapped to a physical address:
> [ 3.974309][ T1] pci-host-generic 4010000000.pcie: IO
> 0x003eff0000..0x003effffff -> 0x0000000000
>
> So it's probably qemu that triggers the 'synchronous external
> abort' when accessing the PCI I/O space, which in turn hints
> towards a bug in qemu. Presumably it only returns data from
> I/O ports that are actually mapped to a device when real hardware
> is supposed to return 0xffffffff when reading from unused I/O ports.
> This would be separate from the work that John did, which only
> fixed the kernel for accessing I/O port ranges that do not have
> a corresponding MMU mapping to hardware ports.
Will John's patch fix this crash w/o any changes in qemu? That would
be good enough for syzbot. Otherwise we need to report the issue to
qemu.
next prev parent reply other threads:[~2021-03-12 9:22 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-11 11:38 arm64 syzbot instances Dmitry Vyukov
2021-03-11 12:33 ` Mark Rutland
2021-03-11 16:56 ` Dmitry Vyukov
2021-03-17 18:45 ` Mark Rutland
2021-03-18 8:32 ` Dmitry Vyukov
2021-03-11 17:11 ` Dmitry Vyukov
2021-03-11 13:30 ` Arnd Bergmann
2021-03-11 17:25 ` Dmitry Vyukov
2021-03-12 6:42 ` Dmitry Vyukov
2021-03-11 17:57 ` Dmitry Vyukov
2021-03-12 8:39 ` Arnd Bergmann
2021-03-12 8:46 ` Dmitry Vyukov
2021-03-12 9:16 ` Arnd Bergmann
2021-03-12 9:21 ` Dmitry Vyukov [this message]
2021-03-12 10:10 ` Arnd Bergmann
2021-03-12 10:38 ` Dmitry Vyukov
2021-03-12 10:52 ` Arnd Bergmann
2021-03-15 9:43 ` John Garry
2021-03-15 10:01 ` Dmitry Vyukov
2021-03-15 10:29 ` John Garry
2021-03-15 10:34 ` Dmitry Vyukov
2021-03-15 11:11 ` Arnd Bergmann
2021-03-20 20:43 ` Peter Maydell
2021-03-21 11:52 ` Arnd Bergmann
2021-03-21 11:55 ` Arnd Bergmann
2021-03-21 18:59 ` Arnd Bergmann
2021-03-22 13:51 ` Peter Maydell
2021-03-22 15:42 ` Arnd Bergmann
2021-03-22 16:34 ` John Garry
2021-03-22 16:49 ` Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CACT4Y+bLdCw+nWndwnv6W9=0EhNNxi=n5Zp032hZE1j0QBMkaA@mail.gmail.com' \
--to=dvyukov@google.com \
--cc=alex.bennee@linaro.org \
--cc=ardb@kernel.org \
--cc=arnd@arndb.de \
--cc=john.garry@huawei.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=maz@kernel.org \
--cc=peter.maydell@linaro.org \
--cc=syzkaller@googlegroups.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).