[Ubuntu18.04][Power9][DD2.2]package installation segfaults inside debian chroot env in P9 KVM guest with HTM enabled (kvm)
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| The Ubuntu-power-systems project |
Fix Released
|
Critical
|
Canonical Kernel Team | ||
| linux (Ubuntu) |
Fix Released
|
Medium
|
Joseph Salisbury | ||
| Bionic |
Fix Released
|
Medium
|
Joseph Salisbury | ||
| Cosmic |
Fix Released
|
Medium
|
Joseph Salisbury | ||
Bug Description
== SRU Justification ==
IBM is requesting this commit in Bionic. It fixes a regression
introduced by upstream commit 4bb3c7a020.
Without this patch, package installation segfaults inside debian chroot
env in P9 KVM guest with HTM enabled.
The fix has already landed in Cosmic master-next.
== Fix ==
f14040bca892 ("KVM: PPC: Book3S HV: Fix guest r11 corruption with POWER9 TM workarounds")
== Regression Potential ==
Low. This commit fixes an existing regrssion and is specific to powerpc. It has been cc'd to
upstream stable, so has had additional upstream review.
== Test Case ==
A test kernel was built with this patch and tested by the original bug reporter.
The bug reporter states the test kernel resolved the bug.
== Comment: #0 - Satheesh Rajendran <email address hidden> - 2018-09-11 04:10:09 ==
---Problem Description---
package installation segfaults inside debian chroot env in P9 KVM guest with HTM enabled
---Additional Hardware Info---
FW with tm-suspend-mode enabled
#cd /sys/firmware/
#ls -1 tm-suspend-mode
enabled
name
phandle
qemu-kvm 1:2.11+
Machine Type = Power9 DD2.2
---Steps to Reproduce---
1. Boot a P9 KVM guest Ubuntu 18.04 (with cap-htm=on, bydefault it is on)
tried with upstream kernel aswell(same results)
create tap device in host
# tunctl -t tap1 -u `whoami`;brctl addif virbr0 tap1;ifconfig tap1 up
#qemu-system-ppc64 -enable-kvm -M pseries -m 8192 -smp 4 -drive file=/home/
run dhclient inside guest.
2. # mkdir -p stretch
# debootstrap stretch /stretch http://
# chroot /stretch
/# apt-get update && apt-get install -y make gcc ruby python
...
[ 32.029474] random: crng init done
[ 32.029477] random: 7 urandom warning(s) missed due to ratelimiting
[ 500.300835] dpkg-deb[8704]: segfault (11) at c0000000000037fa nip 7fffac2d098c lr 7fffac2d08c4 code 1 in libc-2.
[ 500.300863] dpkg-deb[8704]: code: 48000028 eb090010 2eb80000 4096006c 419e0074 85270004 394a0001 794a0020
[ 500.300881] dpkg-deb[8704]: code: 71280001 408200a0 1d2a0018 7d2b4a14 <a1090006> 2ea80000 40960010 e9090008
---uname output---
4.15.0-
---Debugger---
A debugger is not configured
Contact Information = <email address hidden>
Userspace tool common name:
KVM Guest: Ubuntu GLIBC 2.27-3ubuntu1) stable release version 2.27,
Chroot inside KVM Guest: Debian GLIBC 2.24-11+deb9u3) stable release version 2.24
Userspace rpm:
KVM Guest: Ubuntu GLIBC 2.27-3ubuntu1) stable release version 2.27,
Chroot inside KVM Guest: Debian GLIBC 2.24-11+deb9u3) stable release version 2.24
The userspace tool has the following bit modes: both
Userspace tool obtained from project website: na
*Additional Instructions for <email address hidden>:
-Post a private note with access information to the machine that the bug is occuring on.
-Attach ltrace and strace of userspace application.
So latest update taken from https:/
was able to recreate segfault using TM test cases
/linux/
# ./tm-vmxcopy
test: tm_vmxcopy
tags: git_version:
!! child died by signal 11
failure: tm_vmxcopy
this particular test on being run gets a signal 11
[267132.434651] tm-vmxcopy[641]: unhandled signal 11 at 0000000000000001 nip 0000000104ba122c lr 0000000104ba11e4 code 30001
[267253.708795] tm-vmxcopy[7861]: unhandled signal 11 at 0000000000000001 nip 000000012a31122c lr 000000012a3111e4 code 30001
[267385.064533] tm-vmxcopy[13314]: unhandled signal 11 at 0000000000000001 nip 00000001235f122c lr 00000001235f11e4 code 30001
== Comment: #12 - Michael Neuling <email address hidden> - 2018-09-13 00:34:16 ==
Fixes r11 corruption.
== Comment: #14 - Satheesh Rajendran <email address hidden> - 2018-09-13 03:15:46 ==
Tested with above patch on KVM host and reported issue is fixed.
# git log -1
commit 72664e47565f5de
Author: Michael Neuling <email address hidden>
Date: Thu Sep 13 15:33:47 2018 +1000
KVM: PPC: Book3S HV: Fix guest r11 corruption with POWER9 TM workarounds
When we come into the softpatch handler (0x1500), we use r11 to store
the HSRR0 for later use by the denorm handler.
We also use the softpatch handler for the TM workarounds for
POWER9. Unfortunately, in kvmppc_interrupt_hv we later store r11 out
to the vcpu assuming it's still what we got from userspace.
This causes r11 to be corrupted in the VCPU and hence when we restore
the guest, we get a corrupted r11. We've seen this when running TM
tests inside guests on P9.
This fixes the problem by only touching r11 in the denorm case.
Fixes: 4bb3c7a020 ("KVM: PPC: Book3S HV: Work around transactional memory bugs in POWER9")
Cc: <email address hidden> # 4.17+
Test-by: Suraj Jitindar Singh <email address hidden>
Reviewed-by: Paul Mackerras <email address hidden>
Signed-off-by: Michael Neuling <email address hidden>
Regards,
-Satheesh
CVE References
| bugproxy (bugproxy) wrote sosreport of debian chroot inside kvm guest | #1 |
| tags: | added: architecture-ppc64le bugnameltc-171274 severity-critical targetmilestone-inin--- |
| bugproxy (bugproxy) wrote sosreport of kvm guest | #2 |
| bugproxy (bugproxy) wrote Fix for KVM host | #3 |
| Changed in ubuntu: | |
| assignee: | nobody → Ubuntu on IBM Power Systems Bug Triage (ubuntu-power-triage) |
| affects: | ubuntu → linux (Ubuntu) |
| Changed in ubuntu-power-systems: | |
| importance: | Undecided → Critical |
| assignee: | nobody → Canonical Kernel Team (canonical-kernel-team) |
| Christian Ehrhardt (paelzer) wrote | #4 |
| tags: | added: p9 |
| Changed in linux (Ubuntu Cosmic): | |
| assignee: | Ubuntu on IBM Power Systems Bug Triage (ubuntu-power-triage) → Joseph Salisbury (jsalisbury) |
| Changed in linux (Ubuntu Bionic): | |
| assignee: | nobody → Joseph Salisbury (jsalisbury) |
| Changed in linux (Ubuntu Cosmic): | |
| status: | New → In Progress |
| Changed in linux (Ubuntu Bionic): | |
| status: | New → In Progress |
| Changed in linux (Ubuntu Cosmic): | |
| importance: | Undecided → Medium |
| Changed in linux (Ubuntu Bionic): | |
| importance: | Undecided → Medium |
| Changed in ubuntu-power-systems: | |
| status: | New → In Progress |
| Joseph Salisbury (jsalisbury) wrote | #5 |
| bugproxy (bugproxy) wrote Comment bridged from LTC Bugzilla | #6 |
| Changed in linux (Ubuntu Cosmic): | |
| status: | In Progress → Fix Committed |
| Changed in linux (Ubuntu Bionic): | |
| status: | In Progress → Fix Committed |
| Brad Figg (brad-figg) wrote | #8 |
| tags: | added: verification-needed-bionic |
| Changed in ubuntu-power-systems: | |
| status: | In Progress → Fix Committed |
| bugproxy (bugproxy) wrote | #9 |
| bugproxy (bugproxy) wrote testcase | #10 |
| Andrew Cloke (andrew-cloke) wrote | #11 |
| tags: |
added: verification-done-bionic removed: verification-needed-bionic |
| Launchpad Janitor (janitor) wrote | #12 |
| Changed in linux (Ubuntu Bionic): | |
| status: | Fix Committed → Fix Released |
| Changed in linux (Ubuntu Cosmic): | |
| status: | Fix Committed → Fix Released |
| Changed in linux (Ubuntu): | |
| status: | Fix Committed → Fix Released |
| Changed in ubuntu-power-systems: | |
| status: | Fix Committed → Fix Released |
| bugproxy (bugproxy) wrote Comment bridged from LTC Bugzilla | #13 |
| tags: |
added: targetmilestone-inin18041 removed: targetmilestone-inin--- |
Default Comment by Bridge