Bug 1432549

Summary: KVM guest VM PMU access can bring down host kernel
Product: Red Hat Enterprise Linux 7 Reporter: Jaroslav Reznik <jreznik>
Component: kernel-aarch64Assignee: Mark Langsdorf <mlangsdo>
Status: CLOSED ERRATA QA Contact: Erico Nunes <ernunes>
Severity: high Docs Contact: Marie Hornickova <mdolezel>
Priority: high    
Version: 7.3CC: chayang, drjones, hhuang, hkrzesin, jbastian, jcm, jreznik, juzhang, knoel, michen, virt-maint, wehuang
Target Milestone: rcKeywords: OtherQA, Reopened, Security, ZStream
Target Release: ---   
Hardware: aarch64   
OS: Unspecified   
Whiteboard:
Fixed In Version: kernel-aarch64-4.5.0-15.4.2.el7 Doc Type: Bug Fix
Doc Text:
When a 32-bit KVM guest virtual machine attempted to access the Power Management Unit (PMU), a kernel panic on the KVM host occurred. This update fixes the handling of the register access in the host kernel when KVM accesses the PMU. As a result, the kernel panic on KVM host no longer occurs under the described circumstances.
Story Points: ---
Clone Of: 1403106 Environment:
Last Closed: 2017-04-12 12:36:29 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1403106    
Bug Blocks:    
Attachments:
Description Flags
kvm-unit-test patch to add a "mrrc p15" test none

Description Jaroslav Reznik 2017-03-15 16:02:46 UTC
This bug has been copied from bug #1403106 and has been proposed
to be backported to 7.3 z-stream (EUS).

Comment 4 Erico Nunes 2017-03-28 19:09:16 UTC
Created attachment 1267097 [details]
kvm-unit-test patch to add a "mrrc p15" test

Verified on hp-moonshot-02-c25.khw.lab.eng.bos.redhat.com, kernel-aarch64 4.5.0-15.4.2.el7.

I wrote the attached patch on top of kvm-unit-tests commit 95062c2 to run the instruction pointed to by BZ 1403106 comment #0, and ran it with (based on kvm-unit-tests' line, detail to -cpu host,aarch64=off to run aarch32):

/usr/libexec/qemu-kvm -nodefaults -machine virt,gic-version=host,accel=kvm -cpu host,aarch64=off -device virtio-serial-device -device virtconsole,chardev=ctd -chardev testdev,id=ctd -display none -serial stdio -kernel arm/bz1432549.flat -smp 1

kvm-unit-tests had to be built for aarch32 as well so I cross-built it with a arm-linux-gnu- toolchain on my machine.

On kernel 4.5.0-14.el7.aarch64 it crashes with:
[ 3734.681839] kernel BUG at arch/arm64/kvm/sys_regs.c:603! 
   < ... >
[ 3742.714905] [<fffffe00000bbf98>] access_pmu_evcntr+0x1ec/0x1f4 
[ 3742.784903] [<fffffe00000bc148>] emulate_cp+0x68/0xc8 
[ 3742.845513] [<fffffe00000bc2a0>] kvm_handle_cp_64+0xf8/0x10c 
[ 3742.913424] [<fffffe00000bcbc8>] kvm_handle_cp15_64+0x4c/0x58 
[ 3742.982381] [<fffffe00000b8e5c>] handle_exit+0x68/0x160 
[ 3743.045077] [<fffffe00000b2a84>] kvm_arch_vcpu_ioctl_run+0x29c/0x50c 
[ 3743.121336] [<fffffe00000ab970>] kvm_vcpu_ioctl+0x378/0x76c 
[ 3743.188206] [<fffffe0000252474>] do_vfs_ioctl+0xc0/0x754 
[ 3743.251944] [<fffffe0000252b98>] SyS_ioctl+0x90/0xa4 


On kernel 4.5.0-15.4.2.el7.aarch64 it just runs and finishes without the crash.

Comment 6 errata-xmlrpc 2017-04-12 12:36:29 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:0919