[UBUNTU 20.10] Applications runing in QEMU/KVM get translation faults
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Ubuntu on IBM z Systems |
Fix Released
|
Critical
|
Skipper Bug Screeners | ||
| linux (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
| Groovy |
Fix Released
|
Medium
|
Unassigned | ||
| Hirsute |
Fix Released
|
Undecided
|
Unassigned | ||
Bug Description
SRU Justification:
==================
[Impact]
* The commit 0b0ed657fe "s390: remove critical section cleanup from entry.S" was introduced in kernel 5.8, but instigated a problem where FPU registers were not properly restored when entering the SIE (start interpretive execution) instruction.
* This leads to crashes of applications runnning inside KVM, as most of the programs in use nowdays are using FPU registers for backing of general register content.
* To fix this interrupts in load_fpu_regs() need to be disabled - otherwise an interrupt might come in after the registers are loaded, but before CIF_FPU is cleared in load_fpu_regs().
* When the interrupt returns, CIF_FPU will be cleared and the registers will never be restored.
[Fix]
* 1179f170b6f0af7
[Test Case]
* IBM Z or LinuxONE hardware with Ubuntu Server 20.10 installed.
* A KVM host needs to be setup as well as an KVM guest (use again 20.10).
* Run (ideally context switching) workload that makes use of FP instructions inside of the KVM guest.
* Monitor the health of the guest for crashes (logs).
[Regression Potential]
* Even if the code changes are quite overseeable, there is still a certain risk for regression, because:
* the modifications affect a critical part of the kernel (arch/s390/
* affect the handling of the FPU registers
* and are always in use if KVM guests run
* So in worst case the changes may have an even bigger impact on FPU workloads in KVM guests
* and may not only crash in case of FPU usage, but also KVM in general.
* But the code is peurly s390x specific, hence affects IBM Z only,
* and it got already upstream accepted with v5.10-rc6
* and a test kernel (based on groovy master-next) was build for further testing.
[Other]
* The patch got upstream accepted with kernel v5.10-rc6, hence it will land sooner or later in Hirsute.
* It was initially planned to address groovy via 5.8 upstream stable update, and in fact the patch was already marked for this, but it didn't made it because 5.8 already reached it's EOL.
* Hence this SRU is submitted for groovy only.
__________
commit 0b0ed657fe ("s390: remove critical section cleanup from entry.S") introduced a problem where FPU registers were not properly restored when entering SIE. This leads to crashes of applications runnning inside kvm, as most of the programs in use nowdays are using FPU registers for backing of general register content.
Fix is upstream:
author Sven Schnelle <email address hidden> 2020-11-20 14:17:52 +0100
committer Heiko Carstens <email address hidden> 2020-11-23 11:52:13 +0100
commit 1179f170b6f0af7
tree 19e8acb64e0968b
parent 78d732e1f326f74
download linux-1179f170b
s390: fix fpu restore in entry.S
We need to disable interrupts in load_fpu_regs(). Otherwise an
interrupt might come in after the registers are loaded, but before
CIF_FPU is cleared in load_fpu_regs(). When the interrupt returns,
CIF_FPU will be cleared and the registers will never be restored.
The entry.S code usually saves the interrupt state in __SF_EMPTY on the
stack when disabling/restoring interrupts. sie64a however saves the pointer
to the sie control block in __SF_SIE_CONTROL, which references the same
location. This is non-obvious to the reader. To avoid thrashing the sie
control block pointer in load_fpu_regs(), move the __SIE_* offsets eight
bytes after __SF_EMPTY on the stack.
Cc: <email address hidden> # 5.8
Fixes: 0b0ed657fe00 ("s390: remove critical section cleanup from entry.S")
Reported-by: Pierre Morel <email address hidden>
Signed-off-by: Sven Schnelle <email address hidden>
Acked-by: Christian Borntraeger <email address hidden>
Reviewed-by: Heiko Carstens <email address hidden>
Signed-off-by: Heiko Carstens <email address hidden>
CVE References
| tags: | added: architecture-s39064 bugnameltc-189961 severity-critical targetmilestone-inin--- |
| Changed in ubuntu: | |
| assignee: | nobody → Skipper Bug Screeners (skipper-screen-team) |
| affects: | ubuntu → linux (Ubuntu) |
| Frank Heimes (fheimes) wrote | #1 |
| Changed in ubuntu-z-systems: | |
| assignee: | nobody → Skipper Bug Screeners (skipper-screen-team) |
| Changed in linux (Ubuntu): | |
| assignee: | Skipper Bug Screeners (skipper-screen-team) → Frank Heimes (fheimes) |
| Changed in ubuntu-z-systems: | |
| importance: | Undecided → Critical |
| status: | New → Triaged |
| Changed in linux (Ubuntu Groovy): | |
| assignee: | nobody → Frank Heimes (fheimes) |
| Changed in linux (Ubuntu): | |
| assignee: | Frank Heimes (fheimes) → nobody |
| Frank Heimes (fheimes) wrote | #2 |
| Changed in linux (Ubuntu Groovy): | |
| importance: | Undecided → Medium |
| status: | New → In Progress |
| Changed in ubuntu-z-systems: | |
| status: | Triaged → In Progress |
| Changed in linux (Ubuntu Groovy): | |
| assignee: | Frank Heimes (fheimes) → nobody |
| Changed in linux (Ubuntu Groovy): | |
| status: | In Progress → Fix Committed |
| Changed in ubuntu-z-systems: | |
| status: | In Progress → Fix Committed |
| Changed in linux (Ubuntu Hirsute): | |
| status: | New → In Progress |
| Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote | #4 |
| tags: | added: verification-needed-groovy |
| Frank Heimes (fheimes) wrote | #5 |
| Frank Heimes (fheimes) wrote | #6 |
| Changed in linux (Ubuntu Hirsute): | |
| status: | In Progress → Fix Committed |
| Frank Heimes (fheimes) wrote | #7 |
| tags: |
added: verification-done-groovy removed: verification-needed-groovy |
| tags: |
added: targetmilestone-inin2010 removed: targetmilestone-inin--- |
| Frank Heimes (fheimes) wrote | #8 |
| Changed in linux (Ubuntu Hirsute): | |
| status: | Fix Committed → Fix Released |
| Frank Heimes (fheimes) wrote | #9 |
| Launchpad Janitor (janitor) wrote | #10 |
| Changed in linux (Ubuntu Groovy): | |
| status: | Fix Committed → Fix Released |
| Changed in ubuntu-z-systems: | |
| status: | Fix Committed → Fix Released |
| bugproxy (bugproxy) wrote Comment bridged from LTC Bugzilla | #11 |
Since "s390: fix fpu restore in entry.S" is needed to fix "s390: remove critical section cleanup from entry.S" and "s390: remove critical section cleanup from entry.S" got introduced with kernel 5.8, this affects kernel 5.8 only - and with that only groovy and later.
And since "s390: fix fpu restore in entry.S" landed upstream in linux-next (with 'next-20201124' and '5.10-rc5) and got also tagged for 5.8 stable ("Cc: <email address hidden> # 5.8"),
this ticket is just a tracker to make sure the fix is really picked up by the kernel team
with a future LP bug like "Groovy update: v5.8.? upstream stable release".