rdpru in ubuntu_kvm_unit_tests failed on B-4.15 node riccioli with FAIL: RDPRU raises #UD

Bug #1968681 reported by Po-Hsu Lin
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
ubuntu-kernel-tests
Fix Released
Undecided
Po-Hsu Lin
linux (Ubuntu)
Fix Released
Undecided
Unassigned
Bionic
Fix Released
Undecided
Po-Hsu Lin

Bug Description

[Impact]
RDPRU, the Read Processor Register instruction of AMD Zen 2 processors
is used to give access to some processor registers that are typically
only accessible when the privilege level is zero.

rdpru test in ubuntu_kvm_unit_tests is to check if the RDPRU instruction
can be intercepted by the Hypervisor. Without this patchset, this test
will fail on our AMD Zen 2 system "riccioli" with:
  FAIL: RDPRU raises #UD

[Fix]
* fb64f293 x86/cpufeatures: Add feature bit RDPRU on AMD
* 0cb8410b kvm: svm: Intercept RDPRU

We have these patches in newer releases already, only Bionic 4.15
requires this fix. The first patch needs to be backported with some
context adjustment, the second can be cherry-picked.

[Test]
Test kernel can be found here:
https://people.canonical.com/~phlin/kernel/lp-1968681-rdpru/

With the patched kernel, this rdpru test will pass on the target AMD
Zen 2 system.
$ sudo ./rdpru
BUILD_HEAD=d6421940
timeout -k 1s --foreground 90s /usr/bin/qemu-system-x86_64 --no-reboot \
-nodefaults -device pc-testdev -device isa-debug-exit,iobase=0xf4,iosize=0x4 \
-vnc none -serial stdio -device pci-testdev -machine accel=kvm -kernel \
/tmp/tmp.XOMVxpyNnl -smp 1 -cpu max # -initrd /tmp/tmp.I2TbGXFiaZ
enabling apic
smp: waiting for 0 APs
PASS: RDPRU raises #UD
SUMMARY: 1 tests
PASS rdpru (1 tests)

And the rdpru flag will be available in cpuinfo:
$ grep -o rdpru /proc/cpuinfo
rdpru

[Where problems could occur]
This patchset will add a new feature bit RDPRU for AMD Zen 2. We can
expect to see new issues coming up when using this bit in the future.

[Original Bug Report]
Issue found on B-ibm-gt-4.15.0-1116.127
This can be reproduced with B-4.15.0-175 as well.

This failure is only visible on this node.

 Running '/home/ubuntu/autotest/client/tmp/ubuntu_kvm_unit_tests/src/kvm-unit-tests/tests/rdpru'
 BUILD_HEAD=16647354
 timeout -k 1s --foreground 90s /usr/bin/qemu-system-x86_64 --no-reboot -nodefaults -device pc-testdev -device isa-debug-exit,iobase=0xf4,iosize=0x4 -vnc none -serial stdio -device pci-testdev -machine accel=kvm -kernel /tmp/tmp.qGIR5tvTw1 -smp 1 -cpu max # -initrd /tmp/tmp.8JuYRCFRUi
 enabling apic
 FAIL: RDPRU raises #UD
 SUMMARY: 1 tests, 1 unexpected failures
 FAIL rdpru (1 tests, 1 unexpected failures)

CVE References

Po-Hsu Lin (cypressyew)
description: updated
Revision history for this message
Po-Hsu Lin (cypressyew) wrote :

Test passed on this node with newer kernel (focal).

Po-Hsu Lin (cypressyew)
Changed in linux (Ubuntu):
status: New → Fix Released
Changed in linux (Ubuntu Bionic):
status: New → Confirmed
Revision history for this message
Po-Hsu Lin (cypressyew) wrote :

This hardware is an AMD system, codename Rome, Second generation Epyc

Fix:
https://github.com/torvalds/linux/commit/9d40b85bb46a99bc95dad3a07787da93b0a018e9
https://github.com/torvalds/linux/commit/0cb8410b90e78948984f35f2c4d50c2c0b7ee675

With patched kernel, the rdpru flag will be available in cpuinfo:
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl xtopology nonstop_tsc cpuid extd_apicid aperfmperf pni pclmulqdq monitor ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt tce topoext perfctr_core perfctr_nb bpext perfctr_llc mwaitx cpb cat_l3 cdp_l3 invpcid_single hw_pstate ssbd ibrs ibpb stibp vmmcall fsgsbase bmi1 avx2 smep bmi2 erms invpcid cqm rdt_a rdseed adx smap clflushopt clwb sha_ni xsaveopt xsavec xgetbv1 xsaves cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local clzero irperf xsaveerptr rdpru arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold v_vmsave_vmload vgif umip pku ospke vaes vpclmulqdq rdpid overflow_recov succor smca
bugs : sysret_ss_attrs spectre_v1 spectre_v2 spec_store_bypass

$ sudo ./rdpru
BUILD_HEAD=16647354
timeout -k 1s --foreground 90s /usr/bin/qemu-system-x86_64 --no-reboot -nodefaults -device pc-testdev -device isa-debug-exit,iobase=0xf4,iosize=0x4 -vnc none -serial stdio -device pci-testdev -machine accel=kvm -kernel /tmp/tmp.syc17ecDpN -smp 1 -cpu max # -initrd /tmp/tmp.poLG53JqrJ
enabling apic
PASS: RDPRU raises #UD
SUMMARY: 1 tests
PASS rdpru (1 tests)

Po-Hsu Lin (cypressyew)
description: updated
Po-Hsu Lin (cypressyew)
description: updated
Revision history for this message
Po-Hsu Lin (cypressyew) wrote :

With kvm-unit-test repo updated to d8a4f9e5 (ci: Update the list of tests that we run in the Fedora Cirrus-CI), this test is still failing with the same error message.

tags: added: sru-20220919
Po-Hsu Lin (cypressyew)
description: updated
Changed in linux (Ubuntu Bionic):
assignee: nobody → Po-Hsu Lin (cypressyew)
Changed in ubuntu-kernel-tests:
assignee: nobody → Po-Hsu Lin (cypressyew)
status: New → In Progress
Changed in linux (Ubuntu Bionic):
status: Confirmed → In Progress
Po-Hsu Lin (cypressyew)
description: updated
Po-Hsu Lin (cypressyew)
description: updated
Changed in linux (Ubuntu Bionic):
status: In Progress → Fix Committed
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux/4.15.0-206.217 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-bionic-linux verification-needed-bionic
Revision history for this message
Po-Hsu Lin (cypressyew) wrote :

Verified on node riccioli with 4.15.0-206.217, this issue has gone.

tags: added: verification-done-bionic
removed: verification-needed-bionic
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (17.9 KiB)

This bug was fixed in the package linux - 4.15.0-206.217

---------------
linux (4.15.0-206.217) bionic; urgency=medium

  * bionic/linux: 4.15.0-206.217 -proposed tracker (LP: #2004655)

  * CVE-2023-0461
    - SAUCE: Fix inet_csk_listen_start after CVE-2023-0461

linux (4.15.0-205.216) bionic; urgency=medium

  * bionic/linux: 4.15.0-205.216 -proposed tracker (LP: #2004414)

  * Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596)
    - NFSv4.1: Handle RECLAIM_COMPLETE trunking errors
    - NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot
    - nfs4: Fix kmemleak when allocate slot failed
    - net: dsa: Fix possible memory leaks in dsa_loop_init()
    - nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()
    - nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
    - net: fec: fix improper use of NETDEV_TX_BUSY
    - ata: pata_legacy: fix pdc20230_set_piomode()
    - net: sched: Fix use after free in red_enqueue()
    - ipvs: use explicitly signed chars
    - rose: Fix NULL pointer dereference in rose_send_frame()
    - mISDN: fix possible memory leak in mISDN_register_device()
    - isdn: mISDN: netjet: fix wrong check of device registration
    - btrfs: fix inode list leak during backref walking at resolve_indirect_refs()
    - btrfs: fix ulist leaks in error paths of qgroup self tests
    - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
    - net: mdio: fix undefined behavior in bit shift for __mdiobus_register
    - net, neigh: Fix null-ptr-deref in neigh_table_clear()
    - media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
    - media: dvb-frontends/drxk: initialize err to 0
    - i2c: xiic: Add platform module alias
    - Bluetooth: L2CAP: Fix attempting to access uninitialized memory
    - block, bfq: protect 'bfqd->queued' by 'bfqd->lock'
    - btrfs: fix type of parameter generation in btrfs_get_dentry
    - tcp/udp: Make early_demux back namespacified.
    - capabilities: fix potential memleak on error path from vfs_getxattr_alloc()
    - ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices
    - efi: random: reduce seed size to 32 bytes
    - parisc: Make 8250_gsc driver dependend on CONFIG_PARISC
    - parisc: Export iosapic_serial_irq() symbol for serial port driver
    - ext4: fix warning in 'ext4_da_release_space'
    - KVM: x86: Mask off reserved bits in CPUID.80000008H
    - KVM: x86: emulator: em_sysexit should update ctxt->mode
    - KVM: x86: emulator: introduce emulator_recalc_and_set_mode
    - KVM: x86: emulator: update the emulation mode after CR0 write
    - linux/const.h: prefix include guard of uapi/linux/const.h with _UAPI
    - linux/const.h: move UL() macro to include/linux/const.h
    - linux/bits.h: make BIT(), GENMASK(), and friends available in assembly
    - RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()
    - net: tun: fix bugs for oversize packet when napi frags enabled
    - ipvs: fix WARNING in __ip_vs_cleanup_batch()
    - ipvs: fix WARNING in ip_vs_app_net_cleanup()
    - ipv6: fix WARNING in ip6_route_net_exit_late()
    - parisc: Avoid printing the hardware path twice
    - HID: hyperv: fix possible memor...

Changed in linux (Ubuntu Bionic):
status: Fix Committed → Fix Released
Revision history for this message
Po-Hsu Lin (cypressyew) wrote :

Remove hints, closing this bug.

Changed in ubuntu-kernel-tests:
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.