kernel invalid opcode in intel_powerclamp

Bug #1630774 reported by Vinson Lee
44
This bug affects 6 people
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Fix Released
Medium
Joseph Salisbury
Yakkety
Fix Released
Medium
Joseph Salisbury

Bug Description

kernel error on VMware Fusion when booting to graphical login

invalid opcode: 0000 [#1] SMP
Modules linked in: ipmi_msghandler intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel vmw_balloon aesni_intel aes_x86_64 lrw glue_helper ablk_helper cryptd intel_rapl_perf joydev input_leds serio_raw snd_ens1371 snd_ac97_codec gameport ac97_bus snd_pcm binfmt_misc snd_seq_midi snd_seq_midi_event snd_rawmidi uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core videodev media snd_seq btusb btrtl btbcm snd_seq_device btintel snd_timer bluetooth snd soundcore shpchp i2c_piix4 vmw_vmci nfit floppy(+) mac_hid parport_pc ppdev lp parport ip_tables x_tables autofs4 hid_generic usbhid hid psmouse vmwgfx ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm ahci libahci e1000 mptspi mptscsih mptbase scsi_transport_spi pata_acpi fjes
CPU: 0 PID: 806 Comm: kidle_inject/0 Not tainted 4.8.0-19-generic #21-Ubuntu
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015
task: ffff9e70f1ce1c80 task.stack: ffff9e70f6790000
RIP: 0010:[<ffffffffc073c8b8>] [<ffffffffc073c8b8>] clamp_thread+0x2b8/0x5d0 [intel_powerclamp]
RSP: 0018:ffff9e70f6793e00 EFLAGS: 00010246
RAX: ffff9e70f6790008 RBX: 00000000fffee2fe RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246
RBP: ffff9e70f6793ec0 R08: ffff9e70f6790000 R09: 0000000000000000
R10: afb504000afb5041 R11: ffff9e70fa619ac0 R12: ffffffff93958160
R13: ffff9e70f6790000 R14: 0000000000000000 R15: ffff9e70f6790000
FS: 0000000000000000(0000) GS:ffff9e70fa600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd50464ff8 CR3: 00000000b89db000 CR4: 00000000001406f0
Stack:
 0000000000000000 0000000000000005 ffffffffc073e5d8 ffffffffc073ea40
 0000000000000000 0000000300000000 0000000000000000 ffff9e70f6790008
 0000000000000000 ffff9e70fa60ff68 00000000fffee2fe ffffffffc073c0a0
Call Trace:
 [<ffffffffc073c0a0>] ? pkg_state_counter+0xa0/0xa0 [intel_powerclamp]
 [<ffffffffc073c600>] ? powerclamp_set_cur_state+0x170/0x170 [intel_powerclamp]
 [<ffffffffc073c600>] ? powerclamp_set_cur_state+0x170/0x170 [intel_powerclamp]
 [<ffffffff92aa3c18>] kthread+0xd8/0xf0
 [<ffffffff9329f11f>] ret_from_fork+0x1f/0x40
 [<ffffffff92aa3b40>] ? kthread_create_on_node+0x1e0/0x1e0
Code: d2 e9 ba 00 00 00 eb 19 0f 1f 00 0f ae f0 65 48 8b 04 25 04 69 01 00 0f ae b8 08 c0 ff ff 0f ae f0 31 d2 48 8b 44 24 38 48 89 d1 <0f> 01 c8 49 8b 45 08 a8 08 75 0b b9 01 00 00 00 4c 89 f0 0f 01
RIP [<ffffffffc073c8b8>] clamp_thread+0x2b8/0x5d0 [intel_powerclamp]
 RSP <ffff9e70f6793e00>
---[ end trace fb2ec9f1e269d231 ]---

CVE References

Revision history for this message
Brad Figg (brad-figg) wrote : Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1630774

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status: New → Incomplete
Revision history for this message
Joseph Salisbury (jsalisbury) wrote :

Would it be possible for you to test the latest kernel updates and post back if it resolves this bug?

Changed in linux (Ubuntu):
importance: Undecided → Medium
tags: added: kernel-da-key
Revision history for this message
Vinson Lee (vlee) wrote :

invalid opcode: 0000 [#1] SMP
Modules linked in: bnep binfmt_misc intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel vmw_balloon aesni_intel aes_x86_64 lrw glue
_helper ablk_helper cryptd intel_rapl_perf snd_ens1371 snd_ac97_codec gameport ac97_bus snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi btusb btrtl snd
_seq btbcm btintel joydev input_leds serio_raw bluetooth snd_seq_device snd_timer snd soundcore vmw_vmci i2c_piix4 shpchp nfit floppy(+) mac_hid parport_pc
 ppdev lp parport ip_tables x_tables autofs4 hid_generic usbhid hid psmouse e1000 mptspi mptscsih mptbase scsi_transport_spi vmwgfx ttm drm_kms_helper sysc
opyarea sysfillrect sysimgblt fb_sys_fops drm pata_acpi fjes
CPU: 0 PID: 760 Comm: kidle_inject/0 Not tainted 4.8.0-22-generic #24-Ubuntu
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015
task: ffff8adbf9f9c740 task.stack: ffff8adbf8c68000
RIP: 0010:[<ffffffffc06348b8>] [<ffffffffc06348b8>] clamp_thread+0x2b8/0x5d0 [intel_powerclamp]
RSP: 0000:ffff8adbf8c6be00 EFLAGS: 00010246
RAX: ffff8adbf8c68008 RBX: 00000000fffee3ee RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246
RBP: ffff8adbf8c6bec0 R08: 0000000000000001 R09: 0000000000000000
R10: ffffffffba15a5c0 R11: ffffffffc0636a40 R12: ffffffffba1581a0
R13: ffff8adbf8c68000 R14: 0000000000000000 R15: ffff8adbf8c68000
FS: 0000000000000000(0000) GS:ffff8adbfb600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557b803fc1b8 CR3: 0000000074fae000 CR4: 00000000003406f0
Stack:
 0000000000000000 0000000000000005 ffffffffc06365d8 ffffffffc0636a40
 0000000000000000 0000000400000000 0000000000000000 ffff8adbf8c68008
 0000000000000000 ffff8adbfb60fee8 00000000fffee3ee ffffffffc06340a0
Call Trace:
 [<ffffffffc06340a0>] ? pkg_state_counter+0xa0/0xa0 [intel_powerclamp]
 [<ffffffffc0634600>] ? powerclamp_set_cur_state+0x170/0x170 [intel_powerclamp]
 [<ffffffffc0634600>] ? powerclamp_set_cur_state+0x170/0x170 [intel_powerclamp]
 [<ffffffffb92a3c18>] kthread+0xd8/0xf0
 [<ffffffffb9a9f29f>] ret_from_fork+0x1f/0x40
 [<ffffffffb92a3b40>] ? kthread_create_on_node+0x1e0/0x1e0
Code: f8 e9 ba 00 00 00 eb 19 0f 1f 00 0f ae f0 65 48 8b 04 25 04 69 01 00 0f ae b8 08 c0 ff ff 0f ae f0 31 d2 48 8b 44 24 38 48 89 d1 <0f> 01 c8 49 8b 45
08 a8 08 75 0b b9 01 00 00 00 4c 89 f0 0f 01
RIP [<ffffffffc06348b8>] clamp_thread+0x2b8/0x5d0 [intel_powerclamp]
 RSP <ffff8adbf8c6be00>
---[ end trace da976877e8971c0a ]---

Revision history for this message
Vinson Lee (vlee) wrote :

I can boot completely with kernel command line parameter 'modprobe.blacklist=intel_powerclamp'.

Revision history for this message
Alok Kataria (akataria) wrote :

This is a bug in the intel_powerclamp driver, please see following thread on LKML for details

https://lkml.org/lkml/2016/10/18/356

A fix is available here https://patchwork.kernel.org/patch/9365005/ this should make it's way to the stable releases, though I don't know when will it be available. Ubuntu folks might want to cherry pick it to release a kernel update

Thanks !

Changed in linux (Ubuntu Yakkety):
status: New → Triaged
Changed in linux (Ubuntu):
status: Incomplete → Triaged
Changed in linux (Ubuntu Yakkety):
importance: Undecided → Medium
Revision history for this message
Joseph Salisbury (jsalisbury) wrote :

I built a test kernel with the patch posted in comment 5. Thanks for the pointer, Alok!

Can you test this kernel and see if it resolves this bug? It can be downloaded from:

http://kernel.ubuntu.com/~jsalisbury/lp1622894/

With this kernel, you need to install both the linux-image and linux-image-extra .deb packages.

Revision history for this message
Joseph Salisbury (jsalisbury) wrote :

Sorry, the correct download location is:
http://kernel.ubuntu.com/~jsalisbury/lp1630774

NOT the link posted in comment #6.

Revision history for this message
Alok Kataria (akataria) wrote :

Hi Joseph.

This build works great, the driver now rightly refuses to load on VMware platform.

root@ubuntu:~$ uname -a
Linux ubuntu 4.8.0-26-generic #28~lp1630774 SMP Thu Oct 20 18:44:11 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

root@ubuntu:~# modprobe intel_powerclamp
modprobe: ERROR: could not insert 'intel_powerclamp': No such device

In dmesg -

[ 6806.907456] intel_powerclamp: CPU does not support MWAIT

Thanks for the quick turnaround with the build, when should we expect the kernel update to be available for download ?

Changed in linux (Ubuntu):
status: Triaged → In Progress
Changed in linux (Ubuntu Yakkety):
status: Triaged → In Progress
Changed in linux (Ubuntu):
assignee: nobody → Joseph Salisbury (jsalisbury)
Changed in linux (Ubuntu Yakkety):
assignee: nobody → Joseph Salisbury (jsalisbury)
tags: added: yakkety
Tim Gardner (timg-tpi)
Changed in linux (Ubuntu Yakkety):
status: In Progress → Fix Committed
Changed in linux (Ubuntu):
status: In Progress → Won't Fix
status: Won't Fix → Invalid
Revision history for this message
Luis Henriques (henrix) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-yakkety' to 'verification-done-yakkety'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-yakkety
Revision history for this message
Alok Kataria (akataria) wrote :

I updated the kernel from the proposed repository and verified that the problem is fixed. The intel_powerclamp module fails to load now for ubuntu 16.10 guests running on VMware's platform.

Kernel version - 4.8.0-28-generic.

I don't think I have the required access to change the tags, can someone else from canonical please update it.

Thanks.

Seth Forshee (sforshee)
tags: added: verification-done-yakkety
removed: verification-needed-yakkety
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (26.6 KiB)

This bug was fixed in the package linux - 4.8.0-28.30

---------------
linux (4.8.0-28.30) yakkety; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1641083

  * lxc-attach to malicious container allows access to host (LP: #1639345)
    - Revert "UBUNTU: SAUCE: (noup) ptrace: being capable wrt a process requires
      mapped uids/gids"
    - (upstream) mm: Add a user_ns owner to mm_struct and fix ptrace permission
      checks

  * [Feature] AVX-512 new instruction sets (avx512_4vnniw, avx512_4fmaps)
    (LP: #1637526)
    - x86/cpufeature: Add AVX512_4VNNIW and AVX512_4FMAPS features

  * zfs: importing zpool with vdev on zvol hangs kernel (LP: #1636517)
    - SAUCE: (noup) Update zfs to 0.6.5.8-0ubuntu4.1

  * Move some device drivers build from kernel built-in to modules
    (LP: #1637303)
    - [Config] CONFIG_TIGON3=m for all arches
    - [Config] CONFIG_VIRTIO_BLK=m, CONFIG_VIRTIO_NET=m

  * I2C touchpad does not work on AMD platform (LP: #1612006)
    - pinctrl/amd: Configure GPIO register using BIOS settings

  * guest experiencing Transmit Timeouts on CX4 (LP: #1636330)
    - powerpc/64: Re-fix race condition between going idle and entering guest
    - powerpc/64: Fix race condition in setting lock bit in idle/wakeup code

  * QEMU throws failure msg while booting guest with SRIOV VF (LP: #1630554)
    - KVM: PPC: Always select KVM_VFIO, plus Makefile cleanup

  * [Feature] KBL - New device ID for Kabypoint(KbP) (LP: #1591618)
    - SAUCE: mfd: lpss: Fix Intel Kaby Lake PCH-H properties

  * hio: SSD data corruption under stress test (LP: #1638700)
    - SAUCE: hio: set bi_error field to signal an I/O error on a BIO
    - SAUCE: hio: splitting bio in the entry of .make_request_fn

  * cleanup primary tree for linux-hwe layering issues (LP: #1637473)
    - [Config] switch Vcs-Git: to yakkety repository
    - [Packaging] handle both linux-lts* and linux-hwe* as backports
    - [Config] linux-tools-common and linux-cloud-tools-common are one per series
    - [Config] linux-source-* is in the primary linux namespace
    - [Config] linux-tools -- always suggest the base package

  * SRU: sync zfsutils-linux and spl-linux changes to linux (LP: #1635656)
    - SAUCE: (noup) Update spl to 0.6.5.8-2, zfs to 0.6.5.8-0ubuntu4 (LP:
      #1635656)

  * [Feature] SKX: perf uncore PMU support (LP: #1591810)
    - perf/x86/intel/uncore: Add Skylake server uncore support
    - perf/x86/intel/uncore: Remove hard-coded implementation for Node ID mapping
      location
    - perf/x86/intel/uncore: Handle non-standard counter offset

  * [Feature] Purley: Memory Protection Keys (LP: #1591804)
    - x86/pkeys: Add fault handling for PF_PK page fault bit
    - mm: Implement new pkey_mprotect() system call
    - x86/pkeys: Make mprotect_key() mask off additional vm_flags
    - x86/pkeys: Allocation/free syscalls
    - x86: Wire up protection keys system calls
    - generic syscalls: Wire up memory protection keys syscalls
    - pkeys: Add details of system call use to Documentation/
    - x86/pkeys: Default to a restrictive init PKRU
    - x86/pkeys: Allow configuration of init_pkru
    - x86/pkeys: Add self-tests

  * kernel invalid ...

Changed in linux (Ubuntu Yakkety):
status: Fix Committed → Fix Released
Revision history for this message
Steve Langasek (vorlon) wrote : Update Released

The verification of the Stable Release Update for linux has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package linux - 4.8.0-30.32

---------------
linux (4.8.0-30.32) yakkety; urgency=low

  * CVE-2016-8655 (LP: #1646318)
    - packet: fix race condition in packet_set_ring

 -- Brad Figg <email address hidden> Thu, 01 Dec 2016 08:02:53 -0800

Changed in linux (Ubuntu):
status: Invalid → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.