[Xen-changelog] [xen master] x86/tboot: avoid recursive fault in early boot panic with tboot

[patchbot@xxxxxxx]

commit deb8ba12e5e91f78a0f3a72fd28668369f51f588
Author:     Jason Andryuk <jandryuk@xxxxxxxxx>
AuthorDate: Tue Jul 24 15:55:07 2018 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Jul 24 15:55:07 2018 +0200

    x86/tboot: avoid recursive fault in early boot panic with tboot
    
    If panic is called before init_idle_domain on a tboot-launched system,
    then Xen recursively faults in write_ptbase as seen below.
    
    (XEN)    [<ffff82d080286690>] write_ptbase+0/0x10
    (XEN)    [<ffff82d0802c4c3b>] tboot_shutdown+0x6b/0x260
    (XEN)    [<ffff82d08029ddac>] machine_restart+0xac/0x2d0
    (XEN)    [<ffff82d080286690>] write_ptbase+0/0x10
    (XEN)    [<ffff82d0802446c1>] panic+0x111/0x120
    (XEN)    [<ffff82d0802a51c1>] do_general_protection+0x171/0x1f0
    (XEN)    [<ffff82d080287a82>] mm.c#virt_to_xen_l2e+0x12/0x1c0
    (XEN)    [<ffff82d080354720>] 
x86_64/entry.S#handle_exception_saved+0x66/0xa4
    (XEN)    [<ffff82d080286690>] write_ptbase+0/0x10
    (XEN)    [<ffff82d0802c4c3b>] tboot_shutdown+0x6b/0x260
    (XEN)    [<ffff82d08029ddac>] machine_restart+0xac/0x2d0
    (XEN)    [<ffff82d0802446c1>] panic+0x111/0x120
    (XEN)    [<ffff82d0803c11a0>] setup.c#bootstrap_map+0/0x11a
    (XEN)    [<ffff82d0803b82a0>] flask_op.c#parse_flask_param+0/0xb0
    (XEN)    [<ffff82d0803c11a0>] setup.c#bootstrap_map+0/0x11a
    (XEN)    [<ffff82d0803b6f6c>] xsm_multiboot_init+0x7c/0xb0
    (XEN)    [<ffff82d0803c34bb>] __start_xen+0x1d2b/0x2da0
    (XEN)    [<ffff82d0802000f3>] __high_start+0x53/0x60
    
    idle_vcpu[0] is still poisoned with INVALID_VCPU, so write_ptbase faults
    dereferencing the pointer.  This fault calls panic and recurses through
    the same code path.
    
    If tboot_shutdown is called while idle_vcpu[0] == INVALID_VCPU, then we
    are still operating with the initial page tables.  Therefore changing
    page tables with write_ptbase is unnecessary.
    
    An easy way to reproduce this is to use tboot to launch an XSM-enabled
    Xen without an XSM policy.
    
    Signed-off-by: Jason Andryuk <jandryuk@xxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/arch/x86/tboot.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/tboot.c b/xen/arch/x86/tboot.c
index fb4616ae83..d5a5292d7e 100644
--- a/xen/arch/x86/tboot.c
+++ b/xen/arch/x86/tboot.c
@@ -391,7 +391,12 @@ void tboot_shutdown(uint32_t shutdown_type)
         tboot_gen_xenheap_integrity(g_tboot_shared->s3_key, &xenheap_mac);
     }
 
-    write_ptbase(idle_vcpu[0]);
+    /*
+     * During early boot, we can be called by panic before idle_vcpu[0] is
+     * setup, but in that case we don't need to change page tables.
+     */
+    if ( idle_vcpu[0] != INVALID_VCPU )
+        write_ptbase(idle_vcpu[0]);
 
     ((void(*)(void))(unsigned long)g_tboot_shared->shutdown_entry)();
 
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog