Re: [Xen-devel] [PATCH v2] arm: p2m.c bug-fix: hypervisor hang on __p2m_get_mem_access

[Ian Campbell <ian.campbell@xxxxxxxxxx>]

On Wed, 2016-02-03 at 13:37 +0200, Corneliu ZUZU wrote:

I just now applied a previous v2 which was already in my queue. Was this
just an accidental resend of v2 or is there some important change and this
is really a v3?

> When __p2m_get_mem_access gets called, the p2m lock is already taken
> by either get_page_from_gva or p2m_get_mem_access.
> Possible code paths:
> 1)    -> get_page_from_gva
>               -> p2m_mem_access_check_and_get_page
>                       -> __p2m_get_mem_access
> 2)    -> p2m_get_mem_access
>               -> __p2m_get_mem_access
> 
> In both cases if __p2m_get_mem_access subsequently gets to
> call p2m_lookup (happens if !radix_tree_lookup(...)), a hypervisor
> hang will occur, since p2m_lookup also spin-locks on the p2m lock.
> 
> This bug-fix simply replaces the p2m_lookup call from
> __p2m_get_mem_access
> with a call to __p2m_lookup and also adds an ASSERT to ensure that the
> p2m lock
> is already taken upon __p2m_get_mem_access entry.
> 
> Signed-off-by: Corneliu ZUZU <czuzu@xxxxxxxxxxxxxxx>
> 
> ---
> Changed since v1:
> Â * added p2m-lock ASSERT
> ---
> Âxen/arch/arm/p2m.c | 4 +++-
> Â1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/xen/arch/arm/p2m.c b/xen/arch/arm/p2m.c
> index 2190908..e8e6db4 100644
> --- a/xen/arch/arm/p2m.c
> +++ b/xen/arch/arm/p2m.c
> @@ -468,6 +468,8 @@ static int __p2m_get_mem_access(struct domain *d,
> gfn_t gfn,
> Â#undef ACCESS
> ÂÂÂÂÂ};
> Â
> +ÂÂÂÂASSERT(spin_is_locked(&p2m->lock));
> +
> ÂÂÂÂÂ/* If no setting was ever set, just return rwx. */
> ÂÂÂÂÂif ( !p2m->mem_access_enabled )
> ÂÂÂÂÂ{
> @@ -490,7 +492,7 @@ static int __p2m_get_mem_access(struct domain *d,
> gfn_t gfn,
> ÂÂÂÂÂÂÂÂÂÂ* No setting was found in the Radix tree. Check if the
> ÂÂÂÂÂÂÂÂÂÂ* entry exists in the page-tables.
> ÂÂÂÂÂÂÂÂÂÂ*/
> -ÂÂÂÂÂÂÂÂpaddr_t maddr = p2m_lookup(d, gfn_x(gfn) << PAGE_SHIFT, NULL);
> +ÂÂÂÂÂÂÂÂpaddr_t maddr = __p2m_lookup(d, gfn_x(gfn) << PAGE_SHIFT, NULL);
> ÂÂÂÂÂÂÂÂÂif ( INVALID_PADDR == maddr )
> ÂÂÂÂÂÂÂÂÂÂÂÂÂreturn -ESRCH;
> Â

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel