[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [PATCH v2] xen: fix XEN_DOMCTL_gdbsx_guestmemio crash
On 19.04.2022 12:40, Andrew Cooper wrote: > On 19/04/2022 11:18, Juergen Gross wrote: >> A hypervisor built without CONFIG_GDBSX will crash in case the >> XEN_DOMCTL_gdbsx_guestmemio domctl is being called, as the call will >> end up in iommu_do_domctl() with d == NULL: >> >> (XEN) CPU: 6 >> (XEN) RIP: e008:[<ffff82d040269984>] iommu_do_domctl+0x4/0x30 >> (XEN) RFLAGS: 0000000000010202 CONTEXT: hypervisor (d0v0) >> (XEN) rax: 00000000000003e8 rbx: ffff830856277ef8 rcx: ffff830856277fff >> ... >> (XEN) Xen call trace: >> (XEN) [<ffff82d040269984>] R iommu_do_domctl+0x4/0x30 >> (XEN) [<ffff82d04035cd5f>] S arch_do_domctl+0x7f/0x2330 >> (XEN) [<ffff82d040239e46>] S do_domctl+0xe56/0x1930 >> (XEN) [<ffff82d040238ff0>] S do_domctl+0/0x1930 >> (XEN) [<ffff82d0402f8c59>] S pv_hypercall+0x99/0x110 >> (XEN) [<ffff82d0402f5161>] S >> arch/x86/pv/domain.c#_toggle_guest_pt+0x11/0x90 >> (XEN) [<ffff82d040366288>] S lstar_enter+0x128/0x130 >> (XEN) >> (XEN) Pagetable walk from 0000000000000144: >> (XEN) L4[0x000] = 0000000000000000 ffffffffffffffff >> (XEN) >> (XEN) **************************************** >> (XEN) Panic on CPU 6: >> (XEN) FATAL PAGE FAULT >> (XEN) [error_code=0000] >> (XEN) Faulting linear address: 0000000000000144 >> >> Fix this issue by modifying the interface of gdbsx_guest_mem_io() to >> take the already known domain pointer instead of the domid. > > There is some explanation missing here. The adjustments you make are > within CONFIG_GDBSX, with the exception of the final hunk. > > > The actual bug is that non-IOMMU subops end up in iommu_do_domctl(), so > while this is good cleanup to gdbsx_guest_mem_io() it, along with Jan's > adjustment to iommu_do_domctl(), are not suitable fixes to the crash as > reported. Whether non-IOMMU subops ending up in iommu_do_domctl() is a bug is a matter of the position you take: Considering how we chain common -> arch -> IOMMU domctls, this can also be viewed as intentional, with further chaining going to be added anywhere in this set. The downside of your approach (which otherwise I think would have been the way to go already when the IOMMU domctls gained their own function) is that at least one higher layer will need to know which specific sub-ops the function is going to handle. If that was acceptable, I'd then question whether the top layer shouldn't also know which sub-ops the per-arch functions are going to handle. Jan
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |