Re: [Xen-devel] [PATCH for-4.12 V4] x86/altp2m: fix HVMOP_altp2m_set_domain_state race

[Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>]

On 2/14/19 8:06 PM, George Dunlap wrote:
> On 2/12/19 11:42 AM, Razvan Cojocaru wrote:
>> HVMOP_altp2m_set_domain_state does not domain_pause(), presumably
>> on purpose (as it was originally supposed to cater to a in-guest
>> agent, and a domain pausing itself is not a good idea).
>>
>> This can lead to domain crashes in the vmx_vmexit_handler() code
>> that checks if the guest has the ability to switch EPTP without an
>> exit. That code can __vmread() the host p2m's EPT_POINTER
>> (before HVMOP_altp2m_set_domain_state "for_each_vcpu()" has a
>> chance to run altp2m_vcpu_initialise(), but after
>> d->arch.altp2m_active is set).
> 
> Sorry, where exactly does the crash happen?

3655     /*
3656      * If the guest has the ability to switch EPTP without an exit,
3657      * figure out whether it has done so and update the altp2m data.
3658      */
3659     if ( altp2m_active(v->domain) &&
3660         (v->arch.hvm.vmx.secondary_exec_control &
3661         SECONDARY_EXEC_ENABLE_VM_FUNCTIONS) )
3662     {
3663         unsigned long idx;
3664
3665         if ( v->arch.hvm.vmx.secondary_exec_control &
3666             SECONDARY_EXEC_ENABLE_VIRT_EXCEPTIONS )
3667             __vmread(EPTP_INDEX, &idx);
3668         else
3669         {
3670             unsigned long eptp;
3671
3672             __vmread(EPT_POINTER, &eptp);
3673
3674             if ( (idx = p2m_find_altp2m_by_eptp(v->domain, eptp)) ==
3675                  INVALID_ALTP2M )
3676             {
3677                 gdprintk(XENLOG_ERR, "EPTP not found in alternate
p2m list\n");
3678                 domain_crash(v->domain);

Right here (at line 3678 in vmx.c).


Thanks,
Razvan

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel