tboot: Avoid recursive fault in early boot panic with tboot
PATCH 1/1 tboot: Avoid recursive fault in early boot panic with tboot
If panic is called before init_idle_domain on a tboot-launched system, Xen recursively faults in write_ptbase as seen below.
(XEN) [<ffff82d080286690>] write_ptbase+0/0x10 (XEN) [<ffff82d0802c4c3b>] tboot_shutdown+0x6b/0x260 (XEN) [<ffff82d08029ddac>] machine_restart+0xac/0x2d0 (XEN) [<ffff82d080286690>] write_ptbase+0/0x10 (XEN) [<ffff82d0802446c1>] panic+0x111/0x120 (XEN) [<ffff82d0802a51c1>] do_general_protection+0x171/0x1f0 (XEN) [<ffff82d080287a82>] mm.c#virt_to_xen_l2e+0x12/0x1c0 (XEN) [<ffff82d080354720>] x86_64/entry.S#handle_exception_saved+0x66/0xa4 (XEN) [<ffff82d080286690>] write_ptbase+0/0x10 (XEN) [<ffff82d0802c4c3b>] tboot_shutdown+0x6b/0x260 (XEN) [<ffff82d08029ddac>] machine_restart+0xac/0x2d0 (XEN) [<ffff82d0802446c1>] panic+0x111/0x120 (XEN) [<ffff82d0803c11a0>] setup.c#bootstrap_map+0/0x11a (XEN) [<ffff82d0803b82a0>] flask_op.c#parse_flask_param+0/0xb0 (XEN) [<ffff82d0803c11a0>] setup.c#bootstrap_map+0/0x11a (XEN) [<ffff82d0803b6f6c>] xsm_multiboot_init+0x7c/0xb0 (XEN) [<ffff82d0803c34bb>] __start_xen+0x1d2b/0x2da0 (XEN) [<ffff82d0802000f3>] __high_start+0x53/0x60
idle_vcpu[0] is still poisoned with INVALID_VCPU, so write_ptbase faults dereferencing the pointer. This fault calls panic and recurses through the same code path.
If tboot_shutdown is called while idle_vcpu[0] == INVALID_VCPU, then we are still operating with the initial page tables. Therefore changing page tables with write_ptbase is unnecessary.
An easy way to reproduce this is to use tboot to launch an XSM-enabled Xen without an XSM policy.
--- xen/arch/x86/tboot.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
xen/arch/x86/tboot.c +6 -1
@@ -391,7 +391,12 @@ void tboot_shutdown(uint32_t shutdown_type)tboot_gen_xenheap_integrity (g_tboot_shared->s3_key, &xenheap_mac); } -write_ptbase (idle_vcpu[0 ]); +/* During early boot, we can be called by panic before idle_vcpu[0] is +* setup, but in that case we don't need to change page tables. */ +if ( idle_vcpu[0 ] !=INVALID_VCPU ) + { +write_ptbase (idle_vcpu[0 ]); + } ((void (*)(void ))(unsigned long )g_tboot_shared->shutdown_entry)();
Signature · 7 lines
2.17.1 _______________________________________________ Xen-devel mailing list [email protected] https://lists.xenproject.org/mailman/listinfo/xen-devel
Quoted 4 lines
Quoted 1 line
Quoted 1 line · On 16.07.18 at 13:59, <[email protected]> wrote:
xen/arch/x86/tboot.c void tboot_shutdown(uint32_t shutdown_type) · line 399
Quoted 10 lines
xen/arch/x86/tboot.c +6
-1@@ -391,7 +391,12 @@ void tboot_shutdown(uint32_t shutdown_type)tboot_gen_xenheap_integrity (g_tboot_shared->s3_key, &xenheap_mac); } -write_ptbase (idle_vcpu[0 ]); +/* During early boot, we can be called by panic before idle_vcpu[0] is +* setup, but in that case we don't need to change page tables. */ +if ( idle_vcpu[0 ] !=INVALID_VCPU ) + { +write_ptbase (idle_vcpu[0 ]); + }
There are two style issues here: The comment wants to be properly formatted, and the braces want to be dropped.
Also please honor patch submission rules - they get sent _to_ the list, with maintainers _cc_-ed.
Jan
_______________________________________________
Xen-devel mailing list
[email protected]
https://lists.xenproject.org/mailman/listinfo/xen-devel
Quoted 18 lines · Jan Beulich
Quoted 4 lines
Quoted 1 line
Quoted 1 line · On 16.07.18 at 13:59, <[email protected]> wrote:
xen/arch/x86/tboot.c void tboot_shutdown(uint32_t shutdown_type) · line 399
Quoted 10 lines
xen/arch/x86/tboot.c +6
-1@@ -391,7 +391,12 @@ void tboot_shutdown(uint32_t shutdown_type)tboot_gen_xenheap_integrity (g_tboot_shared->s3_key, &xenheap_mac); } -write_ptbase (idle_vcpu[0 ]); +/* During early boot, we can be called by panic before idle_vcpu[0] is +* setup, but in that case we don't need to change page tables. */ +if ( idle_vcpu[0 ] !=INVALID_VCPU ) + { +write_ptbase (idle_vcpu[0 ]); + }There are two style issues here: The comment wants to be properly formatted, and the braces want to be dropped.
Quoted 2 lines
Also please honor patch submission rules - they get sent _to_ the list, with maintainers _cc_-ed.
Ok. Sorry for all the errors and thanks for the pointers.
Regards,
Jason
_______________________________________________
Xen-devel mailing list
[email protected]
https://lists.xenproject.org/mailman/listinfo/xen-devel