* [PATCH v2] tboot: Avoid recursive fault in early boot panic with tboot
@ 2018-07-19 10:39 Jason Andryuk
2018-07-19 10:55 ` Jan Beulich
2018-08-27 16:43 ` Jason Andryuk
0 siblings, 2 replies; 4+ messages in thread
From: Jason Andryuk @ 2018-07-19 10:39 UTC (permalink / raw)
To: xen-devel; +Cc: Shane Wang, Andrew Cooper, Gang Wei, Jan Beulich, Jason Andryuk
If panic is called before init_idle_domain on a tboot-launched system,
then Xen recursively faults in write_ptbase as seen below.
(XEN) [<ffff82d080286690>] write_ptbase+0/0x10
(XEN) [<ffff82d0802c4c3b>] tboot_shutdown+0x6b/0x260
(XEN) [<ffff82d08029ddac>] machine_restart+0xac/0x2d0
(XEN) [<ffff82d080286690>] write_ptbase+0/0x10
(XEN) [<ffff82d0802446c1>] panic+0x111/0x120
(XEN) [<ffff82d0802a51c1>] do_general_protection+0x171/0x1f0
(XEN) [<ffff82d080287a82>] mm.c#virt_to_xen_l2e+0x12/0x1c0
(XEN) [<ffff82d080354720>] x86_64/entry.S#handle_exception_saved+0x66/0xa4
(XEN) [<ffff82d080286690>] write_ptbase+0/0x10
(XEN) [<ffff82d0802c4c3b>] tboot_shutdown+0x6b/0x260
(XEN) [<ffff82d08029ddac>] machine_restart+0xac/0x2d0
(XEN) [<ffff82d0802446c1>] panic+0x111/0x120
(XEN) [<ffff82d0803c11a0>] setup.c#bootstrap_map+0/0x11a
(XEN) [<ffff82d0803b82a0>] flask_op.c#parse_flask_param+0/0xb0
(XEN) [<ffff82d0803c11a0>] setup.c#bootstrap_map+0/0x11a
(XEN) [<ffff82d0803b6f6c>] xsm_multiboot_init+0x7c/0xb0
(XEN) [<ffff82d0803c34bb>] __start_xen+0x1d2b/0x2da0
(XEN) [<ffff82d0802000f3>] __high_start+0x53/0x60
idle_vcpu[0] is still poisoned with INVALID_VCPU, so write_ptbase faults
dereferencing the pointer. This fault calls panic and recurses through
the same code path.
If tboot_shutdown is called while idle_vcpu[0] == INVALID_VCPU, then we
are still operating with the initial page tables. Therefore changing
page tables with write_ptbase is unnecessary.
An easy way to reproduce this is to use tboot to launch an XSM-enabled
Xen without an XSM policy.
Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
---
v2: Correct comment and brace style
---
xen/arch/x86/tboot.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/xen/arch/x86/tboot.c b/xen/arch/x86/tboot.c
index fb4616ae83..d5a5292d7e 100644
--- a/xen/arch/x86/tboot.c
+++ b/xen/arch/x86/tboot.c
@@ -391,7 +391,12 @@ void tboot_shutdown(uint32_t shutdown_type)
tboot_gen_xenheap_integrity(g_tboot_shared->s3_key, &xenheap_mac);
}
- write_ptbase(idle_vcpu[0]);
+ /*
+ * During early boot, we can be called by panic before idle_vcpu[0] is
+ * setup, but in that case we don't need to change page tables.
+ */
+ if ( idle_vcpu[0] != INVALID_VCPU )
+ write_ptbase(idle_vcpu[0]);
((void(*)(void))(unsigned long)g_tboot_shared->shutdown_entry)();
--
2.17.1
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] tboot: Avoid recursive fault in early boot panic with tboot
2018-07-19 10:39 [PATCH v2] tboot: Avoid recursive fault in early boot panic with tboot Jason Andryuk
@ 2018-07-19 10:55 ` Jan Beulich
2018-08-27 16:43 ` Jason Andryuk
1 sibling, 0 replies; 4+ messages in thread
From: Jan Beulich @ 2018-07-19 10:55 UTC (permalink / raw)
To: Jason Andryuk; +Cc: Andrew Cooper, xen-devel, Gang Wei, Shane Wang
>>> On 19.07.18 at 12:39, <jandryuk@gmail.com> wrote:
> If panic is called before init_idle_domain on a tboot-launched system,
> then Xen recursively faults in write_ptbase as seen below.
>
> (XEN) [<ffff82d080286690>] write_ptbase+0/0x10
> (XEN) [<ffff82d0802c4c3b>] tboot_shutdown+0x6b/0x260
> (XEN) [<ffff82d08029ddac>] machine_restart+0xac/0x2d0
> (XEN) [<ffff82d080286690>] write_ptbase+0/0x10
> (XEN) [<ffff82d0802446c1>] panic+0x111/0x120
> (XEN) [<ffff82d0802a51c1>] do_general_protection+0x171/0x1f0
> (XEN) [<ffff82d080287a82>] mm.c#virt_to_xen_l2e+0x12/0x1c0
> (XEN) [<ffff82d080354720>] x86_64/entry.S#handle_exception_saved+0x66/0xa4
> (XEN) [<ffff82d080286690>] write_ptbase+0/0x10
> (XEN) [<ffff82d0802c4c3b>] tboot_shutdown+0x6b/0x260
> (XEN) [<ffff82d08029ddac>] machine_restart+0xac/0x2d0
> (XEN) [<ffff82d0802446c1>] panic+0x111/0x120
> (XEN) [<ffff82d0803c11a0>] setup.c#bootstrap_map+0/0x11a
> (XEN) [<ffff82d0803b82a0>] flask_op.c#parse_flask_param+0/0xb0
> (XEN) [<ffff82d0803c11a0>] setup.c#bootstrap_map+0/0x11a
> (XEN) [<ffff82d0803b6f6c>] xsm_multiboot_init+0x7c/0xb0
> (XEN) [<ffff82d0803c34bb>] __start_xen+0x1d2b/0x2da0
> (XEN) [<ffff82d0802000f3>] __high_start+0x53/0x60
>
> idle_vcpu[0] is still poisoned with INVALID_VCPU, so write_ptbase faults
> dereferencing the pointer. This fault calls panic and recurses through
> the same code path.
>
> If tboot_shutdown is called while idle_vcpu[0] == INVALID_VCPU, then we
> are still operating with the initial page tables. Therefore changing
> page tables with write_ptbase is unnecessary.
>
> An easy way to reproduce this is to use tboot to launch an XSM-enabled
> Xen without an XSM policy.
>
> Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] tboot: Avoid recursive fault in early boot panic with tboot
2018-07-19 10:39 [PATCH v2] tboot: Avoid recursive fault in early boot panic with tboot Jason Andryuk
2018-07-19 10:55 ` Jan Beulich
@ 2018-08-27 16:43 ` Jason Andryuk
2018-08-28 2:41 ` Wei, Gang
1 sibling, 1 reply; 4+ messages in thread
From: Jason Andryuk @ 2018-08-27 16:43 UTC (permalink / raw)
To: xen-devel, Gang Wei, Shane Wang; +Cc: Andrew Cooper, Jan Beulich
On Thu, Jul 19, 2018 at 6:39 AM Jason Andryuk <jandryuk@gmail.com> wrote:
>
> If panic is called before init_idle_domain on a tboot-launched system,
> then Xen recursively faults in write_ptbase as seen below.
>
> (XEN) [<ffff82d080286690>] write_ptbase+0/0x10
> (XEN) [<ffff82d0802c4c3b>] tboot_shutdown+0x6b/0x260
> (XEN) [<ffff82d08029ddac>] machine_restart+0xac/0x2d0
> (XEN) [<ffff82d080286690>] write_ptbase+0/0x10
> (XEN) [<ffff82d0802446c1>] panic+0x111/0x120
> (XEN) [<ffff82d0802a51c1>] do_general_protection+0x171/0x1f0
> (XEN) [<ffff82d080287a82>] mm.c#virt_to_xen_l2e+0x12/0x1c0
> (XEN) [<ffff82d080354720>] x86_64/entry.S#handle_exception_saved+0x66/0xa4
> (XEN) [<ffff82d080286690>] write_ptbase+0/0x10
> (XEN) [<ffff82d0802c4c3b>] tboot_shutdown+0x6b/0x260
> (XEN) [<ffff82d08029ddac>] machine_restart+0xac/0x2d0
> (XEN) [<ffff82d0802446c1>] panic+0x111/0x120
> (XEN) [<ffff82d0803c11a0>] setup.c#bootstrap_map+0/0x11a
> (XEN) [<ffff82d0803b82a0>] flask_op.c#parse_flask_param+0/0xb0
> (XEN) [<ffff82d0803c11a0>] setup.c#bootstrap_map+0/0x11a
> (XEN) [<ffff82d0803b6f6c>] xsm_multiboot_init+0x7c/0xb0
> (XEN) [<ffff82d0803c34bb>] __start_xen+0x1d2b/0x2da0
> (XEN) [<ffff82d0802000f3>] __high_start+0x53/0x60
>
> idle_vcpu[0] is still poisoned with INVALID_VCPU, so write_ptbase faults
> dereferencing the pointer. This fault calls panic and recurses through
> the same code path.
>
> If tboot_shutdown is called while idle_vcpu[0] == INVALID_VCPU, then we
> are still operating with the initial page tables. Therefore changing
> page tables with write_ptbase is unnecessary.
>
> An easy way to reproduce this is to use tboot to launch an XSM-enabled
> Xen without an XSM policy.
>
> Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
Ping, Shane and Gang?
> ---
> v2: Correct comment and brace style
> ---
> xen/arch/x86/tboot.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/xen/arch/x86/tboot.c b/xen/arch/x86/tboot.c
> index fb4616ae83..d5a5292d7e 100644
> --- a/xen/arch/x86/tboot.c
> +++ b/xen/arch/x86/tboot.c
> @@ -391,7 +391,12 @@ void tboot_shutdown(uint32_t shutdown_type)
> tboot_gen_xenheap_integrity(g_tboot_shared->s3_key, &xenheap_mac);
> }
>
> - write_ptbase(idle_vcpu[0]);
> + /*
> + * During early boot, we can be called by panic before idle_vcpu[0] is
> + * setup, but in that case we don't need to change page tables.
> + */
> + if ( idle_vcpu[0] != INVALID_VCPU )
> + write_ptbase(idle_vcpu[0]);
>
> ((void(*)(void))(unsigned long)g_tboot_shared->shutdown_entry)();
>
> --
> 2.17.1
>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] tboot: Avoid recursive fault in early boot panic with tboot
2018-08-27 16:43 ` Jason Andryuk
@ 2018-08-28 2:41 ` Wei, Gang
0 siblings, 0 replies; 4+ messages in thread
From: Wei, Gang @ 2018-08-28 2:41 UTC (permalink / raw)
To: Jason Andryuk; +Cc: Wang, Shane, Andrew Cooper, Jan Beulich, xen-devel
> On Aug 28, 2018, at 12:44 AM, Jason Andryuk <jandryuk@gmail.com> wrote:
>
>> On Thu, Jul 19, 2018 at 6:39 AM Jason Andryuk <jandryuk@gmail.com> wrote:
>>
>> If panic is called before init_idle_domain on a tboot-launched system,
>> then Xen recursively faults in write_ptbase as seen below.
>>
>> (XEN) [<ffff82d080286690>] write_ptbase+0/0x10
>> (XEN) [<ffff82d0802c4c3b>] tboot_shutdown+0x6b/0x260
>> (XEN) [<ffff82d08029ddac>] machine_restart+0xac/0x2d0
>> (XEN) [<ffff82d080286690>] write_ptbase+0/0x10
>> (XEN) [<ffff82d0802446c1>] panic+0x111/0x120
>> (XEN) [<ffff82d0802a51c1>] do_general_protection+0x171/0x1f0
>> (XEN) [<ffff82d080287a82>] mm.c#virt_to_xen_l2e+0x12/0x1c0
>> (XEN) [<ffff82d080354720>] x86_64/entry.S#handle_exception_saved+0x66/0xa4
>> (XEN) [<ffff82d080286690>] write_ptbase+0/0x10
>> (XEN) [<ffff82d0802c4c3b>] tboot_shutdown+0x6b/0x260
>> (XEN) [<ffff82d08029ddac>] machine_restart+0xac/0x2d0
>> (XEN) [<ffff82d0802446c1>] panic+0x111/0x120
>> (XEN) [<ffff82d0803c11a0>] setup.c#bootstrap_map+0/0x11a
>> (XEN) [<ffff82d0803b82a0>] flask_op.c#parse_flask_param+0/0xb0
>> (XEN) [<ffff82d0803c11a0>] setup.c#bootstrap_map+0/0x11a
>> (XEN) [<ffff82d0803b6f6c>] xsm_multiboot_init+0x7c/0xb0
>> (XEN) [<ffff82d0803c34bb>] __start_xen+0x1d2b/0x2da0
>> (XEN) [<ffff82d0802000f3>] __high_start+0x53/0x60
>>
>> idle_vcpu[0] is still poisoned with INVALID_VCPU, so write_ptbase faults
>> dereferencing the pointer. This fault calls panic and recurses through
>> the same code path.
>>
>> If tboot_shutdown is called while idle_vcpu[0] == INVALID_VCPU, then we
>> are still operating with the initial page tables. Therefore changing
>> page tables with write_ptbase is unnecessary.
>>
>> An easy way to reproduce this is to use tboot to launch an XSM-enabled
>> Xen without an XSM policy.
>>
>> Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
>
> Ping, Shane and Gang?
Acked-by: Gang Wei <gang.wei@intel.com>
>
>> ---
>> v2: Correct comment and brace style
>> ---
>> xen/arch/x86/tboot.c | 7 ++++++-
>> 1 file changed, 6 insertions(+), 1 deletion(-)
>>
>> diff --git a/xen/arch/x86/tboot.c b/xen/arch/x86/tboot.c
>> index fb4616ae83..d5a5292d7e 100644
>> --- a/xen/arch/x86/tboot.c
>> +++ b/xen/arch/x86/tboot.c
>> @@ -391,7 +391,12 @@ void tboot_shutdown(uint32_t shutdown_type)
>> tboot_gen_xenheap_integrity(g_tboot_shared->s3_key, &xenheap_mac);
>> }
>>
>> - write_ptbase(idle_vcpu[0]);
>> + /*
>> + * During early boot, we can be called by panic before idle_vcpu[0] is
>> + * setup, but in that case we don't need to change page tables.
>> + */
>> + if ( idle_vcpu[0] != INVALID_VCPU )
>> + write_ptbase(idle_vcpu[0]);
>>
>> ((void(*)(void))(unsigned long)g_tboot_shared->shutdown_entry)();
>>
>> --
>> 2.17.1
>>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-08-28 2:41 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-07-19 10:39 [PATCH v2] tboot: Avoid recursive fault in early boot panic with tboot Jason Andryuk
2018-07-19 10:55 ` Jan Beulich
2018-08-27 16:43 ` Jason Andryuk
2018-08-28 2:41 ` Wei, Gang
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.