From nobody Sun Feb 8 05:37:19 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=reject dis=none) header.from=citrix.com ARC-Seal: i=1; a=rsa-sha256; t=1650890305; cv=none; d=zohomail.com; s=zohoarc; b=BQwBOV6DO8Bxa0e308r8+vbrRGIMrIrkkQVzJlwnOr+G/H6uug8jJ0dVkESKoKHbbmqAa8SCwymVFCoBEQyulW8UmlDTYCbz27+QziAxaieThKPrWCVOSZOsQ2AupQkFv4Qli+JuTr98nBka7PwIIf3nedNE1EfOEf0EzYzkqsQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1650890305; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=DKr4C1kBRH8TZqEVkeiV9v0Nkyc6OO1AbrP7usK2Ah4=; b=iIH3T4hGyqx67xyrebczb098TKOkZUm4ptWmgDcf+sVkv22RwTYWJ5l4i/QYjmqRVuqmIJgb0AMGKFgew2NnYg3XdZI1XcUWIFsnIzJG0OpD0KuFu2MaxvfoupxuBhu97ghNOxwgbQdM1O6cJwGoW7et/vL7ZsPgE2Y3BLVXCfE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 165089030535711.932993786998509; Mon, 25 Apr 2022 05:38:25 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.312874.530267 (Exim 4.92) (envelope-from ) id 1nixyO-0008Ru-4j; Mon, 25 Apr 2022 12:37:48 +0000 Received: by outflank-mailman (output) from mailman id 312874.530267; Mon, 25 Apr 2022 12:37:48 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nixyO-0008Rn-1D; Mon, 25 Apr 2022 12:37:48 +0000 Received: by outflank-mailman (input) for mailman id 312874; Mon, 25 Apr 2022 12:37:46 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nixyM-0008Rh-M7 for xen-devel@lists.xenproject.org; Mon, 25 Apr 2022 12:37:46 +0000 Received: from esa4.hc3370-68.iphmx.com (esa4.hc3370-68.iphmx.com [216.71.155.144]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id 80544ce1-c494-11ec-8fc2-03012f2f19d4; Mon, 25 Apr 2022 14:37:44 +0200 (CEST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 80544ce1-c494-11ec-8fc2-03012f2f19d4 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1650890264; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=XQJj0IseyZHMSZc/mrIZz/x+xkn7YoebrjeeAlWQNFo=; b=AOT8bLE98jYOT4GiLZL/n81GcFKzx14aHz+qAmSeFpC7Bl4HykchK0W1 ULXdyi7/8poYreWy17RiNNuxhqcth22yUUl92Atu3qh+sUAdDsrjFhSmo AIH6DqgV+q3c0RaB5TeZilmfNufmQv/y77iTT1GLJBPcnm7EHu+v2Or1d I=; Authentication-Results: esa4.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none X-SBRS: 5.1 X-MesageID: 72295449 X-Ironport-Server: esa4.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:64iRqa/eNYGP75oqzEnbDrUDbX6TJUtcMsCJ2f8bNWPcYEJGY0x3z WoZCGnQPamKMGTwL413YNvg8k9Uu8SBmocwQQVlpH08E34SpcT7XtnIdU2Y0wF+jyHgoOCLy +1EN7Es+ehtFie0Si+Fa+Sn9T8mvU2xbuKU5NTsY0idfic5DnZ54f5fs7Rh2NQw3YLkW1rlV e7a+KUzBnf0g1aYDUpMg06zgEsHUCPa4W5wUvQWPJinjXeG/5UnJMt3yZKZdhMUdrJ8DO+iL 9sv+Znilo/vE7XBPfv++lrzWhVirrc/pmFigFIOM0SpqkAqSiDfTs/XnRfTAKtao2zhojx/9 DlCncWIa144AYvho/0YVB99C3xyHLdi8oaSdBBTseTLp6HHW37lwvEoB0AqJ4wIvO1wBAmi9 9RBdmpLNErawbvrnvTrEYGAhex6RCXvFKoZtmtt0nfyCvE+TIqYa67L+cVZzHE7gcUm8fP2O JBDOGczMEWojxtnGEoWDsMOldeTtlLadBp9lwyTi7Y1/D2GpOB2+Oe0a4eEEjCQfu1XkVyfv Xnu5HniD1cRM9n34Riv/2+oh+TPtTjmQ49UH7q9ntZgjUeP3GUVBFsTXEGivPiiokekXpRUL El80hQpqa8+5Um6VO7XVhezoGOHlhMEUt8WGOo/gCmW0bbd6QudAmkCTxZCZcYguctwQiYlv neZktWsCTFxvbm9TXOG6qzSvT60ITISL2IJeWkDVwRty9v+pIA+iDrfQ9AlF7S65vXqHRngz jbMqzIx74j/luZSif/9pwqexWvx+N6ZFWbZ+zk7QEr81iEgdbGDSrex7F/dyO4dIKeDalO46 S1sd9el0MgCCpSElSqoSeoLHa206/vtDAAwkWKDDLF6qW3zpifLkZR4pWgneRw3appslSrBO he7hO9H2HNE0JJGh4dTapn5NcklxLOI+T/NBqGNNYomjnScmWa6EMBSiay4gjqFfKsEy/hX1 XKnnSGEVytyNEif5GDqL9rxKJdyrszE+UvdRIrg0zOs2qeEaXieRN8taQXTNr9ktfve8ViPr b6z0vdmLT0FCYUShQGNr+Yuwa0idyBnVfgaVeQKHgJ8HuaWMD54UKKAqV/QU4dkg75Uho/1E oKVASdlJK7ErSSfc22iMyk7AJu2BMYXhS9rbEQEYAfzs1B+MNnH0UvqX8ZuFVXR3Lc4lqAco jhsU5joP8mjvRyapWRANcWt8N0KmdbCrVvmAhdJqQMXJ/ZILzElMPe4Fucz3EHi1haKiPY= IronPort-HdrOrdr: A9a23:CFfzO6Oqtr7yKsBcTs2jsMiBIKoaSvp037Eqv3oedfUzSL3+qy nOpoV+6faaslYssR0b9exoW5PwJE80l6QFgrX5VI3KNGKN1VdARLsSi7cKqAeAJ8SRzIFgPN 9bAspDNOE= X-IronPort-AV: E=Sophos;i="5.90,288,1643691600"; d="scan'208";a="72295449" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper , George Dunlap , Jan Beulich , "Stefano Stabellini" , Wei Liu , Julien Grall , Juergen Gross , =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= , "Volodymyr Babchuk" , Bertrand Marquis Subject: [PATCH v3] x86: Fix XEN_DOMCTL_gdbsx_guestmemio crash Date: Mon, 25 Apr 2022 13:37:17 +0100 Message-ID: <20220425123717.18876-1-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @citrix.com) X-ZM-MESSAGEID: 1650890307569100001 When CONFIG_GDBSX is compiled out, iommu_do_domctl() falls over a NULL pointer. One of several bugs here is known-but-compiled-out subops falling into the default chain and hitting unrelated logic. Remove the CONFIG_GDBSX ifdefary in arch_do_domctl() by implementing gdbsx_domctl() and moving the logic across. As minor cleanup, * gdbsx_guest_mem_io() can become static * Remove opencoding of domain_vcpu() and %pd Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- CC: George Dunlap CC: Jan Beulich CC: Stefano Stabellini CC: Wei Liu CC: Julien Grall CC: Juergen Gross CC: Roger Pau Monn=C3=A9 CC: Volodymyr Babchuk CC: Bertrand Marquis v2: * Implement the "split into new function" approach from the RFC. v3: * Switch to int. * Insert missing break. * static inline for stub. --- xen/arch/x86/domctl.c | 61 +--------------------------------- xen/arch/x86/gdbsx.c | 70 ++++++++++++++++++++++++++++++++++++= +++- xen/arch/x86/include/asm/gdbsx.h | 16 +++++++-- 3 files changed, 83 insertions(+), 64 deletions(-) diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index c20ab4352715..9131acb8a230 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -816,71 +816,12 @@ long arch_do_domctl( } #endif =20 -#ifdef CONFIG_GDBSX case XEN_DOMCTL_gdbsx_guestmemio: - ret =3D gdbsx_guest_mem_io(d, &domctl->u.gdbsx_guest_memio); - if ( !ret ) - copyback =3D true; - break; - case XEN_DOMCTL_gdbsx_pausevcpu: - { - struct vcpu *v; - - ret =3D -EBUSY; - if ( !d->controller_pause_count ) - break; - ret =3D -EINVAL; - if ( domctl->u.gdbsx_pauseunp_vcpu.vcpu >=3D d->max_vcpus || - (v =3D d->vcpu[domctl->u.gdbsx_pauseunp_vcpu.vcpu]) =3D=3D NU= LL ) - break; - ret =3D vcpu_pause_by_systemcontroller(v); - break; - } - case XEN_DOMCTL_gdbsx_unpausevcpu: - { - struct vcpu *v; - - ret =3D -EBUSY; - if ( !d->controller_pause_count ) - break; - ret =3D -EINVAL; - if ( domctl->u.gdbsx_pauseunp_vcpu.vcpu >=3D d->max_vcpus || - (v =3D d->vcpu[domctl->u.gdbsx_pauseunp_vcpu.vcpu]) =3D=3D NU= LL ) - break; - ret =3D vcpu_unpause_by_systemcontroller(v); - if ( ret =3D=3D -EINVAL ) - printk(XENLOG_G_WARNING - "WARN: d%d attempting to unpause %pv which is not pause= d\n", - currd->domain_id, v); - break; - } - case XEN_DOMCTL_gdbsx_domstatus: - { - struct vcpu *v; - - domctl->u.gdbsx_domstatus.vcpu_id =3D -1; - domctl->u.gdbsx_domstatus.paused =3D d->controller_pause_count > 0; - if ( domctl->u.gdbsx_domstatus.paused ) - { - for_each_vcpu ( d, v ) - { - if ( v->arch.gdbsx_vcpu_event ) - { - domctl->u.gdbsx_domstatus.vcpu_id =3D v->vcpu_id; - domctl->u.gdbsx_domstatus.vcpu_ev =3D - v->arch.gdbsx_vcpu_event; - v->arch.gdbsx_vcpu_event =3D 0; - break; - } - } - } - copyback =3D true; + ret =3D gdbsx_domctl(d, domctl, ©back); break; - } -#endif =20 case XEN_DOMCTL_setvcpuextstate: case XEN_DOMCTL_getvcpuextstate: diff --git a/xen/arch/x86/gdbsx.c b/xen/arch/x86/gdbsx.c index 6ef46e8ea77d..21442f5dff1a 100644 --- a/xen/arch/x86/gdbsx.c +++ b/xen/arch/x86/gdbsx.c @@ -152,7 +152,8 @@ static unsigned int dbg_rw_guest_mem(struct domain *dp,= unsigned long addr, return len; } =20 -int gdbsx_guest_mem_io(struct domain *d, struct xen_domctl_gdbsx_memio *io= p) +static int gdbsx_guest_mem_io( + struct domain *d, struct xen_domctl_gdbsx_memio *iop) { if ( d && !d->is_dying ) { @@ -178,6 +179,73 @@ void domain_pause_for_debugger(void) send_global_virq(VIRQ_DEBUGGER); } =20 +int gdbsx_domctl(struct domain *d, struct xen_domctl *domctl, bool *copyba= ck) +{ + struct vcpu *v; + int ret; + + switch ( domctl->cmd ) + { + case XEN_DOMCTL_gdbsx_guestmemio: + ret =3D gdbsx_guest_mem_io(d, &domctl->u.gdbsx_guest_memio); + if ( !ret ) + *copyback =3D true; + break; + + case XEN_DOMCTL_gdbsx_pausevcpu: + ret =3D -EBUSY; + if ( !d->controller_pause_count ) + break; + ret =3D -EINVAL; + if ( (v =3D domain_vcpu(d, domctl->u.gdbsx_pauseunp_vcpu.vcpu)) = =3D=3D NULL ) + break; + ret =3D vcpu_pause_by_systemcontroller(v); + break; + + case XEN_DOMCTL_gdbsx_unpausevcpu: + ret =3D -EBUSY; + if ( !d->controller_pause_count ) + break; + ret =3D -EINVAL; + if ( (v =3D domain_vcpu(d, domctl->u.gdbsx_pauseunp_vcpu.vcpu)) = =3D=3D NULL ) + break; + ret =3D vcpu_unpause_by_systemcontroller(v); + if ( ret =3D=3D -EINVAL ) + printk(XENLOG_G_WARNING + "WARN: %pd attempting to unpause %pv which is not pause= d\n", + current->domain, v); + break; + + case XEN_DOMCTL_gdbsx_domstatus: + ret =3D 0; + domctl->u.gdbsx_domstatus.vcpu_id =3D -1; + domctl->u.gdbsx_domstatus.paused =3D d->controller_pause_count > 0; + if ( domctl->u.gdbsx_domstatus.paused ) + { + for_each_vcpu ( d, v ) + { + if ( v->arch.gdbsx_vcpu_event ) + { + domctl->u.gdbsx_domstatus.vcpu_id =3D v->vcpu_id; + domctl->u.gdbsx_domstatus.vcpu_ev =3D + v->arch.gdbsx_vcpu_event; + v->arch.gdbsx_vcpu_event =3D 0; + break; + } + } + } + *copyback =3D true; + break; + + default: + ASSERT_UNREACHABLE(); + ret =3D -ENOSYS; + break; + } + + return ret; +} + /* * Local variables: * mode: C diff --git a/xen/arch/x86/include/asm/gdbsx.h b/xen/arch/x86/include/asm/gd= bsx.h index 938eb74e2e25..e906be9ea318 100644 --- a/xen/arch/x86/include/asm/gdbsx.h +++ b/xen/arch/x86/include/asm/gdbsx.h @@ -2,18 +2,28 @@ #ifndef __X86_GDBX_H__ #define __X86_GDBX_H__ =20 -#ifdef CONFIG_GDBSX +#include =20 struct domain; -struct xen_domctl_gdbsx_memio; +struct xen_domctl; =20 -int gdbsx_guest_mem_io(struct domain *d, struct xen_domctl_gdbsx_memio *io= p); +#ifdef CONFIG_GDBSX =20 void domain_pause_for_debugger(void); =20 +int gdbsx_domctl(struct domain *d, struct xen_domctl *domctl, bool *copyba= ck); + #else =20 +#include + static inline void domain_pause_for_debugger(void) {} =20 +static inline int gdbsx_domctl( + struct domain *d, struct xen_domctl *domctl, bool *copyback) +{ + return -ENOSYS; +} + #endif /* CONFIG_GDBSX */ #endif /* __X86_GDBX_H__ */ --=20 2.11.0