From nobody Thu Jul 23 21:17:01 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; arc=pass (i=1 dmarc=pass fromdomain=epam.com); dmarc=pass(p=quarantine dis=none) header.from=epam.com ARC-Seal: i=2; a=rsa-sha256; t=1784056663; cv=pass; d=zohomail.com; s=zohoarc; b=Y3COakRQNuUxoCc1cJnO2L9w0QM2xTH4DiQ2qyxILe5B76VoMe/hPEoIPCLIc33qg9Gm7V06BESJ0VuUdzmY62kpyFnYLnRgO4vuaOnYii8dwFo4kUQj17fGyq2xL4KfbGGDx1FMQ4qNx/LxT/JXHFHUWjqw3nOxrgPbbsGCF+g= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784056663; h=Content-ID:Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=OX9/iBkmR8Fc4Q3+JgjgX70rmFfBOjUy2qweTSgBLUE=; b=YHU97dNxczBv8DlPp13K4O32HTRV6TewcuPLZKV4KYKKGbbFI7kQN5YxycZuOfaJVV39IP3Dqlt3nkYWtJE6zjlld1XyZbKyGx33kIc5GLsigOEKb6ziIw5G4j1Il6nkoM4USOy76ObPhI8ZZHsp1eu/NdS1W5IrQdDBi3gOxhQ= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; arc=pass (i=1 dmarc=pass fromdomain=epam.com); dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1784056662919468.66668511479736; Tue, 14 Jul 2026 12:17:42 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1362507.1614335 (Exim 4.92) (envelope-from ) id 1wjicq-0003FV-Vl; Tue, 14 Jul 2026 19:17:04 +0000 Received: by outflank-mailman (output) from mailman id 1362507.1614335; Tue, 14 Jul 2026 19:17:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjicq-0003FO-T7; Tue, 14 Jul 2026 19:17:04 +0000 Received: by outflank-mailman (input) for mailman id 1362507; Tue, 14 Jul 2026 19:17:03 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjicp-0003FI-8A for xen-devel@lists.xenproject.org; Tue, 14 Jul 2026 19:17:03 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wjico-008iaS-L6 for xen-devel@lists.xenproject.org; Tue, 14 Jul 2026 21:17:02 +0200 Received: from [10.42.69.11] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a568b02-bab6-0a2a0a5309dd-0a2a450b8aa2-30 for ; Tue, 14 Jul 2026 21:17:02 +0200 Received: from [52.101.84.139] (helo=DB3PR0202CU003.outbound.protection.outlook.com) by tlsNG-42698a.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6a568b2e-b7e8-0a2a450b0019-3465548b66df-3 for ; Tue, 14 Jul 2026 21:17:02 +0200 Received: from AM4PR03MB11152.eurprd03.prod.outlook.com (2603:10a6:20b:6cc::22) by DU4PR03MB10718.eurprd03.prod.outlook.com (2603:10a6:10:592::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9; Tue, 14 Jul 2026 19:16:56 +0000 Received: from AM4PR03MB11152.eurprd03.prod.outlook.com ([fe80::bbbf:5b9b:1043:4510]) by AM4PR03MB11152.eurprd03.prod.outlook.com ([fe80::bbbf:5b9b:1043:4510%5]) with mapi id 15.21.0202.018; Tue, 14 Jul 2026 19:16:56 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=epam.com header.i="@epam.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Vy0KgrvToQnQK/0YyOvNYVazTILleNM7mlr35jUBWh+Nb89kF3LXudt1CIuucOKihgECyhDTS1qYWfewOTyTn9mNDPR/M03cJT9FAtXfZ0Cb6vrDO+keIjjSJB5d2ih8+ItkYB7JKxyL5Rsc/Mk2GrZ5Kh9Wow6x/o3fdEAlLWB0e4w4XokOT7T5pyqIPx8cEmRozHxbC47PaYxZy0aLFgAjs0Ien/dQD+6gfXgt9JnJr0ZqOZfXt34QVqfDik/0ekODIl52dHkceE2BzPQCpLwJSJdZzFnyDmiZWlXR8/l21AslGZDZ54ATGzqJWkO072b2WDd2WY+Zv/DvQvbeEw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=OX9/iBkmR8Fc4Q3+JgjgX70rmFfBOjUy2qweTSgBLUE=; b=Y8lGRtMFdvjN2JkNfqkT0lHm0Rrcmqn7+bRLuyr02fBjwjm991qrSxFqB7N7YYBLkVJm9uEXaxL7tDit1iK7lp2QWPNj5pJExdR7I0wYSzsG5soM3nuZnY4cgVjbHfilXHi767ft6paqK5Yn+jhA4uT32/pgeHmTJYuDYSkUuD3ZFYvF8alUtLJbaJ+1dfykdZlvpEkul4s1QX2CKxtALX8Vkqgqfk1SrIOQW83B9GSBbnxiGNve24B5AUxEih/7HljOAKezkgrY1xre+u77mi12y9HaAzfI36JBo61ONuKP1TxjFNFMx6N2zJzvH+q2u2OIBSl65mSy5adFD23r+g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=epam.com; dmarc=pass action=none header.from=epam.com; dkim=pass header.d=epam.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=epam.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OX9/iBkmR8Fc4Q3+JgjgX70rmFfBOjUy2qweTSgBLUE=; b=hEWvaXlPEAyz/GL2Z3iPmb7AqBC1QbwkHloCmdy9clWuU3QFtwLvo5pMbbnNxoWH267cQClfcuya2fqAv1V/rsCCzwY3s0pGXWC/vU32cupUbXNX7HRL1c2N1TzBt8w4sOEWOznU5xFKBArrKPsYa/KGKAy+GMhPgy6oX6TRq5hML+YYFa4rGdrDgJG6G128Kj41A28pVaUIH0ciiPymH74kYY5J51UFYeBkvLMfziIh1YH4+BmG8MUZCd290hbp4RNaeDQKPrjomPmv8XfUKUMhqNULVBA8a3KN0B5hZnwwpzQoMsQUB49kV4BLpDqYVrlJJ1HnHoc2CRMYaeSfdw== From: Oleksandr Tyshchenko To: "xen-devel@lists.xenproject.org" CC: Stefano Stabellini , Julien Grall , Bertrand Marquis , Michal Orzel , Volodymyr Babchuk , Ayan Kumar Halder Subject: [PATCH] xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() Thread-Topic: [PATCH] xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() Thread-Index: AQHdE8VVAWU+M64fN0eM/0vNp09wjA== Date: Tue, 14 Jul 2026 19:16:56 +0000 Message-ID: <20260714191655.155717-1-oleksandr_tyshchenko@epam.com> Accept-Language: en-US, ru-RU Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=epam.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: AM4PR03MB11152:EE_|DU4PR03MB10718:EE_ x-ms-office365-filtering-correlation-id: 5256d075-fdcc-402d-d795-08dee1dc7868 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|376014|366016|23010399003|1800799024|42112799006|56012099006|5023799004|11063799006|3023799007|38070700021|18002099003|6133799003; x-microsoft-antispam-message-info: qYfsEnuFw+3DfnEUaGE5WCUnj04OofBnI29xzNg2WNe7JqB5xtrog5ssWRMhmyQSH5ocVp2wkhTEFG7/2QmZXE6BlFEQX932j6m3y3TWwQEHuLxRTCSVU2qwrKqciA4/pm0KUBIhyQN/A/y0fD0RsV7+yXrEQdv50UHeWZwkuRD0dmmArt9BDVKJK3D/laled/AMXqi7sfyb3Pftrd8hqVCpOhoDa1+07oLoj1Kv+L9GxKIKOEFn8gfaMHkINBiodyQXRBErwDT95t5abY/I59PB+d1Tnj9UeNCTcgOU6NTq+VHD8dl/BjCxjOs0zoYqY+qWRZYj7WJ1SFd44Yne9dp94cFDCcIPpunEiTWIFUSAQbLKhJRKcAAMrpMVb8uTzSS8bM5hv+voZnfcnbFyoBceQRdKGrk1RBSYNpxKGhmOIg8I9g1tWKXrRcRTJtKa8F4s/q//9dr7OVxtRaZ5mBXtE9cS/DaLTXdiiRwfOKqgLIJUpt6x59k/sbHjc6KWCjNgNZaW5Qi8xRaW9+Iw6fZnj90J3RfOlEGJO3JGVwnwK7oEGZ7C83RR5HQ1bwGIxRkGuPOcwJHG226ZzgL6yp89CbmtbEWKu6tOfpjIShXzYnRoRP5Z9tHrCi4vuvxEQYfqUDvlv3oQ0nwKAwrz9sAmZHkPeQ9S23NiHcaOEaUppqJjqa8Go7zhi1hKU+x96abspQB0uyC/fdQ7RvK2h03XTewqefXJjn5X8BIFJlk= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM4PR03MB11152.eurprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(23010399003)(1800799024)(42112799006)(56012099006)(5023799004)(11063799006)(3023799007)(38070700021)(18002099003)(6133799003);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?dkw0YjJTVmVaWVI3MWtJSHRqWkN2bTAza2xlOHdtOVlBdTI2c0xCTmRTdU1u?= =?utf-8?B?NGpva2Q3c05tWHpNTGxKbmhsQ3NUUUNVUnJSQ2JYUnpWR211V0lKaG9aM2U3?= =?utf-8?B?L09QQ1o2UUdXYmtaZU02QWx6UWxicDhoYzM5SjVDazV3KzFsZS9BT21Mbm1s?= =?utf-8?B?d01HOVpPZXcyZEZrM0V5Y0I3YkU1bDdkbEUzSGhHak9Obm9MRXF2NHhrVllv?= =?utf-8?B?L1krdUd5ZjlPdHYyWDAxcFQwNnhZcExranNxVXhyenNsYndpNG1ZTWFVUUc5?= =?utf-8?B?a29ZOU0zZlRWNXRxQVZBSnZabVNMR0MyalljNDBZeVQ2SitBQW5WWFlkaVJU?= =?utf-8?B?RWhuRnpPQmhuRkU1aXZOTVdDZmk2WEk0QVh1R1FvTU4yUGdaWmZVUk9XbWlE?= =?utf-8?B?UVdPL2NPbGJmTUd0NXp5Q2pGQ0xheFZhaVVsODJRaGtTU2g0VkVwOWNEVWVI?= =?utf-8?B?aTFveldmcWtFWGxmUktmTWFtb1FpUHNsMlE5YXo4QW83L3lKOHpqVy84cXhY?= =?utf-8?B?NHVpcU5QUnkxanU3Z211YWFMUVdHK3FSa1p3OW1ZYTNyUEZWaFlnUmpxTVdW?= =?utf-8?B?WnViOEdHMTh1eFI5T2hHYnpMOUZPS2RCSDZrSGJ3UTd4ZHZod25TakRXcmhH?= =?utf-8?B?YmtZY3Y3TEs3V1Rjblh4eU5PVGJDWEZrV0N4Q211OEI1eWFNUXZzTDZCVTdX?= =?utf-8?B?UU40bXdUenRHODRkZFdyUGpDNlIzdERsVkVzVkdPY0lJMGFtYTE0djNDQTZN?= =?utf-8?B?cFE2cVp1UitIOCtlTEVJZ2k1WTk1eUQvaTdLeVRvRUJxWm5OYWp4d3BwbTcz?= =?utf-8?B?cDFmUFZvZ0pkM1FiWjk0SGRXWlloais2QWN3VGMrQVZ1VGp2a2IxQmVpSDJC?= =?utf-8?B?K1ZTQ2s0TlYzOFo2OEdYYWUyWU5uVWdkbTdMM0RKdmJaOEc3endsM24yRHp1?= =?utf-8?B?MjA2RXhjZEN1c21pUEk2b2djMHBzL2dWTFFCejFVMWx2TlU0Nmo5Sk9nS0Ja?= =?utf-8?B?NVNJSDYzUUxFWEM2UjBVcmlsZ2hmUXA3OEF6ZTYvcExQTlV5L0Z2WGUxc0cr?= =?utf-8?B?T1g5UFFNV0d6N1J6Mlk4d0JiRkFHMEZ3VjR2UFdSYkZtV3RlRExSeW83Y21y?= =?utf-8?B?TzZQdkdiQ2pDdHV1ZEg4L2wvdGs1M3MvZXRMbjQ0dFZkbFRqQXY0M0ZSNDZQ?= =?utf-8?B?QVZNUktqV1VGQVVZR3JjTHFXVmc1djNqRGR2TXJoUjB2RzJ5T2psOTlrR21o?= =?utf-8?B?bVZ0cDdBLzRJRzBGYlJrZS8wbXhSb2hMZjdLR0lYTnU5NGlROWh3RUR4dlBt?= =?utf-8?B?M2dYVEU0WW1LMWsyOVNqeWVNVEdFbmlhVzN1UzZpK1FrTVlVY29PUWw0YUhk?= =?utf-8?B?S24xWHlOUkdDbS9sTVJrRHg3UVFqa0thYnRVZDBVYSsyQ1hoTTRSWlhyQVZY?= =?utf-8?B?bmhJMkpZRU5NZEs2dmpWWTBaYzljb2lxU3VjQWUyNDZBRHRLUTlpTTlPb28w?= =?utf-8?B?WmIrY1N5dnVLdGU1clpIMWhJZHF1KzRRWURDRUlYTUR4NFMxM0E3VXNtdEk0?= =?utf-8?B?bVhiWkppYUdwVFFLYk01a2g0MnJ4WXFvYkJFTld5YUtmWlhHVXVQNnFhNitD?= =?utf-8?B?TXg4S0pMR3dMOGQvbE0vcCtXQVpjamNMNUxtSUErZWd4MDJJVktaVjFPUzJN?= =?utf-8?B?R2NEOEZTNER1ZytMVXFNY204OG83K0lNejM4MHRBbGtzMWUzUFdQMTRDQ1ps?= =?utf-8?B?ODkrTHBsQ05sam11VmV5V1VjU2pNUFpkVXBsb1RUMWIyZEVPSExMRzZMcG9F?= =?utf-8?B?YXczUklwWjVKNlQwaWJ2Q01hajdFdjhWYmdaeTFzTmF0YUNselI2cjg2S25V?= =?utf-8?B?Wmc0UjhUeGtvTG14ODZaUElkdkxZek9nOHhneHFoM2hsc1FMbldHWnlqWHFQ?= =?utf-8?B?L0I2bExwNnA3QUVpQjdZOVJXZHFaWXp1VFFVRjNNQndyR0VjOThKYTBxeFBE?= =?utf-8?B?bFNsMWpOVGhuUGk0ZUljMVhRNmwwVWNqWU15THJoYmJVMVprQWJWeWYwS0Mz?= =?utf-8?B?NzdwY09yRWlncHpMYllOcU50MlVKNEJMNVlFelNJckliVlpHeGg4bWZLT1Bo?= =?utf-8?B?S0FVaXkyc3BsOTZQNVV6bEJ0d0ZlcHZCdUpWbFZDb044V3FLaGZEbWl5OFJF?= =?utf-8?B?eSt2bWt6M01kYVpRVzdrcWRzOTZDTHRzYVBzZ2V5Q2VqSlNpSklWTUF6NUlY?= =?utf-8?B?ckgwU3ZibXRyRE96OXF5QnBZSWxLMGdEMUtYbW5wampyTGxXUmxCVjZaS0h6?= =?utf-8?B?SU9JWGNvQUdDMUxlNnpBVHBaVDhFTGJjSE9VSUE5WjBzdTNuUlpkOVhZNENa?= =?utf-8?Q?jXlDe13I7/kjATgp2uX+w6TxmuH2lsvLuwp6K?= Content-Type: text/plain; charset="utf-8" Content-ID: <42171481A6EC73449FF2D37A1368B409@eurprd03.prod.outlook.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: epam.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: AM4PR03MB11152.eurprd03.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5256d075-fdcc-402d-d795-08dee1dc7868 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Jul 2026 19:16:56.1734 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: b41b72d0-4e9f-4c26-8a69-f949f367c91d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 6P6RZ6wX/xj06ZSp4yy8yajCAz/ymudacapEOBeJu97Iw7oOiaRA6lyA4BPcpI/KtquWI07udNBnd4mfNmpoRuqhyfwUw9d/UCcyCjPM0MI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU4PR03MB10718 X-purgate-ID: tlsNG-42698a/1784056622-A92CC9EA-782DC63F/0/0 X-purgate-type: clean X-purgate-size: 12970 X-ZohoMail-DKIM: pass (identity @epam.com) X-ZM-MESSAGEID: 1784056664947158500 A privileged domain on Arm64 can trigger a data abort in the hypervisor by issuing memory_op's XENMEM_add_to_physmap_batch sub-op with space=3DXENMAPSPACE_gmfn_foreign, idx=3D0 and foreign_domid=3DDOMID_IO. get_pg_owner(DOMID_IO) succeeds, returning a pointer to the dom_io pseudo-domain. The subsequent get_page_from_gfn(dom_io, ...) then attempts to walk dom_io's P2M table, which is not initialized for pseudo-domains, resulting in a data abort in p2m_get_entry() when it dereferences the invalid pointer returned by p2m_get_root_pointer(). Replace get_pg_owner() with explicit domain lookup logic matching the x86 implementation: handle DOMID_XEN via rcu_lock_domain(dom_xen), and resolve all other domain IDs via rcu_lock_remote_domain_by_id(), which rejects pseudo-domains (DOMID_IO, etc.) that are not present in the domain hash, returning -ESRCH before any P2M access occurs. Fixes: 615897bc6c01 ("xen/arm: Allow a privileged domain to map foreign pag= e from DOMID_XEN") Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Michal Orzel --- Discovered while testing boundary conditions. An unprivileged domain cannot trigger this crash, any attempt to issue the hypercall with these parameters is blocked by the XSM, resulting in -EPERM. The following test, when run in a privileged Arm64 domain, reliably=20 triggers the panic: void test(void) { /* =C2=A0* Crucial: idx 0 is required to bypass max_mapped_gfn bounds chec= ks =C2=A0* in p2m_get_entry(). =C2=A0* The P2M walker first performs a bounds check. Because dom_io is= not =C2=A0* fully initialized, its max bounds are 0. A large idx fails the = bounds =C2=A0* check, safely returns error, and aborts before the pointer dere= ference. =C2=A0*/ unsigned long idx =3D 0; /* Arbitrary target GFN, the hypervisor crashes before mapping occurs */ unsigned long gpfn =3D 0x100000; int ret, err =3D 0; struct xen_add_to_physmap_batch xatpb =3D { .domid =3D DOMID_SELF, .space =3D XENMAPSPACE_gmfn_foreign, .size =3D 1, /* * Crucial: DOMID_IO lacks a P2M table, causing p2m_get_root_pointe= r() * to return an invalid pointer (garbage) in p2m_get_entry() */ .u.foreign_domid =3D DOMID_IO, .idxs =3D &idx, .gpfns =3D &gpfn, .errs =3D &err }; ret =3D hypercall_memory_op(XENMEM_add_to_physmap_batch, &xatpb); if ( ret || err ) { printk("Test: XENMEM_add_to_physmap_batch failed (ret=3D%d, err=3D%= d)\n", ret, err); } } (XEN) Data Abort Trap. Syndrome=3D0x4 (XEN) Walking Hypervisor VA 0xb6d9100000000000 on CPU0 via TTBR 0x000000004= 06fb000 (XEN) 0TH[0x020] =3D 0x0 (XEN) CPU0: Unexpected Trap: Data Abort (XEN) ----[ Xen-4.23-unstable arm64 debug=3Dn Tainted: I ]---- (XEN) CPU: 0 (XEN) PC: 00000a000024732c p2m.c#p2m_next_level+0x2c/0x258 (XEN) LR: 00000a00002489b0 (XEN) SP: 000080007e1b79f0 (XEN) CPSR: 0000000080000249 MODE:64-bit EL2h (Hypervisor, handler) (XEN) X0: 000080007ffe5200 X1: 0000000000000001 X2: 0000000000000000 (XEN) X3: 000080007e1b7aa8 X4: 0000000000000000 X5: ffffffffffffffff (XEN) X6: 00000a000027a000 X7: 0000000000000000 X8: 00000a000027b000 (XEN) X9: 0000000000000000 X10: ffffffffffffffff X11: ffffff8000015ff0 (XEN) X12: ffffff800000a428 X13: 0000000000000006 X14: 0000000000000000 (XEN) X15: 0000000000000000 X16: 000000000000000c X17: 0000000000000000 (XEN) X18: 0000000000000000 X19: 0000000000000000 X20: 0000000000000000 (XEN) X21: 0000000000000000 X22: 000080007e1b7aa8 X23: 000080007e1b7b1c (XEN) X24: b6d9100000000000 X25: 0000000000000000 X26: b6d9100000000000 (XEN) X27: 0000000000000000 X28: 000080007ffe5200 FP: ffffff8000015fa0 (XEN)=20 (XEN) VTCR_EL2: 0000000080043594 (XEN) VTTBR_EL2: 00010000bffd2000 (XEN)=20 (XEN) SCTLR_EL2: 0000000030cd183d (XEN) HCR_EL2: 00000000807c663f (XEN) TTBR0_EL2: 00000000406fb000 (XEN)=20 (XEN) ESR_EL2: 0000000096000004 (XEN) HPFAR_EL2: 0000000000220000 (XEN) FAR_EL2: b6d9100000000000 (XEN)=20 (XEN) Xen stack trace from sp=3D000080007e1b79f0: (XEN) 0000000000000000 0000000000000000 0000000000000000 000080007e1b7ab0 (XEN) 000080007e1b7b1c 0000000000000000 0000000000000000 0000000000000000 (XEN) 0000000000000001 00000a00002489b0 000080007ffe5000 00000a00002e8040 (XEN) 000080007ffd3000 000080007e1b7b84 0000000000000000 000080007ffd3000 (XEN) 00000a00002e9308 0000000000007ff1 0000000000000000 0000000000000000 (XEN) 00000a0000252f1c 00000a0000253a88 0000000000000008 b6d9100000000000 (XEN) 0000000000000000 0000000000000000 000080007ffe5000 ffffffffffffffff (XEN) 000080007ffd3000 0000000000100000 00000a00002ef9a8 00000a00002efa24 (XEN) 00000a00002e8228 00000a000025247c 00000a00002e8280 ffffff8000015fd0 (XEN) 000080007e1b7c60 0000000000000000 00000a00002e8280 ffffff8000015fd0 (XEN) 000080007e1b7c60 0000000000000000 0000000000000000 000080007ffd3000 (XEN) 00000a00002e9308 0000000000007ff1 0000000000000000 0000000000000000 (XEN) 00000a0000219b5c 00000a00002754d9 0000000000000020 ffffffffffffffff (XEN) 000080007e1b7ea0 000080007e1bb000 000080007e1b7fa8 0000000040000345 (XEN) 000000005a000ea1 0000000000000000 0000000000000000 0000000000000000 (XEN) 0000000000000000 0000000000000000 00000a00002556c0 000000000000001f (XEN) 00000a00002eeb00 000080007e1b7c80 0000000000000000 0000000000001fff (XEN) 0000000093830045 000080007ffd3000 000000000000000a 0000000000000240 (XEN) 00000a000024df08 000080007ffd3500 0000000000000000 000080007ffd3500 (XEN) 000080007e1b7d88 0000000040000249 0000000000000000 00000a000024432c (XEN) 0000000000000000 0000000000000000 0000000000100000 0000000000000240 (XEN) 0000000000000000 0000000000000000 0000000000000005 0000000000000020 (XEN) 0000000000004000 00000a00002ef000 ffffffffffffffff fefefefefefeff09 (XEN) 7f7f7f7f7f7f7f7f 0101010101010101 0000000000000008 0000000000000006 (XEN) 0000000000000000 0000000000000000 00000a000023cb50 0000000000000000 (XEN) 0000000000000000 0000000000000000 000080007ffd3500 000080007ffd3000 (XEN) 000000000000000a 000080007ffd353c 000080007ffd3000 000000000000000a (XEN) 0000000000000240 0000000000000000 0000000000000000 ffffff8000015f10 (XEN) 00000a000025e260 000080007e1b7da0 7ff1000100047ff0 ffffff8000015fc0 (XEN) ffffff8000015fc8 ffffff8000015fbc 000080007fffa9c0 00000a000025de70 (XEN) 0000000093830045 000080007e1b7e88 00000a00002e8130 0000000000000000 (XEN) 00000a00002eeb00 00000a00002e9308 0000000000000001 ffffffffffffffff (XEN) 000080007e1bb000 00000a00002e8280 0000000000000000 0000000000000000 (XEN) 0000000000000000 0000000000000000 00000a0000256ff0 00000a00002e8280 (XEN) 000080007e1bb000 00000a00002e8280 0000000400000004 00000a00002e8280 (XEN) 0000000000000000 00000a0000256fd4 00000a0000258cc8 ffffff800000c000 (XEN) 0000000000000000 0000000043e00000 0000000000000000 0000000043e00000 (XEN) 00000a0000244480 0000000022000000 0000000000000017 ffffff8000015fd0 (XEN) ffffff8000015fbc ffffff8000015fc8 ffffff8000015fc0 7ff1000100047ff0 (XEN) 0000000000100000 ffffff800000a42a 00000000ffffffff 0000000000000069 (XEN) Xen call trace: (XEN) [<00000a000024732c>] p2m.c#p2m_next_level+0x2c/0x258 (PC) (XEN) [<00000a00002489b0>] p2m_get_entry+0xd0/0x218 (LR) (XEN)=20 (XEN)=20 (XEN) **************************************** (XEN) Panic on CPU 0: (XEN) CPU0: Unexpected Trap: Data Abort (XEN) **************************************** (XEN)=20 (XEN) Reboot in five seconds... --- xen/arch/arm/mm.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c index 65aea71c43..751f2f42fb 100644 --- a/xen/arch/arm/mm.c +++ b/xen/arch/arm/mm.c @@ -191,20 +191,25 @@ int xenmem_add_to_physmap_one( struct domain *od; p2m_type_t p2mt; =20 - od =3D get_pg_owner(extra.foreign_domid); - if ( od =3D=3D NULL ) - return -ESRCH; - - if ( od =3D=3D d ) + if ( extra.foreign_domid =3D=3D DOMID_XEN ) + od =3D rcu_lock_domain(dom_xen); + else { - put_pg_owner(od); - return -EINVAL; + rc =3D rcu_lock_remote_domain_by_id(extra.foreign_domid, &od); + if ( rc ) + return rc; + + if ( od =3D=3D d ) + { + rcu_unlock_domain(od); + return -EINVAL; + } } =20 rc =3D xsm_map_gmfn_foreign(XSM_TARGET, d, od); if ( rc ) { - put_pg_owner(od); + rcu_unlock_domain(od); return rc; } =20 @@ -213,7 +218,7 @@ int xenmem_add_to_physmap_one( page =3D get_page_from_gfn(od, idx, &p2mt, P2M_ALLOC); if ( !page ) { - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } =20 @@ -222,13 +227,13 @@ int xenmem_add_to_physmap_one( else { put_page(page); - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } =20 mfn =3D page_to_mfn(page); =20 - put_pg_owner(od); + rcu_unlock_domain(od); break; } case XENMAPSPACE_dev_mmio: --=20 2.34.1