From 9a77b3177ad764b50ab6a19132f208b55c23520a Mon Sep 17 00:00:00 2001 From: Matias Zabaljauregui Date: Wed, 8 Apr 2009 17:58:39 -0300 Subject: [PATCH] lguest: fix crash on vmlinux images Typical message: 'lguest: unhandled trap 6 at 0x418726 (0x0)' vmlinux guests were broken by 445311b22043711eefebb602a64c047166deb028 'lguest: use KVM hypercalls', which rewrites guest text from kvm hypercalls to trap 31. The Launcher mmaps the kernel image. The Guest executes and immediately faults in the first text page (read-only). Then it hits a hypercall, and we rewrite that hypercall, causing a copy-on-write. But the Guest pagetables still refer to the old page: we fault again, but as Host we see the hypercall already rewritten, and pass the fault back to the Guest. The Guest hasn't set up an IDT yet, so we kill it. This doesn't happen with bzImages: they unpack themselves and so the text pages are already read-write. Signed-off-by: Rusty Russell Tested-by: Patrick McHardy --- drivers/lguest/x86/core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c index a6b717644be0d..d6d7ac0982ab6 100644 --- a/drivers/lguest/x86/core.c +++ b/drivers/lguest/x86/core.c @@ -324,6 +324,11 @@ static void rewrite_hypercall(struct lg_cpu *cpu) u8 insn[3] = {0xcd, 0x1f, 0x90}; __lgwrite(cpu, guest_pa(cpu, cpu->regs->eip), insn, sizeof(insn)); + /* The above write might have caused a copy of that page to be made + * (if it was read-only). We need to make sure the Guest has + * up-to-date pagetables. As this doesn't happen often, we can just + * drop them all. */ + guest_pagetable_clear_all(cpu); } static bool is_hypercall(struct lg_cpu *cpu) -- 2.39.5