From bd0dbf9b110a67ebff9421d6a80afed4f0fa1b78 Mon Sep 17 00:00:00 2001 From: Andrei Vagin Date: Mon, 3 Feb 2025 14:04:28 -0800 Subject: [PATCH] kvm/arm64: send SIGKILL if ring0.El0SyncInv has been triggered Linux does the same thing. PiperOrigin-RevId: 722789748 --- images/default/Dockerfile | 2 +- pkg/sentry/platform/kvm/machine_arm64_unsafe.go | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/images/default/Dockerfile b/images/default/Dockerfile index 5910a695e..15fdfad52 100644 --- a/images/default/Dockerfile +++ b/images/default/Dockerfile @@ -30,6 +30,6 @@ RUN curl https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud ln -s /google-cloud-sdk/bin/gcloud /usr/bin/gcloud # Download the official bazel binary. The APT repository isn't used because there is not packages for arm64. -RUN sh -c 'curl -o /usr/local/bin/bazel https://releases.bazel.build/7.3.2/release/bazel-7.3.2-linux-$(uname -m | sed s/aarch64/arm64/) && chmod ugo+x /usr/local/bin/bazel' +RUN sh -c 'curl -o /usr/local/bin/bazel https://releases.bazel.build/7.5.0/release/bazel-7.5.0-linux-$(uname -m | sed s/aarch64/arm64/) && chmod ugo+x /usr/local/bin/bazel' WORKDIR /workspace ENTRYPOINT ["/usr/local/bin/bazel"] diff --git a/pkg/sentry/platform/kvm/machine_arm64_unsafe.go b/pkg/sentry/platform/kvm/machine_arm64_unsafe.go index 1ed244cf6..4420e6fb8 100644 --- a/pkg/sentry/platform/kvm/machine_arm64_unsafe.go +++ b/pkg/sentry/platform/kvm/machine_arm64_unsafe.go @@ -327,7 +327,8 @@ func (c *vCPU) SwitchToUser(switchOpts ring0.SwitchOpts, info *linux.SignalInfo) return c.fault(int32(unix.SIGBUS), info) case ring0.Vector(bounce): // ring0.VirtualizationException. return hostarch.NoAccess, platform.ErrContextInterrupt - case ring0.El0SyncUndef: + case ring0.El0SyncUndef, + ring0.El0SyncInv: return c.fault(int32(unix.SIGILL), info) case ring0.El0SyncDbg: *info = linux.SignalInfo{