[Minios-devel] [UNIKRAFT PATCH 0/3] plat/kvm: Make most of the first MB inaccessible

[Florian Schmidt <florian.schmidt@xxxxxxxxx>]

On kvm on x86, we currently use a 1:1 mapping between virtual and physical
memory by mapping the first 1GB of virtual memory via one layer-3 page table
with large (2MB) pages. As a side effect, all memory addresses below 1GB are
accessible, even 0x0 and other very low addresses. This is not in itself a
problem (it's valid memory, after all), but it tends to mask bugs where we
try to dereference NULL pointers etc.

The most straightforward solution, marking the first page table entry as
inaccessible, is impractical: most importantly, there are addresses in that
range that we want to legitimately access: 0x8b000-0x8ffff is the VGA
buffer, and 0x9500 is the address at which QEMU passes the multiboot
information from the bootloader. Instead, we create one more page table,
this one with 4k granularity, and refer to that one from the first layer-3
entry.

I'm aware that this is a potentially disruptive change, because it might
uncover additional minor bugs, crashing the system where before it pottered
on happily. I might also have forgotten to provide access to area in the
first MB that we legitimately want to access. However, I think the first
argument is weak, becauase we'd rather find these bugs instead of staying
blissfully unaware; and the second argument describes an easily fixable
problem by simply changing a line in the page table as a quick patch. In any
case, "standard unikraft" (i.e., not testing specific libraries or
applications) seems to work well with this patch.


Florian Schmidt (3):
  plat/kvm: Replace numerical flags with defines in pagetable.S
  plat/kvm: 4k-granularity page table for the first 2MB
  plat/kvm: set write protect flag in CR0

 plat/common/include/x86/cpu_defs.h |    1 +
 plat/kvm/x86/entry64.S             |    2 +-
 plat/kvm/x86/pagetable.S           | 1309 +++++++++++++++++-----------
 3 files changed, 796 insertions(+), 516 deletions(-)

-- 
2.21.0


_______________________________________________
Minios-devel mailing list
Minios-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/minios-devel