[Xen-changelog] [xen stable-4.10] xen/pvh: place the trampoline at page 0x1

[patchbot@xxxxxxx]

commit fa23f2aaa24c603f748b49b32378b738d18cc68f
Author:     Roger Pau Monne <roger.pau@xxxxxxxxxx>
AuthorDate: Wed Jan 17 12:00:41 2018 +0000
Commit:     Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CommitDate: Wed Jan 17 16:34:22 2018 +0000

    xen/pvh: place the trampoline at page 0x1
    
    Since PVH guest jump straight into trampoline_setup trampoline_phys is
    not initialized, thus the trampoline is relocated to address 0.
    
    This works, but has the undesirable effect of having VA 0 mapped to
    MFN 0, which means NULL pointed dereferences no longer trigger a page
    fault.
    
    In order to solve this, place the trampoline at page 0x1 and reserve
    the memory used by it.
    
    Signed-off-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    Reviewed-by: Wei Liu <wei.liu2@xxxxxxxxxx>
---
 xen/arch/x86/boot/head.S | 3 +++
 xen/arch/x86/mm.c        | 9 +++++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/boot/head.S b/xen/arch/x86/boot/head.S
index 14caca6798..c527910478 100644
--- a/xen/arch/x86/boot/head.S
+++ b/xen/arch/x86/boot/head.S
@@ -411,6 +411,9 @@ __pvh_start:
         /* Skip bootloader setup and bios setup, go straight to trampoline */
         movb    $1, sym_esi(pvh_boot)
         movb    $1, sym_esi(skip_realmode)
+
+        /* Set trampoline_phys to use mfn 1 to avoid having a mapping at VA 0 
*/
+        movw    $0x1000, sym_esi(trampoline_phys)
         jmp     trampoline_setup
 
 #endif /* CONFIG_PVH_GUEST */
diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index 371c764027..a8b59617d3 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -292,9 +292,14 @@ void __init arch_init_memory(void)
     /*
      * First 1MB of RAM is historically marked as I/O.  If we booted PVH,
      * reclaim the space.  Irrespective, leave MFN 0 as special for the sake
-     * of 0 being a very common default value.
+     * of 0 being a very common default value. Also reserve page 0x1 which is
+     * used by the trampoline code on PVH.
      */
-    for ( i = 0; i < (pvh_boot ? 1 : 0x100); i++ )
+    BUG_ON(pvh_boot && trampoline_phys != 0x1000);
+    for ( i = 0;
+          i < (pvh_boot ? (1 + PFN_UP(trampoline_end - trampoline_start))
+                        : 0x100);
+          i++ )
         share_xen_page_with_guest(mfn_to_page(_mfn(i)),
                                   dom_io, XENSHARE_writable);
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.10

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog