[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-changelog] [xen master] x86/boot: Don't map 0 during boot



commit faa85d4fb39554b382ec3d6d5ec82a9ffc9c63f5
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Mon Jan 6 13:37:41 2020 +0000
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Fri Jan 10 17:45:30 2020 +0000

    x86/boot: Don't map 0 during boot
    
    In particular, it causes accidental NULL pointer dereferences to go 
unnoticed.
    
    The majority of the early operation takes place either in Real mode, or
    Protected Unpaged mode.  The only bit which requires pagetable mappings is 
the
    trampoline transition into Long mode and jump to the higher mappings, so 
there
    is no need for the whole bottom 2M to be mapped.
    
    Introduce a new l1_bootmap in .init.data, and use it instead of l1_identmap.
    The EFI boot path doesn't pass through the trampoline, so doesn't need any
    adjustment.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/arch/x86/boot/head.S   | 14 ++++++++------
 xen/arch/x86/boot/x86_64.S |  4 ++++
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/xen/arch/x86/boot/head.S b/xen/arch/x86/boot/head.S
index 0b75d33a25..d246e374f1 100644
--- a/xen/arch/x86/boot/head.S
+++ b/xen/arch/x86/boot/head.S
@@ -689,12 +689,14 @@ trampoline_setup:
         sub     $(L2_PAGETABLE_ENTRIES*8),%eax
         loop    1b
 
-        /*
-         * During boot, hook 4kB mappings of first 2MB of memory into L2.
-         * This avoids mixing cachability for the legacy VGA region.
-         */
-        lea     __PAGE_HYPERVISOR+sym_esi(l1_identmap),%edi
-        mov     %edi,sym_fs(l2_bootmap)
+        /* Map the permanent trampoline page into l{1,2}_bootmap[]. */
+        mov     sym_esi(trampoline_phys), %ecx
+        lea     __PAGE_HYPERVISOR_RX(%ecx), %edx /* %edx = PTE to write  */
+        shr     $PAGE_SHIFT, %ecx                /* %ecx = Slot to write */
+        mov     %edx, sym_offs(l1_bootmap)(%esi, %ecx, 8)
+
+        lea     __PAGE_HYPERVISOR + sym_esi(l1_bootmap), %edx
+        mov     %edx, sym_esi(l2_bootmap)
 
         /* Apply relocations to bootstrap trampoline. */
         mov     sym_fs(trampoline_phys),%edx
diff --git a/xen/arch/x86/boot/x86_64.S b/xen/arch/x86/boot/x86_64.S
index de555f87f4..af62850589 100644
--- a/xen/arch/x86/boot/x86_64.S
+++ b/xen/arch/x86/boot/x86_64.S
@@ -155,6 +155,10 @@ GLOBAL(__page_tables_end)
         .section .init.data, "aw", @progbits
         .align PAGE_SIZE, 0
 
+l1_bootmap:
+        .fill L1_PAGETABLE_ENTRIES, 8, 0
+        .size l1_bootmap, . - l1_bootmap
+
 GLOBAL(l2_bootmap)
         .fill 4 * L2_PAGETABLE_ENTRIES, 8, 0
         .size l2_bootmap, . - l2_bootmap
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog

 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.