x86/64: Avoid bogus mbi pointer into relocated Xen address space.

Prevent similar bugs in future by poisoning the relocated bottom
megabyte.
Signed-off-by: Keir Fraser <keir@xensource.com>

diff --git a/xen/arch/x86/boot/x86_32.S b/xen/arch/x86/boot/x86_32.S
index 2d005e76786fbefb15043098161f2e8d628a40b3..1220f940a5721cce053053ed8ef689da0cc89ce5 100644 (file)
--- a/xen/arch/x86/boot/x86_32.S
+++ b/xen/arch/x86/boot/x86_32.S
@@ -30,9 +30,7 @@
         loop    1b
                 
         /* Pass off the Multiboot info structure to C land. */
-        mov     multiboot_ptr,%eax
-        add     $__PAGE_OFFSET,%eax
-        push    %eax
+        pushl   multiboot_ptr
         call    __start_xen
         ud2     /* Force a panic (invalid opcode). */
 

diff --git a/xen/arch/x86/boot/x86_64.S b/xen/arch/x86/boot/x86_64.S
index c4f368420d1771e9b56ba877bbe4bfc771e3c242..d3c11b8788e8674c587063cf19c1d75b3119ee05 100644 (file)
--- a/xen/arch/x86/boot/x86_64.S
+++ b/xen/arch/x86/boot/x86_64.S
@@ -51,8 +51,6 @@
 
         /* Pass off the Multiboot info structure to C land. */
         mov     multiboot_ptr(%rip),%edi
-        lea     start-0x100000(%rip),%rax
-        add     %rax,%rdi
         call    __start_xen
         ud2     /* Force a panic (invalid opcode). */
 

diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
index 779b7fb37d26d3307e00ff1568f2221d0ef05622..129621a4cad467562d35fb4ea8b6f4278a3b5d97 100644 (file)
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -402,7 +402,7 @@ void init_done(void)
     startup_cpu_idle_loop();
 }
 
-void __init __start_xen(multiboot_info_t *mbi)
+void __init __start_xen(unsigned long mbi_p)
 {
     char *memmap_type = NULL;
     char __cmdline[] = "", *cmdline = __cmdline;
@@ -410,6 +410,7 @@ void __init __start_xen(multiboot_info_t *mbi)
     unsigned int initrdidx = 1;
     char *_policy_start = NULL;
     unsigned long _policy_len = 0;
+    multiboot_info_t *mbi = __va(mbi_p);
     module_t *mod = (module_t *)__va(mbi->mods_addr);
     unsigned long nr_pages, modules_length;
     int i, e820_warn = 0, bytes = 0;
@@ -678,6 +679,9 @@ void __init __start_xen(multiboot_info_t *mbi)
             barrier();
             move_memory(e, 0, __pa(&_end) - xen_phys_start);
 
+            /* Poison low 1MB to detect stray pointers to physical 0-1MB. */
+            memset(maddr_to_bootstrap_virt(e), 0x55, 1U<<20);
+
             /* Walk initial pagetables, relocating page directory entries. */
             pl4e = __va(__pa(idle_pg_table));
             for ( i = 0 ; i < L4_PAGETABLE_ENTRIES; i++, pl4e++ )