From bd0ad700716a3108149dfc7d898bc5adbe6e1a32 Mon Sep 17 00:00:00 2001 From: "kfraser@localhost.localdomain" Date: Mon, 18 Jun 2007 16:48:05 +0100 Subject: [PATCH] x86/64: Avoid bogus mbi pointer into relocated Xen address space. Prevent similar bugs in future by poisoning the relocated bottom megabyte. Signed-off-by: Keir Fraser --- xen/arch/x86/boot/x86_32.S | 4 +--- xen/arch/x86/boot/x86_64.S | 2 -- xen/arch/x86/setup.c | 6 +++++- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/xen/arch/x86/boot/x86_32.S b/xen/arch/x86/boot/x86_32.S index 2d005e7678..1220f940a5 100644 --- a/xen/arch/x86/boot/x86_32.S +++ b/xen/arch/x86/boot/x86_32.S @@ -30,9 +30,7 @@ loop 1b /* Pass off the Multiboot info structure to C land. */ - mov multiboot_ptr,%eax - add $__PAGE_OFFSET,%eax - push %eax + pushl multiboot_ptr call __start_xen ud2 /* Force a panic (invalid opcode). */ diff --git a/xen/arch/x86/boot/x86_64.S b/xen/arch/x86/boot/x86_64.S index c4f368420d..d3c11b8788 100644 --- a/xen/arch/x86/boot/x86_64.S +++ b/xen/arch/x86/boot/x86_64.S @@ -51,8 +51,6 @@ /* Pass off the Multiboot info structure to C land. */ mov multiboot_ptr(%rip),%edi - lea start-0x100000(%rip),%rax - add %rax,%rdi call __start_xen ud2 /* Force a panic (invalid opcode). */ diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c index 779b7fb37d..129621a4ca 100644 --- a/xen/arch/x86/setup.c +++ b/xen/arch/x86/setup.c @@ -402,7 +402,7 @@ void init_done(void) startup_cpu_idle_loop(); } -void __init __start_xen(multiboot_info_t *mbi) +void __init __start_xen(unsigned long mbi_p) { char *memmap_type = NULL; char __cmdline[] = "", *cmdline = __cmdline; @@ -410,6 +410,7 @@ void __init __start_xen(multiboot_info_t *mbi) unsigned int initrdidx = 1; char *_policy_start = NULL; unsigned long _policy_len = 0; + multiboot_info_t *mbi = __va(mbi_p); module_t *mod = (module_t *)__va(mbi->mods_addr); unsigned long nr_pages, modules_length; int i, e820_warn = 0, bytes = 0; @@ -678,6 +679,9 @@ void __init __start_xen(multiboot_info_t *mbi) barrier(); move_memory(e, 0, __pa(&_end) - xen_phys_start); + /* Poison low 1MB to detect stray pointers to physical 0-1MB. */ + memset(maddr_to_bootstrap_virt(e), 0x55, 1U<<20); + /* Walk initial pagetables, relocating page directory entries. */ pl4e = __va(__pa(idle_pg_table)); for ( i = 0 ; i < L4_PAGETABLE_ENTRIES; i++, pl4e++ ) -- 2.30.2