From nobody Wed Feb 11 01:00:15 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1671193103; cv=none; d=zohomail.com; s=zohoarc; b=mwBfph22mKAj9d2l2d0a8t9WDQnfcLSCGGDF1RFWEIPzNzFc18zGvnZNttc504AykPjlQW6ynw8kElrPVneQn1kfIhgfcIR76roVNXtIHfzrti/mcBiqHDXnGrbwlwRTsbPS9tDB+2fWTLO48bPHhn8fKP1muBjmtR9EyDprHeA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1671193103; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=9j1baKWOTDAmSEXXRPz5vlDNPs8x5yzHk136j/q4JZg=; b=A7QSiUKZedHvHPzrtYXL22PYpzNJj9Zm4FMxCEqVf3cUuH/0m//ZdLTKcoLoTP6f2HwaJT3PTmi2r/+3cgz1rlJr5y6fRQNzlnQ7qMLwQMN2BhuyycKN93RWH2SDIgGE/kt82bmpPxyiXagw7uGPHQ3SoTLzrOSsnFg7TcBYqO8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1671193103928321.76440516092305; Fri, 16 Dec 2022 04:18:23 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.464572.723062 (Exim 4.92) (envelope-from ) id 1p69eq-0000MG-5x; Fri, 16 Dec 2022 12:17:44 +0000 Received: by outflank-mailman (output) from mailman id 464572.723062; Fri, 16 Dec 2022 12:17:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1p69ep-0000Gd-JP; Fri, 16 Dec 2022 12:17:43 +0000 Received: by outflank-mailman (input) for mailman id 464572; Fri, 16 Dec 2022 12:17:38 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1p69ek-0007Lt-2H for xen-devel@lists.xenproject.org; Fri, 16 Dec 2022 12:17:38 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1p69ej-00034G-OC; Fri, 16 Dec 2022 12:17:37 +0000 Received: from 54-240-197-232.amazon.com ([54.240.197.232] helo=dev-dsk-jgrall-1b-035652ec.eu-west-1.amazon.com) by xenbits.xenproject.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1p69DE-0004sN-I6; Fri, 16 Dec 2022 11:49:12 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xen.org; s=20200302mail; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:Cc:To:From; bh=9j1baKWOTDAmSEXXRPz5vlDNPs8x5yzHk136j/q4JZg=; b=x83k0fXRB6Jd3aoaqIjCeiTXkZ 7qIX6P/MiqvL54Or2V6+svj4lDwUZZCmBuqxYrvv3ob8rabbm6oXC3e1YeRuKe+CMfYZghExbqb80 kDwukK5Zdqncp5eH8pALQ1iPRGFB4ocn6dI8WO4JRZ75DOghEq/3Qh1IyTnBGkN+9KEc=; From: Julien Grall To: xen-devel@lists.xenproject.org Cc: julien@xen.org, Hongyan Xia , Andrew Cooper , George Dunlap , Jan Beulich , Stefano Stabellini , Wei Liu , Bertrand Marquis , Volodymyr Babchuk , =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= , Julien Grall Subject: [PATCH 11/22] x86: add a boot option to enable and disable the direct map Date: Fri, 16 Dec 2022 11:48:42 +0000 Message-Id: <20221216114853.8227-12-julien@xen.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221216114853.8227-1-julien@xen.org> References: <20221216114853.8227-1-julien@xen.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @xen.org) X-ZM-MESSAGEID: 1671193104868100009 Content-Type: text/plain; charset="utf-8" From: Hongyan Xia Also add a helper function to retrieve it. Change arch_mfns_in_direct_map to check this option before returning. This is added as a boot command line option, not a Kconfig to allow the user to experiment the feature without rebuild the hypervisor. Signed-off-by: Hongyan Xia Signed-off-by: Julien Grall ---- TODO: * Do we also want to provide a Kconfig option? Changes since Hongyan's version: * Reword the commit message * opt_directmap is only modified during boot so mark it as __ro_after_init --- docs/misc/xen-command-line.pandoc | 12 ++++++++++++ xen/arch/arm/include/asm/mm.h | 5 +++++ xen/arch/x86/include/asm/mm.h | 17 ++++++++++++++++- xen/arch/x86/mm.c | 3 +++ xen/arch/x86/setup.c | 2 ++ 5 files changed, 38 insertions(+), 1 deletion(-) diff --git a/docs/misc/xen-command-line.pandoc b/docs/misc/xen-command-line= .pandoc index b7ee97be762e..a63e4612acac 100644 --- a/docs/misc/xen-command-line.pandoc +++ b/docs/misc/xen-command-line.pandoc @@ -760,6 +760,18 @@ Specify the size of the console debug trace buffer. By= specifying `cpu:` additionally a trace buffer of the specified size is allocated per cpu. The debug trace feature is only enabled in debugging builds of Xen. =20 +### directmap (x86) +> `=3D ` + +> Default: `true` + +Enable or disable the direct map region in Xen. + +By default, Xen creates the direct map region which maps physical memory +in that region. Setting this to no will remove the direct map, blocking +exploits that leak secrets via speculative memory access in the direct +map. + ### dma_bits > `=3D ` =20 diff --git a/xen/arch/arm/include/asm/mm.h b/xen/arch/arm/include/asm/mm.h index 68adcac9fa8d..2366928d71aa 100644 --- a/xen/arch/arm/include/asm/mm.h +++ b/xen/arch/arm/include/asm/mm.h @@ -406,6 +406,11 @@ static inline void page_set_xenheap_gfn(struct page_in= fo *p, gfn_t gfn) } while ( (y =3D cmpxchg(&p->u.inuse.type_info, x, nx)) !=3D x ); } =20 +static inline bool arch_has_directmap(void) +{ + return true; +} + #endif /* __ARCH_ARM_MM__ */ /* * Local variables: diff --git a/xen/arch/x86/include/asm/mm.h b/xen/arch/x86/include/asm/mm.h index db29e3e2059f..cf8b20817c6c 100644 --- a/xen/arch/x86/include/asm/mm.h +++ b/xen/arch/x86/include/asm/mm.h @@ -464,6 +464,8 @@ static inline int get_page_and_type(struct page_info *p= age, ASSERT(((_p)->count_info & PGC_count_mask) !=3D 0); \ ASSERT(page_get_owner(_p) =3D=3D (_d)) =20 +extern bool opt_directmap; + /*************************************************************************= ***** * With shadow pagetables, the different kinds of address start * to get get confusing. @@ -620,13 +622,26 @@ extern const char zero_page[]; /* Build a 32bit PSE page table using 4MB pages. */ void write_32bit_pse_identmap(uint32_t *l2); =20 +static inline bool arch_has_directmap(void) +{ + return opt_directmap; +} + /* * x86 maps part of physical memory via the directmap region. * Return whether the range of MFN falls in the directmap region. + * + * When boot command line sets directmap=3Dno, we will not have a direct m= ap at + * all so this will always return false. */ static inline bool arch_mfns_in_directmap(unsigned long mfn, unsigned long= nr) { - unsigned long eva =3D min(DIRECTMAP_VIRT_END, HYPERVISOR_VIRT_END); + unsigned long eva; + + if ( !arch_has_directmap() ) + return false; + + eva =3D min(DIRECTMAP_VIRT_END, HYPERVISOR_VIRT_END); =20 return (mfn + nr) <=3D (virt_to_mfn(eva - 1) + 1); } diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index 041bd4cfde17..e76e135b96fc 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -157,6 +157,9 @@ l1_pgentry_t __section(".bss.page_aligned") __aligned(P= AGE_SIZE) l1_pgentry_t __section(".bss.page_aligned") __aligned(PAGE_SIZE) l1_fixmap_x[L1_PAGETABLE_ENTRIES]; =20 +bool __ro_after_init opt_directmap =3D true; +boolean_param("directmap", opt_directmap); + /* Frame table size in pages. */ unsigned long max_page; unsigned long total_pages; diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c index 1c2e09711eb0..2cb051c6e4e7 100644 --- a/xen/arch/x86/setup.c +++ b/xen/arch/x86/setup.c @@ -1423,6 +1423,8 @@ void __init noreturn __start_xen(unsigned long mbi_p) if ( highmem_start ) xenheap_max_mfn(PFN_DOWN(highmem_start - 1)); =20 + printk("Booting with directmap %s\n", arch_has_directmap() ? "on" : "o= ff"); + /* * Walk every RAM region and map it in its entirety (on x86/64, at lea= st) * and notify it to the boot allocator. --=20 2.38.1