@@ -799,6 +799,18 @@ that enabling this option cannot guarantee anything beyond what underlying
hardware guarantees (with, where available and known to Xen, respective
tweaks applied).
+### directmap (x86)
+> `= <boolean>`
+
+> Default: `true`
+
+Enable or disable fully populating the directmap region in Xen.
+
+By default, Xen creates the directmap region which maps all physical memory
+in that region. Disabling this option will sparsely populate the directmap,
+blocking exploits that leak secrets via speculative memory access in the
+directmap.
+
### dma_bits
> `= <integer>`
@@ -23,6 +23,7 @@ config X86
select HAS_IOPORTS
select HAS_KEXEC
select HAS_NS16550
+ select HAS_ONDEMAND_DIRECTMAP
select HAS_PASSTHROUGH
select HAS_PCI
select HAS_PCI_MSI
@@ -620,11 +620,17 @@ void write_32bit_pse_identmap(uint32_t *l2);
/*
* x86 maps part of physical memory via the directmap region.
* Return whether the range of MFN falls in the directmap region.
+ *
+ * When boot command line sets directmap=no, the directmap will mostly be empty
+ * so this will always return false.
*/
static inline bool arch_mfns_in_directmap(unsigned long mfn, unsigned long nr)
{
unsigned long eva = min(DIRECTMAP_VIRT_END, HYPERVISOR_VIRT_END);
+ if ( !has_directmap() )
+ return false;
+
return (mfn + nr) <= (virt_to_mfn(eva - 1) + 1);
}
@@ -1586,6 +1586,8 @@ void asmlinkage __init noreturn __start_xen(void)
if ( highmem_start )
xenheap_max_mfn(PFN_DOWN(highmem_start - 1));
+ printk("Booting with directmap %s\n", has_directmap() ? "full" : "on demand");
+
/*
* Walk every RAM region and map it in its entirety (on x86/64, at least)
* and notify it to the boot allocator.
@@ -71,6 +71,9 @@ config HAS_IOPORTS
config HAS_KEXEC
bool
+config HAS_ONDEMAND_DIRECTMAP
+ bool
+
config HAS_PIRQ
bool
@@ -415,6 +418,20 @@ source "common/sched/Kconfig"
config CRYPTO
bool
+config ONDEMAND_DIRECTMAP
+ bool "On-Demand Directmap"
+ depends on HAS_ONDEMAND_DIRECTMAP
+ help
+ The directmap contains mapping for most of the RAM, making domain
+ memory easily accessible. While this can improve performance, it also
+ increases the vulnerability to speculation attacks.
+
+ Enabling this feature allows the user to control whether the memory
+ is always mapped at boot or mapped only on demand (see the command line
+ option "directmap").
+
+ If unsure, say N.
+
config LIVEPATCH
bool "Live patching support"
default X86
@@ -175,6 +175,11 @@ paddr_t __ro_after_init mem_hotplug;
static char __initdata opt_badpage[100] = "";
string_param("badpage", opt_badpage);
+#ifdef CONFIG_HAS_ONDEMAND_DIRECTMAP
+bool __ro_after_init opt_directmap = true;
+boolean_param("directmap", opt_directmap);
+#endif
+
/*
* no-bootscrub -> Free pages are not zeroed during boot.
*/
@@ -167,6 +167,17 @@ extern unsigned long max_page;
extern unsigned long total_pages;
extern paddr_t mem_hotplug;
+#ifdef CONFIG_HAS_ONDEMAND_DIRECTMAP
+ extern bool opt_directmap;
+#else
+ #define opt_directmap true
+#endif
+
+static inline bool has_directmap(void)
+{
+ return !IS_ENABLED(CONFIG_HAS_ONDEMAND_DIRECTMAP) || opt_directmap;
+}
+
/*
* Extra fault info types which are used to further describe
* the source of an access violation.