| Message ID | 20230502145920.56588-2-roger.pau@citrix.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | x86: init improvements | expand |
On 02.05.2023 16:59, Roger Pau Monne wrote: > Ensure that the base address is 2M aligned, or else the page table > entries created would be corrupt as reserved bits on the PDE end up > set. > > We have encountered a broken firmware where grub2 would end up loading > Xen at a non 2M aligned region when using the multiboot2 protocol, and > that caused a very difficult to debug triple fault. > > If the alignment is not as required by the page tables print an error > message and stop the boot. Also add a build time check that the > calculation of symbol offsets don't break alignment of passed > addresses. > > The check could be performed earlier, but so far the alignment is > required by the page tables, and hence feels more natural that the > check lives near to the piece of code that requires it. > > Note that when booted as an EFI application from the PE entry point > the alignment check is already performed by > efi_arch_load_addr_check(), and hence there's no need to add another > check at the point where page tables get built in > efi_arch_memory_setup(). > > Signed-off-by: Roger Pau Monné <roger.pau@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Would you mind if, while committing, ... > @@ -146,6 +148,9 @@ bad_cpu: > not_multiboot: > add $sym_offs(.Lbad_ldr_msg),%esi # Error message > jmp .Lget_vtb > +not_aligned: ... a .L prefix was added to this label, bringing it out of sync with the earlier one, but in line with e.g. ... > + add $sym_offs(.Lbag_alg_msg),%esi # Error message > + jmp .Lget_vtb > .Lmb2_no_st: ... this one? I don't think the label is particularly useful to have in the symbol table (nor are not_multiboot and likely a few others). Jan
On Wed, May 03, 2023 at 10:08:20AM +0200, Jan Beulich wrote: > On 02.05.2023 16:59, Roger Pau Monne wrote: > > Ensure that the base address is 2M aligned, or else the page table > > entries created would be corrupt as reserved bits on the PDE end up > > set. > > > > We have encountered a broken firmware where grub2 would end up loading > > Xen at a non 2M aligned region when using the multiboot2 protocol, and > > that caused a very difficult to debug triple fault. > > > > If the alignment is not as required by the page tables print an error > > message and stop the boot. Also add a build time check that the > > calculation of symbol offsets don't break alignment of passed > > addresses. > > > > The check could be performed earlier, but so far the alignment is > > required by the page tables, and hence feels more natural that the > > check lives near to the piece of code that requires it. > > > > Note that when booted as an EFI application from the PE entry point > > the alignment check is already performed by > > efi_arch_load_addr_check(), and hence there's no need to add another > > check at the point where page tables get built in > > efi_arch_memory_setup(). > > > > Signed-off-by: Roger Pau Monné <roger.pau@citrix.com> > > Reviewed-by: Jan Beulich <jbeulich@suse.com> > > Would you mind if, while committing, ... > > > @@ -146,6 +148,9 @@ bad_cpu: > > not_multiboot: > > add $sym_offs(.Lbad_ldr_msg),%esi # Error message > > jmp .Lget_vtb > > +not_aligned: > > ... a .L prefix was added to this label, bringing it out of sync with the > earlier one, but in line with e.g. ... > > > + add $sym_offs(.Lbag_alg_msg),%esi # Error message > > + jmp .Lget_vtb > > .Lmb2_no_st: > > ... this one? I don't think the label is particularly useful to have in > the symbol table (nor are not_multiboot and likely a few others). Hm, right, yes, I don't think having those on the symbol table is helpful, please adjust. Thanks, Roger.
diff --git a/xen/arch/x86/boot/head.S b/xen/arch/x86/boot/head.S index 0fb7dd3029f2..b9c9447df9df 100644 --- a/xen/arch/x86/boot/head.S +++ b/xen/arch/x86/boot/head.S @@ -1,3 +1,4 @@ +#include <xen/lib.h> #include <xen/multiboot.h> #include <xen/multiboot2.h> #include <public/xen.h> @@ -121,6 +122,7 @@ multiboot2_header: .Lbad_ldr_nst: .asciz "ERR: EFI SystemTable is not provided by bootloader!" .Lbad_ldr_nih: .asciz "ERR: EFI ImageHandle is not provided by bootloader!" .Lbad_efi_msg: .asciz "ERR: EFI IA-32 platforms are not supported!" +.Lbag_alg_msg: .asciz "ERR: Xen must be loaded at a 2Mb boundary!" .section .init.data, "aw", @progbits .align 4 @@ -146,6 +148,9 @@ bad_cpu: not_multiboot: add $sym_offs(.Lbad_ldr_msg),%esi # Error message jmp .Lget_vtb +not_aligned: + add $sym_offs(.Lbag_alg_msg),%esi # Error message + jmp .Lget_vtb .Lmb2_no_st: /* * Here we are on EFI platform. vga_text_buffer was zapped earlier @@ -670,6 +675,15 @@ trampoline_setup: cmp %edi, %eax jb 1b + .if !IS_ALIGNED(sym_offs(0), 1 << L2_PAGETABLE_SHIFT) + .error "Symbol offset calculation breaks alignment" + .endif + + /* Check that the image base is aligned. */ + lea sym_esi(_start), %eax + test $(1 << L2_PAGETABLE_SHIFT) - 1, %eax + jnz not_aligned + /* Map Xen into the higher mappings using 2M superpages. */ lea _PAGE_PSE + PAGE_HYPERVISOR_RWX + sym_esi(_start), %eax mov $sym_offs(_start), %ecx /* %eax = PTE to write ^ */
Ensure that the base address is 2M aligned, or else the page table entries created would be corrupt as reserved bits on the PDE end up set. We have encountered a broken firmware where grub2 would end up loading Xen at a non 2M aligned region when using the multiboot2 protocol, and that caused a very difficult to debug triple fault. If the alignment is not as required by the page tables print an error message and stop the boot. Also add a build time check that the calculation of symbol offsets don't break alignment of passed addresses. The check could be performed earlier, but so far the alignment is required by the page tables, and hence feels more natural that the check lives near to the piece of code that requires it. Note that when booted as an EFI application from the PE entry point the alignment check is already performed by efi_arch_load_addr_check(), and hence there's no need to add another check at the point where page tables get built in efi_arch_memory_setup(). Signed-off-by: Roger Pau Monné <roger.pau@citrix.com> --- Changes since v1: - Use test instead of and instruction. - Add a build time check for sym_offs correctness. - Reword part of the commit message. --- xen/arch/x86/boot/head.S | 14 ++++++++++++++ 1 file changed, 14 insertions(+)