From patchwork Thu Sep 19 08:00:19 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Frediano Ziglio X-Patchwork-Id: 13807476 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 388F3CE8D60 for ; Thu, 19 Sep 2024 08:00:57 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.800548.1210486 (Exim 4.92) (envelope-from ) id 1srC5c-0000BV-GX; Thu, 19 Sep 2024 08:00:36 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 800548.1210486; Thu, 19 Sep 2024 08:00:36 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1srC5c-0000BO-DG; Thu, 19 Sep 2024 08:00:36 +0000 Received: by outflank-mailman (input) for mailman id 800548; Thu, 19 Sep 2024 08:00:35 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1srC5b-00089h-2G for xen-devel@lists.xenproject.org; Thu, 19 Sep 2024 08:00:35 +0000 Received: from mail-ej1-x631.google.com (mail-ej1-x631.google.com [2a00:1450:4864:20::631]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id 3e06f027-765d-11ef-99a2-01e77a169b0f; Thu, 19 Sep 2024 10:00:31 +0200 (CEST) Received: by mail-ej1-x631.google.com with SMTP id a640c23a62f3a-a90188ae58eso63656766b.1 for ; Thu, 19 Sep 2024 01:00:31 -0700 (PDT) Received: from fziglio-desktop.. ([185.25.67.249]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a90612b3833sm686196966b.128.2024.09.19.01.00.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 19 Sep 2024 01:00:30 -0700 (PDT) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 3e06f027-765d-11ef-99a2-01e77a169b0f DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloud.com; s=cloud; t=1726732831; x=1727337631; darn=lists.xenproject.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=/5XBTlP1TXEcRRwDcvdfbc6Qq+ncvIdAbw/WbPBlRnI=; b=LHfia2+e3S9pvMXM47L5mbcWDlea9AReM6Rh4ndg9xLrt5h7SRAe4z33xNA1MubsIx 3e6jyw7xlt2JgIuPoIW3rHk5FgHgk9X8y/5/F/4fWHRokbqttCRv7uSod8gU7lFZgJsO xr7uomfjmr234AF5Zh8gHm+PT34NnhjekUjew= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1726732831; x=1727337631; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=/5XBTlP1TXEcRRwDcvdfbc6Qq+ncvIdAbw/WbPBlRnI=; b=YlmLrK/XVyi0Os6mzYnnMD/SoG7FR9cZRiU/0HeM5P6QxAaktLeTMhG9lqVxPAgImj oWh3on4w/hoLjqiPC3MN7Ugq0OngdI+nMgvry+I9iKGwGRzYLnqH1jWi+9pgW5+xluhI wOPsJKQFLdpgMposgbPz7B20vyop+31Vou2JpspKYUTC9Y4WfbbNX2MWThmPNLcCFpWr ArVVWTpiYepZEF4JvNej3GQtywTN+2m6Fe5fD4OtJVIJXJXS/evubcnuRWZ3ZWhF3+gM eyYPBkwkaQ3DlBuK3wvu6yG9SKRhOWkEC8w5Os81beNgEoApWVKtULTbMDqEtLi5XMa0 nVQg== X-Gm-Message-State: AOJu0YyA1rFj8cyUq0Q/FxbNoYPv3c5M8QW8mL/MX7kpGcy1BPvU7zr5 SwflzD6BtGdbnfXBdeCXFwA6sxnEaOYTr5WU28fzQLR9SS6SBNsPvcdYvTSpT24OGHKPqW6pqsk x X-Google-Smtp-Source: AGHT+IESGS6X3JslvnpPsVjgHFuxRffa1ThI9Aoww6Jzb8p67+KQwdu33i5O57wA0HpSwxon7ulsuQ== X-Received: by 2002:a17:906:fd8b:b0:a8a:792c:4116 with SMTP id a640c23a62f3a-a902961a5f8mr2292692366b.40.1726732830857; Thu, 19 Sep 2024 01:00:30 -0700 (PDT) From: Frediano Ziglio To: xen-devel@lists.xenproject.org Cc: Frediano Ziglio , Jan Beulich , Andrew Cooper , =?utf-8?q?Roger_Pau_Monn=C3=A9?= Subject: [PATCH v4 1/3] x86: Put trampoline in separate .init.trampoline section Date: Thu, 19 Sep 2024 09:00:19 +0100 Message-Id: <20240919080021.20155-2-frediano.ziglio@cloud.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240919080021.20155-1-frediano.ziglio@cloud.com> References: <20240919080021.20155-1-frediano.ziglio@cloud.com> MIME-Version: 1.0 This change put the trampoline in a separate, not executable section. The trampoline contains a mix of code and data (data which is modified from C code during early start so must be writable). This is in preparation for W^X patch in order to satisfy UEFI CA memory mitigation requirements. At the moment .init.text and .init.data in EFI mode are put together so they will be in the same final section as before this patch. Putting in a separate section (even in final executables) allows to easily disassembly that section. As we need to have a writable section and as we can't have code and data together to satisfy W^X requirement we need to have a data section. However tools like objdump by default do not disassemble data sections. Forcing disassembly of data sections would result in a very large output and possibly crash of tools. Putting in a separate section allows to selectively disassemble that part of code using a command like objdump -m i386 -j .init.trampoline -d xen-syms Signed-off-by: Frediano Ziglio --- Changes since last version: - use completely separate section even on final executables (suggested by Jan Beulich). Changes since v1: - remove useless align. Changes since v2: - remove change to alignment; - improved commit message. Changes since v3: - split commit, add more requirements. --- xen/arch/x86/boot/head.S | 5 +++-- xen/arch/x86/xen.lds.S | 4 ++++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/boot/head.S b/xen/arch/x86/boot/head.S index 12bbb97f33..493286a9fb 100644 --- a/xen/arch/x86/boot/head.S +++ b/xen/arch/x86/boot/head.S @@ -882,8 +882,9 @@ cmdline_parse_early: reloc: .incbin "reloc.bin" +#include "x86_64.S" + + .section .init.trampoline, "aw", @progbits ENTRY(trampoline_start) #include "trampoline.S" ENTRY(trampoline_end) - -#include "x86_64.S" diff --git a/xen/arch/x86/xen.lds.S b/xen/arch/x86/xen.lds.S index d48de67cfd..22fb7d8458 100644 --- a/xen/arch/x86/xen.lds.S +++ b/xen/arch/x86/xen.lds.S @@ -269,6 +269,10 @@ SECTIONS __ctors_end = .; } PHDR(text) + DECL_SECTION(.init.trampoline) { + *(.init.trampoline) + } PHDR(text) + #ifndef EFI /* * With --orphan-sections=warn (or =error) we need to handle certain linker From patchwork Thu Sep 19 08:00:20 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Frediano Ziglio X-Patchwork-Id: 13807473 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id EC9ECCE8D5D for ; Thu, 19 Sep 2024 08:00:53 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.800549.1210491 (Exim 4.92) (envelope-from ) id 1srC5c-0000DU-OK; Thu, 19 Sep 2024 08:00:36 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 800549.1210491; Thu, 19 Sep 2024 08:00:36 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1srC5c-0000D2-KN; Thu, 19 Sep 2024 08:00:36 +0000 Received: by outflank-mailman (input) for mailman id 800549; Thu, 19 Sep 2024 08:00:35 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1srC5b-00089h-8t for xen-devel@lists.xenproject.org; Thu, 19 Sep 2024 08:00:35 +0000 Received: from mail-ed1-x52e.google.com (mail-ed1-x52e.google.com [2a00:1450:4864:20::52e]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id 3e84af72-765d-11ef-99a2-01e77a169b0f; Thu, 19 Sep 2024 10:00:32 +0200 (CEST) Received: by mail-ed1-x52e.google.com with SMTP id 4fb4d7f45d1cf-5c42bd0386cso700801a12.2 for ; Thu, 19 Sep 2024 01:00:32 -0700 (PDT) Received: from fziglio-desktop.. ([185.25.67.249]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a90612b3833sm686196966b.128.2024.09.19.01.00.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 19 Sep 2024 01:00:31 -0700 (PDT) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 3e84af72-765d-11ef-99a2-01e77a169b0f DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloud.com; s=cloud; t=1726732832; x=1727337632; darn=lists.xenproject.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=wlJV860CHFIhZUFAaTj7LRdFO7tQVpGEeYCyJLyCLTE=; b=KoOHRS8F6HjQkAnSy8wJ64qoCiAuLg5lvxM5MvnVX/edg+uQqTF3FoUY1Y37+OeCjK r7Kt8F5U9kfNl4Dxncvg/9csMoxRpPOlbhnchWjvLajf1PVRZbHj83W8UsaStD2nZnqA JBl6gYoZjOzd+wMOY0HKgMK5Ori3CaJk+ruGM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1726732832; x=1727337632; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=wlJV860CHFIhZUFAaTj7LRdFO7tQVpGEeYCyJLyCLTE=; b=KB+hDwkOh5/oyyRXB91sUSv/z31Y4jeH8nhBHf9GVKfaFSXK9uR0ZaaaMaQVQLwtkr yYKQ8WPtWfT5LvvjhYg5CdBSGpQfwv2sRsRz6SMpUqcnWVBjcx25w0RNYR1hkW78PBfg 70mQahxDDo+9jdDb6g1ZmOrCYKrw00wV+M4LRzwuASozaSh86xdQ58bbNpRaI1wywlod IvbCZcfxMJot85Zn+hr4zJnBzycgZ5fu6wq2ThNxNgPpvpnnSUoqFMBCGU1tkkNAzqDY BTYgGOAGd9zG1lEJx2TKmvHHbDG3/Jio9z+zIwrOTFo7uUgkJh+x8OlGADyeDu9B9+62 cMgQ== X-Gm-Message-State: AOJu0Yy8B/btGBWvad93Sn8qut4j0efLaDKf121VhqYEgfILmd8JpsZ5 5N8RhQo9cWvECnTTA9ftw6GaTaLdL5iGaVd7faho7J+KEeZx01Tm+OaI+AtToABFPyGQvmN0mu3 3 X-Google-Smtp-Source: AGHT+IFuM1neyyvkiv8/7X9CBi7JjqlypIO++ycMpb0mRa3IK/kvKtWpocgbbS+asR8PGMc1YflBag== X-Received: by 2002:a17:906:794d:b0:a8b:154b:7643 with SMTP id a640c23a62f3a-a90295a2e51mr2608125366b.28.1726732831744; Thu, 19 Sep 2024 01:00:31 -0700 (PDT) From: Frediano Ziglio To: xen-devel@lists.xenproject.org Cc: Frediano Ziglio , Jan Beulich , Andrew Cooper , =?utf-8?q?Roger_Pau_Monn=C3=A9?= Subject: [PATCH v4 2/3] x86: Split output sections for UEFI CA memory mitigation requirements Date: Thu, 19 Sep 2024 09:00:20 +0100 Message-Id: <20240919080021.20155-3-frediano.ziglio@cloud.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240919080021.20155-1-frediano.ziglio@cloud.com> References: <20240919080021.20155-1-frediano.ziglio@cloud.com> MIME-Version: 1.0 Split code and data to satisfy W^X requirement. Signed-off-by: Frediano Ziglio Acked-by: Jan Beulich --- xen/arch/x86/xen.lds.S | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/xen/arch/x86/xen.lds.S b/xen/arch/x86/xen.lds.S index 22fb7d8458..b0b952dd9c 100644 --- a/xen/arch/x86/xen.lds.S +++ b/xen/arch/x86/xen.lds.S @@ -194,11 +194,7 @@ SECTIONS __2M_init_start = .; /* Start of 2M superpages, mapped RWX (boot only). */ . = ALIGN(PAGE_SIZE); /* Init code and data */ __init_begin = .; -#ifdef EFI /* EFI wants to merge all of .init.* ELF doesn't. */ - DECL_SECTION(.init) { -#else DECL_SECTION(.init.text) { -#endif _sinittext = .; *(.init.text) *(.text.startup) @@ -210,12 +206,9 @@ SECTIONS */ *(.altinstr_replacement) -#ifdef EFI /* EFI wants to merge all of .init.* ELF doesn't. */ - . = ALIGN(SMP_CACHE_BYTES); -#else } PHDR(text) + DECL_SECTION(.init.data) { -#endif *(.init.bss.stack_aligned) . = ALIGN(POINTER_ALIGN); From patchwork Thu Sep 19 08:00:21 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Frediano Ziglio X-Patchwork-Id: 13807475 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 2FB0FCE8D5C for ; Thu, 19 Sep 2024 08:00:57 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.800547.1210476 (Exim 4.92) (envelope-from ) id 1srC5b-0008OF-9Q; Thu, 19 Sep 2024 08:00:35 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 800547.1210476; Thu, 19 Sep 2024 08:00:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1srC5b-0008O8-5k; Thu, 19 Sep 2024 08:00:35 +0000 Received: by outflank-mailman (input) for mailman id 800547; Thu, 19 Sep 2024 08:00:34 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1srC5a-00089b-6b for xen-devel@lists.xenproject.org; Thu, 19 Sep 2024 08:00:34 +0000 Received: from mail-ej1-x62f.google.com (mail-ej1-x62f.google.com [2a00:1450:4864:20::62f]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 3f2bcf75-765d-11ef-a0b8-8be0dac302b0; Thu, 19 Sep 2024 10:00:33 +0200 (CEST) Received: by mail-ej1-x62f.google.com with SMTP id a640c23a62f3a-a8d43657255so75177166b.0 for ; Thu, 19 Sep 2024 01:00:33 -0700 (PDT) Received: from fziglio-desktop.. ([185.25.67.249]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a90612b3833sm686196966b.128.2024.09.19.01.00.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 19 Sep 2024 01:00:32 -0700 (PDT) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 3f2bcf75-765d-11ef-a0b8-8be0dac302b0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloud.com; s=cloud; t=1726732833; x=1727337633; darn=lists.xenproject.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=LC8M6s/MVpQRIQSwMvY2TOhq+jsgpFyl0gaX8hEkFeg=; b=Bqxnlq65gXEBY8AvxRAWX5V7JSmWJl24yDTY1v2oEnc3gf0Z+kxpvNPDtpDczd8Nid zUrq9bjh/YrXdkN601hc3JKQi/X8H2u8o6MgzfnpxENszxcdSGs96oZCfVAPJMj0IygD ydnIIkTT9ywWtBDgbY2wnfBPDuw8yupIrtaBo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1726732833; x=1727337633; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=LC8M6s/MVpQRIQSwMvY2TOhq+jsgpFyl0gaX8hEkFeg=; b=DaxWU7x/PpnFr4Za3K1nQGGnooCq+6ZjJuO4WCiAtCLvRVQQLOELGscqqk6HPGHXGx XiJMJ10o4OdgoI6SV1JhK73p9WMaLs1QNxO0pzFAMEXvP2LFfflNhrNmVziWrvdC2+Av QMyep97FEprrkjp7OmZlojHYvjRvNnkN/o/BtwFjiAEyzSlSag6Gucn/uK3SufINhx8p dIAZQoesrswjPa6Skr0isNtJzm8sf13k8cqcFNHfGSH3AfZfDmNe+sM0YIFV40DZX+W7 3F379b9sVRMdIhzWsVraysW+B3W4pI1ECQ5g2m43rG0GyHvFPqWtoQMN+zFlocr40HRr 7NEw== X-Gm-Message-State: AOJu0YytPkNmgd07tecADuyA49Sbe3htdCjhtPy/HeeSHbQWA2SDef1O hKuIa8mqWAkk1eGrt2xSEtutU2iV3qmm+SgI8FDuWcqi7A9+yr5ZZv/YMjAvNPzEoTl6YbzJ8lN W X-Google-Smtp-Source: AGHT+IGOsZNYCuv/0HbieXRUQDMoMUEOCgm6cKCkRH3yQfSv2nuJkEEBFPCrsnP8EALdPW7R9A9HHA== X-Received: by 2002:a17:907:60cd:b0:a7a:9144:e23a with SMTP id a640c23a62f3a-a904804371dmr1973443666b.43.1726732832925; Thu, 19 Sep 2024 01:00:32 -0700 (PDT) From: Frediano Ziglio To: xen-devel@lists.xenproject.org Cc: Frediano Ziglio , Jan Beulich , Andrew Cooper , =?utf-8?q?Roger_Pau_Monn=C3=A9?= Subject: [PATCH v4 3/3] x86: Align output sections for UEFI CA memory mitigation requirements Date: Thu, 19 Sep 2024 09:00:21 +0100 Message-Id: <20240919080021.20155-4-frediano.ziglio@cloud.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240919080021.20155-1-frediano.ziglio@cloud.com> References: <20240919080021.20155-1-frediano.ziglio@cloud.com> MIME-Version: 1.0 All loadable sections should be page aligned. Signed-off-by: Frediano Ziglio --- xen/arch/x86/xen.lds.S | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/xen/arch/x86/xen.lds.S b/xen/arch/x86/xen.lds.S index b0b952dd9c..ef446e0a71 100644 --- a/xen/arch/x86/xen.lds.S +++ b/xen/arch/x86/xen.lds.S @@ -208,6 +208,10 @@ SECTIONS } PHDR(text) +#ifdef EFI + /* align to satisfy UEFI CA memory mitigation */ + . = ALIGN(PAGE_SIZE); +#endif DECL_SECTION(.init.data) { *(.init.bss.stack_aligned) @@ -262,6 +266,10 @@ SECTIONS __ctors_end = .; } PHDR(text) +#ifdef EFI + /* align to satisfy UEFI CA memory mitigation */ + . = ALIGN(PAGE_SIZE); +#endif DECL_SECTION(.init.trampoline) { *(.init.trampoline) } PHDR(text)