Re: [PATCH v3] Avoid crash calling PrintErrMesg from efi_multiboot2

[Frediano Ziglio <frediano.ziglio@xxxxxxxxx>]

On Mon, Aug 19, 2024 at 3:14 PM Jan Beulich <jbeulich@xxxxxxxx> wrote:
>
> On 19.08.2024 16:02, Frediano Ziglio wrote:
> > On Mon, Aug 19, 2024 at 2:19 PM Jan Beulich <jbeulich@xxxxxxxx> wrote:
> >>
> >> On 19.08.2024 14:54, Frediano Ziglio wrote:
> >>> Although code is compiled with -fpic option data is not position
> >>> independent. This causes data pointer to become invalid if
> >>> code is not relocated properly which is what happens for
> >>> efi_multiboot2 which is called by multiboot entry code.
> >>>
> >>> Code tested adding
> >>>    PrintErrMesg(L"Test message", EFI_BUFFER_TOO_SMALL);
> >>> in efi_multiboot2 before calling efi_arch_edd (this function
> >>> can potentially call PrintErrMesg).
> >>>
> >>> Before the patch (XenServer installation on Qemu, xen replaced
> >>> with vanilla xen.gz):
> >>>   Booting `XenServer (Serial)'Booting `XenServer (Serial)'
> >>>   Test message: !!!! X64 Exception Type - 0E(#PF - Page-Fault)  CPU Apic 
> >>> ID - 00000000 !!!!
> >>>   ExceptionData - 0000000000000000  I:0 R:0 U:0 W:0 P:0 PK:0 SS:0 SGX:0
> >>>   RIP  - 000000007DC29E46, CS  - 0000000000000038, RFLAGS - 
> >>> 0000000000210246
> >>>   RAX  - 0000000000000000, RCX - 0000000000000050, RDX - 0000000000000000
> >>>   RBX  - 000000007DAB4558, RSP - 000000007EFA1200, RBP - 0000000000000000
> >>>   RSI  - FFFF82D040467A88, RDI - 0000000000000000
> >>>   R8   - 000000007EFA1238, R9  - 000000007EFA1230, R10 - 0000000000000000
> >>>   R11  - 000000007CF42665, R12 - FFFF82D040467A88, R13 - 000000007EFA1228
> >>>   R14  - 000000007EFA1225, R15 - 000000007DAB45A8
> >>>   DS   - 0000000000000030, ES  - 0000000000000030, FS  - 0000000000000030
> >>>   GS   - 0000000000000030, SS  - 0000000000000030
> >>>   CR0  - 0000000080010033, CR2 - FFFF82D040467A88, CR3 - 000000007EC01000
> >>>   CR4  - 0000000000000668, CR8 - 0000000000000000
> >>>   DR0  - 0000000000000000, DR1 - 0000000000000000, DR2 - 0000000000000000
> >>>   DR3  - 0000000000000000, DR6 - 00000000FFFF0FF0, DR7 - 0000000000000400
> >>>   GDTR - 000000007E9E2000 0000000000000047, LDTR - 0000000000000000
> >>>   IDTR - 000000007E4E5018 0000000000000FFF,   TR - 0000000000000000
> >>>   FXSAVE_STATE - 000000007EFA0E60
> >>>   !!!! Find image based on IP(0x7DC29E46) (No PDB)  
> >>> (ImageBase=000000007DC28000, EntryPoint=000000007DC2B917) !!!!
> >>>
> >>> After the patch:
> >>>   Booting `XenServer (Serial)'Booting `XenServer (Serial)'
> >>>   Test message: Buffer too small
> >>>   BdsDxe: loading Boot0000 "UiApp" from 
> >>> Fv(7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1)/FvFile(462CAA21-7614-4503-836E-8AB6F4662331)
> >>>   BdsDxe: starting Boot0000 "UiApp" from 
> >>> Fv(7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1)/FvFile(462CAA21-7614-4503-836E-8AB6F4662331)
> >>>
> >>> Fixes: 00d5d5ce23e6 ("work around Clang generating .data.rel.ro section 
> >>> for init-only files")
> >
> > ^^^^ here ??
>
> Did you not see ...
>
> >>> Signed-off-by: Frediano Ziglio <frediano.ziglio@xxxxxxxxx>
> >>> ---
> >>>  xen/common/efi/boot.c | 46 ++++++++++++++++++++++++++++++-------------
> >>>  1 file changed, 32 insertions(+), 14 deletions(-)
> >>> ---
> >>> Changes since v1:
> >>> - added "Fixes:" tag;
> >>> - fixed cast style change.
> >>>
> >>> Changes since v2:
> >>> - wrap long line.
> >>
> >> And what about the Fixes: tag?
>
> ... my respective v2 comment then? There I said:
>
> "I don't think this is right. While this is where the array was introduced,
>  it was correct at that time afaict. It went wrong when MB2 support was added
>  about a year later. 9180f5365524 ("x86: add multiboot2 protocol support for
>  EFI platforms") may be reasonable to blame, albeit I'm not sure that was the
>  final one, after which MB2 support was considered complete."
>
> Jan

Yes, missed, updated

Frediano