Re: [PATCH for-4.20 v5] Avoid crash calling PrintErrMesg from efi_multiboot2

[Frediano Ziglio <frediano.ziglio@xxxxxxxxx>]

ping

On Wed, Feb 5, 2025 at 11:40 AM Frediano Ziglio
<frediano.ziglio@xxxxxxxxx> wrote:
>
> On Wed, Feb 5, 2025 at 10:24 AM Oleksii Kurochko
> <oleksii.kurochko@xxxxxxxxx> wrote:
> >
> >
> > On 2/4/25 2:07 PM, Jan Beulich wrote:
> >
> > On 22.01.2025 11:14, Frediano Ziglio wrote:
> >
> > Although code is compiled with -fpic option data is not position
> > independent. This causes data pointer to become invalid if
> > code is not relocated properly which is what happens for
> > efi_multiboot2 which is called by multiboot entry code.
> >
> > Code tested adding
> >    PrintErrMesg(L"Test message", EFI_BUFFER_TOO_SMALL);
> > in efi_multiboot2 before calling efi_arch_edd (this function
> > can potentially call PrintErrMesg).
> >
> > Before the patch (XenServer installation on Qemu, xen replaced
> > with vanilla xen.gz):
> >   Booting `XenServer (Serial)'Booting `XenServer (Serial)'
> >   Test message: !!!! X64 Exception Type - 0E(#PF - Page-Fault)  CPU Apic ID 
> > - 00000000 !!!!
> >   ExceptionData - 0000000000000000  I:0 R:0 U:0 W:0 P:0 PK:0 SS:0 SGX:0
> >   RIP  - 000000007EE21E9A, CS  - 0000000000000038, RFLAGS - 0000000000210246
> >   RAX  - 000000007FF0C1B5, RCX - 0000000000000050, RDX - 0000000000000010
> >   RBX  - 0000000000000000, RSP - 000000007FF0C180, RBP - 000000007FF0C210
> >   RSI  - FFFF82D040467CE8, RDI - 0000000000000000
> >   R8   - 000000007FF0C1C8, R9  - 000000007FF0C1C0, R10 - 0000000000000000
> >   R11  - 0000000000001020, R12 - FFFF82D040467CE8, R13 - 000000007FF0C1B8
> >   R14  - 000000007EA33328, R15 - 000000007EA332D8
> >   DS   - 0000000000000030, ES  - 0000000000000030, FS  - 0000000000000030
> >   GS   - 0000000000000030, SS  - 0000000000000030
> >   CR0  - 0000000080010033, CR2 - FFFF82D040467CE8, CR3 - 000000007FC01000
> >   CR4  - 0000000000000668, CR8 - 0000000000000000
> >   DR0  - 0000000000000000, DR1 - 0000000000000000, DR2 - 0000000000000000
> >   DR3  - 0000000000000000, DR6 - 00000000FFFF0FF0, DR7 - 0000000000000400
> >   GDTR - 000000007F9DB000 0000000000000047, LDTR - 0000000000000000
> >   IDTR - 000000007F48E018 0000000000000FFF,   TR - 0000000000000000
> >   FXSAVE_STATE - 000000007FF0BDE0
> >   !!!! Find image based on IP(0x7EE21E9A) (No PDB)  
> > (ImageBase=000000007EE20000, EntryPoint=000000007EE23935) !!!!
> >
> > After the patch:
> >   Booting `XenServer (Serial)'Booting `XenServer (Serial)'
> >   Test message: Buffer too small
> >   BdsDxe: loading Boot0000 "UiApp" from 
> > Fv(7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1)/FvFile(462CAA21-7614-4503-836E-8AB6F4662331)
> >   BdsDxe: starting Boot0000 "UiApp" from 
> > Fv(7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1)/FvFile(462CAA21-7614-4503-836E-8AB6F4662331)
> >
> > This partially rollback commit 00d5d5ce23e6.
> >
> > Fixes: 9180f5365524 ("x86: add multiboot2 protocol support for EFI 
> > platforms")
> > Signed-off-by: Frediano Ziglio <frediano.ziglio@xxxxxxxxx>
> >
> > I expect we want this in before the release. Oleksii? Maintainers?
> >
> > Interesting it is a fix for a ~3 years old bug ( if to look at when 
> > 9180f5365524 is introduced ) so it seems it happens not often.
>
> I would say it's quite normal for booting messages, usually we expect
> them to work and not get errors, we are in a pretty "stable" state.
> The problem happens when there are some strange combinations of
> firmware bugs or behavior resulting in errors. There was a bug some
> time ago during the boot phase where a message would be helpful
> instead of a crash, but it exercised a different error path.
>
> > Anyway, I agree that we want this fix before the release:
> > R-Acked-by: Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>
> >
> > Thanks.
> >
> > ~ Oleksii
> >
> > Jan