From nobody Tue Aug 25 00:44:42 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1783334803; cv=none; d=zohomail.com; s=zohoarc; b=aJeX8ig+r9X9qAQabeP/m8GeG8t/QNccNDOZraNUobGA/hP32+Hz6xuYz5P6vRjGkQxUgZtrG3zLu0ihzZFmWtL/J1rGrGWytHA7H1VCwN60RlK+/fi6aZ3CC/EojXPk7Gri+bB9n+6QLGXVz7y2RjXPSKxiT3eYN7Txrp1GpcM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783334803; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ia93IaiRGnVFsVP6/iZrBYXvaYw/rZ06cLV16cU84oM=; b=hsvb/9G17fMJH9asCQ3irstZa4RRxd23k59PRHfh82DI2+Y04HZ6jfArV8NjhMdFQkhEyIsto3PNswK4rOhjY06qWFWFkkwLpVU9tOHd9hrKgH4jNHgUx945MFJvzf1Gf/wTapCM2YcjBifXBwcGCkTPaBwXCLzUhWbqKdjf/K8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1783334803895565.6712840841566; Mon, 6 Jul 2026 03:46:43 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1355305.1610099 (Exim 4.92) (envelope-from ) id 1wggq3-0003Hx-DL; Mon, 06 Jul 2026 10:46:11 +0000 Received: by outflank-mailman (output) from mailman id 1355305.1610099; Mon, 06 Jul 2026 10:46:11 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wggq3-0003HZ-A8; Mon, 06 Jul 2026 10:46:11 +0000 Received: by outflank-mailman (input) for mailman id 1355305; Mon, 06 Jul 2026 10:46:10 +0000 Received: from mx.expurgate.net ([195.190.135.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wggq2-0002ch-0b for xen-devel@lists.xenproject.org; Mon, 06 Jul 2026 10:46:10 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wggq1-00HA6J-DT for xen-devel@lists.xenproject.org; Mon, 06 Jul 2026 12:46:09 +0200 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a4b876b-e002-0a2a0a5209dd-0a2a4501c908-14 for ; Mon, 06 Jul 2026 12:46:09 +0200 Received: from [209.85.128.50] (helo=mail-wm1-f50.google.com) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6a4b8771-400f-0a2a45010019-d1558032e1f4-3 for ; Mon, 06 Jul 2026 12:46:09 +0200 Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-493c83474ddso26424155e9.3 for ; Mon, 06 Jul 2026 03:46:09 -0700 (PDT) Received: from localhost.localdomain (2.115.147.147.dyn.plus.net. [147.147.115.2]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-493c63ba97csm349823985e9.12.2026.07.06.03.46.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Jul 2026 03:46:08 -0700 (PDT) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=20251104 header.d=gmail.com header.i="@gmail.com" header.h="Content-Transfer-Encoding:Content-Type:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783334769; x=1783939569; darn=lists.xenproject.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=ia93IaiRGnVFsVP6/iZrBYXvaYw/rZ06cLV16cU84oM=; b=bL2qnVfwcZJ+nmzugoVfEsDe0ytVgSdT0xg9GvcGl02/kuvCWbGAczdqU0p1XTfrI8 ApwuedtLgDV9Toyx6imse19CxjRwwp/4nmz54BxvK/pEH58i0v+p0vihyXUQqBTF9v20 KvBy7QaojIsyY3TABb3qsftPpkbQ9TKTY0sueEqxa3wJAMGQ79XA5q6WR0EhTY3kQtT9 wP/K2bI78VDV0+QvJZdoZ862wZ4VymTBe4LFYI98qeX5/o7d6cmuMzV/76QwFKeipiPg PsBlW1MelgsWLgmvwg6+H4IYfgc1MSgZzVTCLeHDAiXH+qR51ZYxLi1RKJH7kGZVEnYf KrKw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783334769; x=1783939569; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=ia93IaiRGnVFsVP6/iZrBYXvaYw/rZ06cLV16cU84oM=; b=b/Id4pi2U/je3R8Id6vZ2PkyLoizxVkQOHaQJHVpGrySfOcpTV5UpT7mbtKsP6fp0C 3QXBWzU3+ipkteAP3HDKCkng4zuqWTuBJy+TMpnn8WQoPYM2XNs09MTqdfZFuuzUFjNh E211riUHHm6NCjAUGpl4usDxqmXSUM/XTRoeVLIGLt6NCc6S7gheh9XMHfwA0PP5hroi soYwRYmF3nlYdmC5IZX53F5QvWggXztNr2yGyf92PcX6mJnhBS5JNhDqk+fNu9EGtfVz y8D1zIMId8xFB82Zh9vGN5W20I1sQkEFTOH0vD8Ob1GAUeBt6XVwXRyh62XM3YSTmO1S L1fQ== X-Gm-Message-State: AOJu0YyHN8w0BLRSVhVIDB5dp7vBt7AYTrvffniIc6grvNSwTId1YUuz sCXRNaL3KUO3dalcARQ8mOiqpC1GE2n9Jn+wuPwumylHW7J4wzY81UB7Ly0BO94dBDY= X-Gm-Gg: AfdE7clpLDTlgz2zlMKGYSxQHseczWymL7Ei/jVqxUTuwsWfHtXXaDVUtoos7Qd0+9c kYGEw3PyfLPtm+rqh2VhvRsE5pcVriqL69q560umetucflF11IAPV+rz+64kkAdUpUjXE3MnQ2E G91AyTVRA2Z1nOF+82DZqhK5E5wuwYlEtk7exdNXR+I64qzlRHTGnQ/ts9eNmq+dDVZgJALjvC9 P9f0spSlPCWk8DVxznaHT/cew4o9NHnIZDzAbyeoghV2e1/JY13sdRWJeB6CK8QsAV/DNJ9T4Bx SSPSvmd0f1pfrWk3KpMY2DnBnFFin20Qt7+ujfCLVcx48ZgrJe+7RruslbvMNQYzRTAWBDaQlqC yiM+U30/tWwV2XMDgAY8tTmaTN13F1MZWwoFc+K/q7GCL/HOBsZq+1Ga2rVCp2/uf804YfhDLg9 pVjSr01qFwAd0cQFvHT2puZB23v6+y/xHE7zyk63gOxmY3npAjVY1PQLsgN7DV2ijEWGnlj8gHO Z/YVFCBsWne3zEsCs0= X-Received: by 2002:a05:600c:2282:b0:492:5bb6:6d4b with SMTP id 5b1f17b1804b1-493d11fb775mr86459585e9.34.1783334768506; Mon, 06 Jul 2026 03:46:08 -0700 (PDT) From: Frediano Ziglio X-Google-Original-From: Frediano Ziglio To: xen-devel@lists.xenproject.org Cc: Frediano Ziglio , Jan Beulich , Andrew Cooper , =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= , Teddy Astie , =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= , Frediano Ziglio Subject: [PATCH v7 4/4] x86: Split .init section to satisfy UEFI CA memory mitigation Date: Mon, 6 Jul 2026 11:45:57 +0100 Message-ID: <20260706104557.430097-5-frediano.ziglio@citrix.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260706104557.430097-1-frediano.ziglio@citrix.com> References: <20260706104557.430097-1-frediano.ziglio@citrix.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-purgate-ID: tlsNG-d62444/1783334769-82CC61E0-829AF86F/0/0 X-purgate-type: clean X-purgate-size: 1957 X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1783334806273158500 From: Frediano Ziglio Currently .init section is both writeable and executable, split data and co= de to have 2 sections satisfying W^X rule. It is a requirement for NX_COMPAT so the PE can be loaded with W^X perms in the pagetables. NX_COMPAT is a requirement from shim-review, https://github.com/rhboot/shim-review#do-you-have-the-nx-bit-set-in-your-sh= im-if-so-is-your-entire-boot-stack-nx-compatible-and-what-testing-have-you-= done-to-ensure-such-compatibility Signed-off-by: Frediano Ziglio Acked-by: Marek Marczykowski-G=C3=B3recki Acked-by: Jan Beulich --- Change since v1: - update comment style. Changes since v3: - Added Acked-by. Changes since v4: - Added Acked-by. --- xen/arch/x86/xen.lds.S | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/xen/arch/x86/xen.lds.S b/xen/arch/x86/xen.lds.S index 4ed1d2bec1..e26e37db13 100644 --- a/xen/arch/x86/xen.lds.S +++ b/xen/arch/x86/xen.lds.S @@ -193,11 +193,7 @@ SECTIONS __2M_init_start =3D .; /* Start of 2M superpages, mapped RWX (bo= ot only). */ . =3D ALIGN(PAGE_SIZE); /* Init code and data */ __init_begin =3D .; -#ifdef EFI /* EFI wants to merge all of .init.* ELF doesn't. */ - DECL_SECTION(.init) { -#else DECL_SECTION(.init.text) { -#endif _sinittext =3D .; *(.init.multiboot) *(.init.text) @@ -210,12 +206,12 @@ SECTIONS */ *(.altinstr_replacement) =20 -#ifdef EFI /* EFI wants to merge all of .init.* ELF doesn't. */ - . =3D ALIGN(SMP_CACHE_BYTES); -#else } PHDR(text) - DECL_SECTION(.init.data) { +#ifdef EFI + /* Align to satisfy UEFI CA memory mitigation. */ + . =3D ALIGN(SECTION_ALIGN); #endif + DECL_SECTION(.init.data) { *(.init.bss.stack_aligned) *(.init.data.page_aligned) =20 --=20 2.43.0