From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3784ECDE016 for ; Fri, 26 Jun 2026 12:37:33 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.1346120.1604637 (Exim 4.92) (envelope-from ) id 1wd5nt-00046X-VT; Fri, 26 Jun 2026 12:37:05 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1346120.1604637; Fri, 26 Jun 2026 12:37:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wd5nt-00046L-RV; Fri, 26 Jun 2026 12:37:05 +0000 Received: by outflank-mailman (input) for mailman id 1346120; Fri, 26 Jun 2026 12:37:05 +0000 Received: from mx.expurgate.net ([195.190.135.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wd5nt-00046F-8E for xen-devel@lists.xenproject.org; Fri, 26 Jun 2026 12:37:05 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wd5ns-008INd-Kt for xen-devel@lists.xenproject.org; Fri, 26 Jun 2026 14:37:04 +0200 Received: from [10.42.69.8] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a3e726d-e002-0a2a0a5209dd-0a2a4508b3e4-8 for ; Fri, 26 Jun 2026 14:37:04 +0200 Received: from [209.85.128.45] (helo=mail-wm1-f45.google.com) by tlsNG-c1860d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6a3e7270-edec-0a2a45080019-d155802dc930-3 for ; Fri, 26 Jun 2026 14:37:04 +0200 Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-49241896317so4658705e9.3 for ; Fri, 26 Jun 2026 05:37:04 -0700 (PDT) Received: from localhost.localdomain (8.17.6.51.dyn.plus.net. [51.6.17.8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49268ff1be9sm76578835e9.8.2026.06.26.05.37.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Jun 2026 05:37:03 -0700 (PDT) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=20251104 header.d=gmail.com header.i="@gmail.com" header.h="Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782477424; x=1783082224; darn=lists.xenproject.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=SZ5oq/h6Ct/bubpgcFsVwUap/Y9yiAwC2oUUawjmI68=; b=l9m5imnYUPZGohIf2QU0qVmhqxhtLCQxR3jx3II/9h2WAZRUkQJcDZCjAzXkUdSKQ7 zWDKygena+02bFBKRCUf649gv+Si2LERDMxcDuSQsb7EuO5JJRxdPVn5/cnWYXIjN3iQ tUNMS5s4v40X552mTk0Lh8m17Qp88e9u3/+Rlim2iU3o9zT7oJVCO3AVWnYmRwVtIMD9 3OzPkL1W386FDR61B+8QafSLBAgpSEHi0R2MaNlhY64y+uIX/arjnrgYhtBsb9NiI0WM U9fibYWTb/WosovCSRLYNvK3LmH8OERg8pFNOwdAgUm2dzPLDTMMRgPuUR050Ij/tAHq Mriw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782477424; x=1783082224; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=SZ5oq/h6Ct/bubpgcFsVwUap/Y9yiAwC2oUUawjmI68=; b=FOQE5zeJlDYMUPG/5AApOE5LULSZEu4JZXyyp8Be6gHzK/IvIUdzyoSQbMPwuHqZPw dooG+mnBnOru8gN6ZmMZyUfa21Q+2PlcKZWtomPBriHBwlYuynoYFPVTt6USg//uSYvo VcJWWfKWtl5RRImGq1undMn0ndtuR+tRmO+ZH7HdPnwI3TpwyjE4q6H9twQGU4Y5BJu2 3J+tvvYVpFew2HdFpyHBnGOKmvf/oTzDF3f45oxrvgYpes46MlfPUq9oezTxtB8N7Wm1 4UV3kNAO8J100jGYwHPf+pa/WFmcTpae8QP+NyzMs3TWUUziCIJ405snjBrO+SeKpuza x26w== X-Gm-Message-State: AOJu0YyKbrrTRQY2FZjnGhnEwwXgRDa9T7N6xH1c54EfWdOgvOqeWVCX W2DbqptIIUeAt6tqXGfMLZjrc5hLoH8/cXeb1RTupzWBt5JKqte/TWBhR+DofgwA0Sc= X-Gm-Gg: AfdE7ck1Q0TduYZDbSKdnnZbJ4T4hLMG4BNVSvZbxlrK7eHLckbHQV0RD15Al2Ys4bW iOvEupidhgwe3jkNdMCO50emymYUCNLq6Sc1XZLAdON789HtnzyB60ytE5chJIEjppIvNkcP1id +CB1uQN0s0Fucod7pmeFbQF7ajCp31ZiIxwx9I7FvjJgqN6rSbTR7p7zRCRQNtisiFNebNPjezI J9+aRsJY40ynds6Gb26E6/ZslT3OndPfvabrfZUVO2CtKuJXj1Vc5dBuEDDguZ5BA9sldptYAMn 9V78rRTtBZb0XqAVyiju+187ezRRwdr/6HSVp5OFG3TmrQgJGcFRQgapzlJIyJQE8QJltaHDTKP idt4+IMENBCqp5OFEVGcGH62ww20WZzh1HUJ9ZTNkqqBKDNqC5gg57knFTXgQGVqRTg6ioHNa3e 1zka7LsTwU81Ju2e4emK9Il6OWDa9+N0meP3/mMGutNJcrUPCzj5n9S19aPxBETHhAjQdQUWVkR V9ACDgD X-Received: by 2002:a05:600c:8b4b:b0:492:3d05:5639 with SMTP id 5b1f17b1804b1-492668945eamr90594455e9.36.1782477423934; Fri, 26 Jun 2026 05:37:03 -0700 (PDT) From: Frediano Ziglio X-Google-Original-From: Frediano Ziglio To: xen-devel@lists.xenproject.org Cc: Frediano Ziglio , Jan Beulich , Andrew Cooper , =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= , Teddy Astie , =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= , Frediano Ziglio Subject: [PATCH v5 1/5] Align relevant sections to 4KB Date: Fri, 26 Jun 2026 13:36:41 +0100 Message-ID: <20260626123645.229375-2-frediano.ziglio@citrix.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260626123645.229375-1-frediano.ziglio@citrix.com> References: <20260626123645.229375-1-frediano.ziglio@citrix.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-purgate-ID: tlsNG-c1860d/1782477424-411293FC-B7135E53/0/0 X-purgate-type: clean X-purgate-size: 2075 From: Frediano Ziglio Required by UEFI CA memory mitigation. It is a requirement for NX_COMPAT so the PE can be loaded with W^X perms in the pagetables. NX_COMPAT is a requirement from shim-review, https://github.com/rhboot/shim-review#do-you-have-the-nx-bit-set-in-your-shim-if-so-is-your-entire-boot-stack-nx-compatible-and-what-testing-have-you-done-to-ensure-such-compatibility Sections with different permissions must be in separate pages. In the case of debug sections they are contiguous and have the same permissions, including the immediately preceding .reloc section, so it's not an issue if they are not aligned to the page. Before the .debug sections you could have the .reloc or the SBAT section, either are permission-compatible. Signed-off-by: Frediano Ziglio Acked-by: Marek Marczykowski-Górecki Acked-by: Jan Beulich -- Changes since v1: - Change subject. Changes since v2: - Improved commit message and subject. Changes since v3: - Added Acked-by; - Improved commit message. Changes since v4: - Added missing comment; - Added Acked-by. --- xen/arch/x86/xen.lds.S | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/xen.lds.S b/xen/arch/x86/xen.lds.S index b9e888e596..8e63cf5bc2 100644 --- a/xen/arch/x86/xen.lds.S +++ b/xen/arch/x86/xen.lds.S @@ -162,8 +162,8 @@ SECTIONS __note_gnu_build_id_end = .; } PHDR(note) PHDR(text) #elif defined(BUILD_ID_EFI) - /* Workaround bug in binutils < 2.36 */ - . = ALIGN(32); + /* Align to satisfy UEFI CA memory mitigation. */ + . = ALIGN(PAGE_SIZE); DECL_SECTION(.buildid) { __note_gnu_build_id_start = .; *(.buildid) @@ -330,6 +330,8 @@ SECTIONS __2M_rwdata_end = ALIGN(SECTION_ALIGN); #ifdef EFI + /* Align to satisfy UEFI CA memory mitigation. */ + . = ALIGN(PAGE_SIZE); .reloc ALIGN(4) : { __base_relocs_start = .; *(.reloc) -- 2.43.0