[build] Align sections to page boundaries

Allow PE section attributes to be used to inform page-level protection mechanisms such as W^X by aligning all sections to a page boundary. Aligning the payload to a page boundary causes it to no longer immediately follow the bzImage setup code. Allow for this padding when locating the start of the loaded-high payload to be copied to the runtime address. Signed-off-by: Michael Brown <[email protected]>
ipxe · Aug 16, 2023 · 1398b3e · 1398b3e
1 parent 7da4a1e
commit 1398b3e
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 7 deletions.
diff --git a/src/prefix.S b/src/prefix.S
@@ -39,6 +39,9 @@
 /** Sector size */
 #define SECTOR_SIZE 512
 
+/** Setup code length */
+#define SETUP_LEN ( ( SETUP_SECTS + 1 ) * SECTOR_SIZE )
+
 /** Protected-mode code will be loaded high */
 #define LOADED_HIGH 0x01
 
@@ -112,8 +115,8 @@ opt_header:
 	.long	( _data - BASE_ADDRESS ) /* BaseOfData */
 	.long	BASE_ADDRESS		/* ImageBase */
 #endif
-	.long	0x200			/* SectionAlignment */
-	.long	0x200			/* FileAlignment */
+	.long	0x1000			/* SectionAlignment */
+	.long	0x1000			/* FileAlignment */
 	.word	0			/* MajorOperatingSystemVersion */
 	.word	0			/* MinorOperatingSystemVersion */
 	.word	0			/* MajorImageVersion */
@@ -301,7 +304,7 @@ setup:
 	rep stosb
 
 	/* Copy payload to runtime address */
-	movl	$LOADED_HIGH_ADDRESS, %esi
+	movl	$( LOADED_HIGH_ADDRESS + _payload_pos - SETUP_LEN ), %esi
 	movl	$_payload, %edi
 	movl	$_payload_len, %ecx
 	cld
@@ -361,4 +364,4 @@ debug_rsds:
 	.equ	debug_rsds_len, . - debug_rsds
 	.size	debug_rsds,	. - debug_rsds
 
-	.org	( ( SETUP_SECTS + 1 ) * SECTOR_SIZE )
+	.org	SETUP_LEN
diff --git a/src/script.lds b/src/script.lds
@@ -1,7 +1,7 @@
 SECTIONS {
 
-	/* Align sections to keep PE tools happy */
-	alignment = 512;
+	/* Align sections to allow for page-level runtime protection */
+	alignment = 0x1000;
 
 	/* Virtual addresses start at 0x20000 */
 	. = 0x20000;
@@ -40,7 +40,8 @@ SECTIONS {
 	_bss16_len = ABSOLUTE ( _ebss16 ) - ABSOLUTE ( _bss16 );
 
 	/* Data (and 16-bit BIOS text) section */
-	_data_pos = ( _prefix_pos + _prefix_len );
+	_payload_pos = ( _prefix_pos + _prefix_len );
+	_data_pos = _payload_pos;
 	.data : AT ( _data_pos ) {
 		_data = .;
 		_payload = .;