x86/boot/compressed/64: Validate trampoline placement against E820

There were two report of boot failure cased by trampoline placed into
a reserved memory region. It can happen on machines that don't report
EBDA correctly.

Fix the problem by re-validating the found address against the E820 table.
If the address is in a reserved area, find the next usable region below the
initial address.

Fixes: 3548e131ec6a ("x86/boot/compressed/64: Find a place for 32-bit trampoline")
Reported-by: Dmitry Malkin <d.malkin@real-time-systems.com>
Reported-by: youling 257 <youling257@gmail.com>
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Link: https://lkml.kernel.org/r/20180801133225.38121-1-kirill.shutemov@linux.intel.com

1 files changed, 55 insertions, 18 deletions

diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compressed/pgtable_64.c
index 8c5107545251..9e2157371491 100644
--- a/arch/x86/boot/compressed/pgtable_64.c
+++ b/arch/x86/boot/compressed/pgtable_64.c
@@ -1,3 +1,4 @@
+#include <asm/e820/types.h>
 #include <asm/processor.h>
 #include "pgtable.h"
 #include "../string.h"
@@ -34,10 +35,62 @@ unsigned long *trampoline_32bit __section(.data);
 extern struct boot_params *boot_params;
 int cmdline_find_option_bool(const char *option);
 
+static unsigned long find_trampoline_placement(void)
+{
+        unsigned long bios_start, ebda_start;
+        unsigned long trampoline_start;
+        struct boot_e820_entry *entry;
+        int i;
+
+        /*
+         * Find a suitable spot for the trampoline.
+         * This code is based on reserve_bios_regions().
+         */
+
+        ebda_start = *(unsigned short *)0x40e << 4;
+        bios_start = *(unsigned short *)0x413 << 10;
+
+        if (bios_start < BIOS_START_MIN || bios_start > BIOS_START_MAX)
+                bios_start = BIOS_START_MAX;
+
+        if (ebda_start > BIOS_START_MIN && ebda_start < bios_start)
+                bios_start = ebda_start;
+
+        bios_start = round_down(bios_start, PAGE_SIZE);
+
+        /* Find the first usable memory region under bios_start. */
+        for (i = boot_params->e820_entries - 1; i >= 0; i--) {
+                entry = &boot_params->e820_table[i];
+
+                /* Skip all entries above bios_start. */
+                if (bios_start <= entry->addr)
+                        continue;
+
+                /* Skip non-RAM entries. */
+                if (entry->type != E820_TYPE_RAM)
+                        continue;
+
+                /* Adjust bios_start to the end of the entry if needed. */
+                if (bios_start > entry->addr + entry->size)
+                        bios_start = entry->addr + entry->size;
+
+                /* Keep bios_start page-aligned. */
+                bios_start = round_down(bios_start, PAGE_SIZE);
+
+                /* Skip the entry if it's too small. */
+                if (bios_start - TRAMPOLINE_32BIT_SIZE < entry->addr)
+                        continue;
+
+                break;
+        }
+
+        /* Place the trampoline just below the end of low memory */
+        return bios_start - TRAMPOLINE_32BIT_SIZE;
+}
+
 struct paging_config paging_prepare(void *rmode)
 {
         struct paging_config paging_config = {};
-        unsigned long bios_start, ebda_start;
 
         /* Initialize boot_params. Required for cmdline_find_option_bool(). */
         boot_params = rmode;
@@ -61,23 +114,7 @@ struct paging_config paging_prepare(void *rmode)
                 paging_config.l5_required = 1;
         }
 
-        /*
-         * Find a suitable spot for the trampoline.
-         * This code is based on reserve_bios_regions().
-         */
-
-        ebda_start = *(unsigned short *)0x40e << 4;
-        bios_start = *(unsigned short *)0x413 << 10;
-
-        if (bios_start < BIOS_START_MIN || bios_start > BIOS_START_MAX)
-                bios_start = BIOS_START_MAX;
-
-        if (ebda_start > BIOS_START_MIN && ebda_start < bios_start)
-                bios_start = ebda_start;
-
-        /* Place the trampoline just below the end of low memory, aligned to 4k */
-        paging_config.trampoline_start = bios_start - TRAMPOLINE_32BIT_SIZE;
-        paging_config.trampoline_start = round_down(paging_config.trampoline_start, PAGE_SIZE);
+        paging_config.trampoline_start = find_trampoline_placement();
 
         trampoline_32bit = (unsigned long *)paging_config.trampoline_start;