From patchwork Tue Apr 4 15:19:55 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 13200472 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B6D81C761A6 for ; Tue, 4 Apr 2023 15:21:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=2G+FZPmrfoDqkP8qdYHoNFVH/mi/jf+3OtpOVDiOuQg=; b=kiaFeRqA5HlKlZ GRSun2XzvoTSMMmYrMumlrqsQCFheIcQrzQEEJalAyKR0upHCHXMZSlqOZVbD8Y6diOWlsZNahTQW 0tTzQcQzgvLLGLn87G6SuI1K6+dcCzMWxf6MnmxnYHv0qKrlvJjUAV1G00llPzu2xA+O3ONs5FQco c4LGVy8BR9p2o5sXNQABzxwVFkdli3RBcyCXsVXkYlmXzOmWOz3T2GB9GDCMlxNkPv5rVoWMHpMNI uCJdqps0mh3k6roqcfm22L2nGkEdQcDte27hOgtX0tZj4wSKT2uk3CdvypjffZ9dHzLA8Sk5hf4GB LzQVWkqPgdbs7v1tZwLg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1pjiSG-001xpn-29; Tue, 04 Apr 2023 15:20:16 +0000 Received: from dfw.source.kernel.org ([2604:1380:4641:c500::1]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1pjiSB-001xmk-24 for linux-arm-kernel@lists.infradead.org; Tue, 04 Apr 2023 15:20:13 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3E69E635C2; Tue, 4 Apr 2023 15:20:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 236C5C433A0; Tue, 4 Apr 2023 15:20:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1680621610; bh=Ga8kRwA4cYPGJueBNhAKY9K+0CddQq8XhgGyaJTDtY4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hpVEE7lAJt9ndt27k37zxCybUY+1K6Hrpo+utt6qw/EDihTFzRkh901NOOBZ0cBu6 U6kkHyK+zG4ggTAnedmm7BNARQ0tlXywKwi4I5cgLNohLF9seuMcGXN7Pu9MyKO+Tn lDRSaTJCclkMDC1pYVlfDp3jZ3J1Vg7vUzx9aTWPiSY0ByLIllVd/ZCGSWrFYQfJCR fH7/+RY9L/dYT4T01cDj3e9aLvf844scK9W1igRwJ5Dok+8O6+lM8OAAvgUabMk3y5 1gA0C7n1lMIZ0/nUNUmfnsFpLLk+/YN2DB+FpqWjh7Cy5Wx80lr/Bob0mof83fmQE8 +G0aDVyQEKHJw== From: Ard Biesheuvel To: linux-efi@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org, will@kernel.org, catalin.marinas@arm.com, mark.rutland@arm.com, broonie@Kernel.org, Ard Biesheuvel Subject: [PATCH 2/6] arm64: efi: Enable BTI codegen and add PE/COFF annotation Date: Tue, 4 Apr 2023 17:19:55 +0200 Message-Id: <20230404151959.2774612-3-ardb@kernel.org> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230404151959.2774612-1-ardb@kernel.org> References: <20230404151959.2774612-1-ardb@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4840; i=ardb@kernel.org; h=from:subject; bh=Ga8kRwA4cYPGJueBNhAKY9K+0CddQq8XhgGyaJTDtY4=; b=owGbwMvMwCFmkMcZplerG8N4Wi2JIUXHQfLYasdkze6AN91rV+VkfDv11nazUfPUr3MuZSWpZ FVO5/3RUcrCIMbBICumyCIw+++7nacnStU6z5KFmcPKBDKEgYtTACZy+xvDf8f4G9H7Zh2S+i5d tXHezKkPDl6ZO+OCaZjchQc3ruvcfa/J8N+Hd5Hl8olH+oR9bTxXWl2fu/Leww0OAdzCJstcg+v +CbABAA== X-Developer-Key: i=ardb@kernel.org; a=openpgp; fpr=F43D03328115A198C90016883D200E9CA6329909 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230404_082011_755053_0B1DC9B9 X-CRM114-Status: GOOD ( 18.35 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org UEFI heavily relies on so-called protocols, which are essentially tables populated with pointers to executable code, and these are invoked indirectly using BR or BLR instructions. This makes the EFI execution context vulnerable to attacks on forward edge control flow, and so it would help if we could enable hardware enforcement (BTI) on CPUs that implement it. So let's no longer disable BTI codegen for the EFI stub, and set the newly introduced PE/COFF header flag when the kernel is built with BTI landing pads. Signed-off-by: Ard Biesheuvel Reviewed-by: Mark Brown --- arch/arm64/kernel/efi-header.S | 71 ++++++++++++-------- drivers/firmware/efi/libstub/Makefile | 3 +- 2 files changed, 44 insertions(+), 30 deletions(-) diff --git a/arch/arm64/kernel/efi-header.S b/arch/arm64/kernel/efi-header.S index d731b4655df8eb27..11d7f7de202d0ed2 100644 --- a/arch/arm64/kernel/efi-header.S +++ b/arch/arm64/kernel/efi-header.S @@ -81,9 +81,47 @@ .quad 0 // CertificationTable .quad 0 // BaseRelocationTable -#ifdef CONFIG_DEBUG_EFI +#if defined(CONFIG_DEBUG_EFI) || defined(CONFIG_ARM64_BTI_KERNEL) .long .Lefi_debug_table - .L_head // DebugTable .long .Lefi_debug_table_size + + /* + * The debug table is referenced via its Relative Virtual Address (RVA), + * which is only defined for those parts of the image that are covered + * by a section declaration. Since this header is not covered by any + * section, the debug table must be emitted elsewhere. So stick it in + * the .init.rodata section instead. + * + * Note that the payloads themselves are permitted to have zero RVAs, + * which means we can simply put those right after the section headers. + */ + __INITRODATA + + .align 2 +.Lefi_debug_table: +#ifdef CONFIG_DEBUG_EFI + // EFI_IMAGE_DEBUG_DIRECTORY_ENTRY + .long 0 // Characteristics + .long 0 // TimeDateStamp + .short 0 // MajorVersion + .short 0 // MinorVersion + .long IMAGE_DEBUG_TYPE_CODEVIEW // Type + .long .Lefi_debug_entry_size // SizeOfData + .long 0 // RVA + .long .Lefi_debug_entry - .L_head // FileOffset +#endif +#ifdef CONFIG_ARM64_BTI_KERNEL + .long 0 // Characteristics + .long 0 // TimeDateStamp + .short 0 // MajorVersion + .short 0 // MinorVersion + .long IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICS // Type + .long 4 // SizeOfData + .long 0 // RVA + .long .Lefi_dll_characteristics_ex - .L_head // FileOffset +#endif + .set .Lefi_debug_table_size, . - .Lefi_debug_table + .previous #endif // Section table @@ -119,33 +157,6 @@ .set .Lsection_count, (. - .Lsection_table) / 40 #ifdef CONFIG_DEBUG_EFI - /* - * The debug table is referenced via its Relative Virtual Address (RVA), - * which is only defined for those parts of the image that are covered - * by a section declaration. Since this header is not covered by any - * section, the debug table must be emitted elsewhere. So stick it in - * the .init.rodata section instead. - * - * Note that the EFI debug entry itself may legally have a zero RVA, - * which means we can simply put it right after the section headers. - */ - __INITRODATA - - .align 2 -.Lefi_debug_table: - // EFI_IMAGE_DEBUG_DIRECTORY_ENTRY - .long 0 // Characteristics - .long 0 // TimeDateStamp - .short 0 // MajorVersion - .short 0 // MinorVersion - .long IMAGE_DEBUG_TYPE_CODEVIEW // Type - .long .Lefi_debug_entry_size // SizeOfData - .long 0 // RVA - .long .Lefi_debug_entry - .L_head // FileOffset - - .set .Lefi_debug_table_size, . - .Lefi_debug_table - .previous - .Lefi_debug_entry: // EFI_IMAGE_DEBUG_CODEVIEW_NB10_ENTRY .ascii "NB10" // Signature @@ -157,6 +168,10 @@ .set .Lefi_debug_entry_size, . - .Lefi_debug_entry #endif +#ifdef CONFIG_ARM64_BTI_KERNEL +.Lefi_dll_characteristics_ex: + .long IMAGE_DLLCHARACTERISTICS_EX_FORWARD_CFI_COMPAT +#endif .balign SEGMENT_ALIGN .Lefi_header_end: diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile index 80d85a5169fb2c72..3abb2b357482a416 100644 --- a/drivers/firmware/efi/libstub/Makefile +++ b/drivers/firmware/efi/libstub/Makefile @@ -23,8 +23,7 @@ cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ \ # arm64 uses the full KBUILD_CFLAGS so it's necessary to explicitly # disable the stackleak plugin cflags-$(CONFIG_ARM64) += -fpie $(DISABLE_STACKLEAK_PLUGIN) \ - -fno-unwind-tables -fno-asynchronous-unwind-tables \ - $(call cc-option,-mbranch-protection=none) + -fno-unwind-tables -fno-asynchronous-unwind-tables cflags-$(CONFIG_ARM) += -DEFI_HAVE_STRLEN -DEFI_HAVE_STRNLEN \ -DEFI_HAVE_MEMCHR -DEFI_HAVE_STRRCHR \ -DEFI_HAVE_STRCMP -fno-builtin -fpic \