From patchwork Mon Feb 6 16:24:34 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 9558349 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 4189E602B1 for ; Mon, 6 Feb 2017 16:25:52 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 324F426D05 for ; Mon, 6 Feb 2017 16:25:52 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 26DD127F88; Mon, 6 Feb 2017 16:25:52 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 2395826D05 for ; Mon, 6 Feb 2017 16:25:50 +0000 (UTC) Received: (qmail 28074 invoked by uid 550); 6 Feb 2017 16:25:23 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 28012 invoked from network); 6 Feb 2017 16:25:23 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=DRa11LOYnPiHYRqnQNqsEAN9ZN4jhvFEHNr+apBRaPY=; b=JbEFptge+dT64AFMU7d6dPGCyC3Y00owDgc4mDFEbrzQU5O88CsOhLVuoxD54geLDB X4N2CzDogs2Uxyq/QRlHP7fA67SCQWBaCQ4VI7laOPe/dWt4ZJ72fCJO/5HbDhBkzZP2 6FgaGWxKJjDMBlkQ2AYkZy0bgax9uyuCJ0jYg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=DRa11LOYnPiHYRqnQNqsEAN9ZN4jhvFEHNr+apBRaPY=; b=Miy+8oFtaEAdxXLiaUzAgk3F9j4WkD5ZwBkxsWxTMj74bztoYguROkQIiVnzqlfKbX iolEwBaSQn7JawWGNBUeYU9XuSAeS9vaT7BmVYaq69yhXE5ReRo5zIWZijt4vlIEljcr qxwGiMkdzGnn32xUgi9N6or9bAXPHVg7ggnwptHpf2+Iiu9v77q+k9eZrVsA7i+Gs9f4 JNscc8ona8u71YYU5yjTpRjxikS/IRrzSpFMO1Xs/ZhCCDdVjPGkh8TuycCa76vkcBBC WQkCyncNkvsd1ca0TnVuneq0VefprqyEzP9416hpcat6sclBYEVrAGw4IJWi1mdHQAHD s7og== X-Gm-Message-State: AMke39k2kCKzu8wXRFDWzyqRjVdtyoM2rPvbCrEwqP3YTlYS1Z+IcER+761GPzLugpv96F2t X-Received: by 10.28.214.137 with SMTP id n131mr8639131wmg.120.1486398310564; Mon, 06 Feb 2017 08:25:10 -0800 (PST) From: Ard Biesheuvel To: linux-arm-kernel@lists.infradead.org, will.deacon@arm.com, catalin.marinas@arm.com, mark.rutland@arm.com Cc: labbott@fedoraproject.org, kernel-hardening@lists.openwall.com, leif.lindholm@linaro.org, pjones@redhat.com, Ard Biesheuvel Date: Mon, 6 Feb 2017 16:24:34 +0000 Message-Id: <1486398275-3966-7-git-send-email-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1486398275-3966-1-git-send-email-ard.biesheuvel@linaro.org> References: <1486398275-3966-1-git-send-email-ard.biesheuvel@linaro.org> Subject: [kernel-hardening] [PATCH 6/7] arm64: efi: replace open coded constants with symbolic ones X-Virus-Scanned: ClamAV using ClamSMTP Replace open coded constants with symbolic ones throughout the Image and the EFI headers. Note that in two cases, this removes a value that the PE/COFF spec does not allow: - NumberOfSymbols in the PE header should be 0 - PE/COFF executable sections (as opposed to sections in object files) should not use the section alignment flags Signed-off-by: Ard Biesheuvel --- arch/arm64/kernel/efi-header.S | 37 ++++++++++---------- arch/arm64/kernel/head.S | 5 +-- 2 files changed, 20 insertions(+), 22 deletions(-) diff --git a/arch/arm64/kernel/efi-header.S b/arch/arm64/kernel/efi-header.S index 35b11654ecc5..c87c23336c86 100644 --- a/arch/arm64/kernel/efi-header.S +++ b/arch/arm64/kernel/efi-header.S @@ -7,6 +7,8 @@ * published by the Free Software Foundation. */ +#include + .macro __jmp, target #ifdef CONFIG_EFI /* @@ -33,21 +35,20 @@ .long pe_header - _head // Offset to the PE header. pe_header: - .ascii "PE" - .short 0 + .long PE_MAGIC coff_header: - .short 0xaa64 // AArch64 - .short 1 // nr_sections + .short IMAGE_FILE_MACHINE_ARM64 // Machine + .short 1 // NumberOfSections .long 0 // TimeDateStamp .long 0 // PointerToSymbolTable - .long 1 // NumberOfSymbols + .long 0 // NumberOfSymbols .short section_table - optional_header // SizeOfOptionalHeader - .short 0x206 // Characteristics. - // IMAGE_FILE_DEBUG_STRIPPED | - // IMAGE_FILE_EXECUTABLE_IMAGE | - // IMAGE_FILE_LINE_NUMS_STRIPPED + .short IMAGE_FILE_DEBUG_STRIPPED | \ + IMAGE_FILE_EXECUTABLE_IMAGE | \ + IMAGE_FILE_LINE_NUMS_STRIPPED // Characteristics + optional_header: - .short 0x20b // PE32+ format + .short PE_OPT_MAGIC_PE32PLUS // PE32+ format .byte 0x02 // MajorLinkerVersion .byte 0x14 // MinorLinkerVersion .long _end - efi_header_end // SizeOfCode @@ -58,7 +59,7 @@ optional_header: extra_header_fields: .quad 0 // ImageBase - .long 0x1000 // SectionAlignment + .long SZ_4K // SectionAlignment .long PECOFF_FILE_ALIGNMENT // FileAlignment .short 0 // MajorOperatingSystemVersion .short 0 // MinorOperatingSystemVersion @@ -73,7 +74,7 @@ extra_header_fields: // Everything before the kernel image is considered part of the header .long efi_header_end - _head // SizeOfHeaders .long 0 // CheckSum - .short 0xa // Subsystem (EFI application) + .short IMAGE_SUBSYSTEM_EFI_APPLICATION // Subsystem .short 0 // DllCharacteristics .quad 0 // SizeOfStackReserve .quad 0 // SizeOfStackCommit @@ -96,10 +97,7 @@ extra_header_fields: // Section table section_table: - .ascii ".text" - .byte 0 - .byte 0 - .byte 0 // end of 0 padding of section name + .ascii ".text\0\0\0" .long _end - efi_header_end // VirtualSize .long efi_header_end - _head // VirtualAddress .long _edata - efi_header_end // SizeOfRawData @@ -109,7 +107,10 @@ section_table: .long 0 // PointerToLineNumbers .short 0 // NumberOfRelocations .short 0 // NumberOfLineNumbers - .long 0xe0500020 // Characteristics + .long IMAGE_SCN_CNT_CODE | \ + IMAGE_SCN_MEM_EXECUTE | \ + IMAGE_SCN_MEM_READ | \ + IMAGE_SCN_MEM_WRITE // Characteristics #ifdef CONFIG_DEBUG_EFI /* @@ -131,7 +132,7 @@ efi_debug_table: .long 0 // TimeDateStamp .short 0 // MajorVersion .short 0 // MinorVersion - .long 2 // Type == EFI_IMAGE_DEBUG_TYPE_CODEVIEW + .long IMAGE_DEBUG_TYPE_CODEVIEW // Type .long efi_debug_entry_size // SizeOfData .long 0 // RVA .long efi_debug_entry - _head // FileOffset diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index aca9b184035a..055735ba3600 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -81,10 +81,7 @@ _head: .quad 0 // reserved .quad 0 // reserved .quad 0 // reserved - .byte 0x41 // Magic number, "ARM\x64" - .byte 0x52 - .byte 0x4d - .byte 0x64 + .ascii "ARM\x64" // Magic number __EFI_HEADER