All of lore.kernel.org
 help / color / mirror / Atom feed
From: ard.biesheuvel@linaro.org (Ard Biesheuvel)
To: linux-arm-kernel@lists.infradead.org
Subject: [PATCH 0/7] arm64: efi: PE/COFF cleanup/hardening
Date: Mon,  6 Feb 2017 16:24:28 +0000	[thread overview]
Message-ID: <1486398275-3966-1-git-send-email-ard.biesheuvel@linaro.org> (raw)

This cleans up the PE/COFF EFI header, by taking some of Mark's patches
and use them to replace open coded constants with symbolic ones, and
remove incorrect values or unused sections.

Finally, it updates the section layout so that the kernel Image can be
mapped in a way that does not require setting RWX permissions anywhere.
Note that this is currently not a huge win, given that most current UEFI
implementations map all of RAM RWX by default, but this is finally gaining
some attention, and work is underway to make the PE/COFF loader in EDK2
adhere to the section permissions, which would also allow the RAM mapping
to default to non-executable. Work in progress nonetheless...

Ard Biesheuvel (5):
  arm64: efi: move EFI header and related data to a separate .S file
  arm64: efi: ensure that the PE/COFF header pointer appears at offset
    0x3c
  arm64: efi: remove pointless dummy .reloc section
  arm64: efi: replace open coded constants with symbolic ones
  arm64: efi: split Image code and data into separate PE/COFF sections

Mark Rutland (2):
  include: pe.h: allow for use in assembly
  include: pe.h: add some missing definitions

 arch/arm64/kernel/efi-header.S  | 178 ++++++++++++++++++++
 arch/arm64/kernel/head.S        | 176 +------------------
 arch/arm64/kernel/vmlinux.lds.S |   5 +
 include/linux/pe.h              | 177 +++++++++----------
 4 files changed, 280 insertions(+), 256 deletions(-)
 create mode 100644 arch/arm64/kernel/efi-header.S

-- 
2.7.4

WARNING: multiple messages have this Message-ID (diff)
From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
To: linux-arm-kernel@lists.infradead.org, will.deacon@arm.com,
	catalin.marinas@arm.com, mark.rutland@arm.com
Cc: labbott@fedoraproject.org, kernel-hardening@lists.openwall.com,
	leif.lindholm@linaro.org, pjones@redhat.com,
	Ard Biesheuvel <ard.biesheuvel@linaro.org>
Subject: [kernel-hardening] [PATCH 0/7] arm64: efi: PE/COFF cleanup/hardening
Date: Mon,  6 Feb 2017 16:24:28 +0000	[thread overview]
Message-ID: <1486398275-3966-1-git-send-email-ard.biesheuvel@linaro.org> (raw)

This cleans up the PE/COFF EFI header, by taking some of Mark's patches
and use them to replace open coded constants with symbolic ones, and
remove incorrect values or unused sections.

Finally, it updates the section layout so that the kernel Image can be
mapped in a way that does not require setting RWX permissions anywhere.
Note that this is currently not a huge win, given that most current UEFI
implementations map all of RAM RWX by default, but this is finally gaining
some attention, and work is underway to make the PE/COFF loader in EDK2
adhere to the section permissions, which would also allow the RAM mapping
to default to non-executable. Work in progress nonetheless...

Ard Biesheuvel (5):
  arm64: efi: move EFI header and related data to a separate .S file
  arm64: efi: ensure that the PE/COFF header pointer appears at offset
    0x3c
  arm64: efi: remove pointless dummy .reloc section
  arm64: efi: replace open coded constants with symbolic ones
  arm64: efi: split Image code and data into separate PE/COFF sections

Mark Rutland (2):
  include: pe.h: allow for use in assembly
  include: pe.h: add some missing definitions

 arch/arm64/kernel/efi-header.S  | 178 ++++++++++++++++++++
 arch/arm64/kernel/head.S        | 176 +------------------
 arch/arm64/kernel/vmlinux.lds.S |   5 +
 include/linux/pe.h              | 177 +++++++++----------
 4 files changed, 280 insertions(+), 256 deletions(-)
 create mode 100644 arch/arm64/kernel/efi-header.S

-- 
2.7.4

             reply	other threads:[~2017-02-06 16:24 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-02-06 16:24 Ard Biesheuvel [this message]
2017-02-06 16:24 ` [kernel-hardening] [PATCH 0/7] arm64: efi: PE/COFF cleanup/hardening Ard Biesheuvel
2017-02-06 16:24 ` [PATCH 1/7] include: pe.h: allow for use in assembly Ard Biesheuvel
2017-02-06 16:24   ` [kernel-hardening] " Ard Biesheuvel
2017-02-06 16:33   ` Mark Rutland
2017-02-06 16:33     ` [kernel-hardening] " Mark Rutland
2017-02-06 16:40     ` Ard Biesheuvel
2017-02-06 16:40       ` [kernel-hardening] " Ard Biesheuvel
2017-02-06 16:24 ` [PATCH 2/7] include: pe.h: add some missing definitions Ard Biesheuvel
2017-02-06 16:24   ` [kernel-hardening] " Ard Biesheuvel
2017-02-06 16:24 ` [PATCH 3/7] arm64: efi: move EFI header and related data to a separate .S file Ard Biesheuvel
2017-02-06 16:24   ` [kernel-hardening] " Ard Biesheuvel
2017-02-06 17:03   ` Mark Rutland
2017-02-06 17:03     ` [kernel-hardening] " Mark Rutland
2017-02-06 17:07     ` Ard Biesheuvel
2017-02-06 17:07       ` [kernel-hardening] " Ard Biesheuvel
2017-02-06 16:24 ` [PATCH 4/7] arm64: efi: ensure that the PE/COFF header pointer appears at offset 0x3c Ard Biesheuvel
2017-02-06 16:24   ` [kernel-hardening] " Ard Biesheuvel
2017-02-06 17:05   ` Mark Rutland
2017-02-06 17:05     ` [kernel-hardening] " Mark Rutland
2017-02-06 16:24 ` [PATCH 5/7] arm64: efi: remove pointless dummy .reloc section Ard Biesheuvel
2017-02-06 16:24   ` [kernel-hardening] " Ard Biesheuvel
2017-02-06 17:06   ` Mark Rutland
2017-02-06 17:06     ` [kernel-hardening] " Mark Rutland
2017-02-07 18:30   ` Peter Jones
2017-02-07 18:30     ` [kernel-hardening] " Peter Jones
2017-02-06 16:24 ` [PATCH 6/7] arm64: efi: replace open coded constants with symbolic ones Ard Biesheuvel
2017-02-06 16:24   ` [kernel-hardening] " Ard Biesheuvel
2017-02-06 17:13   ` Mark Rutland
2017-02-06 17:13     ` [kernel-hardening] " Mark Rutland
2017-02-06 16:24 ` [PATCH 7/7] arm64: efi: split Image code and data into separate PE/COFF sections Ard Biesheuvel
2017-02-06 16:24   ` [kernel-hardening] " Ard Biesheuvel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1486398275-3966-1-git-send-email-ard.biesheuvel@linaro.org \
    --to=ard.biesheuvel@linaro.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.