From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by mx.groups.io with SMTP id smtpd.web11.16997.1676301546917254394 for ; Mon, 13 Feb 2023 07:19:07 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=Pl4VISyJ; spf=pass (domain: kernel.org, ip: 145.40.68.75, mailfrom: ardb@kernel.org) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 63992B8122D; Mon, 13 Feb 2023 15:19:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8DBC7C4339C; Mon, 13 Feb 2023 15:19:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1676301544; bh=+k0J8qvlqouGieIgVXeSneIpQ/HEIuZBk+sndzsMr7A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Pl4VISyJeeEksgL3p5XyXrMMfAKkWQGBPK5AZq5qDIfU/fIBiJwYZFZdJ1lvOeXu/ 3RTVsvexQvNDZtoAXTrq4zQ1x8X1Jozj77b0ufsM78zNqMiEOYpNWIVdL0ZWzliGS0 nWJPw+n4dGYrxc6hTjzxWYtERwrIjdwD1meaCu8BvHma4LRGqSoXOE0dkyR2NLXqk6 pkXJbV2hQeKH4w/R8tW9oB3Kdn0mFbNk47r6OpkLZnuhlDNwfQMDTDcrxUF5StNlNV UEgcgoxvwH3Xlg3lDr1CNzB6+OAEbTNNEW39XwO7eqeKgXNwjTnBZOhhbw/THjOvXK uvAEYw+mSKb5A== From: "Ard Biesheuvel" To: devel@edk2.groups.io Cc: Ard Biesheuvel , Michael Kinney , Liming Gao , Jiewen Yao , Michael Kubacki , Sean Brogan , Rebecca Cran , Leif Lindholm , Sami Mujawar , Taylor Beebe , Matthew Garrett , Peter Jones , Kees Cook Subject: [RFC 12/13] BaseTools/GccBase AARCH64: Avoid page sharing between code and data Date: Mon, 13 Feb 2023 16:18:09 +0100 Message-Id: <20230213151810.2301480-13-ardb@kernel.org> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230213151810.2301480-1-ardb@kernel.org> References: <20230213151810.2301480-1-ardb@kernel.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable The AArch64 ARM architecture supports a hardware enforcement mode for mutual exclusion between code and data: any page that is mapped writable is implicitly non-executable as well. This means that remapping part of a runtime image for reapplying relocation fixups may result in any code sharing the same page to lose its executable permissions. Let's avoid this, by moving all quantities that are subject to relocation fixups to a separate page if the build is using 64k section alignment, which is only the case when building a runtime driver for AArch64. Signed-off-by: Ard Biesheuvel --- BaseTools/Scripts/GccBase.lds | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/BaseTools/Scripts/GccBase.lds b/BaseTools/Scripts/GccBase.lds index 83cebd29d599..63e097e0727c 100644 --- a/BaseTools/Scripts/GccBase.lds +++ b/BaseTools/Scripts/GccBase.lds @@ -21,9 +21,8 @@ SECTIONS { . =3D PECOFF_HEADER_SIZE;=0D =0D .text : ALIGN(CONSTANT(COMMONPAGESIZE)) {=0D - *(.text .text.* .stub .gnu.linkonce.t.*)=0D + *(.text .text.* .stub .gnu.linkonce.t.* .plt)=0D *(.rodata .rodata.* .gnu.linkonce.r.*)=0D - *(.got .got.*)=0D =0D /*=0D * The contents of AutoGen.c files are mostly constant from the POV of= the=0D @@ -34,6 +33,16 @@ SECTIONS { * emitted GUIDs here.=0D */=0D *:AutoGen.obj(.data.g*Guid)=0D +=0D + /*=0D + * AArch64 runtime drivers use 64k alignment, and may run in a mode wh= ere=0D + * mutual exclusion of RO and XP mappings are hardware enforced. In su= ch=0D + * cases, the input sections below, which carry any quantities that ar= e=0D + * subject to relocation fixups at runtime, must not share a 4 KiB pag= e=0D + * with any code content.=0D + */=0D + . =3D ALIGN(CONSTANT(COMMONPAGESIZE) > 0x1000 ? 0x1000 : 0x20);=0D + *(.got .got.* .data.rel.ro)=0D }=0D =0D /*=0D --=20 2.39.1