public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: "Ard Biesheuvel" <ardb@kernel.org>
To: devel@edk2.groups.io
Cc: "Ard Biesheuvel" <ardb@kernel.org>,
	"Michael Kinney" <michael.d.kinney@intel.com>,
	"Liming Gao" <gaoliming@byosoft.com.cn>,
	"Jiewen Yao" <jiewen.yao@intel.com>,
	"Michael Kubacki" <michael.kubacki@microsoft.com>,
	"Sean Brogan" <sean.brogan@microsoft.com>,
	"Rebecca Cran" <quic_rcran@quicinc.com>,
	"Leif Lindholm" <quic_llindhol@quicinc.com>,
	"Sami Mujawar" <sami.mujawar@arm.com>,
	"Taylor Beebe" <t@taylorbeebe.com>,
	"Marvin Häuser" <mhaeuser@posteo.de>,
	"Bob Feng" <bob.c.feng@intel.com>,
	"Oliver Smith-Denny" <osde@linux.microsoft.com>
Subject: [PATCH v3 0/4] Enable BTI support in memory attributes table
Date: Tue,  4 Apr 2023 17:40:18 +0200	[thread overview]
Message-ID: <20230404154022.2776035-1-ardb@kernel.org> (raw)

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2967 bytes --]

Implement version 2 of the memory attributes table, which now contains a
flag informing the OS whether or not code regions may be mapped with CFI
mitigations such as IBT or BTI enabled.

This series covers the remaining parts after the AArch64 specific
changes were merged:

- Update the BaseTools to emit the appropriate PE/COFF annotation when a
  BTI/IBT compatible ELF executable is converted to PE/COFF
- Take this PE/COFF annotation into account when populating the memory
  attributes table in the DXE core

TODO:
- X64 changes to make the code IBT compatible and emit the ELF note
- Figure out how to generate such executables with native PE toolchains
- Implement BTI/IBT enforcement at boot time - this is something I
  intend to look into next.

Can be tested with the CLANG38 toolchain (both Clang compiler and LLD
linker, version 3.8 or newer) with the following build options.

[BuildOptions]
  GCC:*_*_AARCH64_PP_FLAGS = -mbranch-protection=bti
  GCC:*_*_AARCH64_CC_FLAGS = -mbranch-protection=bti
  GCC:*_*_AARCH64_DLINK_FLAGS = -fuse-ld=lld -Wl,--no-relax,--no-pie,-z,bti-report=error

Changes since v2:
- increase DllCharacteristicsEx field to 4 bytes
- add Oliver's Rb

If no comments or objections have been raised by the end of the week, I
will go ahead and merge this - thanks.

Cc: Michael Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Michael Kubacki <michael.kubacki@microsoft.com>
Cc: Sean Brogan <sean.brogan@microsoft.com>
Cc: Rebecca Cran <quic_rcran@quicinc.com>
Cc: Leif Lindholm <quic_llindhol@quicinc.com>
Cc: Sami Mujawar <sami.mujawar@arm.com>
Cc: Taylor Beebe <t@taylorbeebe.com>
Cc: Marvin Häuser <mhaeuser@posteo.de>
Cc: Bob Feng <bob.c.feng@intel.com>
Cc: Oliver Smith-Denny <osde@linux.microsoft.com>

Ard Biesheuvel (4):
  BaseTools/GenFw: Parse IBT/BTI support status from ELF note
  BaseTools/GenFw: Add DllCharacteristicsEx field to debug data
  MdePkg/PeCoffLib: Capture DLL characteristics fields in image context
  MdeModulePkg: Enable forward edge CFI in mem attributes table

 BaseTools/Source/C/GenFw/Elf64Convert.c               | 104 +++++++++++++++++---
 BaseTools/Source/C/GenFw/GenFw.c                      |   3 +-
 BaseTools/Source/C/GenFw/elf_common.h                 |   9 ++
 BaseTools/Source/C/Include/IndustryStandard/PeImage.h |  13 ++-
 MdeModulePkg/Core/Dxe/DxeMain.h                       |   2 +
 MdeModulePkg/Core/Dxe/Image/Image.c                   |  10 ++
 MdeModulePkg/Core/Dxe/Misc/MemoryAttributesTable.c    |   8 +-
 MdePkg/Include/IndustryStandard/PeImage.h             |  13 ++-
 MdePkg/Include/Library/PeCoffLib.h                    |   6 ++
 MdePkg/Library/BasePeCoffLib/BasePeCoff.c             |  46 ++++++---
 10 files changed, 186 insertions(+), 28 deletions(-)

-- 
2.39.2


             reply	other threads:[~2023-04-04 15:40 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-04-04 15:40 Ard Biesheuvel [this message]
2023-04-04 15:40 ` [PATCH v3 1/4] BaseTools/GenFw: Parse IBT/BTI support status from ELF note Ard Biesheuvel
2023-04-05  1:57   ` [edk2-devel] " Michael Kubacki
2023-04-04 15:40 ` [PATCH v3 2/4] BaseTools/GenFw: Add DllCharacteristicsEx field to debug data Ard Biesheuvel
2023-04-05  1:58   ` [edk2-devel] " Michael Kubacki
2023-04-04 15:40 ` [PATCH v3 3/4] MdePkg/PeCoffLib: Capture DLL characteristics fields in image context Ard Biesheuvel
2023-04-05  1:58   ` [edk2-devel] " Michael Kubacki
2023-04-04 15:40 ` [PATCH v3 4/4] MdeModulePkg: Enable forward edge CFI in mem attributes table Ard Biesheuvel
2023-04-05  1:59   ` [edk2-devel] " Michael Kubacki
2023-04-04 16:19 ` [PATCH v3 0/4] Enable BTI support in memory " Marvin Häuser
2023-04-04 16:29   ` Ard Biesheuvel
2023-04-04 16:42     ` Marvin Häuser
2023-04-04 16:53       ` Ard Biesheuvel
2023-04-06  1:33 ` 回复: [edk2-devel] " gaoliming
2023-04-07 12:40   ` Ard Biesheuvel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230404154022.2776035-1-ardb@kernel.org \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox