arm64: efi: Enable BTI codegen and add PE/COFF annotation

Browse source

UEFI heavily relies on so-called protocols, which are essentially
tables populated with pointers to executable code, and these are invoked
indirectly using BR or BLR instructions.

This makes the EFI execution context vulnerable to attacks on forward
edge control flow, and so it would help if we could enable hardware
enforcement (BTI) on CPUs that implement it.

So let's no longer disable BTI codegen for the EFI stub, and set the
newly introduced PE/COFF header flag when the kernel is built with BTI
landing pads.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Mark Brown <broonie@kernel.org>

...

This commit is contained in:

Ard Biesheuvel 2023-04-18 15:49:48 +02:00

parent 038585573d

commit 8358098b97

2 changed files with 44 additions and 30 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

71

arch/arm64/kernel/efi-header.S

View file

3

drivers/firmware/efi/libstub/Makefile

View file