From patchwork Thu Sep 27 08:50:38 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 147694 Delivered-To: patch@linaro.org Received: by 2002:a2e:8595:0:0:0:0:0 with SMTP id b21-v6csp1726496lji; Thu, 27 Sep 2018 01:51:21 -0700 (PDT) X-Google-Smtp-Source: ACcGV6386CYTv0SXA+Pn2GqFvw0vY1qcLmqRj7gVVWb3oaWFVXhxgHIDjLrzQBSEsmedIIv7pp+f X-Received: by 2002:a63:7044:: with SMTP id a4-v6mr9182636pgn.63.1538038281591; Thu, 27 Sep 2018 01:51:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1538038281; cv=none; d=google.com; s=arc-20160816; b=h3opw35LIAPOku5jNlpK0wax3xipPYgjO+v5IwfJ2fzyB0ZvQaCP7mS54iC+zLDroM vrtEBdB4BlxNYPFxElUuKEwdcpqtWZJMuWoRf4Uchf/PSG9ln8qfVYRTolFMEA0FzOG/ fV7fTNQjFMO/6gvXrpj/n8bsIt5wF22z/M7tsUq/BiK9EQutKOd4qsbD++eWQLoa6vNK uVrCN7hqRTb3/sKafUb6bUFucfckOyqNkxlznFRPBedZWosz/8rIBJgeO9KByUfUquEu KX7YX6Ivh6hT/b1Tk+wtRo9YdQoEyQFUvH1R4XBPjHfx99xRuoSqSt3sej7OkoEeVhe8 cdEQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature; bh=TfIdZcBS7cb/g0U3CKumXnOhft7wKZSPUCftG/nZTIU=; b=mKn75GzZIbHT4OZyJQHNx1b9+gXU8itTJT0miyc4P2XT1X51Wu2D579ILN3Gfh/2O4 aIYbxORc/rzm6kuZHCIYcwKzMlzpHwXS/3W8JIsKZr8MscRW8VCpGN/cYdI03LrWe2G9 Vkf/XjUDTIE0DGJ+bX2ASqkErsjaIW0yi0KNAf+DQeQYOC0EGwiCSsKf3+yJXUDR4nyW fyy5aQarr1H0cXlWMVpLzBY5eOa7rSnaoM7KkHZeqDLZFn3Mgpy57uQCfm9YzYlQD/I9 rH0nAAz8fK3KNsxq7tKMI8iVNLL/xS8Hfa/db3Vd9sASVeXkTo39Kpv5MzxGlCYJwPD8 wlkg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=MxmXSZVp; spf=pass (google.com: best guess record for domain of linux-efi-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-efi-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id n13-v6si1259522pgd.280.2018.09.27.01.51.21; Thu, 27 Sep 2018 01:51:21 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-efi-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=MxmXSZVp; spf=pass (google.com: best guess record for domain of linux-efi-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-efi-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727362AbeI0PI3 (ORCPT + 3 others); Thu, 27 Sep 2018 11:08:29 -0400 Received: from mail-wr1-f66.google.com ([209.85.221.66]:42825 "EHLO mail-wr1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727435AbeI0PIX (ORCPT ); Thu, 27 Sep 2018 11:08:23 -0400 Received: by mail-wr1-f66.google.com with SMTP id b11-v6so1643445wru.9 for ; Thu, 27 Sep 2018 01:51:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=TfIdZcBS7cb/g0U3CKumXnOhft7wKZSPUCftG/nZTIU=; b=MxmXSZVp9aZeoV7cZf9KfayGE16KbjJtimG5liLaZNVP2zRf2ka2NLhsepqy2hQH5D VL/D1UATC2OZdEDtaH9HRBuuTL/QPFCktrwVSqgaW1FLpdj1GTBrlfTBpxFBSIzwHRqc NlBi66GGIhZQeDCYg19m3yCWKfjxjyU9ajlIw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=TfIdZcBS7cb/g0U3CKumXnOhft7wKZSPUCftG/nZTIU=; b=VOpkg+j1zHwWnJgVabYWraf4/kp8cRJd2XzDJQUt149WPEQHMIUqupOF6qfCwFNVhE qR5n/t/hiyohNkeXZOhR/5C0xF5qZqWZRJLRR8UQR/MDsgHANLLhhPrK2KbMNXPW5xY0 VbY5Q08ypwYHbAyteb9Fj6gVtfWd/efxA9LRtMO6uB3H9QMqiAHhH/StPro4jFwKNqy3 1mTSUmCLWrpCrW6cTbIHGw0kaLLQ79CizFlHdu5glltmMTstHtBeSpZpB6V4JLBTTtT6 7knovQq173i3quD+6qfGoogSUOPfOOda0PJFoKD60gR1cKL15Sf1qQyurats5x0bJrOu tyDg== X-Gm-Message-State: ABuFfojxd/kXkF22aL5bQrflG36LWkwWp1fGas61M7INNtH6MiKpb0AB TBIqZENN9dWDK+Dm6oM2kCCzew== X-Received: by 2002:adf:ffc3:: with SMTP id x3-v6mr8154410wrs.137.1538038272552; Thu, 27 Sep 2018 01:51:12 -0700 (PDT) Received: from rev03.home ([2a01:cb1d:112:6f00:546e:3c44:5966:2f5e]) by smtp.gmail.com with ESMTPSA id p11-v6sm1304055wrd.74.2018.09.27.01.51.11 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 27 Sep 2018 01:51:11 -0700 (PDT) From: Ard Biesheuvel To: linux-kernel@vger.kernel.org, Ingo Molnar , Thomas Gleixner Cc: Ard Biesheuvel , linux-efi@vger.kernel.org, Aaron Ma , Alistair Strachan , Ben Hutchings , Bhupesh Sharma , Hans de Goede , Ivan Hu , Jeremy Linton , Marc Zyngier , Matt Fleming , Peter Robinson , Sai Praneeth Prakhya , Sebastian Andrzej Siewior , Stefan Agner Subject: [PATCH 11/11] x86: boot: Fix EFI stub alignment Date: Thu, 27 Sep 2018 10:50:38 +0200 Message-Id: <20180927085039.8391-12-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20180927085039.8391-1-ard.biesheuvel@linaro.org> References: <20180927085039.8391-1-ard.biesheuvel@linaro.org> Sender: linux-efi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org From: Ben Hutchings We currently align the end of the compressed image to a multiple of 16. However, the PE-COFF header included in the EFI stub says that the file alignment is 32 bytes, and when adding an EFI signature to the file it must first be padded to this alignment. sbsigntool commands warn about this: warning: file-aligned section .text extends beyond end of file warning: checksum areas are greater than image size. Invalid section table? Worse, pesign -at least when creating a detached signature- uses the hash of the unpadded file, resulting in an invalid signature if padding is required. Avoid both these problems by increasing alignment to 32 bytes when CONFIG_EFI_STUB is enabled. Signed-off-by: Ben Hutchings Signed-off-by: Ard Biesheuvel --- arch/x86/boot/tools/build.c | 7 +++++++ 1 file changed, 7 insertions(+) -- 2.18.0 diff --git a/arch/x86/boot/tools/build.c b/arch/x86/boot/tools/build.c index d4e6cd4577e5..bf0e82400358 100644 --- a/arch/x86/boot/tools/build.c +++ b/arch/x86/boot/tools/build.c @@ -391,6 +391,13 @@ int main(int argc, char ** argv) die("Unable to mmap '%s': %m", argv[2]); /* Number of 16-byte paragraphs, including space for a 4-byte CRC */ sys_size = (sz + 15 + 4) / 16; +#ifdef CONFIG_EFI_STUB + /* + * COFF requires minimum 32-byte alignment of sections, and + * adding a signature is problematic without that alignment. + */ + sys_size = (sys_size + 1) & ~1; +#endif /* Patch the setup code with the appropriate size parameters */ buf[0x1f1] = setup_sectors-1;