openSUSE Build Service

Overview Repositories Revisions Requests Users Attributes Meta

File 40.patch of Package fwupd-efi2 (Revision 76b1298b486180c93667f81ec4aade03)

Currently displaying revision 76b1298b486180c93667f81ec4aade03 , Show latest

From e51c282fa64220d3209474035c1c648ef9ddf8a0 Mon Sep 17 00:00:00 2001
From: Callum Farmer <gmbr3@opensuse.org>
Date: Sat, 11 Feb 2023 15:33:42 +0000
Subject: [PATCH 1/7] Only use 4KiB pages on aarch64

Binutils is currently configured by default
to use 64KiB pages on aarch64, however this
is not allowed by the UEFI specification

Signed-off-by: Callum Farmer <gmbr3@opensuse.org>
---
 efi/meson.build | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/efi/meson.build b/efi/meson.build
index 1931855..d00357d 100644
--- a/efi/meson.build
+++ b/efi/meson.build
@@ -187,6 +187,12 @@ efi_ldflags = ['-T',
                '-L', efi_libdir,
                join_paths(efi_crtdir, arch_crt)]
 
+if host_cpu == 'aarch64'
+# Don't use 64KiB pages
+  efi_ldflags += ['-z', 'common-page-size=4096']
+  efi_ldflags += ['-z', 'max-page-size=4096']
+endif
+
 if objcopy_manualsymbols
   # older objcopy for Aarch64 and ARM32 are not EFI capable.
   # Use 'binary' instead, and add required symbols manually.

From 1e33aecc61759db1fa97f33592f3e44daec8b6c8 Mon Sep 17 00:00:00 2001
From: Callum Farmer <gmbr3@opensuse.org>
Date: Sat, 11 Feb 2023 15:39:06 +0000
Subject: [PATCH 2/7] Revert "Align sections to 512 bytes"

This is not permitted according to the Microsoft
guidelines which require section alignment to be
the same as the page size of the architecture which
for all supported archs is the default in Binutils

https://techcommunity.microsoft.com/t5/hardware-dev-center/new-uefi-ca-memory-mitigation-requirements-for-signing/ba-p/3608714

This reverts commit c60c0b8dfda71275ab40bdb316a6ca650c7a8948.
---
 efi/generate_binary.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/efi/generate_binary.py b/efi/generate_binary.py
index bd2d959..e2d153a 100755
--- a/efi/generate_binary.py
+++ b/efi/generate_binary.py
@@ -32,8 +32,6 @@ def _run_objcopy(args):
         ".rodata",
         "-j",
         ".rel*",
-        "--section-alignment",
-        "512",
         args.infile,
         args.outfile,
     ]

From e3bbaf5c78109863cb36755bd12bb82768854a4e Mon Sep 17 00:00:00 2001
From: Callum Farmer <gmbr3@opensuse.org>
Date: Tue, 28 Feb 2023 14:52:56 +0000
Subject: [PATCH 3/7] lds: Add .rel[a].plt section

Where it isn't already included, add the
.rel[a].plt section to the linker scripts
to prevent ld automatically adding an un-padded
.rel[a].plt which causes a gap in the section
table

Signed-off-by: Callum Farmer <gmbr3@opensuse.org>
---
 efi/lds/elf_ia32_efi.lds   | 2 ++
 efi/lds/elf_x86_64_efi.lds | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/efi/lds/elf_ia32_efi.lds b/efi/lds/elf_ia32_efi.lds
index 742e0a4..3efa8b0 100644
--- a/efi/lds/elf_ia32_efi.lds
+++ b/efi/lds/elf_ia32_efi.lds
@@ -67,6 +67,8 @@ SECTIONS
     *(.data.rel.ro)
     *(.data.rel*)
   }
+  . = ALIGN(4096);
+  .rel.plt : { *(.rel.plt) }
   _edata = .;
   _data_size = . - _data;
   . = ALIGN(4096);
diff --git a/efi/lds/elf_x86_64_efi.lds b/efi/lds/elf_x86_64_efi.lds
index bcc6527..7e3430a 100644
--- a/efi/lds/elf_x86_64_efi.lds
+++ b/efi/lds/elf_x86_64_efi.lds
@@ -69,6 +69,8 @@ SECTIONS
     *(.rela.got*)
     *(.rela.stab*)
   }
+  . = ALIGN(4096);
+  .rela.plt : { *(.rela.plt) }
   _edata = .;
   _data_size = . - _data;
   . = ALIGN(4096);

From 205e9021634b3b703b4a0d4044258752d500401e Mon Sep 17 00:00:00 2001
From: Callum Farmer <gmbr3@opensuse.org>
Date: Tue, 28 Feb 2023 17:34:21 +0000
Subject: [PATCH 4/7] crt0: Add .note.GNU-stack section

When we are using the included crt0, ensure
that we have set noexecstack (.note.GNU-stack)
otherwise this will result in a linker warning
and will break NX compatibility

Signed-off-by: Callum Farmer <gmbr3@opensuse.org>
---
 efi/crt0/crt0-efi-aarch64.S | 4 ++++
 efi/crt0/crt0-efi-arm.S     | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/efi/crt0/crt0-efi-aarch64.S b/efi/crt0/crt0-efi-aarch64.S
index e8f4426..fad7f50 100644
--- a/efi/crt0/crt0-efi-aarch64.S
+++ b/efi/crt0/crt0-efi-aarch64.S
@@ -164,3 +164,7 @@ _start:
 
 0:	ldp		x29, x30, [sp], #32
 	ret
+
+#if defined(__ELF__) && defined(__linux__)
+	.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/efi/crt0/crt0-efi-arm.S b/efi/crt0/crt0-efi-arm.S
index a84dc5d..9bb93a1 100644
--- a/efi/crt0/crt0-efi-arm.S
+++ b/efi/crt0/crt0-efi-arm.S
@@ -191,3 +191,7 @@ _start:
 
 .L_DYNAMIC:
 	.word		_DYNAMIC - .
+
+#if defined(__ELF__) && defined(__linux__)
+	.section .note.GNU-stack,"",%progbits
+#endif

From fb16fb89a767d709bb141810280c489d960ade6b Mon Sep 17 00:00:00 2001
From: Callum Farmer <gmbr3@opensuse.org>
Date: Tue, 28 Feb 2023 18:07:57 +0000
Subject: [PATCH 5/7] Check if crt0 contains .note.GNU-stack section

We need the .note.GNU-stack section for NX
compat. If we don't have a new enough
gnu-efi, error as the gnu-efi libraries
themselves must have been built as NX
for this to work

Signed-off-by: Callum Farmer <gmbr3@opensuse.org>
---
 efi/crt0/meson.build | 1 +
 efi/meson.build      | 6 +++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/efi/crt0/meson.build b/efi/crt0/meson.build
index f5f45c5..fbd943e 100644
--- a/efi/crt0/meson.build
+++ b/efi/crt0/meson.build
@@ -1,3 +1,4 @@
+arch_crt_source = 'crt0-efi-@0@.S'.format(gnu_efi_path_arch)
 o_crt0 = custom_target('efi_crt0',
                        input : arch_crt_source,
                        output : arch_crt,
diff --git a/efi/meson.build b/efi/meson.build
index d00357d..a476884 100644
--- a/efi/meson.build
+++ b/efi/meson.build
@@ -95,6 +95,11 @@ else
         coff_header_in_crt0 = false
 endif
 
+# For NX compat, we must ensure we have .note.GNU-stack
+if run_command('grep', '-q', '.note.GNU-stack', join_paths(efi_crtdir, arch_crt), check: false).returncode() != 0
+    error('Cannot find NX section in @0@, update to gnu-efi 3.0.15+'.format(join_paths(efi_crtdir, arch_crt)))
+endif
+
 # older objcopy for Aarch64 and ARM32 are not EFI capable.
 # Use 'binary' instead, and add required symbols manually.
 if host_cpu == 'arm' or (host_cpu == 'aarch64' and (objcopy_version.version_compare ('< 2.38') or coff_header_in_crt0))
@@ -119,7 +124,6 @@ endif
 # is the system crt0 for arm and aarch64 new enough to know about SBAT?
 if objcopy_manualsymbols
   if get_option('efi_sbat_distro_id') != ''
-    arch_crt_source = 'crt0-efi-@0@.S'.format(gnu_efi_path_arch)
     cmd = run_command('grep', '-q', 'sbat', join_paths(efi_crtdir, arch_crt))
     if cmd.returncode() != 0
       warning('Cannot find SBAT section in @0@, using local copy'.format(join_paths(efi_crtdir, arch_crt)))

From 73462e8becd7c26450c5ff99e2ec4a0d47c72759 Mon Sep 17 00:00:00 2001
From: Callum Farmer <gmbr3@opensuse.org>
Date: Tue, 28 Feb 2023 19:02:09 +0000
Subject: [PATCH 6/7] Cleanup uses of run_command()

Meson needs to know whether (or not) to error if the command fails

Signed-off-by: Callum Farmer <gmbr3@opensuse.org>
---
 efi/meson.build | 18 +++++++++---------
 meson.build     |  2 +-
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/efi/meson.build b/efi/meson.build
index a476884..f9e7016 100644
--- a/efi/meson.build
+++ b/efi/meson.build
@@ -38,7 +38,7 @@ endif
 efi_libdir = get_option('efi-libdir')
 if efi_libdir == ''
   fs = import('fs')
-  multi = run_command(cc.cmd_array(), '-print-multi-os-directory').stdout().strip()
+  multi = run_command(cc.cmd_array(), '-print-multi-os-directory', check: true).stdout().strip()
   efi_libdir = join_paths('/usr/lib/', multi)
   if not fs.is_dir(join_paths(efi_libdir, 'gnuefi'))
     efi_libdir = '/usr/lib'
@@ -61,26 +61,26 @@ arch_lds = 'efi.lds'
 arch_crt = 'crt0.o'
 if efi_ldsdir == ''
   efi_ldsdir = join_paths(efi_libdir, 'gnuefi', gnu_efi_path_arch)
-  cmd = run_command('test', '-f', join_paths(efi_ldsdir, arch_lds))
+  cmd = run_command('test', '-f', join_paths(efi_ldsdir, arch_lds), check: false)
   if cmd.returncode() != 0
     arch_lds = 'elf_@0@@1@_efi.lds'.format(gnu_efi_path_arch, lds_os)
     arch_crt = 'crt0-efi-@0@.o'.format(gnu_efi_path_arch)
     efi_ldsdir = join_paths(efi_libdir, 'gnuefi')
-    cmd = run_command('test', '-f', join_paths(efi_ldsdir, arch_lds))
+    cmd = run_command('test', '-f', join_paths(efi_ldsdir, arch_lds), check: false)
   endif
   if cmd.returncode() != 0
     efi_ldsdir = efi_libdir
-    cmd = run_command('test', '-f', join_paths(efi_ldsdir, arch_lds))
+    cmd = run_command('test', '-f', join_paths(efi_ldsdir, arch_lds), check: false)
     if cmd.returncode() != 0
       error('Cannot find @0@'.format(arch_lds))
     endif
   endif
 else
-  cmd = run_command('test', '-f', join_paths(efi_ldsdir, arch_lds))
+  cmd = run_command('test', '-f', join_paths(efi_ldsdir, arch_lds), check: false)
   if cmd.returncode() != 0
     arch_lds = 'elf_@0@@1@_efi.lds'.format(gnu_efi_path_arch, lds_os)
     arch_crt = 'crt0-efi-@0@.o'.format(gnu_efi_path_arch)
-    cmd = run_command('test', '-f', join_paths(efi_ldsdir, arch_lds))
+    cmd = run_command('test', '-f', join_paths(efi_ldsdir, arch_lds), check: false)
   endif
   if cmd.returncode() != 0
     error('Cannot find @0@'.format(arch_lds))
@@ -113,7 +113,7 @@ endif
 # is the system linker script new enough to know about SBAT?
 # i.e. gnu-efi with https://github.com/vathpela/gnu-efi/pull/14 has been installed
 if get_option('efi_sbat_distro_id') != ''
-  cmd = run_command('grep', '-q', 'sbat', join_paths(efi_ldsdir, arch_lds))
+  cmd = run_command('grep', '-q', 'sbat', join_paths(efi_ldsdir, arch_lds), check: false)
   if cmd.returncode() != 0
     warning('Cannot find SBAT section in @0@, using local copy'.format(join_paths(efi_ldsdir, arch_lds)))
     efi_ldsdir = join_paths(meson.current_source_dir(), 'lds')
@@ -124,7 +124,7 @@ endif
 # is the system crt0 for arm and aarch64 new enough to know about SBAT?
 if objcopy_manualsymbols
   if get_option('efi_sbat_distro_id') != ''
-    cmd = run_command('grep', '-q', 'sbat', join_paths(efi_crtdir, arch_crt))
+    cmd = run_command('grep', '-q', 'sbat', join_paths(efi_crtdir, arch_crt), check: false)
     if cmd.returncode() != 0
       warning('Cannot find SBAT section in @0@, using local copy'.format(join_paths(efi_crtdir, arch_crt)))
       # The gnuefi libraries are still needed
@@ -206,7 +206,7 @@ else
   efi_format = ['--target=efi-app-@0@'.format(gnu_efi_arch)]
 endif
 
-libgcc_file_name = run_command(cc.cmd_array(), '-print-libgcc-file-name').stdout().strip()
+libgcc_file_name = run_command(cc.cmd_array(), '-print-libgcc-file-name', check: true).stdout().strip()
 efi_name = 'fwupd@0@.efi'.format(EFI_MACHINE_TYPE_NAME)
 
 o_files = []
diff --git a/meson.build b/meson.build
index bb7dae9..3965eee 100644
--- a/meson.build
+++ b/meson.build
@@ -11,7 +11,7 @@ conf.set_quoted('PACKAGE_VERSION', meson.project_version())
 cc = meson.get_compiler('c')
 ld = cc.get_linker_id()
 objcopy = find_program('objcopy')
-objcopy_version = run_command(objcopy, '--version').stdout().split('\n')[0].split(' ')[-1]
+objcopy_version = run_command(objcopy, '--version', check: true).stdout().split('\n')[0].split(' ')[-1]
 
 prefix = get_option('prefix')
 libdir = join_paths(prefix, get_option('libdir'))

From afcc6666e7d812c13f1bca477f50e43e8f84cf67 Mon Sep 17 00:00:00 2001
From: Callum Farmer <gmbr3@opensuse.org>
Date: Tue, 18 Apr 2023 11:01:38 +0100
Subject: [PATCH 7/7] Force unsigned char

Required post gnu-efi 3.0.16

Signed-off-by: Callum Farmer <gmbr3@opensuse.org>
---
 efi/meson.build | 1 +
 1 file changed, 1 insertion(+)

diff --git a/efi/meson.build b/efi/meson.build
index f9e7016..9c8296a 100644
--- a/efi/meson.build
+++ b/efi/meson.build
@@ -150,6 +150,7 @@ compile_args = ['-Og',
                 '-Wvla',
                 '-std=gnu11',
                 '-fpic',
+                '-funsigned-char',
                 '-fshort-wchar',
                 '-ffreestanding',
                 '-fno-strict-aliasing',

Places

File 40.patch of Package fwupd-efi2 (Revision 76b1298b486180c93667f81ec4aade03)

Places