Skip to content

Commit e1e8bd5

Browse files
esnowbergvathpela
esnowberg
authored and
vathpela
committed
Allow aarch64 programs to be signed.
Currently aarch64 certmule efi programs can not be signed. The header is not correct. % file certmule.efi certmule.efi: PE Unknown PE signature 0x742e (stripped to external PDB), for MS Windows It is missing many fields, including the Subsystem. % objdump -x certmule.efi certmule.efi: file format pei-aarch64-little certmule.efi architecture: aarch64, flags 0x00000001: HAS_RELOC start address 0x0000000000000000 Characteristics 0x20c line numbers stripped symbols stripped debugging information removed Time/Date Wed Dec 31 16:00:00 1969 Magic 0000 MajorLinkerVersion 0 MinorLinkerVersion 0 SizeOfCode 0000000000000000 SizeOfInitializedData 0000000000000000 SizeOfUninitializedData 0000000000000000 AddressOfEntryPoint 0000000000000000 BaseOfCode 0000000000000000 ImageBase 0000000000000000 SectionAlignment 00000000 FileAlignment 00000000 MajorOSystemVersion 0 MinorOSystemVersion 0 MajorImageVersion 0 MinorImageVersion 0 MajorSubsystemVersion 0 MinorSubsystemVersion 0 Win32Version 00000000 SizeOfImage 00000000 SizeOfHeaders 00000000 CheckSum 00000000 Subsystem 00000000 (unspecified) DllCharacteristics 00000000 SizeOfStackReserve 0000000000000000 SizeOfStackCommit 0000000000000000 SizeOfHeapReserve 0000000000000000 SizeOfHeapCommit 0000000000000000 LoaderFlags 00000000 NumberOfRvaAndSizes 00000000 Move over all the linker script files from shim to properly build a certmule program that can be signed. Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
1 parent d50e6c5 commit e1e8bd5

6 files changed

Lines changed: 516 additions & 1 deletion

File tree

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ sbat_data.o : /dev/null
114114
%.so : %.o
115115
$(CC) $(CCLDFLAGS) $(SOFLAGS) -o $@ $^ $(SOLIBS) \
116116
$(shell $(CC) -print-libgcc-file-name) \
117-
-T $(GNUEFIDIR)/gnuefi/elf_$(ARCH)_efi.lds
117+
-T $(TOPDIR)/elf_$(ARCH)_efi.lds
118118

119119
%.o : %.c
120120
$(CC) $(BUILDFLAGS) -c -o $@ $^

‎elf_aarch64_efi.lds‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
OUTPUT_FORMAT("elf64-littleaarch64", "elf64-littleaarch64", "elf64-littleaarch64")
2+
OUTPUT_ARCH(aarch64)
3+
ENTRY(_start)
4+
SECTIONS
5+
{
6+
. = 0;
7+
ImageBase = .;
8+
.hash : { *(.hash) } /* this MUST come first! */
9+
. = ALIGN(4096);
10+
.eh_frame :
11+
{
12+
*(.eh_frame)
13+
}
14+
. = ALIGN(4096);
15+
.text :
16+
{
17+
_text = .;
18+
*(.text)
19+
*(.text.*)
20+
*(.gnu.linkonce.t.*)
21+
_etext = .;
22+
}
23+
. = ALIGN(4096);
24+
.reloc :
25+
{
26+
*(.reloc)
27+
}
28+
. = ALIGN(4096);
29+
.note.gnu.build-id : {
30+
*(.note.gnu.build-id)
31+
}
32+
33+
. = ALIGN(4096);
34+
.data.ident : {
35+
*(.data.ident)
36+
}
37+
. = ALIGN(4096);
38+
.sbatlevel : {
39+
*(.sbatlevel)
40+
}
41+
42+
. = ALIGN(4096);
43+
.data :
44+
{
45+
_data = .;
46+
*(.rodata*)
47+
*(.got.plt)
48+
*(.got)
49+
*(.data*)
50+
*(.sdata)
51+
/* the EFI loader doesn't seem to like a .bss section, so we stick
52+
it all into .data: */
53+
*(.sbss)
54+
*(.scommon)
55+
*(.dynbss)
56+
*(.bss)
57+
*(COMMON)
58+
*(.rel.local)
59+
}
60+
61+
. = ALIGN(4096);
62+
.vendor_cert :
63+
{
64+
*(.vendor_cert)
65+
}
66+
. = ALIGN(4096);
67+
.dynamic : { *(.dynamic) }
68+
. = ALIGN(4096);
69+
.rela :
70+
{
71+
*(.rela.data*)
72+
*(.rela.got*)
73+
*(.rela.stab*)
74+
}
75+
_edata = .;
76+
_data_size = . - _data;
77+
. = ALIGN(4096);
78+
.sbat :
79+
{
80+
_sbat = .;
81+
*(.sbat)
82+
*(.sbat.*)
83+
}
84+
_esbat = .;
85+
_sbat_size = . - _sbat;
86+
87+
. = ALIGN(4096);
88+
.dynsym : { *(.dynsym) }
89+
. = ALIGN(4096);
90+
.dynstr : { *(.dynstr) }
91+
. = ALIGN(4096);
92+
.ignored.reloc :
93+
{
94+
*(.rela.reloc)
95+
*(.eh_frame)
96+
*(.note.GNU-stack)
97+
}
98+
.comment 0 : { *(.comment) }
99+
.note.gnu.build-id : { *(.note.gnu.build-id) }
100+
}

‎elf_arm_efi.lds‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
OUTPUT_FORMAT("elf32-littlearm", "elf32-littlearm", "elf32-littlearm")
2+
OUTPUT_ARCH(arm)
3+
ENTRY(_start)
4+
SECTIONS
5+
{
6+
.text 0x0 : {
7+
_text = .;
8+
*(.text.head)
9+
*(.text)
10+
*(.text.*)
11+
*(.gnu.linkonce.t.*)
12+
_evtext = .;
13+
. = ALIGN(4096);
14+
}
15+
_etext = .;
16+
_text_size = . - _text;
17+
_text_vsize = _evtext - _text;
18+
19+
. = ALIGN(4096);
20+
.data :
21+
{
22+
_data = .;
23+
*(.sdata)
24+
*(.data)
25+
*(.data1)
26+
*(.data.*)
27+
*(.got.plt)
28+
*(.got)
29+
30+
*(.dynamic)
31+
32+
/* the EFI loader doesn't seem to like a .bss section, so we stick
33+
it all into .data: */
34+
. = ALIGN(16);
35+
_bss = .;
36+
*(.sbss)
37+
*(.scommon)
38+
*(.dynbss)
39+
*(.bss)
40+
*(COMMON)
41+
_evdata = .;
42+
. = ALIGN(4096);
43+
_bss_end = .;
44+
}
45+
_edata = .;
46+
_data_vsize = _evdata - _data;
47+
_data_size = . - _data;
48+
49+
/*
50+
* Note that _sbat must be the beginning of the data, and _esbat must be the
51+
* end and must be before any section padding. The sbat self-check uses
52+
* _esbat to find the bounds of the data, and if the padding is included, the
53+
* CSV parser (correctly) rejects the data as having NUL values in one of the
54+
* required columns.
55+
*/
56+
. = ALIGN(4096);
57+
.sbat :
58+
{
59+
_sbat = .;
60+
*(.sbat)
61+
*(.sbat.*)
62+
_esbat = .;
63+
. = ALIGN(4096);
64+
_epsbat = .;
65+
}
66+
_sbat_size = _epsbat - _sbat;
67+
_sbat_vsize = _esbat - _sbat;
68+
69+
. = ALIGN(4096);
70+
.rodata :
71+
{
72+
_rodata = .;
73+
*(.rodata*)
74+
*(.srodata)
75+
. = ALIGN(16);
76+
*(.note.gnu.build-id)
77+
. = ALIGN(4096);
78+
*(.vendor_cert)
79+
*(.data.ident)
80+
. = ALIGN(4096);
81+
}
82+
. = ALIGN(4096);
83+
.rela :
84+
{
85+
*(.rela.dyn)
86+
*(.rela.plt)
87+
*(.rela.got)
88+
*(.rela.data)
89+
*(.rela.data*)
90+
}
91+
. = ALIGN(4096);
92+
.dyn :
93+
{
94+
*(.dynsym)
95+
*(.dynstr)
96+
_evrodata = .;
97+
. = ALIGN(4096);
98+
}
99+
_erodata = .;
100+
_rodata_size = . - _rodata;
101+
_rodata_vsize = _evrodata - _rodata;
102+
_alldata_size = . - _data;
103+
104+
/DISCARD/ :
105+
{
106+
*(.rel.reloc)
107+
*(.eh_frame)
108+
*(.note.GNU-stack)
109+
}
110+
.comment 0 : { *(.comment) }
111+
}

‎elf_ia32_efi.lds‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
OUTPUT_FORMAT("elf32-i386", "elf32-i386", "elf32-i386")
2+
OUTPUT_ARCH(i386)
3+
ENTRY(_start)
4+
SECTIONS
5+
{
6+
. = 0;
7+
ImageBase = .;
8+
.hash : { *(.hash) } /* this MUST come first! */
9+
. = ALIGN(4096);
10+
.text :
11+
{
12+
_text = .;
13+
*(.text)
14+
*(.text.*)
15+
*(.gnu.linkonce.t.*)
16+
_etext = .;
17+
}
18+
. = ALIGN(4096);
19+
.reloc :
20+
{
21+
*(.reloc)
22+
}
23+
. = ALIGN(4096);
24+
.note.gnu.build-id : {
25+
*(.note.gnu.build-id)
26+
}
27+
. = ALIGN(4096);
28+
.data.ident : {
29+
*(.data.ident)
30+
}
31+
. = ALIGN(4096);
32+
.sbatlevel : {
33+
*(.sbatlevel)
34+
}
35+
36+
. = ALIGN(4096);
37+
.data :
38+
{
39+
_data = .;
40+
*(.rodata*)
41+
*(.data)
42+
*(.data1)
43+
*(.data.*)
44+
*(.sdata)
45+
*(.got.plt)
46+
*(.got)
47+
/* the EFI loader doesn't seem to like a .bss section, so we stick
48+
it all into .data: */
49+
*(.sbss)
50+
*(.scommon)
51+
*(.dynbss)
52+
*(.bss)
53+
*(COMMON)
54+
}
55+
56+
. = ALIGN(4096);
57+
.vendor_cert :
58+
{
59+
*(.vendor_cert)
60+
}
61+
. = ALIGN(4096);
62+
.dynamic : { *(.dynamic) }
63+
. = ALIGN(4096);
64+
.rel :
65+
{
66+
*(.rel.data)
67+
*(.rel.data.*)
68+
*(.rel.got)
69+
*(.rel.stab)
70+
*(.data.rel.ro.local)
71+
*(.data.rel.local)
72+
*(.data.rel.ro)
73+
*(.data.rel*)
74+
}
75+
_edata = .;
76+
_data_size = . - _data;
77+
. = ALIGN(4096);
78+
.sbat :
79+
{
80+
_sbat = .;
81+
*(.sbat)
82+
*(.sbat.*)
83+
}
84+
_esbat = .;
85+
_sbat_size = . - _sbat;
86+
87+
. = ALIGN(4096);
88+
.dynsym : { *(.dynsym) }
89+
. = ALIGN(4096);
90+
.dynstr : { *(.dynstr) }
91+
. = ALIGN(4096);
92+
/DISCARD/ :
93+
{
94+
*(.rel.reloc)
95+
*(.eh_frame)
96+
*(.note.GNU-stack)
97+
}
98+
.comment 0 : { *(.comment) }
99+
}

0 commit comments

Comments
 (0)