[PATCH 1/6] Add SBAT section to the PE binary

[Frediano Ziglio <freddy77@xxxxxxxxx>]

From: Gerald Elder-Vass <gerald.elder-vass@xxxxxxxxx>

The SBAT section provides a way for the binary to declare a generation
id for its upstream source and any vendor changes applied. A compatible
loader can then revoke vulnerable binaries by generation, using the
binary's declared generation id(s) to determine if it is safe to load.

More information about SBAT is available here:
https://github.com/rhboot/shim/blob/main/SBAT.md

Populate the SBAT section in the Xen binary by using the information
in xen/arch/x86/sbat.csv.

On XenServer, the version and release fields are populated by the spec
file during the build process.

Signed-off-by: Gerald Elder-Vass <gerald.elder-vass@xxxxxxxxx>
Signed-off-by: Frediano Ziglio <frediano.ziglio@xxxxxxxxx>
---
 xen/arch/x86/Makefile     | 4 ++++
 xen/arch/x86/xen.lds.S    | 2 ++
 xen/include/xen/xen.lds.h | 3 ++-
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/Makefile b/xen/arch/x86/Makefile
index 47dd6c50fe..a2bdcb6f44 100644
--- a/xen/arch/x86/Makefile
+++ b/xen/arch/x86/Makefile
@@ -71,6 +71,7 @@ obj-$(CONFIG_TBOOT) += tboot.o
 obj-y += hpet.o
 obj-$(CONFIG_VM_EVENT) += vm_event.o
 obj-y += xstate.o
+obj-y += sbat_data.o
 
 ifneq ($(CONFIG_PV_SHIM_EXCLUSIVE),y)
 obj-y += domctl.o
@@ -275,6 +276,9 @@ $(obj)/efi.lds: AFLAGS-y += -DEFI
 $(obj)/xen.lds $(obj)/efi.lds: $(src)/xen.lds.S FORCE
        $(call if_changed_dep,cpp_lds_S)
 
+$(obj)/sbat_data.o: $(src)/sbat.csv
+       $(OBJCOPY) -I binary -O elf64-x86-64 --rename-section 
.data=.sbat,readonly,data,contents --add-section .note.GNU-stack=/dev/null 
$(srcdir)/sbat.csv $@
+
 clean-files := \
     include/asm/asm-macros.* \
     $(objtree)/.xen-syms.[0-9]* \
diff --git a/xen/arch/x86/sbat.csv b/xen/arch/x86/sbat.csv
new file mode 100644
index 000000000000..1573604e2f10
--- /dev/null
+++ b/xen/arch/x86/sbat.csv
@@ -0,0 +1,1 @@
+sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
diff --git a/xen/arch/x86/xen.lds.S b/xen/arch/x86/xen.lds.S
index b9e888e596..c2b9b5a893 100644
--- a/xen/arch/x86/xen.lds.S
+++ b/xen/arch/x86/xen.lds.S
@@ -354,6 +354,8 @@ SECTIONS
   PROVIDE(ALT_START = 0);
   VIRT_START &= 0;
   ALT_START &= 0;
+
+  .sbat (NOLOAD) : { *(.sbat) }
 #elif defined(XEN_BUILD_EFI)
   /*
    * Due to the way EFI support is currently implemented, these two symbols
diff --git a/xen/include/xen/xen.lds.h b/xen/include/xen/xen.lds.h
index ea11e3fb62..c9aa1b7fae 100644
--- a/xen/include/xen/xen.lds.h
+++ b/xen/include/xen/xen.lds.h
@@ -118,7 +118,8 @@
        *(.comment.*) \
        *(.note.*)
 #else
-#define DISCARD_EFI_SECTIONS
+#define DISCARD_EFI_SECTIONS \
+       *(.sbat)
 #endif
 
 /* Sections to be discarded. */
-- 
2.43.0