Skip to contentSkip to conversation

efi: implement generic compressed boot support

PATCH In review Ard Biesheuvel 5 participants 20 messages Sep 10, 2022 – Sep 20, 2022

Subsystems (5)
RISC-V arm64 EFI LoongArch +1 more subsystems
lore
Share & tools
lore

Ard Biesheuvel

author maintainer
#0 lore raw

v5 cover efi: implement generic compressed boot support

Relatively modern architectures such as arm64 or RISC-V don't implement a self-decompressing kernel, and leave it up to the bootloader to decompress the compressed image before executing it. For bare metal boot, this policy makes sense, as a self-decompressing image essentially duplicates a lot of fiddly preparation work to create a 1:1 mapping and set up the C runtime, and to discover or infer where DRAM lives from device trees or other firmware tables.

For EFI boot, the situation is a bit different: the EFI entrypoint is called with a 1:1 cached mapping covering all of DRAM already active, and with a stack, a heap, a memory map and boot services to load and start images. This means it is rather trivial to implement a self-decompressing wrapper for EFI boot in a generic manner, and reuse it across architectures that implement EFI boot.

The only slight downside is that when UEFI secure boot is enabled, the generic LoadImage/StartImage only allow signed images to be loaded and started, and we would prefer to avoid the need to sign both the inner and outer PE/COFF images.

However, the only truly generic and portable way to achieve this is to rely on LoadImage/StartImage as the EFI spec defines them, and avoid making assumptions about how things might work under the hood, and how we might circumvent that. This includes just loading the image into memory and jumping to the PE entry point: in the context of secure boot, measured boot and other hardening measures the firmware may take (such as disallowing mappings that are both writable and executable), using the firmware's image loading API is the only maintainable choice.

For this reason, this version of the series includes support for signing the images using sbsign, if the signing key and cert are specified in Kconfig.

The code is wired up for arm64, LoongArch and RISC-V. The latter was build tested only.

Changes since v4:
- make CONFIG_EFI_ZBOOT user selectable again, and turn it on by default only for LoongArch
- set KBUILD_IMAGE to vmlinuz.efi if CONFIG_EFI_ZBOOT=y, so that make targets such as zinstall and bindeb-pkg do the right thing
- throw an error is BSS was not cleared by the loader - this is needed to detect broken distro implementations of LoadImage in shim and grub
- add vmlinuz.* to .gitignore on the various architectures
- switch back to defining uncompressed_size as 'extern __aligned(1)' so that the compiler will perform the unaligned access as appropriate on the architecture in question - this requires the latest binutils on LoongArch [0]

Changes since v3:
- add support for XZ and ZSTD compression
- deal with exit data returned by StartImage()
- use LoadFile2 based image loading instead of passing the raw buffer - this way, the provenance of the data is more visible, allowing us, for instance, to deal with initrd= on arm64 transparently (this means that systemd-boot on arm64 will work unmodified provided that the [deprecated] command line initrd loader is enabled in the kernel build)
- include LoongArch support
- rename compressed image to vmlinuz.efi on all architectures

Changes since v2:
- drop some of the refactoring work to make efi_printk() available in the decompressor, and just use fixed strings instead;
- provide memcpy/memmove/memset based on the UEFI boot services, instead of having to specify for each architecture how to wire these up;
- drop PI/DXE based signature check circumvention, and just sign the inner image instead, if needed;
- add a header to the zimage binary that identifies it as a EFI zboot image, and describes the compression algorithm and where the payload lives in the image - this might be used by non-EFI loaders to locate and decompress the bare metal image, given that the EFI zboot one is not a hybrid like the one it encapsulates.

[0] https://sourceware.org/pipermail/binutils/2022-September/122713.html

Cc "James E.J. Bottomley" <[email protected]>
Cc Matthew Garrett <[email protected]>
Cc Peter Jones <[email protected]>
Cc Ilias Apalodimas <[email protected]>
Cc Heinrich Schuchardt <[email protected]>
Cc AKASHI Takahiro <[email protected]>
Cc Palmer Dabbelt <[email protected]>
Cc Atish Patra <[email protected]>
Cc Arnd Bergmann <[email protected]>
Cc Huacai Chen <[email protected]>
Cc Xi Ruoyao <[email protected]>
Cc Lennart Poettering <[email protected]>
Cc Jeremy Linton <[email protected]>
Cc Will Deacon <[email protected]>
Cc Catalin Marinas <[email protected]>

Ard Biesheuvel (8):
efi: name the ARCH-stub.c files uniformly
efi/libstub: add some missing EFI prototypes efi/libstub: use EFI provided memcpy/memset routines efi/libstub: move efi_system_table global var into separate object efi/libstub: implement generic EFI zboot
arm64: efi: enable generic EFI compressed boot
riscv: efi: enable generic EFI compressed boot
loongarch: efi: enable generic EFI compressed boot

 arch/arm64/Makefile                                       |   9 +-
 arch/arm64/boot/.gitignore                                |   1 +
 arch/arm64/boot/Makefile                                  |   6 +
 arch/arm64/kernel/image-vars.h                            |  13 -
 arch/loongarch/Kconfig                                    |   1 +
 arch/loongarch/Makefile                                   |   4 +-
 arch/loongarch/boot/.gitignore                            |   1 +
 arch/loongarch/boot/Makefile                              |   6 +
 arch/loongarch/kernel/image-vars.h                        |   3 -
 arch/riscv/Makefile                                       |   6 +-
 arch/riscv/boot/.gitignore                                |   1 +
 arch/riscv/boot/Makefile                                  |   6 +
 arch/riscv/kernel/image-vars.h                            |   9 -
 drivers/firmware/efi/Kconfig                              |  38 +++
 drivers/firmware/efi/libstub/Makefile                     |  21 +-
 drivers/firmware/efi/libstub/Makefile.zboot               |  70 +++++
 drivers/firmware/efi/libstub/{arm32-stub.c => arm-stub.c} |   0
 drivers/firmware/efi/libstub/efi-stub.c                   |   2 -
 drivers/firmware/efi/libstub/efistub.h                    |  35 ++-
 drivers/firmware/efi/libstub/file.c                       |  17 ++
 drivers/firmware/efi/libstub/intrinsics.c                 |  30 ++
 drivers/firmware/efi/libstub/systable.c                   |   8 +
 drivers/firmware/efi/libstub/zboot-header.S               | 143 ++++++++++
 drivers/firmware/efi/libstub/zboot.c                      | 296 ++++++++++++++++++++
 drivers/firmware/efi/libstub/zboot.lds                    |  43 +++
 include/linux/efi.h                                       |  13 +
 26 files changed, 732 insertions(+), 50 deletions(-)
 create mode 100644 drivers/firmware/efi/libstub/Makefile.zboot
 rename drivers/firmware/efi/libstub/{arm32-stub.c => arm-stub.c} (100%)
 create mode 100644 drivers/firmware/efi/libstub/intrinsics.c
 create mode 100644 drivers/firmware/efi/libstub/systable.c
 create mode 100644 drivers/firmware/efi/libstub/zboot-header.S
 create mode 100644 drivers/firmware/efi/libstub/zboot.c
 create mode 100644 drivers/firmware/efi/libstub/zboot.lds
Signature · 1 line
2.35.1
author maintainer
#1 lore raw

PATCH v5 1/8 efi: name the ARCH-stub.c files uniformly

Rename arm32-stub.c to arm-stub.c so that we can refer to all of them as $(ARCH)-stub.c

Signed-off-by Ard Biesheuvel <[email protected]>
---
 drivers/firmware/efi/libstub/Makefile                     | 9 ++-------
 drivers/firmware/efi/libstub/{arm32-stub.c => arm-stub.c} | 0
 2 files changed, 2 insertions(+), 7 deletions(-)
drivers/firmware/efi/libstub/Makefile +2 -7
index ec2a7ba9364f..39478fb30b2a 100644
@@ -68,13 +68,8 @@ $(obj)/lib-%.o: $(srctree)/lib/%.c FORCE
 lib-$(CONFIG_EFI_GENERIC_STUB)	+= efi-stub.o fdt.o string.o \
 				   $(patsubst %.c,lib-%.o,$(efi-deps-y))
 
-lib-$(CONFIG_ARM)		+= arm32-stub.o
-lib-$(CONFIG_ARM64)		+= arm64-stub.o
-lib-$(CONFIG_X86)		+= x86-stub.o
-lib-$(CONFIG_RISCV)		+= riscv-stub.o
-lib-$(CONFIG_LOONGARCH)		+= loongarch-stub.o
-
-CFLAGS_arm32-stub.o		:= -DTEXT_OFFSET=$(TEXT_OFFSET)
+lib-y				+= $(ARCH)-stub.o
+CFLAGS_arm-stub.o		:= -DTEXT_OFFSET=$(TEXT_OFFSET)
 
 # Even when -mbranch-protection=none is set, Clang will generate a
 # .note.gnu.property for code-less object files (like lib/ctype.c),
drivers/firmware/efi/libstub/arm-stub.c renamed from drivers/firmware/efi/libstub/arm32-stub.c +0 -0
similarity index 100%
rename from drivers/firmware/efi/libstub/arm32-stub.c
rename to drivers/firmware/efi/libstub/arm-stub.c
Signature · 1 line
2.35.1
author maintainer
#2 lore raw

PATCH v5 2/8 efi/libstub: add some missing EFI prototypes

In reply to Ard Biesheuvel

Define the correct prototypes for the load_image, start_image and unload_image boot service pointers so we can call them from the EFI zboot code.

Also add some prototypes related to installation and deinstallation of protocols in to the EFI protocol database, including some definitions related to device paths.

Signed-off-by Ard Biesheuvel <[email protected]>
---
 drivers/firmware/efi/libstub/efistub.h | 31 ++++++++++++++++----
 include/linux/efi.h                    | 12 ++++++++
 2 files changed, 38 insertions(+), 5 deletions(-)
drivers/firmware/efi/libstub/efistub.h +26 -5
index b0ae0a454404..c7efc404e663 100644
@@ -171,6 +171,23 @@ struct efi_boot_memmap {
 
 typedef struct efi_generic_dev_path efi_device_path_protocol_t;
 
+union efi_device_path_to_text_protocol {
+	struct {
+		efi_char16_t *(__efiapi *convert_device_node_to_text)(
+					const efi_device_path_protocol_t *,
+					bool, bool);
+		efi_char16_t *(__efiapi *convert_device_path_to_text)(
+					const efi_device_path_protocol_t *,
+					bool, bool);
+	};
+	struct {
+		u32 convert_device_node_to_text;
+		u32 convert_device_path_to_text;
+	} mixed_mode;
+};
+
+typedef union efi_device_path_to_text_protocol efi_device_path_to_text_protocol_t;
+
 typedef void *efi_event_t;
 /* Note that notifications won't work in mixed mode */
 typedef void (__efiapi *efi_event_notify_t)(efi_event_t, void *);

@@ -254,13 +271,17 @@ union efi_boot_services {
 							    efi_handle_t *);
 		efi_status_t (__efiapi *install_configuration_table)(efi_guid_t *,
 								     void *);
-		void *load_image;
-		void *start_image;
+		efi_status_t (__efiapi *load_image)(bool, efi_handle_t,
+						    efi_device_path_protocol_t *,
+						    void *, unsigned long,
+						    efi_handle_t *);
+		efi_status_t (__efiapi *start_image)(efi_handle_t, unsigned long *,
+						     efi_char16_t **);
 		efi_status_t __noreturn (__efiapi *exit)(efi_handle_t,
 							 efi_status_t,
 							 unsigned long,
 							 efi_char16_t *);
-		void *unload_image;
+		efi_status_t (__efiapi *unload_image)(efi_handle_t);
 		efi_status_t (__efiapi *exit_boot_services)(efi_handle_t,
 							    unsigned long);
 		void *get_next_monotonic_count;

@@ -277,8 +298,8 @@ union efi_boot_services {
 		void *locate_handle_buffer;
 		efi_status_t (__efiapi *locate_protocol)(efi_guid_t *, void *,
 							 void **);
-		void *install_multiple_protocol_interfaces;
-		void *uninstall_multiple_protocol_interfaces;
+		efi_status_t (__efiapi *install_multiple_protocol_interfaces)(efi_handle_t *, ...);
+		efi_status_t (__efiapi *uninstall_multiple_protocol_interfaces)(efi_handle_t, ...);
 		void *calculate_crc32;
 		void *copy_mem;
 		void *set_mem;
include/linux/efi.h +12 -0
index d2b84c2fec39..af90f7989f80 100644
@@ -368,6 +368,9 @@ void efi_native_runtime_setup(void);
 #define UV_SYSTEM_TABLE_GUID			EFI_GUID(0x3b13a7d4, 0x633e, 0x11dd,  0x93, 0xec, 0xda, 0x25, 0x56, 0xd8, 0x95, 0x93)
 #define LINUX_EFI_CRASH_GUID			EFI_GUID(0xcfc8fc79, 0xbe2e, 0x4ddc,  0x97, 0xf0, 0x9f, 0x98, 0xbf, 0xe2, 0x98, 0xa0)
 #define LOADED_IMAGE_PROTOCOL_GUID		EFI_GUID(0x5b1b31a1, 0x9562, 0x11d2,  0x8e, 0x3f, 0x00, 0xa0, 0xc9, 0x69, 0x72, 0x3b)
+#define LOADED_IMAGE_DEVICE_PATH_PROTOCOL_GUID	EFI_GUID(0xbc62157e, 0x3e33, 0x4fec,  0x99, 0x20, 0x2d, 0x3b, 0x36, 0xd7, 0x50, 0xdf)
+#define EFI_DEVICE_PATH_PROTOCOL_GUID		EFI_GUID(0x09576e91, 0x6d3f, 0x11d2,  0x8e, 0x39, 0x00, 0xa0, 0xc9, 0x69, 0x72, 0x3b)
+#define EFI_DEVICE_PATH_TO_TEXT_PROTOCOL_GUID	EFI_GUID(0x8b843e20, 0x8132, 0x4852,  0x90, 0xcc, 0x55, 0x1a, 0x4e, 0x4a, 0x7f, 0x1c)
 #define EFI_GRAPHICS_OUTPUT_PROTOCOL_GUID	EFI_GUID(0x9042a9de, 0x23dc, 0x4a38,  0x96, 0xfb, 0x7a, 0xde, 0xd0, 0x80, 0x51, 0x6a)
 #define EFI_UGA_PROTOCOL_GUID			EFI_GUID(0x982c298b, 0xf4fa, 0x41cb,  0xb8, 0x38, 0x77, 0xaa, 0x68, 0x8f, 0xb8, 0x39)
 #define EFI_PCI_IO_PROTOCOL_GUID		EFI_GUID(0x4cf5b200, 0x68b8, 0x4ca5,  0x9e, 0xec, 0xb2, 0x3e, 0x3f, 0x50, 0x02, 0x9a)

@@ -952,6 +955,7 @@ extern int efi_status_to_err(efi_status_t status);
 #define   EFI_DEV_MEDIA_VENDOR			 3
 #define   EFI_DEV_MEDIA_FILE			 4
 #define   EFI_DEV_MEDIA_PROTOCOL		 5
+#define   EFI_DEV_MEDIA_REL_OFFSET		 8
 #define EFI_DEV_BIOS_BOOT		0x05
 #define EFI_DEV_END_PATH		0x7F
 #define EFI_DEV_END_PATH2		0xFF

@@ -982,12 +986,20 @@ struct efi_vendor_dev_path {
 	u8				vendordata[];
 } __packed;
 
+struct efi_rel_offset_dev_path {
+	struct efi_generic_dev_path	header;
+	u32				reserved;
+	u64				starting_offset;
+	u64				ending_offset;
+} __packed;
+
 struct efi_dev_path {
 	union {
 		struct efi_generic_dev_path	header;
 		struct efi_acpi_dev_path	acpi;
 		struct efi_pci_dev_path		pci;
 		struct efi_vendor_dev_path	vendor;
+		struct efi_rel_offset_dev_path	rel_offset;
 	};
 } __packed;
Signature · 1 line
2.35.1
author maintainer
#3 lore raw

PATCH v5 3/8 efi/libstub: use EFI provided memcpy/memset routines

In reply to Ard Biesheuvel

The stub is used in different execution environments, but on arm64, RISC-V and LoongArch, we still use the core kernel's implementation of memcpy and memset, as they are just a branch instruction away, and can generally be reused even from code such as the EFI stub that runs in a completely different address space.

KAsan complicates this slightly, resulting in the need for some hacks to expose the uninstrumented, __ prefixed versions as the normal ones, as the latter are instrumented to include the KAsan checks, which only work in the core kernel.

Unfortunately, #define'ing memcpy to __memcpy when building C code does not guarantee that no explicit memcpy() calls will be emitted. And with the upcoming zboot support, which consists of a separate binary which therefore needs its own implementation of memcpy/memset anyway, it's better to provide one explicitly instead of linking to the existing one.

Given that EFI exposes implementations of memmove() and memset() via the boot services table, let's wire those up in the appropriate way, and drop the references to the core kernel ones.

Signed-off-by Ard Biesheuvel <[email protected]>
---
 arch/arm64/kernel/image-vars.h            | 13 ---------
 arch/loongarch/kernel/image-vars.h        |  3 --
 arch/riscv/kernel/image-vars.h            |  9 ------
 drivers/firmware/efi/libstub/Makefile     |  2 +-
 drivers/firmware/efi/libstub/efistub.h    |  4 +--
 drivers/firmware/efi/libstub/intrinsics.c | 30 ++++++++++++++++++++
 6 files changed, 33 insertions(+), 28 deletions(-)
arch/arm64/kernel/image-vars.h +0 -13
index afa69e04e75e..11643f4d864d 100644
@@ -24,9 +24,6 @@ PROVIDE(__efistub_primary_entry_offset	= primary_entry - _text);
  */
 PROVIDE(__efistub_memcmp		= __pi_memcmp);
 PROVIDE(__efistub_memchr		= __pi_memchr);
-PROVIDE(__efistub_memcpy		= __pi_memcpy);
-PROVIDE(__efistub_memmove		= __pi_memmove);
-PROVIDE(__efistub_memset		= __pi_memset);
 PROVIDE(__efistub_strlen		= __pi_strlen);
 PROVIDE(__efistub_strnlen		= __pi_strnlen);
 PROVIDE(__efistub_strcmp		= __pi_strcmp);

@@ -40,16 +37,6 @@ PROVIDE(__efistub__edata		= _edata);
 PROVIDE(__efistub_screen_info		= screen_info);
 PROVIDE(__efistub__ctype		= _ctype);
 
-/*
- * The __ prefixed memcpy/memset/memmove symbols are provided by KASAN, which
- * instruments the conventional ones. Therefore, any references from the EFI
- * stub or other position independent, low level C code should be redirected to
- * the non-instrumented versions as well.
- */
-PROVIDE(__efistub___memcpy		= __pi_memcpy);
-PROVIDE(__efistub___memmove		= __pi_memmove);
-PROVIDE(__efistub___memset		= __pi_memset);
-
 PROVIDE(__pi___memcpy			= __pi_memcpy);
 PROVIDE(__pi___memmove			= __pi_memmove);
 PROVIDE(__pi___memset			= __pi_memset);
arch/loongarch/kernel/image-vars.h +0 -3
index c901ebb903f2..88f5d81702df 100644
@@ -9,9 +9,6 @@
 
 __efistub_memcmp		= memcmp;
 __efistub_memchr		= memchr;
-__efistub_memcpy		= memcpy;
-__efistub_memmove		= memmove;
-__efistub_memset		= memset;
 __efistub_strcat		= strcat;
 __efistub_strcmp		= strcmp;
 __efistub_strlen		= strlen;
arch/riscv/kernel/image-vars.h +0 -9
index 71a76a623257..d6e5f739905e 100644
@@ -25,21 +25,12 @@
  */
 __efistub_memcmp		= memcmp;
 __efistub_memchr		= memchr;
-__efistub_memcpy		= memcpy;
-__efistub_memmove		= memmove;
-__efistub_memset		= memset;
 __efistub_strlen		= strlen;
 __efistub_strnlen		= strnlen;
 __efistub_strcmp		= strcmp;
 __efistub_strncmp		= strncmp;
 __efistub_strrchr		= strrchr;
 
-#ifdef CONFIG_KASAN
-__efistub___memcpy		= memcpy;
-__efistub___memmove		= memmove;
-__efistub___memset		= memset;
-#endif
-
 __efistub__start		= _start;
 __efistub__start_kernel		= _start_kernel;
 __efistub__end			= _end;
drivers/firmware/efi/libstub/Makefile +1 -1
index 39478fb30b2a..98045cfa46dc 100644
@@ -65,7 +65,7 @@ efi-deps-y := fdt_rw.c fdt_ro.c fdt_wip.c fdt.c fdt_empty_tree.c fdt_sw.c
 $(obj)/lib-%.o: $(srctree)/lib/%.c FORCE
 	$(call if_changed_rule,cc_o_c)
 
-lib-$(CONFIG_EFI_GENERIC_STUB)	+= efi-stub.o fdt.o string.o \
+lib-$(CONFIG_EFI_GENERIC_STUB)	+= efi-stub.o fdt.o string.o intrinsics.o \
 				   $(patsubst %.c,lib-%.o,$(efi-deps-y))
 
 lib-y				+= $(ARCH)-stub.o
drivers/firmware/efi/libstub/efistub.h +2 -2
index c7efc404e663..54f37e886be7 100644
@@ -301,8 +301,8 @@ union efi_boot_services {
 		efi_status_t (__efiapi *install_multiple_protocol_interfaces)(efi_handle_t *, ...);
 		efi_status_t (__efiapi *uninstall_multiple_protocol_interfaces)(efi_handle_t, ...);
 		void *calculate_crc32;
-		void *copy_mem;
-		void *set_mem;
+		void (__efiapi *copy_mem)(void *, const void *, unsigned long);
+		void (__efiapi *set_mem)(void *, unsigned long, unsigned char);
 		void *create_event_ex;
 	};
 	struct {
drivers/firmware/efi/libstub/intrinsics.c new file +30 -0
new file mode 100644
index 000000000000..a04ab39292b6
@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/efi.h>
+#include <asm/efi.h>
+#include <asm/string.h>
+
+#include "efistub.h"
+
+#ifdef CONFIG_KASAN
+#undef memcpy
+#undef memmove
+#undef memset
+void *__memcpy(void *__dest, const void *__src, size_t __n) __alias(memcpy);
+void *__memmove(void *__dest, const void *__src, size_t count) __alias(memmove);
+void *__memset(void *s, int c, size_t count) __alias(memset);
+#endif
+
+void *memcpy(void *dst, const void *src, size_t len)
+{
+	efi_bs_call(copy_mem, dst, src, len);
+	return dst;
+}
+
+extern void *memmove(void *dst, const void *src, size_t len) __alias(memcpy);
+
+void *memset(void *dst, int c, size_t len)
+{
+	efi_bs_call(set_mem, dst, len, c & U8_MAX);
+	return dst;
+}
Signature · 1 line
2.35.1
maintainer Acked-by on v5 3/8
#4 lore raw

Re: [PATCH v5 3/8] efi/libstub: use EFI provided memcpy/memset routines

Quoted 17 lines · Ard Biesheuvel

The stub is used in different execution environments, but on arm64, RISC-V and LoongArch, we still use the core kernel's implementation of memcpy and memset, as they are just a branch instruction away, and can generally be reused even from code such as the EFI stub that runs in a completely different address space.

KAsan complicates this slightly, resulting in the need for some hacks to expose the uninstrumented, __ prefixed versions as the normal ones, as the latter are instrumented to include the KAsan checks, which only work in the core kernel.

Unfortunately, #define'ing memcpy to __memcpy when building C code does not guarantee that no explicit memcpy() calls will be emitted. And with the upcoming zboot support, which consists of a separate binary which therefore needs its own implementation of memcpy/memset anyway, it's better to provide one explicitly instead of linking to the existing one.

Quoted 7 lines

Given that EFI exposes implementations of memmove() and memset() via the boot services table, let's wire those up in the appropriate way, and drop the references to the core kernel ones.

Signed-off-by Ard Biesheuvel <[email protected]>
---
 arch/arm64/kernel/image-vars.h            | 13 ---------
Acked-by Catalin Marinas <[email protected]>
author maintainer
#5 lore raw

PATCH v5 4/8 efi/libstub: move efi_system_table global var into separate object

In reply to Ard Biesheuvel

To avoid pulling in the wrong object when using the libstub static library to build the decompressor, define efi_system_table in a separate compilation unit.

Signed-off-by Ard Biesheuvel <[email protected]>
---
 drivers/firmware/efi/libstub/Makefile   | 3 ++-
 drivers/firmware/efi/libstub/efi-stub.c | 2 --
 drivers/firmware/efi/libstub/systable.c | 8 ++++++++
 3 files changed, 10 insertions(+), 3 deletions(-)
drivers/firmware/efi/libstub/Makefile +2 -1
index 98045cfa46dc..8d98efcf4473 100644
@@ -57,7 +57,8 @@ KCOV_INSTRUMENT			:= n
 lib-y				:= efi-stub-helper.o gop.o secureboot.o tpm.o \
 				   file.o mem.o random.o randomalloc.o pci.o \
 				   skip_spaces.o lib-cmdline.o lib-ctype.o \
-				   alignedmem.o relocate.o vsprintf.o
+				   alignedmem.o relocate.o vsprintf.o \
+				   systable.o
 
 # include the stub's generic dependencies from lib/ when building for ARM/arm64
 efi-deps-y := fdt_rw.c fdt_ro.c fdt_wip.c fdt.c fdt_empty_tree.c fdt_sw.c
drivers/firmware/efi/libstub/efi-stub.c +0 -2
index 4bf751484e8b..57ea04378087 100644
@@ -57,8 +57,6 @@
 static u64 virtmap_base = EFI_RT_VIRTUAL_BASE;
 static bool flat_va_mapping = (EFI_RT_VIRTUAL_OFFSET != 0);
 
-const efi_system_table_t *efi_system_table;
-
 static struct screen_info *setup_graphics(void)
 {
 	efi_guid_t gop_proto = EFI_GRAPHICS_OUTPUT_PROTOCOL_GUID;
drivers/firmware/efi/libstub/systable.c new file +8 -0
new file mode 100644
index 000000000000..91d016b02f8c
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/efi.h>
+#include <asm/efi.h>
+
+#include "efistub.h"
+
+const efi_system_table_t *efi_system_table;
Signature · 1 line
2.35.1
author maintainer
#6 lore raw

PATCH v5 5/8 efi/libstub: implement generic EFI zboot

In reply to Ard Biesheuvel

Implement a minimal EFI app that decompresses the real kernel image and launches it using the firmware's LoadImage and StartImage boot services. This removes the need for any arch-specific hacks.

Note that on systems that have UEFI secure boot policies enabled, LoadImage/StartImage require images to be signed, or their hashes known a priori, in order to be permitted to boot.

There are various possible strategies to work around this requirement, but they all rely either on overriding internal PI/DXE protocols (which are not part of the EFI spec) or omitting the firmware provided LoadImage() and StartImage() boot services, which is also undesirable, given that they encapsulate platform specific policies related to secure boot and measured boot, but also related to memory permissions (whether or not and which types of heap allocations have both write and execute permissions.)

The only generic and truly portable way around this is to simply sign both the inner and the outer image with the same key/cert pair, so this is what is implemented here.

Signed-off-by Ard Biesheuvel <[email protected]>
---
 drivers/firmware/efi/Kconfig                |  38 +++
 drivers/firmware/efi/libstub/Makefile       |   9 +-
 drivers/firmware/efi/libstub/Makefile.zboot |  70 +++++
 drivers/firmware/efi/libstub/file.c         |  17 ++
 drivers/firmware/efi/libstub/zboot-header.S | 143 ++++++++++
 drivers/firmware/efi/libstub/zboot.c        | 296 ++++++++++++++++++++
 drivers/firmware/efi/libstub/zboot.lds      |  43 +++
 include/linux/efi.h                         |   1 +
 8 files changed, 614 insertions(+), 3 deletions(-)
drivers/firmware/efi/Kconfig +38 -0
index cbf1c55dc224..c155cd752261 100644
@@ -105,6 +105,44 @@ config EFI_RUNTIME_WRAPPERS
 config EFI_GENERIC_STUB
 	bool
 
+config EFI_ZBOOT
+	bool "Enable the generic EFI decompressor"
+	depends on EFI_GENERIC_STUB && !ARM
+	select HAVE_KERNEL_GZIP
+	select HAVE_KERNEL_LZ4
+	select HAVE_KERNEL_LZMA
+	select HAVE_KERNEL_LZO
+	select HAVE_KERNEL_XZ
+	select HAVE_KERNEL_ZSTD
+	help
+	  Create the bootable image as an EFI application that carries the
+	  actual kernel image in compressed form, and decompresses it into
+	  memory before executing it via LoadImage/StartImage EFI boot service
+	  calls. For compatibility with non-EFI loaders, the payload can be
+	  decompressed and executed by the loader as well, provided that the
+	  loader implements the decompression algorithm and that non-EFI boot
+	  is supported by the encapsulated image. (The compression algorithm
+	  used is described in the zboot image header)
+
+config EFI_ZBOOT_SIGNED
+	bool "Sign the EFI decompressor for UEFI secure boot"
+	depends on EFI_ZBOOT
+	help
+	  Use the 'sbsign' command line tool (which must exist on the host
+	  path) to sign both the EFI decompressor PE/COFF image, as well as the
+	  encapsulated PE/COFF image, which is subsequently compressed and
+	  wrapped by the former image.
+
+config EFI_ZBOOT_SIGNING_CERT
+	string "Certificate to use for signing the compressed EFI boot image"
+	depends on EFI_ZBOOT_SIGNED
+	default ""
+
+config EFI_ZBOOT_SIGNING_KEY
+	string "Private key to use for signing the compressed EFI boot image"
+	depends on EFI_ZBOOT_SIGNED
+	default ""
+
 config EFI_ARMSTUB_DTB_LOADER
 	bool "Enable the DTB loader"
 	depends on EFI_GENERIC_STUB && !RISCV && !LOONGARCH
drivers/firmware/efi/libstub/Makefile +6 -3
index 8d98efcf4473..8c1225b92492 100644
@@ -72,6 +72,12 @@ lib-$(CONFIG_EFI_GENERIC_STUB)	+= efi-stub.o fdt.o string.o intrinsics.o \
 lib-y				+= $(ARCH)-stub.o
 CFLAGS_arm-stub.o		:= -DTEXT_OFFSET=$(TEXT_OFFSET)
 
+zboot-obj-$(CONFIG_RISCV)	:= lib-clz_ctz.o lib-ashldi3.o
+lib-$(CONFIG_EFI_ZBOOT)		+= zboot.o $(zboot-obj-y)
+
+extra-y				:= $(lib-y)
+lib-y				:= $(patsubst %.o,%.stub.o,$(lib-y))
+
 # Even when -mbranch-protection=none is set, Clang will generate a
 # .note.gnu.property for code-less object files (like lib/ctype.c),
 # so work around this by explicitly removing the unwanted section.

@@ -111,9 +117,6 @@ STUBCOPY_RELOC-$(CONFIG_ARM)	:= R_ARM_ABS
 # a verification pass to see if any absolute relocations exist in any of the
 # object files.
 #
-extra-y				:= $(lib-y)
-lib-y				:= $(patsubst %.o,%.stub.o,$(lib-y))
-
 STUBCOPY_FLAGS-$(CONFIG_ARM64)	+= --prefix-alloc-sections=.init \
 				   --prefix-symbols=__efistub_
 STUBCOPY_RELOC-$(CONFIG_ARM64)	:= R_AARCH64_ABS
drivers/firmware/efi/libstub/Makefile.zboot new file +70 -0

70 lines not on this page · raw message

drivers/firmware/efi/libstub/file.c +17 -0
index dd95f330fe6e..42b3338273aa 100644
@@ -66,10 +66,27 @@ static efi_status_t efi_open_file(efi_file_protocol_t *volume,
 static efi_status_t efi_open_volume(efi_loaded_image_t *image,
 				    efi_file_protocol_t **fh)
 {
+	struct efi_vendor_dev_path *dp = image->file_path;
+	efi_guid_t li_proto = LOADED_IMAGE_PROTOCOL_GUID;
 	efi_guid_t fs_proto = EFI_FILE_SYSTEM_GUID;
 	efi_simple_file_system_protocol_t *io;
 	efi_status_t status;
 
+	// If we are using EFI zboot, we should look for the file system
+	// protocol on the parent image's handle instead
+	if (IS_ENABLED(CONFIG_EFI_ZBOOT) &&
+	    image->parent_handle != NULL &&
+	    dp->header.type == EFI_DEV_MEDIA &&
+	    dp->header.sub_type == EFI_DEV_MEDIA_VENDOR &&
+	    !efi_guidcmp(dp->vendorguid, LINUX_EFI_ZBOOT_MEDIA_GUID)) {
+		status = efi_bs_call(handle_protocol, image->parent_handle,
+				     &li_proto, (void *)&image);
+		if (status != EFI_SUCCESS) {
+			efi_err("Failed to locate parent image handle\n");
+			return status;
+		}
+	}
+
 	status = efi_bs_call(handle_protocol, image->device_handle, &fs_proto,
 			     (void **)&io);
 	if (status != EFI_SUCCESS) {
drivers/firmware/efi/libstub/zboot-header.S new file +143 -0

143 lines not on this page · raw message

drivers/firmware/efi/libstub/zboot.c new file +296 -0

296 lines not on this page · raw message

drivers/firmware/efi/libstub/zboot.lds new file +43 -0

43 lines not on this page · raw message

include/linux/efi.h +1 -0
index af90f7989f80..5efc3105f8e0 100644
@@ -411,6 +411,7 @@ void efi_native_runtime_setup(void);
 #define LINUX_EFI_TPM_FINAL_LOG_GUID		EFI_GUID(0x1e2ed096, 0x30e2, 0x4254,  0xbd, 0x89, 0x86, 0x3b, 0xbe, 0xf8, 0x23, 0x25)
 #define LINUX_EFI_MEMRESERVE_TABLE_GUID		EFI_GUID(0x888eb0c6, 0x8ede, 0x4ff5,  0xa8, 0xf0, 0x9a, 0xee, 0x5c, 0xb9, 0x77, 0xc2)
 #define LINUX_EFI_INITRD_MEDIA_GUID		EFI_GUID(0x5568e427, 0x68fc, 0x4f3d,  0xac, 0x74, 0xca, 0x55, 0x52, 0x31, 0xcc, 0x68)
+#define LINUX_EFI_ZBOOT_MEDIA_GUID		EFI_GUID(0xe565a30d, 0x47da, 0x4dbd,  0xb3, 0x54, 0x9b, 0xb5, 0xc8, 0x4f, 0x8b, 0xe2)
 #define LINUX_EFI_MOK_VARIABLE_TABLE_GUID	EFI_GUID(0xc451ed2b, 0x9694, 0x45d3,  0xba, 0xba, 0xed, 0x9f, 0x89, 0x88, 0xa3, 0x89)
 #define LINUX_EFI_COCO_SECRET_AREA_GUID		EFI_GUID(0xadf956ad, 0xe98c, 0x484c,  0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47)
Signature · 1 line
2.35.1
author maintainer
#7 lore raw

PATCH v5 6/8 arm64: efi: enable generic EFI compressed boot

In reply to Ard Biesheuvel

Wire up the generic EFI zboot support for arm64.

Signed-off-by Ard Biesheuvel <[email protected]>
---
 arch/arm64/Makefile        | 9 +++++++--
 arch/arm64/boot/.gitignore | 1 +
 arch/arm64/boot/Makefile   | 6 ++++++
 3 files changed, 14 insertions(+), 2 deletions(-)
arch/arm64/Makefile +7 -2
index 6d9d4a58b898..a82bb3599094 100644
@@ -151,12 +151,17 @@ libs-$(CONFIG_EFI_STUB) += $(objtree)/drivers/firmware/efi/libstub/lib.a
 
 # Default target when executing plain make
 boot		:= arch/arm64/boot
+
+ifeq ($(CONFIG_EFI_ZBOOT),)
 KBUILD_IMAGE	:= $(boot)/Image.gz
+else
+KBUILD_IMAGE	:= $(boot)/vmlinuz.efi
+endif
 
-all:	Image.gz
+all:	$(notdir $(KBUILD_IMAGE))
 
 
-Image: vmlinux
+Image vmlinuz.efi: vmlinux
 	$(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
 
 Image.%: Image
arch/arm64/boot/.gitignore +1 -0
index 9a7a9009d43a..af5dc61f8b43 100644
@@ -1,3 +1,4 @@
 # SPDX-License-Identifier: GPL-2.0-only
 Image
 Image.gz
+vmlinuz*
arch/arm64/boot/Makefile +6 -0
index a0e3dedd2883..c65aee088410 100644
@@ -38,3 +38,9 @@ $(obj)/Image.lzo: $(obj)/Image FORCE
 
 $(obj)/Image.zst: $(obj)/Image FORCE
 	$(call if_changed,zstd)
+
+EFI_ZBOOT_PAYLOAD	:= Image
+EFI_ZBOOT_BFD_TARGET	:= elf64-littleaarch64
+EFI_ZBOOT_MACH_TYPE	:= ARM64
+
+include $(srctree)/drivers/firmware/efi/libstub/Makefile.zboot
Signature · 1 line
2.35.1
author maintainer
#8 lore raw

Re: [PATCH v5 6/8] arm64: efi: enable generic EFI compressed boot

Quoted 4 lines · Ard Biesheuvel

Wire up the generic EFI zboot support for arm64.

Signed-off-by Ard Biesheuvel <[email protected]>

I've queued up most of this now for 6.1 - Catalin, Will, any objections if I queue this one as well via the efi tree?

Quoted 56 lines
---
 arch/arm64/Makefile        | 9 +++++++--
 arch/arm64/boot/.gitignore | 1 +
 arch/arm64/boot/Makefile   | 6 ++++++
 3 files changed, 14 insertions(+), 2 deletions(-)
arch/arm64/Makefile +7 -2
index 6d9d4a58b898..a82bb3599094 100644
@@ -151,12 +151,17 @@ libs-$(CONFIG_EFI_STUB) += $(objtree)/drivers/firmware/efi/libstub/lib.a
 
 # Default target when executing plain make
 boot           := arch/arm64/boot
+
+ifeq ($(CONFIG_EFI_ZBOOT),)
 KBUILD_IMAGE   := $(boot)/Image.gz
+else
+KBUILD_IMAGE   := $(boot)/vmlinuz.efi
+endif
 
-all:   Image.gz
+all:   $(notdir $(KBUILD_IMAGE))
 
 
-Image: vmlinux
+Image vmlinuz.efi: vmlinux
        $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
 
 Image.%: Image
arch/arm64/boot/.gitignore +1 -0
index 9a7a9009d43a..af5dc61f8b43 100644
@@ -1,3 +1,4 @@
 # SPDX-License-Identifier: GPL-2.0-only
 Image
 Image.gz
+vmlinuz*
arch/arm64/boot/Makefile +6 -1
index a0e3dedd2883..c65aee088410 100644
@@ -38,3 +38,9 @@ $(obj)/Image.lzo: $(obj)/Image FORCE
 
 $(obj)/Image.zst: $(obj)/Image FORCE
        $(call if_changed,zstd)
+
+EFI_ZBOOT_PAYLOAD      := Image
+EFI_ZBOOT_BFD_TARGET   := elf64-littleaarch64
+EFI_ZBOOT_MACH_TYPE    := ARM64
+
+include $(srctree)/drivers/firmware/efi/libstub/Makefile.zboot
--

2.35.1

maintainer Acked-by
#9 lore raw

Re: [PATCH v5 6/8] arm64: efi: enable generic EFI compressed boot

Quoted 8 lines · Ard Biesheuvel
Quoted 4 lines · Ard Biesheuvel

Wire up the generic EFI zboot support for arm64.

Signed-off-by Ard Biesheuvel <[email protected]>

I've queued up most of this now for 6.1 - Catalin, Will, any objections if I queue this one as well via the efi tree?

No objections.

Acked-by Catalin Marinas <[email protected]>
author maintainer
#10 lore raw

PATCH v5 7/8 riscv: efi: enable generic EFI compressed boot

In reply to Ard Biesheuvel

Wire up the generic EFI zboot support for RISC-V.

Signed-off-by Ard Biesheuvel <[email protected]>
---
 arch/riscv/Makefile        | 6 +++++-
 arch/riscv/boot/.gitignore | 1 +
 arch/riscv/boot/Makefile   | 6 ++++++
 3 files changed, 12 insertions(+), 1 deletion(-)
arch/riscv/Makefile +5 -1
index 3fa8ef336822..d63295e21373 100644
@@ -136,10 +136,14 @@ ifneq ($(CONFIG_XIP_KERNEL),y)
 ifeq ($(CONFIG_RISCV_M_MODE)$(CONFIG_SOC_CANAAN),yy)
 KBUILD_IMAGE := $(boot)/loader.bin
 else
+ifeq ($(CONFIG_EFI_ZBOOT),)
 KBUILD_IMAGE := $(boot)/Image.gz
+else
+KBUILD_IMAGE := $(boot)/vmlinuz.efi
+endif
 endif
 endif
-BOOT_TARGETS := Image Image.gz loader loader.bin xipImage
+BOOT_TARGETS := Image Image.gz loader loader.bin xipImage vmlinuz.efi
 
 all:	$(notdir $(KBUILD_IMAGE))
arch/riscv/boot/.gitignore +1 -0
index 0cea9f7fa9d5..e1bc507e8cb2 100644
@@ -4,4 +4,5 @@ Image.*
 loader
 loader.lds
 loader.bin
+vmlinuz*
 xipImage
arch/riscv/boot/Makefile +6 -0
index becd0621071c..d1a49adcb1d7 100644
@@ -58,3 +58,9 @@ $(obj)/Image.lzo: $(obj)/Image FORCE
 
 $(obj)/loader.bin: $(obj)/loader FORCE
 	$(call if_changed,objcopy)
+
+EFI_ZBOOT_PAYLOAD	:= Image
+EFI_ZBOOT_BFD_TARGET	:= elf$(BITS)-littleriscv
+EFI_ZBOOT_MACH_TYPE	:= RISCV$(BITS)
+
+include $(srctree)/drivers/firmware/efi/libstub/Makefile.zboot
Signature · 1 line
2.35.1
Tested-by on v5 7/8
#11 lore raw

Re: [PATCH v5 7/8] riscv: efi: enable generic EFI compressed boot

Quoted 5 lines · Ard Biesheuvel

EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe

Wire up the generic EFI zboot support for RISC-V.

Signed-off-by Ard Biesheuvel <[email protected]>

As promised:

Tested-by Conor Dooley <[email protected]>
Quoted 53 lines
---
  arch/riscv/Makefile        | 6 +++++-
  arch/riscv/boot/.gitignore | 1 +
  arch/riscv/boot/Makefile   | 6 ++++++
  3 files changed, 12 insertions(+), 1 deletion(-)
arch/riscv/Makefile +5 -1
index 3fa8ef336822..d63295e21373 100644
@@ -136,10 +136,14 @@ ifneq ($(CONFIG_XIP_KERNEL),y)
  ifeq ($(CONFIG_RISCV_M_MODE)$(CONFIG_SOC_CANAAN),yy)
  KBUILD_IMAGE := $(boot)/loader.bin
  else
+ifeq ($(CONFIG_EFI_ZBOOT),)
  KBUILD_IMAGE := $(boot)/Image.gz
+else
+KBUILD_IMAGE := $(boot)/vmlinuz.efi
+endif
  endif
  endif
-BOOT_TARGETS := Image Image.gz loader loader.bin xipImage
+BOOT_TARGETS := Image Image.gz loader loader.bin xipImage vmlinuz.efi
 
  all:   $(notdir $(KBUILD_IMAGE))
arch/riscv/boot/.gitignore +1 -0
index 0cea9f7fa9d5..e1bc507e8cb2 100644
@@ -4,4 +4,5 @@ Image.*
  loader
  loader.lds
  loader.bin
+vmlinuz*
  xipImage
arch/riscv/boot/Makefile +6 -1
index becd0621071c..d1a49adcb1d7 100644
@@ -58,3 +58,9 @@ $(obj)/Image.lzo: $(obj)/Image FORCE
 
  $(obj)/loader.bin: $(obj)/loader FORCE
         $(call if_changed,objcopy)
+
+EFI_ZBOOT_PAYLOAD      := Image
+EFI_ZBOOT_BFD_TARGET   := elf$(BITS)-littleriscv
+EFI_ZBOOT_MACH_TYPE    := RISCV$(BITS)
+
+include $(srctree)/drivers/firmware/efi/libstub/Makefile.zboot
--

2.35.1

author maintainer
#12 lore raw

Re: [PATCH v5 7/8] riscv: efi: enable generic EFI compressed boot

Quoted 10 lines · On Fri, 16 Sept 2022 at 09:09, <[email protected]> wrote:
Quoted 4 lines · Ard Biesheuvel

Wire up the generic EFI zboot support for RISC-V.

Signed-off-by Ard Biesheuvel <[email protected]>

As promised:

Tested-by Conor Dooley <[email protected]>

Thanks a lot!

Quoted 54 lines
Quoted 53 lines
---
  arch/riscv/Makefile        | 6 +++++-
  arch/riscv/boot/.gitignore | 1 +
  arch/riscv/boot/Makefile   | 6 ++++++
  3 files changed, 12 insertions(+), 1 deletion(-)
arch/riscv/Makefile +5 -1
index 3fa8ef336822..d63295e21373 100644
@@ -136,10 +136,14 @@ ifneq ($(CONFIG_XIP_KERNEL),y)
  ifeq ($(CONFIG_RISCV_M_MODE)$(CONFIG_SOC_CANAAN),yy)
  KBUILD_IMAGE := $(boot)/loader.bin
  else
+ifeq ($(CONFIG_EFI_ZBOOT),)
  KBUILD_IMAGE := $(boot)/Image.gz
+else
+KBUILD_IMAGE := $(boot)/vmlinuz.efi
+endif
  endif
  endif
-BOOT_TARGETS := Image Image.gz loader loader.bin xipImage
+BOOT_TARGETS := Image Image.gz loader loader.bin xipImage vmlinuz.efi
 
  all:   $(notdir $(KBUILD_IMAGE))
arch/riscv/boot/.gitignore +1 -0
index 0cea9f7fa9d5..e1bc507e8cb2 100644
@@ -4,4 +4,5 @@ Image.*
  loader
  loader.lds
  loader.bin
+vmlinuz*
  xipImage
arch/riscv/boot/Makefile +6 -1
index becd0621071c..d1a49adcb1d7 100644
@@ -58,3 +58,9 @@ $(obj)/Image.lzo: $(obj)/Image FORCE
 
  $(obj)/loader.bin: $(obj)/loader FORCE
         $(call if_changed,objcopy)
+
+EFI_ZBOOT_PAYLOAD      := Image
+EFI_ZBOOT_BFD_TARGET   := elf$(BITS)-littleriscv
+EFI_ZBOOT_MACH_TYPE    := RISCV$(BITS)
+
+include $(srctree)/drivers/firmware/efi/libstub/Makefile.zboot
--

2.35.1

author maintainer
#13 lore raw

PATCH v5 8/8 loongarch: efi: enable generic EFI compressed boot

In reply to Ard Biesheuvel

Wire up the generic EFI zboot support for LoongArch64

Signed-off-by Ard Biesheuvel <[email protected]>
---
 arch/loongarch/Kconfig         | 1 +
 arch/loongarch/Makefile        | 4 ++--
 arch/loongarch/boot/.gitignore | 1 +
 arch/loongarch/boot/Makefile   | 6 ++++++
 4 files changed, 10 insertions(+), 2 deletions(-)
arch/loongarch/Kconfig +1 -0
index fca106a8b8af..f960dbbfb62d 100644
@@ -55,6 +55,7 @@ config LOONGARCH
 	select BUILDTIME_TABLE_SORT
 	select COMMON_CLK
 	select EFI
+	select EFI_ZBOOT
 	select GENERIC_CLOCKEVENTS
 	select GENERIC_CMOS_UPDATE
 	select GENERIC_CPU_AUTOPROBE
arch/loongarch/Makefile +2 -2
index 4bc47f47cfd8..357ed2a771bf 100644
@@ -10,7 +10,7 @@ KBUILD_DEFCONFIG := loongson3_defconfig
 ifndef CONFIG_EFI_STUB
 KBUILD_IMAGE	:= $(boot)/vmlinux.elf
 else
-KBUILD_IMAGE	:= $(boot)/vmlinux.efi
+KBUILD_IMAGE	:= $(boot)/vmlinuz.efi
 endif
 
 #

@@ -93,7 +93,7 @@ vdso_install:
 
 all:	$(notdir $(KBUILD_IMAGE))
 
-vmlinux.elf vmlinux.efi: vmlinux
+vmlinux.elf vmlinux.efi vmlinuz.efi: vmlinux
 	$(Q)$(MAKE) $(build)=$(boot) $(bootvars-y) $(boot)/$@
 
 install:
arch/loongarch/boot/.gitignore +1 -0
index 49423ee96ef3..e5dc594dc4b6 100644
@@ -1,2 +1,3 @@
 # SPDX-License-Identifier: GPL-2.0-only
 vmlinux*
+vmlinuz*
arch/loongarch/boot/Makefile +6 -0
index fecf34f50e56..4e1c374c5782 100644
@@ -18,3 +18,9 @@ $(obj)/vmlinux.elf: vmlinux FORCE
 targets += vmlinux.efi
 $(obj)/vmlinux.efi: vmlinux FORCE
 	$(call if_changed,objcopy)
+
+EFI_ZBOOT_PAYLOAD      := vmlinux.efi
+EFI_ZBOOT_BFD_TARGET   := elf64-loongarch
+EFI_ZBOOT_MACH_TYPE    := LOONGARCH64
+
+include $(srctree)/drivers/firmware/efi/libstub/Makefile.zboot
Signature · 1 line
2.35.1
#14 lore raw

Re: [PATCH v5 8/8] loongarch: efi: enable generic EFI compressed boot

Hi, Ard,

I prefer to give a chance to disable ZBOOT, so I don't want to select EFI_ZBOOT unconditionally in Kconfig, and then the Makefile can be like this:

arch/loongarch/Makefile +4 -0
index c3f579bdf9e5..bc6fe65125f5 100644
@@ -14,6 +14,10 @@ else
 KBUILD_IMAGE   := $(boot)/vmlinux.efi
 endif
 
+ifdef CONFIG_EFI_ZBOOT
+KBUILD_IMAGE    := $(boot)/vmlinuz.efi
+endif
+
 archscripts: scripts_basic
        $(Q)$(MAKE) $(build)=arch/loongarch/boot/tools relocs

Huacai

Quoted 75 lines

-----原始邮件-----
发件人: "Ard Biesheuvel" <[email protected]>
发送时间:2022-09-10 16:11:52 (星期六)
收件人: [email protected]
抄送: [email protected], [email protected], "Ard Biesheuvel" <[email protected]>, "James E.J. Bottomley" <[email protected]>, "Matthew Garrett" <[email protected]>, "Peter Jones" <[email protected]>, "Ilias Apalodimas" <[email protected]>, "Heinrich Schuchardt" <[email protected]>, "AKASHI Takahiro" <[email protected]>, "Palmer Dabbelt" <[email protected]>, "Atish Patra" <[email protected]>, "Arnd Bergmann" <[email protected]>, "Huacai Chen" <[email protected]>, "Xi Ruoyao" <[email protected]>, "Lennart Poettering" <[email protected]>, "Jeremy Linton" <[email protected]>, "Will Deacon" <[email protected]>, "Catalin Marinas" <[email protected]> 主题: [PATCH v5 8/8] loongarch: efi: enable generic EFI compressed boot

Wire up the generic EFI zboot support for LoongArch64

Signed-off-by Ard Biesheuvel <[email protected]>
---
 arch/loongarch/Kconfig         | 1 +
 arch/loongarch/Makefile        | 4 ++--
 arch/loongarch/boot/.gitignore | 1 +
 arch/loongarch/boot/Makefile   | 6 ++++++
 4 files changed, 10 insertions(+), 2 deletions(-)
arch/loongarch/Kconfig +1 -0
index fca106a8b8af..f960dbbfb62d 100644
@@ -55,6 +55,7 @@ config LOONGARCH
 	select BUILDTIME_TABLE_SORT
 	select COMMON_CLK
 	select EFI
+	select EFI_ZBOOT
 	select GENERIC_CLOCKEVENTS
 	select GENERIC_CMOS_UPDATE
 	select GENERIC_CPU_AUTOPROBE
arch/loongarch/Makefile +2 -2
index 4bc47f47cfd8..357ed2a771bf 100644
@@ -10,7 +10,7 @@ KBUILD_DEFCONFIG := loongson3_defconfig
 ifndef CONFIG_EFI_STUB
 KBUILD_IMAGE	:= $(boot)/vmlinux.elf
 else
-KBUILD_IMAGE	:= $(boot)/vmlinux.efi
+KBUILD_IMAGE	:= $(boot)/vmlinuz.efi
 endif
 
 #

@@ -93,7 +93,7 @@ vdso_install:
 
 all:	$(notdir $(KBUILD_IMAGE))
 
-vmlinux.elf vmlinux.efi: vmlinux
+vmlinux.elf vmlinux.efi vmlinuz.efi: vmlinux
 	$(Q)$(MAKE) $(build)=$(boot) $(bootvars-y) $(boot)/$@
 
 install:
arch/loongarch/boot/.gitignore +1 -0
index 49423ee96ef3..e5dc594dc4b6 100644
@@ -1,2 +1,3 @@
 # SPDX-License-Identifier: GPL-2.0-only
 vmlinux*
+vmlinuz*
arch/loongarch/boot/Makefile +6 -0
index fecf34f50e56..4e1c374c5782 100644
@@ -18,3 +18,9 @@ $(obj)/vmlinux.elf: vmlinux FORCE
 targets += vmlinux.efi
 $(obj)/vmlinux.efi: vmlinux FORCE
 	$(call if_changed,objcopy)
+
+EFI_ZBOOT_PAYLOAD      := vmlinux.efi
+EFI_ZBOOT_BFD_TARGET   := elf64-loongarch
+EFI_ZBOOT_MACH_TYPE    := LOONGARCH64
+
+include $(srctree)/drivers/firmware/efi/libstub/Makefile.zboot
Signature · 1 line
2.35.1

本邮件及其附件含有龙芯中科的商业秘密信息，仅限于发送给上面地址中列出的个人或群组。禁止任何其他人以任何形式使用（包括但不限于全部或部分地泄露、复制或散发）本邮件及其附件中的信息。如果您错收本邮件，请您立即电话或邮件通知发件人并删除本邮件。
This email and its attachments contain confidential information from Loongson Technology , which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction or dissemination) by persons other than the intended recipient(s) is prohibited. If you receive this email in error, please notify the sender by phone or email immediately and delete it.

author maintainer
#15 lore raw

Re: [PATCH v5 8/8] loongarch: efi: enable generic EFI compressed boot

Quoted 9 lines · 陈华才

Hi, Ard,

I prefer to give a chance to disable ZBOOT, so I don't want to select EFI_ZBOOT unconditionally in Kconfig, and then the Makefile can be like this:

arch/loongarch/Makefile +0 -0
index c3f579bdf9e5..bc6fe65125f5 100644

arch/loongarch/Makefile else · line 23

Quoted 10 lines
arch/loongarch/Makefile +4 -0
@@ -14,6 +14,10 @@ else
 KBUILD_IMAGE   := $(boot)/vmlinux.efi
 endif
 
+ifdef CONFIG_EFI_ZBOOT
+KBUILD_IMAGE    := $(boot)/vmlinuz.efi
+endif
+
 archscripts: scripts_basic
        $(Q)$(MAKE) $(build)=arch/loongarch/boot/tools relocs

OK, I will fold this in. This actually aligns it with the other architectures, so I prefer this approach as well.

Quoted 80 lines
Quoted 75 lines

-----原始邮件-----
发件人: "Ard Biesheuvel" <[email protected]>
发送时间:2022-09-10 16:11:52 (星期六)
收件人: [email protected]
抄送: [email protected], [email protected], "Ard Biesheuvel" <[email protected]>, "James E.J. Bottomley" <[email protected]>, "Matthew Garrett" <[email protected]>, "Peter Jones" <[email protected]>, "Ilias Apalodimas" <[email protected]>, "Heinrich Schuchardt" <[email protected]>, "AKASHI Takahiro" <[email protected]>, "Palmer Dabbelt" <[email protected]>, "Atish Patra" <[email protected]>, "Arnd Bergmann" <[email protected]>, "Huacai Chen" <[email protected]>, "Xi Ruoyao" <[email protected]>, "Lennart Poettering" <[email protected]>, "Jeremy Linton" <[email protected]>, "Will Deacon" <[email protected]>, "Catalin Marinas" <[email protected]> 主题: [PATCH v5 8/8] loongarch: efi: enable generic EFI compressed boot

Wire up the generic EFI zboot support for LoongArch64

Signed-off-by Ard Biesheuvel <[email protected]>
---
 arch/loongarch/Kconfig         | 1 +
 arch/loongarch/Makefile        | 4 ++--
 arch/loongarch/boot/.gitignore | 1 +
 arch/loongarch/boot/Makefile   | 6 ++++++
 4 files changed, 10 insertions(+), 2 deletions(-)
arch/loongarch/Kconfig +1 -0
index fca106a8b8af..f960dbbfb62d 100644
@@ -55,6 +55,7 @@ config LOONGARCH
      select BUILDTIME_TABLE_SORT
      select COMMON_CLK
      select EFI
+     select EFI_ZBOOT
      select GENERIC_CLOCKEVENTS
      select GENERIC_CMOS_UPDATE
      select GENERIC_CPU_AUTOPROBE
arch/loongarch/Makefile +2 -2
index 4bc47f47cfd8..357ed2a771bf 100644
@@ -10,7 +10,7 @@ KBUILD_DEFCONFIG := loongson3_defconfig
 ifndef CONFIG_EFI_STUB
 KBUILD_IMAGE := $(boot)/vmlinux.elf
 else
-KBUILD_IMAGE := $(boot)/vmlinux.efi
+KBUILD_IMAGE := $(boot)/vmlinuz.efi
 endif
 
 #

@@ -93,7 +93,7 @@ vdso_install:
 
 all: $(notdir $(KBUILD_IMAGE))
 
-vmlinux.elf vmlinux.efi: vmlinux
+vmlinux.elf vmlinux.efi vmlinuz.efi: vmlinux
      $(Q)$(MAKE) $(build)=$(boot) $(bootvars-y) $(boot)/$@
 
 install:
arch/loongarch/boot/.gitignore +1 -0
index 49423ee96ef3..e5dc594dc4b6 100644
@@ -1,2 +1,3 @@
 # SPDX-License-Identifier: GPL-2.0-only
 vmlinux*
+vmlinuz*
arch/loongarch/boot/Makefile +6 -1
index fecf34f50e56..4e1c374c5782 100644
@@ -18,3 +18,9 @@ $(obj)/vmlinux.elf: vmlinux FORCE
 targets += vmlinux.efi
 $(obj)/vmlinux.efi: vmlinux FORCE
      $(call if_changed,objcopy)
+
+EFI_ZBOOT_PAYLOAD      := vmlinux.efi
+EFI_ZBOOT_BFD_TARGET   := elf64-loongarch
+EFI_ZBOOT_MACH_TYPE    := LOONGARCH64
+
+include $(srctree)/drivers/firmware/efi/libstub/Makefile.zboot
--
Quoted 1 line

2.35.1

本邮件及其附件含有龙芯中科的商业秘密信息，仅限于发送给上面地址中列出的个人或群组。禁止任何其他人以任何形式使用（包括但不限于全部或部分地泄露、复制或散发）本邮件及其附件中的信息。如果您错收本邮件，请您立即电话或邮件通知发件人并删除本邮件。
This email and its attachments contain confidential information from Loongson Technology , which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction or dissemination) by persons other than the intended recipient(s) is prohibited. If you receive this email in error, please notify the sender by phone or email immediately and delete it.

#16 lore raw

Re: Re: [PATCH v5 8/8] loongarch: efi: enable generic EFI compressed boot

Quoted 23 lines

-----原始邮件-----
发件人: "Ard Biesheuvel" <[email protected]>
发送时间:2022-09-10 22:28:04 (星期六)
收件人: "陈华才" <[email protected]>
抄送: [email protected], [email protected], [email protected], "James E.J. Bottomley" <[email protected]>, "Matthew Garrett" <[email protected]>, "Peter Jones" <[email protected]>, "Ilias Apalodimas" <[email protected]>, "Heinrich Schuchardt" <[email protected]>, "AKASHI Takahiro" <[email protected]>, "Palmer Dabbelt" <[email protected]>, "Atish Patra" <[email protected]>, "Arnd Bergmann" <[email protected]>, "Xi Ruoyao" <[email protected]>, "Lennart Poettering" <[email protected]>, "Jeremy Linton" <[email protected]>, "Will Deacon" <[email protected]>, "Catalin Marinas" <[email protected]> 主题: Re: [PATCH v5 8/8] loongarch: efi: enable generic EFI compressed boot

Quoted 12 lines · 陈华才

Hi, Ard,

I prefer to give a chance to disable ZBOOT, so I don't want to select EFI_ZBOOT unconditionally in Kconfig, and then the Makefile can be like this:

arch/loongarch/Makefile +0 -0
index c3f579bdf9e5..bc6fe65125f5 100644
@@ -14,6 +14,10 @@ else
 KBUILD_IMAGE   := $(boot)/vmlinux.efi
 endif
Quoted 10 lines

arch/loongarch/Makefile else · line 23

Quoted 7 lines
arch/loongarch/Makefile +4 -0
+ifdef CONFIG_EFI_ZBOOT
+KBUILD_IMAGE    := $(boot)/vmlinuz.efi
+endif
+
 archscripts: scripts_basic
        $(Q)$(MAKE) $(build)=arch/loongarch/boot/tools relocs

OK, I will fold this in. This actually aligns it with the other architectures, so I prefer this approach as well.

Thank you, and if "make install" can also handle the zboot case, that's even better. :)

arch/loongarch/Makefile +4 -0
index c3f579bdf9e5..5480fe2de7cd 100644
@@ -137,7 +137,11 @@ vmlinux.elf vmlinux.efi vmlinuz.efi: vmlinux
 core-y += arch/loongarch/boot/dts/
 
 install:
+ifndef CONFIG_EFI_ZBOOT
        $(Q)install -D -m 755 $(KBUILD_IMAGE) $(INSTALL_PATH)/vmlinux-$(KERNELRELEASE)
+else
+       $(Q)install -D -m 755 $(KBUILD_IMAGE) $(INSTALL_PATH)/vmlinuz-$(KERNELRELEASE)
+endif
        $(Q)install -D -m 644 .config $(INSTALL_PATH)/config-$(KERNELRELEASE)
        $(Q)install -D -m 644 System.map $(INSTALL_PATH)/System.map-$(KERNELRELEASE)
Quoted 74 lines
Quoted 74 lines
Quoted 74 lines

-----原始邮件-----
发件人: "Ard Biesheuvel" <[email protected]>
发送时间:2022-09-10 16:11:52 (星期六)
收件人: [email protected]
抄送: [email protected], [email protected], "Ard Biesheuvel" <[email protected]>, "James E.J. Bottomley" <[email protected]>, "Matthew Garrett" <[email protected]>, "Peter Jones" <[email protected]>, "Ilias Apalodimas" <[email protected]>, "Heinrich Schuchardt" <[email protected]>, "AKASHI Takahiro" <[email protected]>, "Palmer Dabbelt" <[email protected]>, "Atish Patra" <[email protected]>, "Arnd Bergmann" <[email protected]>, "Huacai Chen" <[email protected]>, "Xi Ruoyao" <[email protected]>, "Lennart Poettering" <[email protected]>, "Jeremy Linton" <[email protected]>, "Will Deacon" <[email protected]>, "Catalin Marinas" <[email protected]> 主题: [PATCH v5 8/8] loongarch: efi: enable generic EFI compressed boot

Wire up the generic EFI zboot support for LoongArch64

Signed-off-by Ard Biesheuvel <[email protected]>
---
 arch/loongarch/Kconfig         | 1 +
 arch/loongarch/Makefile        | 4 ++--
 arch/loongarch/boot/.gitignore | 1 +
 arch/loongarch/boot/Makefile   | 6 ++++++
 4 files changed, 10 insertions(+), 2 deletions(-)
arch/loongarch/Kconfig +1 -0
index fca106a8b8af..f960dbbfb62d 100644
@@ -55,6 +55,7 @@ config LOONGARCH
      select BUILDTIME_TABLE_SORT
      select COMMON_CLK
      select EFI
+     select EFI_ZBOOT
      select GENERIC_CLOCKEVENTS
      select GENERIC_CMOS_UPDATE
      select GENERIC_CPU_AUTOPROBE
arch/loongarch/Makefile +2 -2
index 4bc47f47cfd8..357ed2a771bf 100644
@@ -10,7 +10,7 @@ KBUILD_DEFCONFIG := loongson3_defconfig
 ifndef CONFIG_EFI_STUB
 KBUILD_IMAGE := $(boot)/vmlinux.elf
 else
-KBUILD_IMAGE := $(boot)/vmlinux.efi
+KBUILD_IMAGE := $(boot)/vmlinuz.efi
 endif
 
 #

@@ -93,7 +93,7 @@ vdso_install:
 
 all: $(notdir $(KBUILD_IMAGE))
 
-vmlinux.elf vmlinux.efi: vmlinux
+vmlinux.elf vmlinux.efi vmlinuz.efi: vmlinux
      $(Q)$(MAKE) $(build)=$(boot) $(bootvars-y) $(boot)/$@
 
 install:
arch/loongarch/boot/.gitignore +1 -0
index 49423ee96ef3..e5dc594dc4b6 100644
@@ -1,2 +1,3 @@
 # SPDX-License-Identifier: GPL-2.0-only
 vmlinux*
+vmlinuz*
arch/loongarch/boot/Makefile +4 -0
index fecf34f50e56..4e1c374c5782 100644
@@ -18,3 +18,9 @@ $(obj)/vmlinux.elf: vmlinux FORCE
 targets += vmlinux.efi
 $(obj)/vmlinux.efi: vmlinux FORCE
      $(call if_changed,objcopy)
+
+EFI_ZBOOT_PAYLOAD      := vmlinux.efi
+EFI_ZBOOT_BFD_TARGET   := elf64-loongarch
+EFI_ZBOOT_MACH_TYPE    := LOONGARCH64
Quoted 8 lines
Quoted 8 lines
Quoted 4 lines
arch/loongarch/boot/Makefile +2 -1
+
+include $(srctree)/drivers/firmware/efi/libstub/Makefile.zboot
--

2.35.1

本邮件及其附件含有龙芯中科的商业秘密信息，仅限于发送给上面地址中列出的个人或群组。禁止任何其他人以任何形式使用（包括但不限于全部或部分地泄露、复制或散发）本邮件及其附件中的信息。如果您错收本邮件，请您立即电话或邮件通知发件人并删除本邮件。
This email and its attachments contain confidential information from Loongson Technology , which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction or dissemination) by persons other than the intended recipient(s) is prohibited. If you receive this email in error, please notify the sender by phone or email immediately and delete it.

本邮件及其附件含有龙芯中科的商业秘密信息，仅限于发送给上面地址中列出的个人或群组。禁止任何其他人以任何形式使用（包括但不限于全部或部分地泄露、复制或散发）本邮件及其附件中的信息。如果您错收本邮件，请您立即电话或邮件通知发件人并删除本邮件。
This email and its attachments contain confidential information from Loongson Technology , which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction or dissemination) by persons other than the intended recipient(s) is prohibited. If you receive this email in error, please notify the sender by phone or email immediately and delete it.

author maintainer
#17 lore raw

Re: Re: [PATCH v5 8/8] loongarch: efi: enable generic EFI compressed boot

Quoted 43 lines · 陈华才
Quoted 24 lines

-----原始邮件-----
发件人: "Ard Biesheuvel" <[email protected]>
发送时间:2022-09-10 22:28:04 (星期六)
收件人: "陈华才" <[email protected]>
抄送: [email protected], [email protected], [email protected], "James E.J. Bottomley" <[email protected]>, "Matthew Garrett" <[email protected]>, "Peter Jones" <[email protected]>, "Ilias Apalodimas" <[email protected]>, "Heinrich Schuchardt" <[email protected]>, "AKASHI Takahiro" <[email protected]>, "Palmer Dabbelt" <[email protected]>, "Atish Patra" <[email protected]>, "Arnd Bergmann" <[email protected]>, "Xi Ruoyao" <[email protected]>, "Lennart Poettering" <[email protected]>, "Jeremy Linton" <[email protected]>, "Will Deacon" <[email protected]>, "Catalin Marinas" <[email protected]> 主题: Re: [PATCH v5 8/8] loongarch: efi: enable generic EFI compressed boot

Quoted 12 lines · 陈华才

Hi, Ard,

I prefer to give a chance to disable ZBOOT, so I don't want to select EFI_ZBOOT unconditionally in Kconfig, and then the Makefile can be like this:

arch/loongarch/Makefile +0 -0
index c3f579bdf9e5..bc6fe65125f5 100644
@@ -14,6 +14,10 @@ else
 KBUILD_IMAGE   := $(boot)/vmlinux.efi
 endif
Quoted 10 lines

arch/loongarch/Makefile else · line 23

Quoted 7 lines
arch/loongarch/Makefile +4 -0
+ifdef CONFIG_EFI_ZBOOT
+KBUILD_IMAGE    := $(boot)/vmlinuz.efi
+endif
+
 archscripts: scripts_basic
        $(Q)$(MAKE) $(build)=arch/loongarch/boot/tools relocs

OK, I will fold this in. This actually aligns it with the other architectures, so I prefer this approach as well.

Thank you, and if "make install" can also handle the zboot case, that's even better. :)

arch/loongarch/Makefile +0 -0
index c3f579bdf9e5..5480fe2de7cd 100644
@@ -137,7 +137,11 @@ vmlinux.elf vmlinux.efi vmlinuz.efi: vmlinux
 core-y += arch/loongarch/boot/dts/

arch/loongarch/Makefile vmlinux.elf vmlinux.efi vmlinuz.efi: vmlinux · line 147

Quoted 10 lines
arch/loongarch/Makefile +4 -0
 
 install:
+ifndef CONFIG_EFI_ZBOOT
        $(Q)install -D -m 755 $(KBUILD_IMAGE) $(INSTALL_PATH)/vmlinux-$(KERNELRELEASE)
+else
+       $(Q)install -D -m 755 $(KBUILD_IMAGE) $(INSTALL_PATH)/vmlinuz-$(KERNELRELEASE)
+endif
        $(Q)install -D -m 644 .config $(INSTALL_PATH)/config-$(KERNELRELEASE)
        $(Q)install -D -m 644 System.map $(INSTALL_PATH)/System.map-$(KERNELRELEASE)

Is there any reason in particular this is open coded like this? Other architectures just do something like

install:

    $(call cmd,install)

and be done with it.

#18 lore raw

Re: Re: Re: [PATCH v5 8/8] loongarch: efi: enable generic EFI compressed boot

Hi, Ard,

Quoted 65 lines

-----原始邮件-----
发件人: "Ard Biesheuvel" <[email protected]>
发送时间:2022-09-12 18:18:05 (星期一)
收件人: "陈华才" <[email protected]>
抄送: [email protected], [email protected], [email protected], "James E.J. Bottomley" <[email protected]>, "Matthew Garrett" <[email protected]>, "Peter Jones" <[email protected]>, "Ilias Apalodimas" <[email protected]>, "Heinrich Schuchardt" <[email protected]>, "AKASHI Takahiro" <[email protected]>, "Palmer Dabbelt" <[email protected]>, "Atish Patra" <[email protected]>, "Arnd Bergmann" <[email protected]>, "Xi Ruoyao" <[email protected]>, "Lennart Poettering" <[email protected]>, "Jeremy Linton" <[email protected]>, "Will Deacon" <[email protected]>, "Catalin Marinas" <[email protected]> 主题: Re: Re: [PATCH v5 8/8] loongarch: efi: enable generic EFI compressed boot

Quoted 43 lines · 陈华才
Quoted 24 lines

-----原始邮件-----
发件人: "Ard Biesheuvel" <[email protected]>
发送时间:2022-09-10 22:28:04 (星期六)
收件人: "陈华才" <[email protected]>
抄送: [email protected], [email protected], [email protected], "James E.J. Bottomley" <[email protected]>, "Matthew Garrett" <[email protected]>, "Peter Jones" <[email protected]>, "Ilias Apalodimas" <[email protected]>, "Heinrich Schuchardt" <[email protected]>, "AKASHI Takahiro" <[email protected]>, "Palmer Dabbelt" <[email protected]>, "Atish Patra" <[email protected]>, "Arnd Bergmann" <[email protected]>, "Xi Ruoyao" <[email protected]>, "Lennart Poettering" <[email protected]>, "Jeremy Linton" <[email protected]>, "Will Deacon" <[email protected]>, "Catalin Marinas" <[email protected]> 主题: Re: [PATCH v5 8/8] loongarch: efi: enable generic EFI compressed boot

Quoted 12 lines · 陈华才

Hi, Ard,

I prefer to give a chance to disable ZBOOT, so I don't want to select EFI_ZBOOT unconditionally in Kconfig, and then the Makefile can be like this:

arch/loongarch/Makefile +0 -0
index c3f579bdf9e5..bc6fe65125f5 100644
@@ -14,6 +14,10 @@ else
 KBUILD_IMAGE   := $(boot)/vmlinux.efi
 endif
Quoted 10 lines

arch/loongarch/Makefile else · line 23

Quoted 7 lines
arch/loongarch/Makefile +4 -0
+ifdef CONFIG_EFI_ZBOOT
+KBUILD_IMAGE    := $(boot)/vmlinuz.efi
+endif
+
 archscripts: scripts_basic
        $(Q)$(MAKE) $(build)=arch/loongarch/boot/tools relocs

OK, I will fold this in. This actually aligns it with the other architectures, so I prefer this approach as well.

Thank you, and if "make install" can also handle the zboot case, that's even better. :)

arch/loongarch/Makefile +0 -0
index c3f579bdf9e5..5480fe2de7cd 100644
@@ -137,7 +137,11 @@ vmlinux.elf vmlinux.efi vmlinuz.efi: vmlinux
 core-y += arch/loongarch/boot/dts/

arch/loongarch/Makefile vmlinux.elf vmlinux.efi vmlinuz.efi: vmlinux · line 147

Quoted 10 lines
arch/loongarch/Makefile +4 -0
 
 install:
+ifndef CONFIG_EFI_ZBOOT
        $(Q)install -D -m 755 $(KBUILD_IMAGE) $(INSTALL_PATH)/vmlinux-$(KERNELRELEASE)
+else
+       $(Q)install -D -m 755 $(KBUILD_IMAGE) $(INSTALL_PATH)/vmlinuz-$(KERNELRELEASE)
+endif
        $(Q)install -D -m 644 .config $(INSTALL_PATH)/config-$(KERNELRELEASE)
        $(Q)install -D -m 644 System.map $(INSTALL_PATH)/System.map-$(KERNELRELEASE)

Is there any reason in particular this is open coded like this? Other architectures just do something like

Quoted 4 lines

install:

    $(call cmd,install)

and be done with it.

It seems that there are two problems:
1, the default install script doesn't install the configuration file;
2, the kernel name in "installkernel" isn't the same as the open coded version, it looks like this:
if [ $ARCH = 'ppc64' -o $ARCH = 'ppc' ]; then
KERNEL_NAME=vmlinux
else
KERNEL_NAME=vmlinuz
fi

Maybe we can provide an arch-specific install.sh as arm64 does, but it is even more complex than the open coded version.

Huacai

本邮件及其附件含有龙芯中科的商业秘密信息，仅限于发送给上面地址中列出的个人或群组。禁止任何其他人以任何形式使用（包括但不限于全部或部分地泄露、复制或散发）本邮件及其附件中的信息。如果您错收本邮件，请您立即电话或邮件通知发件人并删除本邮件。
This email and its attachments contain confidential information from Loongson Technology , which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction or dissemination) by persons other than the intended recipient(s) is prohibited. If you receive this email in error, please notify the sender by phone or email immediately and delete it.

Tested-by on the v5 series
#19 lore raw
In reply to Ard Biesheuvel

Hi,

With the BSS "fix" in grub for fedora/rhel, this is now working fine for both systemd-boot and normal grub2, as well as booting directly from the UEFI shell. Given both the magic number and the bss fix were merged at the same time I don't think anyone should ever see the bad bss message, at least not on the above distro's.

I've largely been testing this on the PFTF/RPi4, and in a libvirt qemu/kvm env with/without ksan/etc on a mostly fedora configured kernel. Hooking this up to kinstall makes sense and works, although i'm not a big fan.

So, its looking good. All thumbs up here :)

Tested-by Jeremy Linton <[email protected]>
Quoted 137 lines · Ard Biesheuvel

Relatively modern architectures such as arm64 or RISC-V don't implement a self-decompressing kernel, and leave it up to the bootloader to decompress the compressed image before executing it. For bare metal boot, this policy makes sense, as a self-decompressing image essentially duplicates a lot of fiddly preparation work to create a 1:1 mapping and set up the C runtime, and to discover or infer where DRAM lives from device trees or other firmware tables.

For EFI boot, the situation is a bit different: the EFI entrypoint is called with a 1:1 cached mapping covering all of DRAM already active, and with a stack, a heap, a memory map and boot services to load and start images. This means it is rather trivial to implement a self-decompressing wrapper for EFI boot in a generic manner, and reuse it across architectures that implement EFI boot.

The only slight downside is that when UEFI secure boot is enabled, the generic LoadImage/StartImage only allow signed images to be loaded and started, and we would prefer to avoid the need to sign both the inner and outer PE/COFF images.

However, the only truly generic and portable way to achieve this is to rely on LoadImage/StartImage as the EFI spec defines them, and avoid making assumptions about how things might work under the hood, and how we might circumvent that. This includes just loading the image into memory and jumping to the PE entry point: in the context of secure boot, measured boot and other hardening measures the firmware may take (such as disallowing mappings that are both writable and executable), using the firmware's image loading API is the only maintainable choice.

For this reason, this version of the series includes support for signing the images using sbsign, if the signing key and cert are specified in Kconfig.

The code is wired up for arm64, LoongArch and RISC-V. The latter was build tested only.

Changes since v4:
- make CONFIG_EFI_ZBOOT user selectable again, and turn it on by default only for LoongArch
- set KBUILD_IMAGE to vmlinuz.efi if CONFIG_EFI_ZBOOT=y, so that make targets such as zinstall and bindeb-pkg do the right thing
- throw an error is BSS was not cleared by the loader - this is needed to detect broken distro implementations of LoadImage in shim and grub
- add vmlinuz.* to .gitignore on the various architectures
- switch back to defining uncompressed_size as 'extern __aligned(1)' so that the compiler will perform the unaligned access as appropriate on the architecture in question - this requires the latest binutils on LoongArch [0]

Changes since v3:
- add support for XZ and ZSTD compression
- deal with exit data returned by StartImage()
- use LoadFile2 based image loading instead of passing the raw buffer - this way, the provenance of the data is more visible, allowing us, for instance, to deal with initrd= on arm64 transparently (this means that systemd-boot on arm64 will work unmodified provided that the [deprecated] command line initrd loader is enabled in the kernel build)
- include LoongArch support
- rename compressed image to vmlinuz.efi on all architectures

Changes since v2:
- drop some of the refactoring work to make efi_printk() available in the decompressor, and just use fixed strings instead;
- provide memcpy/memmove/memset based on the UEFI boot services, instead of having to specify for each architecture how to wire these up;
- drop PI/DXE based signature check circumvention, and just sign the inner image instead, if needed;
- add a header to the zimage binary that identifies it as a EFI zboot image, and describes the compression algorithm and where the payload lives in the image - this might be used by non-EFI loaders to locate and decompress the bare metal image, given that the EFI zboot one is not a hybrid like the one it encapsulates.

[0] https://sourceware.org/pipermail/binutils/2022-September/122713.html

Cc "James E.J. Bottomley" <[email protected]>
Cc Matthew Garrett <[email protected]>
Cc Peter Jones <[email protected]>
Cc Ilias Apalodimas <[email protected]>
Cc Heinrich Schuchardt <[email protected]>
Cc AKASHI Takahiro <[email protected]>
Cc Palmer Dabbelt <[email protected]>
Cc Atish Patra <[email protected]>
Cc Arnd Bergmann <[email protected]>
Cc Huacai Chen <[email protected]>
Cc Xi Ruoyao <[email protected]>
Cc Lennart Poettering <[email protected]>
Cc Jeremy Linton <[email protected]>
Cc Will Deacon <[email protected]>
Cc Catalin Marinas <[email protected]>

Ard Biesheuvel (8):
efi: name the ARCH-stub.c files uniformly
efi/libstub: add some missing EFI prototypes efi/libstub: use EFI provided memcpy/memset routines efi/libstub: move efi_system_table global var into separate object efi/libstub: implement generic EFI zboot
arm64: efi: enable generic EFI compressed boot
riscv: efi: enable generic EFI compressed boot
loongarch: efi: enable generic EFI compressed boot

  arch/arm64/Makefile                                       |   9 +-
  arch/arm64/boot/.gitignore                                |   1 +
  arch/arm64/boot/Makefile                                  |   6 +
  arch/arm64/kernel/image-vars.h                            |  13 -
  arch/loongarch/Kconfig                                    |   1 +
  arch/loongarch/Makefile                                   |   4 +-
  arch/loongarch/boot/.gitignore                            |   1 +
  arch/loongarch/boot/Makefile                              |   6 +
  arch/loongarch/kernel/image-vars.h                        |   3 -
  arch/riscv/Makefile                                       |   6 +-
  arch/riscv/boot/.gitignore                                |   1 +
  arch/riscv/boot/Makefile                                  |   6 +
  arch/riscv/kernel/image-vars.h                            |   9 -
  drivers/firmware/efi/Kconfig                              |  38 +++
  drivers/firmware/efi/libstub/Makefile                     |  21 +-
  drivers/firmware/efi/libstub/Makefile.zboot               |  70 +++++
  drivers/firmware/efi/libstub/{arm32-stub.c => arm-stub.c} |   0
  drivers/firmware/efi/libstub/efi-stub.c                   |   2 -
  drivers/firmware/efi/libstub/efistub.h                    |  35 ++-
  drivers/firmware/efi/libstub/file.c                       |  17 ++
  drivers/firmware/efi/libstub/intrinsics.c                 |  30 ++
  drivers/firmware/efi/libstub/systable.c                   |   8 +
  drivers/firmware/efi/libstub/zboot-header.S               | 143 ++++++++++
  drivers/firmware/efi/libstub/zboot.c                      | 296 ++++++++++++++++++++
  drivers/firmware/efi/libstub/zboot.lds                    |  43 +++
  include/linux/efi.h                                       |  13 +
  26 files changed, 732 insertions(+), 50 deletions(-)

create mode 100644 drivers/firmware/efi/libstub/Makefile.zboot rename drivers/firmware/efi/libstub/{arm32-stub.c => arm-stub.c} (100%) create mode 100644 drivers/firmware/efi/libstub/intrinsics.c create mode 100644 drivers/firmware/efi/libstub/systable.c create mode 100644 drivers/firmware/efi/libstub/zboot-header.S create mode 100644 drivers/firmware/efi/libstub/zboot.c create mode 100644 drivers/firmware/efi/libstub/zboot.lds