x86/efistub backports

From: Ard Biesheuvel <[email protected]>

This is the final batch of changes to bring linux-6.1.y in sync with 6.6 and later in terms of compatibility with tightened boot security requirements imposed by MicroSoft, compliance with which is a prerequisite for them to be willing to resume signing distro shim images with the MS 3rd party secure boot certificate.

Without this, distros can only boot on off-the-shelf x86 PCs after disabling secure boot explicitly.

Most of these changes appeared in v6.8 and have been backported to v6.6 already.

Ard Biesheuvel (20):
x86/efi: Drop EFI stub .bss from .data section
x86/efi: Disregard setup header of loaded image x86/efistub: Reinstate soft limit for initrd loading x86/efi: Drop alignment flags from PE section headers x86/boot: Remove the 'bugger off' message
x86/boot: Omit compression buffer from PE/COFF image memory footprint x86/boot: Drop redundant code setting the root device x86/boot: Drop references to startup_64
x86/boot: Grab kernel_info offset from zoffset header directly x86/boot: Set EFI handover offset directly in header asm x86/boot: Define setup size in linker script
x86/boot: Derive file size from _edata symbol
x86/boot: Construct PE/COFF .text section from assembler x86/boot: Drop PE/COFF .reloc section
x86/boot: Split off PE/COFF .data section
x86/boot: Increase section and file alignment to 4k/512 x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section x86/sme: Move early SME kernel encryption handling into .head.text x86/sev: Move early startup code into .head.text section x86/efistub: Remap kernel text read-only before dropping NX attribute

Hou Wenlong (2):
x86/head/64: Add missing __head annotation to startup_64_load_idt() x86/head/64: Move the __head definition to <asm/init.h>

Pasha Tatashin (1):
x86/mm: Remove P*D_PAGE_MASK and P*D_PAGE_SIZE macros

 arch/x86/boot/Makefile                  |   2 +-
 arch/x86/boot/compressed/Makefile       |   2 +-
 arch/x86/boot/compressed/misc.c         |   1 +
 arch/x86/boot/compressed/sev.c          |   3 +
 arch/x86/boot/compressed/vmlinux.lds.S  |   6 +-
 arch/x86/boot/header.S                  | 211 ++++++---------
 arch/x86/boot/setup.ld                  |  14 +-
 arch/x86/boot/tools/build.c             | 273 +-------------------
 arch/x86/include/asm/boot.h             |   1 +
 arch/x86/include/asm/init.h             |   2 +
 arch/x86/include/asm/mem_encrypt.h      |   8 +-
 arch/x86/include/asm/page_types.h       |  12 +-
 arch/x86/include/asm/sev.h              |  10 +-
 arch/x86/kernel/amd_gart_64.c           |   2 +-
 arch/x86/kernel/head64.c                |   7 +-
 arch/x86/kernel/sev-shared.c            |  23 +-
 arch/x86/kernel/sev.c                   |  11 +-
 arch/x86/mm/mem_encrypt_boot.S          |   4 +-
 arch/x86/mm/mem_encrypt_identity.c      |  58 ++---
 arch/x86/mm/pat/set_memory.c            |   6 +-
 arch/x86/mm/pti.c                       |   2 +-
 drivers/firmware/efi/libstub/Makefile   |   7 -
 drivers/firmware/efi/libstub/x86-stub.c |  58 ++---
 23 files changed, 194 insertions(+), 529 deletions(-)

2.44.0.769.g3c40516874-goog