Relatively modern architectures such as arm64 or RISC-V don't implement a self-decompressing kernel, and leave it up to the bootloader to decompress the compressed image before executing it. For bare metal boot, this policy makes sense, as a self-decompressing image essentially duplicates a lot of fiddly preparation work to create a 1:1 mapping and set up the C runtime, and to discover or infer where DRAM lives from device trees or other firmware tables. For EFI boot, the situation is a bit different: the EFI entrypoint is called with a 1:1 cached mapping covering all of DRAM already active, and with a stack, a heap, a memory map and boot services to load and start images. This means it is rather trivial to implement a self-decompressing wrapper for EFI boot in a generic manner, and reuse it across architectures that implement EFI boot. The only slight downside is that when UEFI secure boot is enabled, the generic LoadImage/StartImage only allow signed images to be loaded and started, and we prefer to avoid the need to sign both the inner and outer PE/COFF images. This series adopts the EFI shim approach, i.e., to override an internal UEFI/PI protocol that is used by the image loader, to allow the inner image to be booted after decompression. This has been tested to work with Tianocore based EFI implementations on arm64, but u-boot will need some interoperability tweaks as well, ideally just a protocol that exposes a LoadImage/StartImage combo that the decompresor can use directly to circumvent the signature check. (Note that EFI apps have full control over the CPU, page tables, etc. so having code that circumvents authentication checks is not as crazy as it sounds, given that the app can do anything it pleases already.) The code is wired up for arm64 and RISC-V. The latter was build tested only. Cc: "James E.J. Bottomley" <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx> Cc: Matthew Garrett <mjg59@xxxxxxxxxxxxx> Cc: Peter Jones <pjones@xxxxxxxxxx> Cc: Ilias Apalodimas <ilias.apalodimas@xxxxxxxxxx> Cc: Heinrich Schuchardt <heinrich.schuchardt@xxxxxxxxxxxxx> Cc: AKASHI Takahiro <takahiro.akashi@xxxxxxxxxx> Cc: Palmer Dabbelt <palmer@xxxxxxxxxxx> Cc: Atish Patra <atishp@xxxxxxxxxxxxxx> Cc: Arnd Bergmann <arnd@xxxxxxxx> Cc: Huacai Chen <chenhuacai@xxxxxxxxxxx> Cc: Lennart Poettering <lennart@xxxxxxxxxxxxxx> Ard Biesheuvel (6): efi: stub: add some missing boot service prototypes efi: stub: split off printk() routines efi: stub: move efi_system_table global var into separate object efi: stub: implement generic EFI zboot arm64: efi: enable generic EFI compressed boot riscv: efi: enable generic EFI compressed boot arch/arm64/Makefile | 5 + arch/arm64/boot/Makefile | 12 ++ arch/riscv/Makefile | 5 + arch/riscv/boot/Makefile | 14 ++ drivers/firmware/efi/Kconfig | 9 + drivers/firmware/efi/libstub/Makefile | 7 +- drivers/firmware/efi/libstub/Makefile.zboot | 30 +++ drivers/firmware/efi/libstub/efi-stub-helper.c | 141 --------------- drivers/firmware/efi/libstub/efi-stub.c | 2 - drivers/firmware/efi/libstub/efistub.h | 12 +- drivers/firmware/efi/libstub/printk.c | 158 ++++++++++++++++ drivers/firmware/efi/libstub/systable.c | 8 + drivers/firmware/efi/libstub/zboot-header.S | 144 +++++++++++++++ drivers/firmware/efi/libstub/zboot.c | 191 ++++++++++++++++++++ drivers/firmware/efi/libstub/zboot.lds | 41 +++++ include/linux/efi.h | 2 + 16 files changed, 633 insertions(+), 148 deletions(-) create mode 100644 drivers/firmware/efi/libstub/Makefile.zboot create mode 100644 drivers/firmware/efi/libstub/printk.c create mode 100644 drivers/firmware/efi/libstub/systable.c create mode 100644 drivers/firmware/efi/libstub/zboot-header.S create mode 100644 drivers/firmware/efi/libstub/zboot.c create mode 100644 drivers/firmware/efi/libstub/zboot.lds -- 2.35.1
