On 8/9/22 10:09, Ard Biesheuvel wrote:
Relatively modern architectures such as arm64 or RISC-V don't implement a self-decompressing kernel, and leave it up to the bootloader to decompress the compressed image before executing it. For bare metal boot, this policy makes sense, as a self-decompressing image essentially duplicates a lot of fiddly preparation work to create a 1:1 mapping and set up the C runtime, and to discover or infer where DRAM lives from device trees or other firmware tables. For EFI boot, the situation is a bit different: the EFI entrypoint is called with a 1:1 cached mapping covering all of DRAM already active, and with a stack, a heap, a memory map and boot services to load and start images. This means it is rather trivial to implement a self-decompressing wrapper for EFI boot in a generic manner, and reuse it across architectures that implement EFI boot. The only slight downside is that when UEFI secure boot is enabled, the generic LoadImage/StartImage only allow signed images to be loaded and started, and we prefer to avoid the need to sign both the inner and outer PE/COFF images. This series adopts the EFI shim approach, i.e., to override an internal UEFI/PI protocol that is used by the image loader, to allow the inner image to be booted after decompression. This has been
We should avoid requiring anything that is not in the UEFI specification. If you have any additional requirements, please, create a change request for the UEFI specification.
Overriding the services of the system table is dangerous and should be avoided.
There is no need for two UEFI binaries one inside the other and we should avoid such overengineering.
Today we append an uncompressed kernel to the EFI stub. The stub relocates it, sets up the memory map and calls it entry point.
Just add decompressor code to the EFI stub and instead of appending an uncompressed kernel append a compressed one. Then sign a binary consisting of the EFI stub and the compressed kernel.
This way you don't need any change to UEFI firmware at all and you don't need to override UEFI services.
Another reasonable approach would be to zip the signed UEFI binary (EFI stub with uncompressed kernel) and let the UEFI firmware unzip it and check the signature of the decompressed UEFI binary. This would not require any patch in Linux at all and would be simple to implement in U-Boot.
Best regards Heinrich
tested to work with Tianocore based EFI implementations on arm64, but u-boot will need some interoperability tweaks as well, ideally just a protocol that exposes a LoadImage/StartImage combo that the decompresor can use directly to circumvent the signature check. (Note that EFI apps have full control over the CPU, page tables, etc. so having code that circumvents authentication checks is not as crazy as it sounds, given that the app can do anything it pleases already.) The code is wired up for arm64 and RISC-V. The latter was build tested only. Cc: "James E.J. Bottomley" <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx> Cc: Matthew Garrett <mjg59@xxxxxxxxxxxxx> Cc: Peter Jones <pjones@xxxxxxxxxx> Cc: Ilias Apalodimas <ilias.apalodimas@xxxxxxxxxx> Cc: Heinrich Schuchardt <heinrich.schuchardt@xxxxxxxxxxxxx> Cc: AKASHI Takahiro <takahiro.akashi@xxxxxxxxxx> Cc: Palmer Dabbelt <palmer@xxxxxxxxxxx> Cc: Atish Patra <atishp@xxxxxxxxxxxxxx> Cc: Arnd Bergmann <arnd@xxxxxxxx> Cc: Huacai Chen <chenhuacai@xxxxxxxxxxx> Cc: Lennart Poettering <lennart@xxxxxxxxxxxxxx> Ard Biesheuvel (6): efi: stub: add some missing boot service prototypes efi: stub: split off printk() routines efi: stub: move efi_system_table global var into separate object efi: stub: implement generic EFI zboot arm64: efi: enable generic EFI compressed boot riscv: efi: enable generic EFI compressed boot arch/arm64/Makefile | 5 + arch/arm64/boot/Makefile | 12 ++ arch/riscv/Makefile | 5 + arch/riscv/boot/Makefile | 14 ++ drivers/firmware/efi/Kconfig | 9 + drivers/firmware/efi/libstub/Makefile | 7 +- drivers/firmware/efi/libstub/Makefile.zboot | 30 +++ drivers/firmware/efi/libstub/efi-stub-helper.c | 141 --------------- drivers/firmware/efi/libstub/efi-stub.c | 2 - drivers/firmware/efi/libstub/efistub.h | 12 +- drivers/firmware/efi/libstub/printk.c | 158 ++++++++++++++++ drivers/firmware/efi/libstub/systable.c | 8 + drivers/firmware/efi/libstub/zboot-header.S | 144 +++++++++++++++ drivers/firmware/efi/libstub/zboot.c | 191 ++++++++++++++++++++ drivers/firmware/efi/libstub/zboot.lds | 41 +++++ include/linux/efi.h | 2 + 16 files changed, 633 insertions(+), 148 deletions(-) create mode 100644 drivers/firmware/efi/libstub/Makefile.zboot create mode 100644 drivers/firmware/efi/libstub/printk.c create mode 100644 drivers/firmware/efi/libstub/systable.c create mode 100644 drivers/firmware/efi/libstub/zboot-header.S create mode 100644 drivers/firmware/efi/libstub/zboot.c create mode 100644 drivers/firmware/efi/libstub/zboot.lds
