On Thu, 15 Feb 2024 at 10:27, Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
>
> On Thu, Feb 15, 2024 at 10:17:20AM +0100, Ard Biesheuvel wrote:
> > (cc stakeholders from various distros - apologies if I missed anyone)
> >
> > Please consider the patches below for backporting to the linux-6.6.y
> > stable tree.
> >
> > These are prerequisites for building a signed x86 efistub kernel image
> > that complies with the tightened UEFI boot requirements imposed by
> > MicroSoft, and this is the condition under which it is willing to sign
> > future Linux secure boot shim builds with its 3rd party CA
> > certificate. (Such builds must enforce a strict separation between
> > executable and writable code, among other things)
> >
> > The patches apply cleanly onto 6.6.17 (-rc2), resulting in a defconfig
> > build that boots as expected under OVMF/KVM.
> >
> > 5f51c5d0e905 x86/efi: Drop EFI stub .bss from .data section
> > 7e50262229fa x86/efi: Disregard setup header of loaded image
> > bfab35f552ab x86/efi: Drop alignment flags from PE section headers
> > 768171d7ebbc x86/boot: Remove the 'bugger off' message
> > 8eace5b35556 x86/boot: Omit compression buffer from PE/COFF image
> > memory footprint
> > 7448e8e5d15a x86/boot: Drop redundant code setting the root device
> > b618d31f112b x86/boot: Drop references to startup_64
> > 2e765c02dcbf x86/boot: Grab kernel_info offset from zoffset header directly
> > eac956345f99 x86/boot: Set EFI handover offset directly in header asm
> > 093ab258e3fb x86/boot: Define setup size in linker script
> > aeb92067f6ae x86/boot: Derive file size from _edata symbol
> > efa089e63b56 x86/boot: Construct PE/COFF .text section from assembler
> > fa5750521e0a x86/boot: Drop PE/COFF .reloc section
> > 34951f3c28bd x86/boot: Split off PE/COFF .data section
> > 3e3eabe26dc8 x86/boot: Increase section and file alignment to 4k/512
> >
> > 1ad55cecf22f x86/efistub: Use 1:1 file:memory mapping for PE/COFF
> > .compat section
>
> Is the list here the order in which they should be applied in?
>
Yes. These are all from v6.7 except the last one, but that has been
queued for v6.7 already.
> And is this not an issue for 6.1.y as well?
>
It is, but there are many more changes that would need to go into v6.1:
Documentation/x86/boot.rst | 2 +-
arch/x86/Kconfig | 17 +
arch/x86/boot/Makefile | 2 +-
arch/x86/boot/compressed/Makefile | 13 +-
arch/x86/boot/compressed/efi_mixed.S | 328 ++++++++++++++
arch/x86/boot/compressed/efi_thunk_64.S | 195 --------
arch/x86/boot/compressed/head_32.S | 38 +-
arch/x86/boot/compressed/head_64.S | 593 +++++--------------------
arch/x86/boot/compressed/mem_encrypt.S | 152 ++++++-
arch/x86/boot/compressed/misc.c | 61 ++-
arch/x86/boot/compressed/misc.h | 2 -
arch/x86/boot/compressed/pgtable.h | 10 +-
arch/x86/boot/compressed/pgtable_64.c | 87 ++--
arch/x86/boot/compressed/sev.c | 112 +++--
arch/x86/boot/compressed/vmlinux.lds.S | 6 +-
arch/x86/boot/header.S | 215 ++++-----
arch/x86/boot/setup.ld | 14 +-
arch/x86/boot/tools/build.c | 271 +----------
arch/x86/include/asm/boot.h | 8 +
arch/x86/include/asm/efi.h | 14 +-
arch/x86/include/asm/sev.h | 7 +
drivers/firmware/efi/libstub/Makefile | 8 +-
drivers/firmware/efi/libstub/alignedmem.c | 5 +-
drivers/firmware/efi/libstub/arm64-stub.c | 6 +-
drivers/firmware/efi/libstub/efi-stub-helper.c | 2 +
drivers/firmware/efi/libstub/efistub.h | 28 +-
drivers/firmware/efi/libstub/mem.c | 3 +-
drivers/firmware/efi/libstub/randomalloc.c | 13 +-
drivers/firmware/efi/libstub/x86-5lvl.c | 95 ++++
drivers/firmware/efi/libstub/x86-stub.c | 327 +++++++-------
drivers/firmware/efi/libstub/x86-stub.h | 17 +
include/linux/efi.h | 1 +
32 files changed, 1204 insertions(+), 1448 deletions(-)
(Note: the commit hashes below are bogus, they are from my tree [0])
If you're happy to take these too, I can give you the proper list, but
perhaps we should deal with v6.6 first?
9d2df639ec41 x86/boot/compressed: Rename efi_thunk_64.S to efi-mixed.S
4dae7beb5530 x86/boot/compressed: Move 32-bit entrypoint code into .text section
8b6ddf82c1e7 x86/boot/compressed: Move bootargs parsing out of 32-bit
startup code
31d3e51c565f x86/boot/compressed: Move efi32_pe_entry into .text section
4099d7a76e86 x86/boot/compressed: Move efi32_entry out of head_64.S
7bed86e158bf x86/boot/compressed: Move efi32_pe_entry() out of head_64.S
d808c48f53d1 x86/boot/compressed, efi: Merge multiple definitions of
image_offset into one
bb183fa754f7 x86/boot/compressed: Simplify IDT/GDT preserve/restore in
the EFI thunk
b78d930f51c9 x86/boot/compressed: Avoid touching ECX in
startup32_set_idt_entry()
8c69f96fe1df x86/boot/compressed: Pull global variable reference into
startup32_load_idt()
6b84fc96784b x86/boot/compressed: Move startup32_load_idt() into .text section
6dd53426e8ef x86/boot/compressed: Move startup32_load_idt() out of head_64.S
82db0efabd4a x86/boot/compressed: Move startup32_check_sev_cbit() into .text
7aaa10f2f01a x86/boot/compressed: Move startup32_check_sev_cbit() out
of head_64.S
6b5a2ab4d783 x86/boot/compressed: Adhere to calling convention in
get_sev_encryption_bit()
bdd9c458fdf8 x86/boot/compressed: Only build mem_encrypt.S if AMD_MEM_ENCRYPT=y
a249efa7500c efi/libstub: Add memory attribute protocol definitions
1bbd66011e5e x86/efi: Make the deprecated EFI handover protocol optional
763512bf9ff8 x86/boot: Robustify calling startup_{32,64}() from the
decompressor code
3cfd94f97c8d x86/efistub: Branch straight to kernel entry point from C code
2684d78d8bdc x86/efistub: Simplify and clean up handover entry code
9ef61120b2ab x86/decompressor: Avoid magic offsets for EFI handover entrypoint
067f18102a11 x86/efistub: Clear BSS in EFI handover protocol entrypoint
c674fa468fa6 x86/decompressor: Store boot_params pointer in callee save register
ed871fc7d947 x86/decompressor: Assign paging related global variables earlier
63915dd5a8fc x86/decompressor: Call trampoline as a normal function
3f6e9fe794ea x86/decompressor: Use standard calling convention for trampoline
eef60ef496f6 x86/decompressor: Avoid the need for a stack in the
32-bit trampoline
1f328cfb5700 x86/decompressor: Call trampoline directly from C code
49e67636077d x86/decompressor: Only call the trampoline when changing
paging levels
a4b6bdff1065 x86/decompressor: Pass pgtable address to trampoline directly
fe802898e7a4 x86/decompressor: Merge trampoline cleanup with switching code
bd1fd32fdce1 x86/efistub: Perform 4/5 level paging switch from the stub
a0bfe7904515 x86/decompressor: Move global symbol references to C code
a0731d919a4b x86/decompressor: Factor out kernel decompression and relocation
402e20d21f65 x86/efistub: Prefer EFI memory attributes protocol over
DXE services
4eda5ae9b321 efi: libstub: use EFI_LOADER_CODE region when moving the
kernel in memory
e09c5817b3bb efi/libstub: Add limit argument to efi_random_alloc()
b31fdf98b3c0 x86/efistub: Perform SNP feature test while running in the firmware
03c9bd02cbc8 x86/efistub: Avoid legacy decompressor when doing EFI boot
[0] https://git.kernel.org/pub/scm/linux/kernel/git/ardb/linux.git/log/?h=x86-efi-peheader-backport
