• Linus Torvalds's avatar
    Merge tag 'efi-next-for-v6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi · 0e470763
    Linus Torvalds authored
    Pull EFI updates from Ard Biesheuvel:
     "A bit more going on than usual in the EFI subsystem. The main driver
      for this has been the introduction of the LoonArch architecture last
      cycle, which inspired some cleanup and refactoring of the EFI code.
      Another driver for EFI changes this cycle and in the future is
      confidential compute.
    
      The LoongArch architecture does not use either struct bootparams or DT
      natively [yet], and so passing information between the EFI stub and
      the core kernel using either of those is undesirable. And in general,
      overloading DT has been a source of issues on arm64, so using DT for
      this on new architectures is a to avoid for the time being (even if we
      might converge on something DT based for non-x86 architectures in the
      future). For this reason, in addition to the patch that enables EFI
      boot for LoongArch, there are a number of refactoring patches applied
      on top of which separate the DT bits from the generic EFI stub bits.
      These changes are on a separate topich branch that has been shared
      with the LoongArch maintainers, who will include it in their pull
      request as well. This is not ideal, but the best way to manage the
      conflicts without stalling LoongArch for another cycle.
    
      Another development inspired by LoongArch is the newly added support
      for EFI based decompressors. Instead of adding yet another
      arch-specific incarnation of this pattern for LoongArch, we are
      introducing an EFI app based on the existing EFI libstub
      infrastructure that encapulates the decompression code we use on other
      architectures, but in a way that is fully generic. This has been
      developed and tested in collaboration with distro and systemd folks,
      who are eager to start using this for systemd-boot and also for arm64
      secure boot on Fedora. Note that the EFI zimage files this introduces
      can also be decompressed by non-EFI bootloaders if needed, as the
      image header describes the location of the payload inside the image,
      and the type of compression that was used. (Note that Fedora's arm64
      GRUB is buggy [0] so you'll need a recent version or switch to
      systemd-boot in order to use this.)
    
      Finally, we are adding TPM measurement of the kernel command line
      provided by EFI. There is an oversight in the TCG spec which results
      in a blind spot for command line arguments passed to loaded images,
      which means that either the loader or the stub needs to take the
      measurement. Given the combinatorial explosion I am anticipating when
      it comes to firmware/bootloader stacks and firmware based attestation
      protocols (SEV-SNP, TDX, DICE, DRTM), it is good to set a baseline now
      when it comes to EFI measured boot, which is that the kernel measures
      the initrd and command line. Intermediate loaders can measure
      additional assets if needed, but with the baseline in place, we can
      deploy measured boot in a meaningful way even if you boot into Linux
      straight from the EFI firmware.
    
      Summary:
    
       - implement EFI boot support for LoongArch
    
       - implement generic EFI compressed boot support for arm64, RISC-V and
         LoongArch, none of which implement a decompressor today
    
       - measure the kernel command line into the TPM if measured boot is in
         effect
    
       - refactor the EFI stub code in order to isolate DT dependencies for
         architectures other than x86
    
       - avoid calling SetVirtualAddressMap() on arm64 if the configured
         size of the VA space guarantees that doing so is unnecessary
    
       - move some ARM specific code out of the generic EFI source files
    
       - unmap kernel code from the x86 mixed mode 1:1 page tables"
    
    * tag 'efi-next-for-v6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: (24 commits)
      efi/arm64: libstub: avoid SetVirtualAddressMap() when possible
      efi: zboot: create MemoryMapped() device path for the parent if needed
      efi: libstub: fix up the last remaining open coded boot service call
      efi/arm: libstub: move ARM specific code out of generic routines
      efi/libstub: measure EFI LoadOptions
      efi/libstub: refactor the initrd measuring functions
      efi/loongarch: libstub: remove dependency on flattened DT
      efi: libstub: install boot-time memory map as config table
      efi: libstub: remove DT dependency from generic stub
      efi: libstub: unify initrd loading between architectures
      efi: libstub: remove pointless goto kludge
      efi: libstub: simplify efi_get_memory_map() and struct efi_boot_memmap
      efi: libstub: avoid efi_get_memory_map() for allocating the virt map
      efi: libstub: drop pointless get_memory_map() call
      efi: libstub: fix type confusion for load_options_size
      arm64: efi: enable generic EFI compressed boot
      loongarch: efi: enable generic EFI compressed boot
      riscv: efi: enable generic EFI compressed boot
      efi/libstub: implement generic EFI zboot
      efi/libstub: move efi_system_table global var into separate object
      ...
    0e470763
setup.c 8.76 KB