Commit a1b87d54 authored by Ard Biesheuvel's avatar Ard Biesheuvel Committed by Borislav Petkov (AMD)
Browse files

x86/efistub: Avoid legacy decompressor when doing EFI boot 



The bare metal decompressor code was never really intended to run in a
hosted environment such as the EFI boot services, and does a few things
that are becoming problematic in the context of EFI boot now that the
logo requirements are getting tighter: EFI executables will no longer be
allowed to consist of a single executable section that is mapped with
read, write and execute permissions if they are intended for use in a
context where Secure Boot is enabled (and where Microsoft's set of
certificates is used, i.e., every x86 PC built to run Windows).

To avoid stepping on reserved memory before having inspected the E820
tables, and to ensure the correct placement when running a kernel build
that is non-relocatable, the bare metal decompressor moves its own
executable image to the end of the allocation that was reserved for it,
in order to perform the decompression in place. This means the region in
question requires both write and execute permissions, which either need
to be given upfront (which EFI will no longer permit), or need to be
applied on demand using the existing page fault handling framework.

However, the physical placement of the kernel is usually randomized
anyway, and even if it isn't, a dedicated decompression output buffer
can be allocated anywhere in memory using EFI APIs when still running in
the boot services, given that EFI support already implies a relocatable
kernel. This means that decompression in place is never necessary, nor
is moving the compressed image from one end to the other.

Since EFI already maps all of memory 1:1, it is also unnecessary to
create new page tables or handle page faults when decompressing the
kernel. That means there is also no need to replace the special
exception handlers for SEV. Generally, there is little need to do
any of the things that the decompressor does beyond

- initialize SEV encryption, if needed,
- perform the 4/5 level paging switch, if needed,
- decompress the kernel
- relocate the kernel

So do all of this from the EFI stub code, and avoid the bare metal
decompressor altogether.

Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
Signed-off-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230807162720.545787-24-ardb@kernel.org
parent 31c77a50

arch/x86/boot/compressed/Makefile

+5 −0
Original line number Diff line number Diff line
@@ -74,6 +74,11 @@ LDFLAGS_vmlinux += -z noexecstack 
ifeq ($(CONFIG_LD_IS_BFD),y)

LDFLAGS_vmlinux += $(call ld-option,--no-warn-rwx-segments)

endif

ifeq ($(CONFIG_EFI_STUB),y)

# ensure that the static EFI stub library will be pulled in, even if it is

# never referenced explicitly from the startup code

LDFLAGS_vmlinux += -u efi_pe_entry

endif

LDFLAGS_vmlinux += -T



hostprogs	:= mkpiggy

arch/x86/boot/compressed/efi_mixed.S

+0 −55
Original line number Diff line number Diff line
@@ -269,10 +269,6 @@ SYM_FUNC_START_LOCAL(efi32_entry) 
	jmp	startup_32

SYM_FUNC_END(efi32_entry)



#define ST32_boottime		60 // offsetof(efi_system_table_32_t, boottime)

#define BS32_handle_protocol	88 // offsetof(efi_boot_services_32_t, handle_protocol)

#define LI32_image_base		32 // offsetof(efi_loaded_image_32_t, image_base)



/*

 * efi_status_t efi32_pe_entry(efi_handle_t image_handle,

 *			       efi_system_table_32_t *sys_table)
@@ -280,8 +276,6 @@ SYM_FUNC_END(efi32_entry) 
SYM_FUNC_START(efi32_pe_entry)

	pushl	%ebp

	movl	%esp, %ebp

	pushl	%eax				// dummy push to allocate loaded_image



	pushl	%ebx				// save callee-save registers

	pushl	%edi
@@ -290,48 +284,8 @@ SYM_FUNC_START(efi32_pe_entry) 
	movl	$0x80000003, %eax		// EFI_UNSUPPORTED

	jnz	2f



	call	1f

1:	pop	%ebx



	/* Get the loaded image protocol pointer from the image handle */

	leal	-4(%ebp), %eax

	pushl	%eax				// &loaded_image

	leal	(loaded_image_proto - 1b)(%ebx), %eax

	pushl	%eax				// pass the GUID address

	pushl	8(%ebp)				// pass the image handle



	/*

	 * Note the alignment of the stack frame.

	 *   sys_table

	 *   handle             <-- 16-byte aligned on entry by ABI

	 *   return address

	 *   frame pointer

	 *   loaded_image       <-- local variable

	 *   saved %ebx		<-- 16-byte aligned here

	 *   saved %edi

	 *   &loaded_image

	 *   &loaded_image_proto

	 *   handle             <-- 16-byte aligned for call to handle_protocol

	 */



	movl	12(%ebp), %eax			// sys_table

	movl	ST32_boottime(%eax), %eax	// sys_table->boottime

	call	*BS32_handle_protocol(%eax)	// sys_table->boottime->handle_protocol

	addl	$12, %esp			// restore argument space

	testl	%eax, %eax

	jnz	2f



	movl	8(%ebp), %ecx			// image_handle

	movl	12(%ebp), %edx			// sys_table

	movl	-4(%ebp), %esi			// loaded_image

	movl	LI32_image_base(%esi), %esi	// loaded_image->image_base

	leal	(startup_32 - 1b)(%ebx), %ebp	// runtime address of startup_32

	/*

	 * We need to set the image_offset variable here since startup_32() will

	 * use it before we get to the 64-bit efi_pe_entry() in C code.

	 */

	subl	%esi, %ebp			// calculate image_offset

	movl	%ebp, (image_offset - 1b)(%ebx)	// save image_offset

	xorl	%esi, %esi

	jmp	efi32_entry			// pass %ecx, %edx, %esi

						// no other registers remain live
@@ -350,15 +304,6 @@ SYM_FUNC_START_NOALIGN(efi64_stub_entry) 
SYM_FUNC_END(efi64_stub_entry)

#endif



	.section ".rodata"

	/* EFI loaded image protocol GUID */

	.balign 4

SYM_DATA_START_LOCAL(loaded_image_proto)

	.long	0x5b1b31a1

	.word	0x9562, 0x11d2

	.byte	0x8e, 0x3f, 0x00, 0xa0, 0xc9, 0x69, 0x72, 0x3b

SYM_DATA_END(loaded_image_proto)



	.data

	.balign	8

SYM_DATA_START_LOCAL(efi32_boot_gdt)

arch/x86/boot/compressed/head_32.S

+0 −13
Original line number Diff line number Diff line
@@ -84,19 +84,6 @@ SYM_FUNC_START(startup_32) 


#ifdef CONFIG_RELOCATABLE

	leal	startup_32@GOTOFF(%edx), %ebx



#ifdef CONFIG_EFI_STUB

/*

 * If we were loaded via the EFI LoadImage service, startup_32() will be at an

 * offset to the start of the space allocated for the image. efi_pe_entry() will

 * set up image_offset to tell us where the image actually starts, so that we

 * can use the full available buffer.

 *	image_offset = startup_32 - image_base

 * Otherwise image_offset will be zero and has no effect on the calculations.

 */

	subl    image_offset@GOTOFF(%edx), %ebx

#endif



	movl	BP_kernel_alignment(%esi), %eax

	decl	%eax

	addl    %eax, %ebx

arch/x86/boot/compressed/head_64.S

+0 −27
Original line number Diff line number Diff line
@@ -146,19 +146,6 @@ SYM_FUNC_START(startup_32) 


#ifdef CONFIG_RELOCATABLE

	movl	%ebp, %ebx



#ifdef CONFIG_EFI_STUB

/*

 * If we were loaded via the EFI LoadImage service, startup_32 will be at an

 * offset to the start of the space allocated for the image. efi_pe_entry will

 * set up image_offset to tell us where the image actually starts, so that we

 * can use the full available buffer.

 *	image_offset = startup_32 - image_base

 * Otherwise image_offset will be zero and has no effect on the calculations.

 */

	subl    rva(image_offset)(%ebp), %ebx

#endif



	movl	BP_kernel_alignment(%esi), %eax

	decl	%eax

	addl	%eax, %ebx
@@ -335,20 +322,6 @@ SYM_CODE_START(startup_64) 
	/* Start with the delta to where the kernel will run at. */

#ifdef CONFIG_RELOCATABLE

	leaq	startup_32(%rip) /* - $startup_32 */, %rbp



#ifdef CONFIG_EFI_STUB

/*

 * If we were loaded via the EFI LoadImage service, startup_32 will be at an

 * offset to the start of the space allocated for the image. efi_pe_entry will

 * set up image_offset to tell us where the image actually starts, so that we

 * can use the full available buffer.

 *	image_offset = startup_32 - image_base

 * Otherwise image_offset will be zero and has no effect on the calculations.

 */

	movl    image_offset(%rip), %eax

	subq	%rax, %rbp

#endif



	movl	BP_kernel_alignment(%rsi), %eax

	decl	%eax

	addq	%rax, %rbp

arch/x86/include/asm/efi.h

+5 −2
Original line number Diff line number Diff line
@@ -90,6 +90,8 @@ static inline void efi_fpu_end(void) 
}



#ifdef CONFIG_X86_32

#define EFI_X86_KERNEL_ALLOC_LIMIT		(SZ_512M - 1)



#define arch_efi_call_virt_setup()					\

({									\

	efi_fpu_begin();						\
@@ -103,8 +105,7 @@ static inline void efi_fpu_end(void) 
})



#else /* !CONFIG_X86_32 */



#define EFI_LOADER_SIGNATURE	"EL64"

#define EFI_X86_KERNEL_ALLOC_LIMIT		EFI_ALLOC_LIMIT



extern asmlinkage u64 __efi_call(void *fp, ...);
@@ -218,6 +219,8 @@ efi_status_t efi_set_virtual_address_map(unsigned long memory_map_size, 


#ifdef CONFIG_EFI_MIXED



#define EFI_ALLOC_LIMIT		(efi_is_64bit() ? ULONG_MAX : U32_MAX)



#define ARCH_HAS_EFISTUB_WRAPPERS



static inline bool efi_is_64bit(void)