linux-kernel - [RFC PATCH 0/3] efi: Implement generic zboot support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230416120729.2470762-1-ardb@kernel.org>
Date:   Sun, 16 Apr 2023 14:07:26 +0200
From:   Ard Biesheuvel <ardb@...nel.org>
To:     linux-efi@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org, Ard Biesheuvel <ardb@...nel.org>,
        Evgeniy Baskov <baskov@...ras.ru>,
        Borislav Petkov <bp@...en8.de>,
        Andy Lutomirski <luto@...nel.org>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Ingo Molnar <mingo@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Alexey Khoroshilov <khoroshilov@...ras.ru>,
        Peter Jones <pjones@...hat.com>,
        Gerd Hoffmann <kraxel@...hat.com>,
        Dave Young <dyoung@...hat.com>,
        Mario Limonciello <mario.limonciello@....com>,
        Kees Cook <keescook@...omium.org>,
        Tom Lendacky <thomas.lendacky@....com>,
        "Kirill A . Shutemov" <kirill.shutemov@...ux.intel.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: [RFC PATCH 0/3] efi: Implement generic zboot support

This series is a proof-of-concept that implements support for the EFI
zboot decompressor for x86. It replaces the ordinary decompressor, and
instead, performs the decompression, KASLR randomization and the 4/5
level paging switch while running in the execution context of EFI.

This simplifies things substantially, and makes it straight-forward to
abide by stricter future requirements related to the use of writable and
executable memory under EFI, which will come into effect on x86 systems
that are certified as being 'more secure', and ship with an even shinier
Windows sticker.

This is an alternative approach to the work being proposed by Evgeny [0]
that makes rather radical changes to the existing decompressor, which
has accumulated too many features already, e.g., related to confidential
compute etc.

EFI zboot images can be booted in two ways:
- by EFI firmware, which loads and starts it as an ordinary EFI
  application, just like the existing EFI stub (with which it shares
  most of its code);
- by a non-EFI loader that parses the image header for the compression
  metadata, and decompresses the image into memory and boots it.

Realistically, the second option is unlikely to ever be used on x86,
given that it already has its existing bzImage, but the first option is
a good choice for distros that target EFI boot only (and some distros
switched to this format already for arm64). The fact that EFI zboot is
implemented in the same way on arm64, RISC-V, LoongArch and [shortly]
ARM helps with maintenance, not only of the kernel itself, but also the
tooling around it relating to kexec, code signing, deployment, etc.

Series can be pulled from [1], which contains some prerequisite patches
that are only tangentially related.

[0] https://lore.kernel.org/all/cover.1678785672.git.baskov@ispras.ru/
[1] https://git.kernel.org/pub/scm/linux/kernel/git/ardb/linux.git/log/?h=efi-x86-zboot

Cc: Evgeniy Baskov <baskov@...ras.ru>
Cc: Borislav Petkov <bp@...en8.de>
Cc: Andy Lutomirski <luto@...nel.org>
Cc: Dave Hansen <dave.hansen@...ux.intel.com>
Cc: Ingo Molnar <mingo@...hat.com>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Alexey Khoroshilov <khoroshilov@...ras.ru>
Cc: Peter Jones <pjones@...hat.com>
Cc: Gerd Hoffmann <kraxel@...hat.com>
Cc: Dave Young <dyoung@...hat.com>
Cc: Mario Limonciello <mario.limonciello@....com>
Cc: Kees Cook <keescook@...omium.org>
Cc: Tom Lendacky <thomas.lendacky@....com>
Cc: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>

Ard Biesheuvel (3):
  efi/libstub: x86: Split off pieces shared with zboot
  efi/zboot: x86: Implement EFI zboot support
  efi/zboot: x86: Clear NX restrictions on populated code regions

 arch/x86/Makefile                              |  18 +-
 arch/x86/include/asm/efi.h                     |  10 +
 arch/x86/kernel/head_64.S                      |  15 +
 arch/x86/zboot/Makefile                        |  29 +
 drivers/firmware/efi/Kconfig                   |   2 +-
 drivers/firmware/efi/libstub/Makefile          |  15 +-
 drivers/firmware/efi/libstub/Makefile.zboot    |   2 +-
 drivers/firmware/efi/libstub/efi-stub-helper.c |   3 +
 drivers/firmware/efi/libstub/x86-stub.c        | 592 +------------------
 drivers/firmware/efi/libstub/x86-zboot.c       | 322 ++++++++++
 drivers/firmware/efi/libstub/x86.c             | 612 ++++++++++++++++++++
 drivers/firmware/efi/libstub/zboot.c           |   3 +-
 drivers/firmware/efi/libstub/zboot.lds         |   5 +
 13 files changed, 1031 insertions(+), 597 deletions(-)
 create mode 100644 arch/x86/zboot/Makefile
 create mode 100644 drivers/firmware/efi/libstub/x86-zboot.c
 create mode 100644 drivers/firmware/efi/libstub/x86.c

-- 
2.39.2