Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <5b1c7eb9-fea6-1cf5-8faf-93fec3a7e57e@amd.com>
Date:   Thu, 20 Apr 2023 07:29:49 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.10.0
Subject: Re: [RFC PATCH 0/3] efi: Implement generic zboot support
Content-Language: en-US
To:     Ard Biesheuvel <ardb@kernel.org>, Gerd Hoffmann <kraxel@redhat.com>
Cc:     linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org,
        Evgeniy Baskov <baskov@ispras.ru>,
        Borislav Petkov <bp@alien8.de>,
        Andy Lutomirski <luto@kernel.org>,
        Dave Hansen <dave.hansen@linux.intel.com>,
        Ingo Molnar <mingo@redhat.com>,
        Peter Zijlstra <peterz@infradead.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Alexey Khoroshilov <khoroshilov@ispras.ru>,
        Peter Jones <pjones@redhat.com>,
        Dave Young <dyoung@redhat.com>,
        Kees Cook <keescook@chromium.org>,
        Tom Lendacky <thomas.lendacky@amd.com>,
        "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
        Linus Torvalds <torvalds@linux-foundation.org>
References: <20230416120729.2470762-1-ardb@kernel.org>
 <jwvybt4sro56aiqvddn6jxdjpdelasdhl747c25kzv4vbjr7ph@fbtheokrtxce>
 <CAMj1kXE4xF9RJbaR0H6uuFxxroUJxQFo8WThb=SUa7H0OpDxUg@mail.gmail.com>
 <3zm36sbx4enlqaumxxz2gp3f6etwzhlfotqrqxsus2r6xulwvm@saqniauxenmi>
 <CAMj1kXF1eaORsUPk=8Mam8OCQbfcMEBca=Lr2tdN=nihiDqb=Q@mail.gmail.com>
From:   Mario Limonciello <mario.limonciello@amd.com>
In-Reply-To: <CAMj1kXF1eaORsUPk=8Mam8OCQbfcMEBca=Lr2tdN=nihiDqb=Q@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?TGd6cG1mdEhLbkk5TTZINmpmTVZnbE9lWllDdkJOZ2ErdThCTG5sa0FlWGpy?=
 =?utf-8?B?Vm5IU3M0M2g0d2U2eXM5c0JQcS9zY1BSWm1odWV0RTV5MHFkcytodDVFazc1?=
 =?utf-8?B?RDNweDlYWFo4Z3hLQkZVYUtwbytrdGZPMW9ZQ3NHMjFPUHJCL2srTFZSUzcy?=
 =?utf-8?B?alRSdW0zbWFBbzI1bEkvSkx5Z09IaGVidEJ1Z1FzN09mMHpBVnY1emZzMHN4?=
 =?utf-8?B?NVRDOHpoTFhJbEx0ZFlLb1F0ajRmT3diYnY3QXFLK2hEaCtlK1F1L0JFUGF1?=
 =?utf-8?B?QnY0Rzc5TW5sc1QzTkxHeTlBOUdoQUtKcXRYQjdCZGwxUW40RTJNeE5IeWNR?=
 =?utf-8?B?M3F6c0hJd2ZVUElZc2Vna0lLdmVyZzVMczNXam05Y3g5VXNTR0V5S3lrS2Fs?=
 =?utf-8?B?MGs0S3cveHMyR1Z4UzZ2dXpEdFViY2h5LzV5ZGFUN0p3REZIN0M3RStYcVFs?=
 =?utf-8?B?WldCYXR6OHB5eERpVS9SRCtKMnVtR2tEUUZGWE5PYWZpTmh5bElEK1RXc2Jm?=
 =?utf-8?B?NmxMRlFlZzhUakVzdTAzRUsrcnA4QmJKNXZTZXRLMExrZUxvcTlOdUhDT2JU?=
 =?utf-8?B?dnMrVlVJU2JpVU5QaisxNjFiVzhjRmxnRldOclVBM1ZjQkMvbHB5Sm90c1JG?=
 =?utf-8?B?M2Rpbkc3c1UwcUJhd0l3MHJmRzBxMnhMZXUrMnArblptdmgyak5jSDd2QWtB?=
 =?utf-8?B?N2tPczBIYmYvRGVhT25PSVRrYmtNQXBHbVFLNS9ROGV4dVNCZWRYWW5WZG5Q?=
 =?utf-8?B?VmN3Z2xmL29jWHZlaFNVSzc1L0hzV0VUeHBjblprMC9pN3lESUw3S2RmbWpY?=
 =?utf-8?B?UGVDTDhNazJ5NTJxTWpOeVRIVW5mK2ZEcEt2TmM0ZzROdlhqSG5CeXQ1TjU4?=
 =?utf-8?B?SGdhR3psclhEUHFJY0FjNFI1MmY4K2g4UFhjM0ZTZlc4U3JoeXlQZGJ0SFRD?=
 =?utf-8?B?MzhxQjZpR0kxWVpoZk1PZkh3ZVI3Wm0xUGwySmZMSjhNRW5mYXowNGJtakxG?=
 =?utf-8?B?MXIrNWVxVUYrbXluclBNKy9hRHBOcUVLRE9rbVV4N21IbEpHMmdhcUxRY3Va?=
 =?utf-8?B?SWR2MTJuN3hJQWsrcUJOY3pwZmk4MWxpdjdSYUkrN1Y5VTBYTDduTUpKMk9X?=
 =?utf-8?B?aWMxMWxqSlVWNys5TGpCd3lyK2lrZWtuNUxvbEpvTXcrNmlJdVRQbG5RZnV5?=
 =?utf-8?B?aFgwdEsydWJxT2VJcEF1L2xrK2E4ZjFINzFRYklYRzMvang1K2l0S0xjM3Yx?=
 =?utf-8?B?emN4UzRPTldob1BqYU95TFdWNkNVbE1TMDU0V1JzQlJ2L09qb25KZUxsYWU0?=
 =?utf-8?B?aW4vL3hoS25IQXpNUElpYS9hemt4Qlk4TUNLU3FuWE9EdXNNUGQwT2N6NGRw?=
 =?utf-8?B?RG5acEdiU1lZL2phaGJpTjBOTjlFeWtuMlhNTDBMcGN4WVgvekEwMGdvVldk?=
 =?utf-8?B?S0ZJODdsRFZXWks2elNYNU5INXJXT0N4NWJRS0wwOW1XVDlZMmtnMVVrd0V5?=
 =?utf-8?B?cVFKN0NkdE9WM09hUGRPNEpTOS9WUi8zR2gxc3JmOTBCQUE0eE1oR3doSm1S?=
 =?utf-8?B?ZEloY000QnF2Q3FhdkFkQUxvYi9ROFhreWZCc0t3U2hBUGtZTCtqMDY4YXFn?=
 =?utf-8?B?RCtwNUJOOVQ0cFJ0bXdRZE0vVEhUajc1RVo2Z3ljOHlQYXRuaU9HeFEzVmNo?=
 =?utf-8?B?VDMxU1djQXExYWFVUG9qVmZYdllXN2ZJZkRKa20ycm1CKzBRTUZmcVZTNnZL?=
 =?utf-8?B?UW8zM0lucFZNSmFqQXg4QU5VTEtrd2htMnV5Z1BEVTd2bkptL0JXOTU3RGpz?=
 =?utf-8?B?VjZNV1lZZkFSTXFadng2LzQ0U3FzclR6WVJlTlJYV0Q1OHJscmN6VjJpUVZs?=
 =?utf-8?B?dTljelV3UWNLQ210ZUtTSW5JdHFyZjVmWDdqTnlUVHAyd2k0VGEreTd4cTlK?=
 =?utf-8?B?a3V1Rzd2MDNxKzYrbTJMTGNKbmN5WnJTcTgxOU5TemZxV2dUaDZDczAvY1ZG?=
 =?utf-8?B?RWZsVHpQUzJxRzZRZ3hQaW1jdlVQUERKN1dkZHRnRHFiYlp2Wkk5enJaSVp0?=
 =?utf-8?B?SzFHUnVPbElxQnZHSi8yaisvZkhSSW42UHZLeXlabURPc2dxOFh3VXpWTUZQ?=
 =?utf-8?B?NG9SMDhaaC8wSjExNDYzUnk4aGpXYW82bXVqZjlpeEJYbWdqR29GRzRzcVF2?=
 =?utf-8?Q?oAzNeUNsWRTxSkx3BoiV6xbDw0oMUcISL/KzRdhtEZe4?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 46ee658c-c913-408a-e18f-08db419af05e
X-MS-Exchange-CrossTenant-AuthSource: DS7PR12MB6095.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Apr 2023 12:29:51.8176
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: vf84aAQXd8aZAidZ5I+sl7ddkyXdJhbmw0StiB35qcL2yEzGh+o2qXNvLiK7ES+XwCBoCc6OI+0pDr/4BKckOw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR12MB5733
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,NICE_REPLY_A,
        RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 4/20/23 02:54, Ard Biesheuvel wrote:
> On Thu, 20 Apr 2023 at 08:07, Gerd Hoffmann <kraxel@redhat.com> wrote:
>>    Hi,
>>
>>>> Realistically, the second option is unlikely to ever be used on x86,
>>>>
>>>> What would be needed to do so?  Teach kexec-tools and grub2 parse and
>>>> load zboot kernels I guess?
>>> I already implemented this for mach-virt here, so we can load Fedora
>>> kernels without firmware:
>>>
>>> https://gitlab.com/qemu-project/qemu/-/commit/ff11422804cd03494cc98691eecd3909ea09ab6f
>>>
>>> On arm64, this is probably more straight-forward, as the bare metal
>>> image is already intended to be booted directly like that. However,
>>> the x86 uncompressed image requires surprisingly little from all the
>>> boot_params/setup_header cruft to actually boot, so perhaps there it
>>> is easy too.
>> For existing boot loaders like grub I'd expect it being easy
>> to code up, all the setup header code exists already, grub also
>> has support for uncompressing stuff, so it should really be only
>> zboot header parsing and some plumbing to get things going (i.e.
>> have grub boot efi zboot kernels in bios mode).
>>
>> Disclaimer: didn't actually check grub source code.
>>
> I have :-(
>
>> I suspect the bigger problem wrt. grub is that getting patches merged
>> upstream is extremely slow and every distro carries a huge stack of
>> patches ...
>>
> Yeah, Daniel has been asking me about LoadFile2 initrd loading support
> for x86, so I think getting things merged is not going to be a problem
> (although it will still take some time) - I can just implement it and
> send it out at the same time.
If zboot ends up being the way to go there would be quite a bit
of pressure to land the GRUB stuff in distros because of the NX
requirements being pushed into the EFI ecosystem.

They wouldn't be able to work on a system that enforces NX which
is anticipated to balloon.

>
> But hacking/building/running GRUB is a rather painful experience, so I
> have been kicking this can down the road.