From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.2 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_2 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D13DDC2BA83 for ; Fri, 7 Feb 2020 16:20:33 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id A42E521775 for ; Fri, 7 Feb 2020 16:20:33 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="KqWyPwQL"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=hansenpartnership.com header.i=@hansenpartnership.com header.b="xexRZIhr"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=hansenpartnership.com header.i=@hansenpartnership.com header.b="xexRZIhr" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A42E521775 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=HansenPartnership.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Mime-Version:References:In-Reply-To: Date:To:From:Subject:Message-ID:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=WJN3Iy/rjJnuun3zJXuejX2ChdHeQGpPocwVIF2PUHQ=; b=KqWyPwQLVx6ZTP YrhRzgw4LIdPAeOUGL8IvrfTyBA514T9NgqXEzaGYpjQZ3cIblBS0a7wGkzHK7Ri558PVHK3lMbK6 3vt71kAxChN71sxbD7E77jMeOLDYqZNPP2FLErhG0YGqWMoKvfJiEJ2IO2+DhH4kDHZdRyVw9gXq+ w8mPIZeQCBaBYFF8sYhdp8QbLp7LlMni0yhDKPJrJcBWp63QBv7lNrMxu2LqLIhyQvORtpLOxV9we sD5wFzV0X05PkYZPevguZg7FvIz5bhQ8DVdWy+d/fq+SqPRoZkSMLhafzAmXZospFrhZvqJz1gSXM Mj65KK9xzP0ubA2b6J9A==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1j06Ml-0005CR-2f; Fri, 07 Feb 2020 16:20:27 +0000 Received: from bedivere.hansenpartnership.com ([66.63.167.143]) by bombadil.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1j06Mi-0005C6-CV for linux-arm-kernel@lists.infradead.org; Fri, 07 Feb 2020 16:20:25 +0000 Received: from localhost (localhost [127.0.0.1]) by bedivere.hansenpartnership.com (Postfix) with ESMTP id 804A18EE165; Fri, 7 Feb 2020 08:20:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=hansenpartnership.com; s=20151216; t=1581092422; bh=uvd4rwLEaY2+E2FC+J/+GniOjYoGdBNbZoO4ku6gsSE=; h=Subject:From:To:Cc:Date:In-Reply-To:References:From; b=xexRZIhrm9xHJGV2dhfty1luTqCxUvHKzrbknQNwWlcd7xwv0ozKBYwSeIcTb+T7t IW12BhgAjugv7gru51mdm4mH/xh6RWRWESsVBOhlqsSkikxkkmXzyFP+Ur0VIINWHe 8V4yqglOLiSIRibaNCh63o56brr+5K6i3fKwEFbc= Received: from bedivere.hansenpartnership.com ([127.0.0.1]) by localhost (bedivere.hansenpartnership.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CWzZ8kdisAgm; Fri, 7 Feb 2020 08:20:22 -0800 (PST) Received: from [153.66.254.194] (unknown [50.35.76.230]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bedivere.hansenpartnership.com (Postfix) with ESMTPSA id AAA758EE0E2; Fri, 7 Feb 2020 08:20:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=hansenpartnership.com; s=20151216; t=1581092422; bh=uvd4rwLEaY2+E2FC+J/+GniOjYoGdBNbZoO4ku6gsSE=; h=Subject:From:To:Cc:Date:In-Reply-To:References:From; b=xexRZIhrm9xHJGV2dhfty1luTqCxUvHKzrbknQNwWlcd7xwv0ozKBYwSeIcTb+T7t IW12BhgAjugv7gru51mdm4mH/xh6RWRWESsVBOhlqsSkikxkkmXzyFP+Ur0VIINWHe 8V4yqglOLiSIRibaNCh63o56brr+5K6i3fKwEFbc= Message-ID: <1581092420.7608.15.camel@HansenPartnership.com> Subject: Re: [PATCH 0/2] arch-agnostic initrd loading method for EFI systems From: James Bottomley To: Ard Biesheuvel , Laszlo Ersek Date: Fri, 07 Feb 2020 08:20:20 -0800 In-Reply-To: References: <20200206140352.6300-1-ardb@kernel.org> X-Mailer: Evolution 3.26.6 Mime-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20200207_082024_439205_7A6C48A6 X-CRM114-Status: GOOD ( 21.60 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-efi , Alexander Graf , Heinrich Schuchardt , Daniel Kiper , Ilias Apalodimas , Matthew Garrett , Peter Jones , Leif Lindholm , Ard Biesheuvel , linux-arm-kernel Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Fri, 2020-02-07 at 12:23 +0000, Ard Biesheuvel wrote: > On Fri, 7 Feb 2020 at 09:22, Laszlo Ersek wrote: > > > > On 02/07/20 10:09, Laszlo Ersek wrote: [...] > > > For example, virt-install's "--location" option "can recognize > > > certain distribution trees and fetches a bootable kernel/initrd > > > pair to launch the install". It would be nice to keep that > > > working for older distros. > > > > > > I think LoadFile[2] can co-exist with SimpleFs. > > > > > > I also think that the "try SimpleFs first, fall back to > > > LoadFile[2] second" requirement applies only to the UEFI boot > > > manager, and not to the kernel's EFI stub. IOW in the new > > > approach the kernel is free to ignore (abandon) the old approach > > > for good. > > > > ... But that might not be good for compatibility with grub and/or > > the platform firmware, from the kernel's own perspective, > > perhaps?... > > > > Who is supposed to produce LoadFile2 with the new VenMedia devpath? > > > > What I am ultimately after is a generic GRUB that uses > LoadImage+Startimage for starting the kernel on all architectures, For most boots, we need to pivot to the MoK. A long time ago, I proposed updating the platform security policy to do an override to allow MoK to become the security verifier (actually principally so I could get the gummiboot bootloader to work with the MoK method): https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git/tree/lib/security_policy.c And I believe all the pivot bootloaders now do this, but the fear was always this looks a bit like hackery that might not work in some UEFI implementations. Since we don't really rely on it (shim link loads after signature verification) we don't know whether the assumption does break or not. We'll need to get much more comfortable with the security override before we can let grub do a simple load+start. > and is able to load the initrd from anywhere in an arch agnostic > manner. I think the use case might not really be grub, it's gummiboot, or systemd-boot as its now called: https://wiki.archlinux.org/index.php/systemd-boot The standard way of using grub and EFI is to put grub on the EFI parition but have the kernel and the initrd on the root parition (which won't be EFI readable). This means we can keep the EFI partition small and only needing modification when grub is updated, meaning it doesn't even need mounting at all usually. Don't get me wrong, I like the gummiboot way of doing the LoadImage+StartImage: it's small and clean and doesn't need the shim protocol, but people like the sophistication grub provides including its ability to read kernel filesystems, so they're unlikely to change that. James _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel