This repository has been archived by the owner on Apr 13, 2024. It is now read-only.
Boot via EFI on arm64 and x86_64 #199
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
kees
reviewed
Aug 14, 2019
kees
reviewed
Aug 14, 2019
|
@kees thank you for all of those suggestions, I have made them and everything appears to work for stable, mainline, and linux-next. kernel/common is still a problem child but I don’t know if it is worth trying to debug that because I don’t think they care about EFI support. Presubmit: https://travis-ci.com/nathanchance/continuous-integration/builds/123430893 I am doing another run with kernel/common excluded: nathanchance@8e47262 I will clean everything up tonight and push for final review. |
We need this to support booting up with EFI, otherwise arm64 on 4.4 panics because the block device cannot be found. This mirrors what is done for arm32. Suggested-by: Kees Cook <[email protected]> Signed-off-by: Nathan Chancellor <[email protected]>
This allows booting up via EFI; without this, init panics because /dev/sda is not found. The IDE block driver is seldom used, virtio is better for our purposes. Suggested-by: Kees Cook <[email protected]> Signed-off-by: Nathan Chancellor <[email protected]>
We need this to start booting via EFI. Signed-off-by: Nathan Chancellor <[email protected]>
If the ovmf or qemu-efi-aarch64 packages are installed on Debian or Ubuntu, use those files to boot up via EFI. This will help prevent regressions like ClangBuiltLinux/linux#634. This is disabled for kernel/common because the kernel does not shut down cleanly; I don't think this is worth exploring because Android does not care about EFI as far as I am aware. I considered checking in the fd files so that other distributions could take advantage of this but these files are over 50MB, which is too much of a burden to force on everyone. Presubmit: https://travis-ci.com/nathanchance/continuous-integration/builds/123450697 [skip ci] Suggested-by: Kees Cook <[email protected]> Signed-off-by: Nathan Chancellor <[email protected]>
|
This should be good now: https://travis-ci.com/nathanchance/continuous-integration/builds/123450697 |
|
cc @ardbiesheuvel for thoughts on EFI |
|
It is not obvious to me why the ide->virtio change is necessary, but if it allows us to do EFI boot testing, I'm all for it. While you're at it, could you add virtio-rng-pci as well so we get a KASLR seed on arm64 kernels built with CONFIG_RANDOMIZE_BASE? |
|
I added |
|
OK, so the KASLR kernel is buggered when compiled with Clang. Are there any known issues in this area that we haven't fixed yet? (You can pass 'nokaslr' on the kernel command line to double check that this is the issue, but it seems highly likely) |
|
Yes, I don't believe there are any outstanding issues, all of the KASLR ones that I was aware of were Where should we start debugging? |
|
That is explained by the fact that the upstream arm64 kernel requires EFI boot for KASLR. |
Huh, I didn't think Pixel kernels booted with EFI, but they definitely use KASLR, but TBH maybe they do use EFI and I'm wrong. Shouldn't |
|
Correction, most Pixels do use UEFI. Not sure how they get their KASLR seed though. I assume the bootloader is involved in collecting entropy, but we're out of my area of expertise. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is currently a WIP but I wanted to push what I had for initial review before I left for work.
@kees noticed that booting via EFI was broken on arm64 because of an ld.lld change: ClangBuiltLinux/linux#634
This will allow us to catch regressions like this in the future.
To work properly, the
ovmfandqemu-efi-aarch64packages need to be installed, which will be done in a separate pull request to the Docker image repo.As it stands now, there are three distinct issues:
/dev/sdais no longer available:Looks like
-biosmight be an option instead:/dev/vdais no longer available:Have not begun to triage this at all.
I'll try to get this all cleaned up so we can actually run this on Travis and see everything a bit more clearly.