[PATCH 11/16] efi/libstub: Put the stub's writable data in unique sections for DRTM
COOLING8d
From: Jason Gunthorpe <jgg@nvidia.com>
Date: 2026-09-24 13:53:40
Also in:
linux-arch, linux-doc, linux-efi, linux-integrity, linux-patches, linux-riscv
Subsystem:
extensible firmware interface (efi), the rest · Maintainers:
Ard Biesheuvel, Linus Torvalds
Currently the EFI stub's .bss and .data are both placed in .init.data, which allows them to be discarded after boot, but places them within the region of memory we need to measure as part of a DRTM launch. If the EFI stub modifies the measured data before the measurement, then we can no longer get a predictable measurement. Give them unique section names; the arch's linker script has to put these sections outside the measured range. Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> --- drivers/firmware/efi/libstub/Makefile | 10 ++++++++++ drivers/firmware/efi/libstub/zboot.lds | 4 ++-- 2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
index 77a2b2d74f3f62..3f1921e6c334d1 100644
--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile@@ -142,6 +142,16 @@ STUBCOPY_FLAGS-$(CONFIG_ARM64) += --prefix-alloc-sections=.init \ --prefix-symbols=__efistub_ STUBCOPY_RELOC-$(CONFIG_ARM64) := R_AARCH64_ABS +# Give writable stub state a dedicated section namespace. objcopy applies +# section renames before section prefixes, irrespective of their command line +# ordering, so these become .init.efidata and .init.efibss. +# +# The names must stay outside the .init.data.* namespace. INIT_DATA collects +# *(.init.data .init.data.*) into a measured kernel output section that the +# arm64 linker script emits first. +STUBCOPY_FLAGS-$(CONFIG_EFI_STUB_DRTM) += --rename-section .data=.efidata \ + --rename-section .bss=.efibss,load,alloc + # For RISC-V, we don't need anything special other than arm64. Keep all the # symbols in .init section and make sure that no absolute symbols references # exist.
diff --git a/drivers/firmware/efi/libstub/zboot.lds b/drivers/firmware/efi/libstub/zboot.lds
index c7c2f4dd144301..5320a05498758d 100644
--- a/drivers/firmware/efi/libstub/zboot.lds
+++ b/drivers/firmware/efi/libstub/zboot.lds@@ -38,13 +38,13 @@ SECTIONS .data : ALIGN(4096) { _data = .; - *(.data* .init.data*) + *(.data* .init.data* .init.efidata*) _edata = ALIGN(512); . = _edata; } .bss : { - *(.bss* .init.bss*) + *(.bss* .init.bss* .init.efibss*) _end = ALIGN(512); . = _end; }
--
2.43.0