Updated support for SHIM on RISC-V

[brianredbeard]

Add what is needed to build on riscv64.

Signed-off-by: Heinrich Schuchardt [email protected]

This is an update which supersedes #420 which brings it in alignment with the current upstream and fixes a minor style nit around the definition of __riscv.

[brianredbeard]

@vathpela can we get a review?

[brianredbeard]

FYI, reverted the previous commit after a discussion with @xypron. Heinrich helpfully pointed out that the structure of pre-processor definitions in the form of __riscv is (tragically) required due to definitions in GCC.

[davidlt]

FYI gnu-efi ( https://github.com/rhboot/gnu-efi/tree/master ) has been rebased to 3.0.18 (released 3 days ago!). The builds are already available for F40 and F41 in Fedora too:
F40: https://koji.fedoraproject.org/koji/buildinfo?buildID=2426104
F41: https://koji.fedoraproject.org/koji/buildinfo?buildID=2426088

[davidlt]

We had some discussions with Peter Jones last year. There was a strong preference not to add more "-O binary" architectures. Two patches landed in binutils 2.42:
[PATCH] Add basic support for RISC-V 64-bit EFI objects
[PATCH] Handle "efi-app-riscv64" and similar targets in objcopy. // From Peter Jones

That means we have efi-app-riscv64 support. That probably means it should look more like aarch64. I haven't looked deeper or tested it.

[xypron]

@davidlt Shim has an .sbat section with the contents of a CSV file for defining the security patch level. How would you create that section with binutils' efi-app-riscv64 target?

The content of the .sbat section is something like:

sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,4,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.ubuntu,1,Ubuntu,shim,15.8-0ubuntu1,https://www.ubuntu.com/

[xypron]

It really seems that the lines

+     FORMAT                  := -O binary
+     SUBSYSTEM               := 0xa
+     ARCH_LDFLAGS            += --defsym=EFI_SUBSYSTEM=$(SUBSYSTEM)
+     TIMESTAMP_LOCATION      := 72

are not needed. SUBSYSTEM defaults to 0x0a in branch main of https://github.com/rhboot/gnu-efi.git:

gnu-efi/gnuefi/crt0-efi-riscv64.S:20:
#define EFI_SUBSYSTEM 10

TIMESTAMP_LOCATION is unused.

FORMAT is a flag passed to riscv64-linux-gnu-objcopy which seems unneded.

@brianredbeard Could you please drop the lines from your merge request.

[davidlt]

The last commit is missing Signed-off-by: based on the review. How sure how important that is.

[juliakreger]

Shouldn't the file name be shorter (as in 8.3 format) given a FAT filesystem?

[xypron]

• FAT supports long file names since Windows 95.
• The default name for EFI binaries on RISC-V is /EFI/BOOT/BOOTRISCV64.EFI. That is not 8.3 either.
• Distros like Fedora and Ubuntu are already using grubriscv64.efi as file name (cf. https://fedoraproject.org/wiki/Architectures/RISC-V/GRUB2)

[juliakreger]

Okay, cool. I was just thinking I've seen some vendors expect/model on it being strict FAT12 in the x86 space, and seeing the longer file name started to bug me. Also interesting Ubuntu beat Debian since I checked Debian packaging yesterday when the question came up in another project of "what would the filename be?!" so we could correctly account for it.

[gmbr3]

UEFI requires support for FAT long filenames (LFN) in all FAT12, FAT16 and FAT32 so it's fine

[andreabolognani]

Hey, I'm wondering what's missing to get this one merged at this point? From a cursory look, it seems that all points raised during review have been addressed.

I'm really keen on seeing this make its way to Fedora. Along with the lack of an up-to-date GRUB2 (which is something that's supposedly being addressed as we speak), not having shim is, at least as far as I'm aware, the last remaining blocker to producing usable (albeit still unofficial) Fedora images for RISC-V.

[jmontleon]

It is not very clean, but I was able to build and boot shim on a VisionFive 2 and EDK2 on a qemu/libvirt VM. I forked shim and gnu-efi with some rough work

I had to pull a few things together to get builds working on riscv64.

• Move to updated gnu-efi https://github.com/ncroxon/gnu-efi
• Use gmbr3/gnu-efi@eecb589 referenced on Move riscv64 crt0 to objcopy ncroxon/gnu-efi#11
• Apply the commits from this pull request
• Sync the changes from gnu-efi elf_riscv64_efi.lds to shim
• other changes/workarounds. (my guess is jmontleon@44d7f95 is probably the worst issue to contend with)

You can basically clone https://github.com/jmontleon/shim/tree/riscv and
cd shim && make clean && make && sudo cp shimriscv64.efi /boot/efi/EFI/BOOT/BOOTRISCV64.EFI && sudo cp fbriscv64.efi /boot/efi/EFI/BOOT/ && sudo cp shimriscv64.efi /boot/efi/EFI/fedora/

With /boot/efi/EFI/fedora/BOOTRISCV64.csv containingshimriscv64.efi,Fedora,,This is the boot entry for Fedora the system boots and you get a boot entry created.

[julian-klode]

Hey, I'm wondering what's missing to get this one merged at this point? From a cursory look, it seems that all points raised during review have been addressed.

I'm really keen on seeing this make its way to Fedora. Along with the lack of an up-to-date GRUB2 (which is something that's supposedly being addressed as we speak), not having shim is, at least as far as I'm aware, the last remaining blocker to producing usable (albeit still unofficial) Fedora images for RISC-V.

I don't think any distro has intentions to sign anything for RISC-V yet and I don't know if Microsoft would even accept it, or what the value would be in handing Microsoft the control over the RISC-V CA too.

And unsigned you can just use grub directly and be happy, so I think there's no value merging changes like this and adding the maintenance overhead or have it potentially break each release because nobody tests it.

[xypron]

Am 24. Juni 2024 09:46:14 MESZ schrieb Julian Andres Klode ***@***.***>:

> Hey, I'm wondering what's missing to get this one merged at this point? From a cursory look, it seems that all points raised during review have been addressed. > > I'm really keen on seeing this make its way to Fedora. Along with the lack of an up-to-date GRUB2 (which is something that's supposedly [being ***@***.***/thread/PHGU7UQS6O5SLLZIWTVD3E73OTM4GCS7/) as we speak), not having shim is, at least as far as I'm aware, the last remaining blocker to producing usable (albeit still unofficial) Fedora images for RISC-V. I don't think any distro has intentions to sign anything for RISC-V yet and I don't know if Microsoft would even accept it, or what the value would be in handing Microsoft the control over the RISC-V CA too.

Testing should be done in the CI. There is no need for Microsoft signing for testing. There has not been any decision on a global signing authority yet. We should avoid development after the hardware is out. Instead we should provide the RISC-V community the tools needed to test secure boot now. This does not imply that distros have to package it now. Best regards Heinrich

…

And unsigned you can just use grub directly and be happy, so I think there's no value merging changes like this and adding the maintenance overhead or have it potentially break each release because nobody tests it.

[andreabolognani]

And unsigned you can just use grub directly and be happy, so I think there's no value merging changes like this and adding the maintenance overhead or have it potentially break each release because nobody tests it.

AFAIK shim doesn't just handle the Secure Boot part though, it also takes care of locating and running the GRUB binary when installed as the fallback entry (${ESP}/BOOT/BOOTRISCV64.EFI). At least that's how things seem to work in Fedora, though admittedly the Debian/Ubuntu boot path appears to be set up differently.

Anyway, that's the part I'm interested in, as it would allow us to ship disk images that can be booted right away, without the need on the user's part to create UEFI boot entries themselves,

For this to work there's no need for the shim binary to be signed, much less to determine who the signing entity would be.

[jmontleon]

ncroxon/gnu-efi#34 was merged.

Using that work and this PR I had to make a few changes to get things working properly.
main...jmontleon:shim:riscv

I also ended up having to reimplement the closed PR #410. I did see the note re: patching gnu-efi instead of shim, which would basically be undoing the CHAR8 commit (ncroxon/gnu-efi@ce1ec9d) if that approach is desired.

[gmbr3]

undoing the CHAR8 commit (ncroxon/gnu-efi@ce1ec9d) if that approach is desired.

I doubt it. SHIM and SHIM's gnu-efi is outdated and in a very inconsistent state. CHAR8 should be 'unsigned char' since that's how UEFI spec says it is.

[vathpela]

On the face, the code this patch adds looks mostly okay to me, but there are still several problems here regarding the result. Even after following jmontleon's suggestions above, there are issues here, ranging from a minor problem with the PR itself to things that make this difficult to consider merging:

• missing DCO
• This doesn't add RISC-V to CI, and AFAICT for the reasons below, and it wouldn't pass if it did
• CHAR8 and char don't match in signedness. I don't have a dog in the fight of which signedness CHAR8 should be on this platform (or really any others), but I don't see how they can be fully independent, and they haven't been in the past, so there's a fair amount of code depending on it. If there's a compelling reason for them not to be the same, we still need patches to fix all the errors that causes, which right now seem to be a lot.
• This tree doesn't build with the newer upstream gnu-efi because of the API/ABI issues with realloc() and others. That looks easy to fix with a #define, but again, this won't pass CI until that's fixed.
• the need to add va_start() (etc) macros looks wrong to me, and the comment that gnu-efi needs them is quite disturbing. gnu-efi is providing these functions (or at least their decls; it should always wind up using compiler builtins). That makes me suspect there's still an issue in the upstream gnu-efi variadics, which will bite us on x86. I haven't tried getting rid of this and seeing if it's really necessary, because this tree doesn't build.
• in general I'm pretty hesitant to switch to newer upstream gnu-efi because that repo is an absolute mess of unnecessary merge commits and nearly empty changelogs, and stuff like the variadic function addition here makes me think we're going to get stuck holding the bag with printf() doing memory corruption again, which isn't acceptable.

[jmontleon]

@vathpela It has been awhile since I looked but I remain able to build off the latest upstream gnu-efi with the additional changes I laid out in https://github.com/jmontleon/shim
At the time I used gnu-efi 33727c2abe8a77dca612f04abd19e10cc5e487fd

But updating gnu-efi to 5ea320f0f01c8de8f9dd4e4e38a245608f0287dd still builds:

git clone [email protected]:jmontleon/shim
cd shim/
git submodule update --init
make

I did a scratch a riscv64 scratch build (http://fedora.riscv.rocks/koji/taskinfo?taskID=1837632) and tested in a virtual machine quick. It seems to still work ok.

I did see an issue with va_list on x86_64 and added a workaround patch to the srpm there so it should build on x86_64 now as well.

I'm definitely not insisting this or all the rest is 100% correct and ready to merge, but it should at least be possible to build and perhaps we can start working down the list of other issues you raised above?

[gmbr3]

• CHAR8 and char don't match in signedness. I don't have a dog in the fight of which signedness CHAR8 should be on this platform (or really any others), but I don't see how they can be fully independent, and they haven't been in the past, so there's a fair amount of code depending on it. If there's a compelling reason for them not to be the same, we still need patches to fix all the errors that causes, which right now seem to be a lot.

UEFI spec says CHAR8 is Latin-1 (0-255) so it's unsigned

• This tree doesn't build with the newer upstream gnu-efi because of the API/ABI issues with realloc() and others. That looks easy to fix with a #define, but again, this won't pass CI until that's fixed.

Can be done by defining GNU_EFI_3_0_COMPAT

• the need to add va_start() (etc) macros looks wrong to me, and the comment that gnu-efi needs them is quite disturbing. gnu-efi is providing these functions (or at least their decls; it should always wind up using compiler builtins). That makes me suspect there's still an issue in the upstream gnu-efi variadics, which will bite us on x86. I haven't tried getting rid of this and seeing if it's really necessary, because this tree doesn't build.

Not defining GNU_EFI_USE_EXTERNAL_STDARG??

and stuff like the variadic function addition here makes me think we're going to get stuck holding the bag with printf() doing memory corruption again, which isn't acceptable.

Totally agree - this is a bit clutching at straws though - if there's a problem that isn't fixed just send a bug report