diff options
| author | Ilias Apalodimas <ilias.apalodimas@linaro.org> | 2020-02-21 09:55:45 +0200 |
|---|---|---|
| committer | Heinrich Schuchardt <xypron.glpk@gmx.de> | 2020-02-28 19:37:14 +0100 |
| commit | ec80b4735a593961fe701cc3a5d717d4739b0fd0 (patch) | |
| tree | 95f61efe72fd10b5fb77ad5b9d502baf82573565 /lib/efi_loader/Kconfig | |
| parent | 12fdbbe860f395575f360f0c03d84bce61a9a212 (diff) | |
| download | u-boot-ec80b4735a593961fe701cc3a5d717d4739b0fd0.tar.gz | |
efi_loader: Implement FileLoad2 for initramfs loading
Following kernel's proposal for an arch-agnostic initrd loading
mechanism [1] let's implement the U-boot counterpart.
This new approach has a number of advantages compared to what we did up
to now. The file is loaded into memory only when requested limiting the
area of TOCTOU attacks. Users will be allowed to place the initramfs
file on any u-boot accessible partition instead of just the ESP one.
Finally this is an attempt of a generic interface across architectures
in the linux kernel so it makes sense to support that.
The file location is intentionally only supported as a config option
argument(CONFIG_EFI_INITRD_FILESPEC), in an effort to enhance security.
Although U-boot is not responsible for verifying the integrity of the
initramfs, we can enhance the offered security by only accepting a
built-in option, which will be naturally verified by UEFI Secure Boot.
This can easily change in the future if needed and configure that via ENV
or UEFI variable.
[1] https://lore.kernel.org/linux-efi/20200207202637.GA3464906@rani.riverdale.lan/T/#m4a25eb33112fab7a22faa0fd65d4d663209af32f
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Diffstat (limited to 'lib/efi_loader/Kconfig')
| -rw-r--r-- | lib/efi_loader/Kconfig | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig index 76f43eca95..9890144d41 100644 --- a/lib/efi_loader/Kconfig +++ b/lib/efi_loader/Kconfig @@ -130,4 +130,19 @@ config EFI_RNG_PROTOCOL Provide a EFI_RNG_PROTOCOL implementation using the hardware random number generator of the platform. +config EFI_LOAD_FILE2_INITRD + bool "EFI_FILE_LOAD2_PROTOCOL for Linux initial ramdisk" + default n + help + Expose a EFI_FILE_LOAD2_PROTOCOL that the Linux UEFI stub can + use to load the initial ramdisk. Once this is enabled using + initrd=<ramdisk> will stop working. + +config EFI_INITRD_FILESPEC + string "initramfs path" + default "host 0:1 initrd" + depends on EFI_LOAD_FILE2_INITRD + help + Full path of the initramfs file, e.g. mmc 0:2 initramfs.cpio.gz. + endif |