u-boot/include/efi_load_initrd.h

/* SPDX-License-Identifier: GPL-2.0+ */
/*
 * Copyright (c) 2020, Linaro Limited
 */

#if !defined _EFI_LOAD_INITRD_H_
#define _EFI_LOAD_INITRD_H_

#include <efi.h>
#include <efi_api.h>

/*
 * Vendor GUID used by Linux to identify the handle with the
 * EFI_LOAD_FILE2_PROTOCOL and load an initial ramdisk.
 */
#define EFI_INITRD_MEDIA_GUID \
	EFI_GUID(0x5568e427, 0x68fc, 0x4f3d, \
		 0xac, 0x74, 0xca, 0x55, 0x52, 0x31, 0xcc, 0x68)
extern const efi_guid_t efi_lf2_initrd_guid;

struct efi_initrd_dp {
	struct efi_device_path_vendor vendor;
	struct efi_device_path end;
} __packed;

#endif
efi_loader: Implement FileLoad2 for initramfs loading Following kernel's proposal for an arch-agnostic initrd loading mechanism [1] let's implement the U-boot counterpart. This new approach has a number of advantages compared to what we did up to now. The file is loaded into memory only when requested limiting the area of TOCTOU attacks. Users will be allowed to place the initramfs file on any u-boot accessible partition instead of just the ESP one. Finally this is an attempt of a generic interface across architectures in the linux kernel so it makes sense to support that. The file location is intentionally only supported as a config option argument(CONFIG_EFI_INITRD_FILESPEC), in an effort to enhance security. Although U-boot is not responsible for verifying the integrity of the initramfs, we can enhance the offered security by only accepting a built-in option, which will be naturally verified by UEFI Secure Boot. This can easily change in the future if needed and configure that via ENV or UEFI variable. [1] https://lore.kernel.org/linux-efi/20200207202637.GA3464906@rani.riverdale.lan/T/#m4a25eb33112fab7a22faa0fd65d4d663209af32f Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> 2020-02-21 09:55:45 +02:00			`/* SPDX-License-Identifier: GPL-2.0+ */`
			`/*`
			`* Copyright (c) 2020, Linaro Limited`
			`*/`

			`#if !defined _EFI_LOAD_INITRD_H_`
			`#define _EFI_LOAD_INITRD_H_`

			`#include <efi.h>`
			`#include <efi_api.h>`

			`/*`
			`* Vendor GUID used by Linux to identify the handle with the`
			`* EFI_LOAD_FILE2_PROTOCOL and load an initial ramdisk.`
			`*/`
			`#define EFI_INITRD_MEDIA_GUID \`
			`EFI_GUID(0x5568e427, 0x68fc, 0x4f3d, \`
			`0xac, 0x74, 0xca, 0x55, 0x52, 0x31, 0xcc, 0x68)`
efi_loader: avoid multiple local copies of lf2_initrd_guid Create the GUID as a global variable. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> 2021-10-15 02:33:33 +02:00			`extern const efi_guid_t efi_lf2_initrd_guid;`
efi_loader: Implement FileLoad2 for initramfs loading Following kernel's proposal for an arch-agnostic initrd loading mechanism [1] let's implement the U-boot counterpart. This new approach has a number of advantages compared to what we did up to now. The file is loaded into memory only when requested limiting the area of TOCTOU attacks. Users will be allowed to place the initramfs file on any u-boot accessible partition instead of just the ESP one. Finally this is an attempt of a generic interface across architectures in the linux kernel so it makes sense to support that. The file location is intentionally only supported as a config option argument(CONFIG_EFI_INITRD_FILESPEC), in an effort to enhance security. Although U-boot is not responsible for verifying the integrity of the initramfs, we can enhance the offered security by only accepting a built-in option, which will be naturally verified by UEFI Secure Boot. This can easily change in the future if needed and configure that via ENV or UEFI variable. [1] https://lore.kernel.org/linux-efi/20200207202637.GA3464906@rani.riverdale.lan/T/#m4a25eb33112fab7a22faa0fd65d4d663209af32f Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> 2020-02-21 09:55:45 +02:00
			`struct efi_initrd_dp {`
			`struct efi_device_path_vendor vendor;`
			`struct efi_device_path end;`
			`} __packed;`

			`#endif`