uefi-ref/edk2
1
0
Fork 0
mirror of https://github.com/tianocore/edk2 synced 2026-08-27 00:23:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

OvmfPkg/X86QemuLoadImageLib: flip default for EnableLegacyLoader to false

Browse source 
What happened since commit 1549bf11cc ("OvmfPkg/X86QemuLoadImageLib:
make legacy loader configurable.") ?

First, qemu 10.0 has been released, which brings support for the -shim
command line option so direct kernel boot with secure boot works.

Second, support has been added to libvirt (version v11.2.0 and newer).

Third, we got a bunch of linux distro releases.  Latest debian, ubuntu
and fedora releases all have new enough edk2+qemu+libvirt packages to
support direct kernel boot with shim.efi loading and proper secure boot
verification.

Lastly, the edk2 security advisory GHSA-6pp6-cm5h-86g5 and CVE-2025-2296
have been published.

Time for the next step in tightening the screws:  Flip the default for
the EnableLegacyLoader config option from true to false.  Also update
the documentation accordingly.

The documentation for the config option is here:
https://github.com/tianocore/edk2/blob/master/OvmfPkg/RUNTIME_CONFIG.md#user-content-security-optorgtianocoreenablelegacyloader

Upcoming final step, in a year or two: remove the legacy loader from the
code base (drop X86QemuLoadImageLib, migrade all users to use
GenericQemuLoadImageLib instead).

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Gerd Hoffmann 2025-12-10 11:16:08 +01:00 • committed by mergify[bot]
parent ba8296810c
commit d2cbaefc08
2 changed files with 10 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

2
OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
View file

@ -449,7 +449,7 @@ QemuLoadKernelImage (
&Enabled
);
if (EFI_ERROR (RetStatus)) {
Enabled = TRUE;
Enabled = FALSE;
}
if (!Enabled) {

15
OvmfPkg/RUNTIME_CONFIG.md
View file

@ -153,16 +153,19 @@ without EFI stub. If you are using kernels that old secure boot
support is the least of your problems though ...
The linux kernel is typically signed by the distro secure boot keys
and is verified by the distro `shim.efi` binary. qemu release 10.0
(ETA ~ March 2025) will get support for passing the shim binary
and is verified by the distro `shim.efi` binary. qemu version 10.0
(released in April 2025) got support for passing the shim binary
(additionally to kernel + initrd) to the firmware, so the usual secure
boot verification can work with direct kernel load too.
For now the legacy loader is enabled by default. Once the new qemu
release is available in most linux distros the defaut will be flipped
to disabled.
In edk2-stable202502 and newer the EnableLegacyLoader config option is
available and enabled by default.
Usage (qemu 10.0+):
In edk2-stable202602 and newer the EnableLegacyLoader config option is
disabled by default.
Here is the qemu command line for direct kernel boot with secure boot
verification:
```
qemu-system-x86_64 \