From 18b525f53c8f7057bfa139df0aea28ce08a59399 Mon Sep 17 00:00:00 2001 From: David Garske Date: Mon, 3 Aug 2026 14:22:19 -0700 Subject: [PATCH] efi: sign the x86_64_efi reference kernel with an authenticated HDR_CMDLINE --- tools/efi/compile_efi_linux.sh | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/tools/efi/compile_efi_linux.sh b/tools/efi/compile_efi_linux.sh index c42c0d08..f6e24d38 100755 --- a/tools/efi/compile_efi_linux.sh +++ b/tools/efi/compile_efi_linux.sh @@ -20,8 +20,13 @@ make -C $WORK_DIR/$BR_DIR O=$IMAGE_DIR SIGN_TOOL="./tools/keytools/sign" -$SIGN_TOOL --ed25519 $IMAGE_DIR/images/bzImage wolfboot_signing_private_key.der 1 -$SIGN_TOOL --ed25519 $IMAGE_DIR/images/bzImage wolfboot_signing_private_key.der 2 +# Carry the kernel command line in the signed manifest (HDR_CMDLINE TLV) so it +# is authenticated with the image; wolfBoot passes it to the kernel EFI stub +# via LoadOptions. console=ttyS0 keeps the kernel log on the QEMU serial port. +CMDLINE="console=ttyS0 wolfboot_efi_cmdline=1" + +$SIGN_TOOL --ed25519 --cmdline "$CMDLINE" $IMAGE_DIR/images/bzImage wolfboot_signing_private_key.der 1 +$SIGN_TOOL --ed25519 --cmdline "$CMDLINE" $IMAGE_DIR/images/bzImage wolfboot_signing_private_key.der 2 mkdir -p /tmp/efi sudo mount /tmp/efi.disk /tmp/efi