Re: F45 Change Proposal: Grub EFI For Confidential Computing (self-contained)

On Wednesday, June 24th, 2026 at 09:41, Neal Gompa <[email protected]> wrote:

> I wish you were right, but you are not. Cloud environments are
> affected by buggy UEFI code just like everything else. These days AWS
> isn't as problematic, but when we first experimented with it, AWS
> instances booting UEFI couldn't even read FAT32 (it was required to be
> FAT16) and they used to freak out over the protective MBR data. We
> have encountered other virtualized environments that have similar problems
> to real PC environments with ESP size, disk layout, binary names, and
> so on.
> --
> 真実はいつも一つ！/ Always, there's only one truth!
> --

I have a suggestion for what this bootloader should be:

  I believe it would be efficacious for a Redhatter, who's more
knowledgeable than myself in regards to EFI/ACPI and hardware
interfacing, to write a simple boot loader, that loads the kernel
into RAM directly from the hard drive, *without using any
filesystem.* It would do this by baking an offset into the binary,
which the program can then use to load the kernel image from a
location on the hard drive. The size of the kernel image would
need to be baked in, as well.

  I don't know how buggy EFI HDD interfaces are, but if they are
buggy, this bootloader would only need to bake in a few driver
interfaces. Or, the interfacing could even be inlined into the
kernel load operation itself, if reasonable.

  Once this bootloader is finished, then image verification can be
added, which will probably require a TPM interface, if the EFI's
interface is too buggy or nonexistent. This way, the only time the
ESP is accessed, is when the bootloader binary is initially loaded.

        - C. S. Sushi


Sent with Proton Mail secure email.


-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new