Commit 06fd8538 authored by Simon Glass's avatar Simon Glass Committed by Albert ARIBAUD
Browse files

arm: Add CONFIG_DELAY_ENVIRONMENT to delay environment loading

This option delays loading of the environment until later, so that only the
default environment will be available to U-Boot.

This can address the security risk of untrusted data being used during boot.

Any time you load untrusted data you expose yourself to a bug in the
code. The attacker gets to choose the data so can sometimes carefully
craft it to exploit a bug. We try to avoid touching user-controlled
data during a verified boot unless strictly necessary. Since the
default environment is good enough in this case (or you would just
change it), this gets around the problem by just not loading the

When CONFIG_DELAY_ENVIRONMENT is defined, it is convenient to have a
run-time way of enabling loading of the environment. Add this to the
fdt as /config/delay-environment.

Note: This patch depends on

Signed-off-by: default avatarDoug Anderson <>
Signed-off-by: Simon Glass's avatarSimon Glass <>
Reviewed-by: default avatarDoug Anderson <>
parent eae78c34
......@@ -2378,6 +2378,15 @@ CBFS (Coreboot Filesystem) support
run-time determined information about the hardware to the
environment. These will be named board_name, board_rev.
Normally the environment is loaded when the board is
intialised so that it is available to U-Boot. This inhibits
that so that the environment is not available until
explicitly loaded later by U-Boot code. With CONFIG_OF_CONTROL
this is instead controlled by the value of
- DataFlash Support:
......@@ -40,6 +40,7 @@
#include <common.h>
#include <command.h>
#include <environment.h>
#include <malloc.h>
#include <stdio_dev.h>
#include <version.h>
......@@ -467,7 +468,28 @@ static char *failed = "*** failed ***\n";
* Tell if it's OK to load the environment early in boot.
* If CONFIG_OF_CONFIG is defined, we'll check with the FDT to see
* if this is OK (defaulting to saying it's not OK).
* NOTE: Loading the environment early can be a bad idea if security is
* important, since no verification is done on the environment.
* @return 0 if environment should not be loaded, !=0 if it is ok to load
static int should_load_env(void)
return fdtdec_get_config_int(gd->fdt_blob, "load-environment", 0);
return 0;
return 1;
* This is the next part if the initialization sequence: we are now
* running from RAM and have a "normal" C environment, i. e. global
......@@ -570,7 +592,10 @@ void board_init_r(gd_t *id, ulong dest_addr)
/* initialize environment */
if (should_load_env())
#if defined(CONFIG_CMD_PCI) || defined(CONFIG_PCI)
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment